What NDR costs depends less on the vendor's list price than on the unit it charges for — monitored devices, IP addresses, bandwidth through the sensors, or data ingested — and on the people and hardware the product needs around it. Most enterprise NDR vendors do not publish a price list and quote each deployment, so the first step is to find out which unit you are being charged for.
The four pricing models
- Per device or per IP address. You pay for each host the product watches. Predictable if your estate is stable; watch how "device" is defined — every IP seen on the wire, or only hosts running a sensor.
- Per bandwidth or per sensor. You pay for the capacity of the sensors that mirror your traffic, often with hardware appliances. Cost follows your busiest links rather than your headcount.
- Per data volume. You pay for the records or gigabytes ingested and for how long they are kept. Common where NDR shares a platform with log analytics; cost grows with retention.
- Per asset, for OT. Industrial monitoring is often priced per monitored asset, with hardware for each site.
What drives the total cost
- Coverage. The number of segments and sites you mirror, and whether OT networks are included.
- Retention. How many days of alerts and records you keep for investigations and audits.
- Hardware. Physical sensors and appliances, their support contracts and their refresh cycle.
- People. The hours your team spends tuning alerts and investigating them. An alert that does not explain itself costs analyst time on every occurrence.
- Modules. Identity, cloud, email or managed-response add-ons that are priced separately.
Five questions to ask before you sign
- What exactly is the billing unit, and how is it counted?
- What happens to the price when you add a site, a segment or a year of retention?
- Is hardware included, leased or bought separately?
- What does each alert tell the analyst about why it fired?
- Where is the data stored, and is a GDPR Article 28 data processing agreement included?
How NetSenX prices
NetSenX publishes its prices and charges per device, where a device is a host running the NetSenX agent — and one agent on a SPAN or TAP port monitors a whole network segment and counts as one device. That means a 200-person company pays for the segments and hosts it chooses to monitor, not for 200 seats.
- Free: €0, up to 3 devices, no time limit.
- Starter: €49 per month, up to 10 devices.
- Pro: €99 per month, up to 25 devices, including OT/ICS protocol visibility and shadow AI detection.
- Business: €249 per month, up to 100 devices, including SIEM export.
- Enterprise: from €999 per month, unlimited devices, on-premises and white-label options.
Prices exclude VAT; annual billing is also available. The agent is software that runs on a host you choose — there is no NetSenX appliance to buy — and every plan includes the plain-language explanation on each alert and EU data residency. The full feature matrix is on the NetSenX pricing page; for vendors that do not publish prices, see our sourced NDR comparisons, and for the difference between NDR, EDR and SIEM, read NDR vs EDR vs SIEM for teams without a SOC.
Written by the NetSenX Team at TriStiX S.L. Questions: [email protected].