What NDR costs depends less on the vendor's list price than on the unit it charges for — monitored devices, IP addresses, bandwidth through the sensors, or data ingested — and on the people and hardware the product needs around it. Most enterprise NDR vendors do not publish a price list and quote each deployment, so the first step is to find out which unit you are being charged for.
The four pricing models
- Per device or per IP address. You pay for each host the product watches. Predictable if your estate is stable; watch how "device" is defined — every IP seen on the wire, or only hosts running a sensor.
- Per bandwidth or per sensor. You pay for the capacity of the sensors that mirror your traffic, often with hardware appliances. Cost follows your busiest links rather than your headcount.
- Per data volume. You pay for the records or gigabytes ingested and for how long they are kept. Common where NDR shares a platform with log analytics; cost grows with retention.
- Per asset, for OT. Industrial monitoring is often priced per monitored asset, with hardware for each site.
What drives the total cost
- Coverage. The number of segments and sites you mirror, and whether OT networks are included.
- Retention. How many days of alerts and records you keep for investigations and audits.
- Hardware. Physical sensors and appliances, their support contracts and their refresh cycle.
- People. The hours your team spends tuning alerts and investigating them. An alert that does not explain itself costs analyst time on every occurrence.
- Modules. Identity, cloud, email or managed-response add-ons that are priced separately.
Five questions to ask before you sign
- What exactly is the billing unit, and how is it counted?
- What happens to the price when you add a site, a segment or a year of retention?
- Is hardware included, leased or bought separately?
- What does each alert tell the analyst about why it fired?
- Where is the data stored, and is a GDPR Article 28 data processing agreement included?
What Darktrace, Vectra AI and ExtraHop publish
None of the three publishes a price list. Darktrace quotes each deployment; procurement platforms such as Vendr list buyer-reported prices, not a public list price. Vectra AI also quotes per customer. ExtraHop states the basis of its SaaS pricing: RevealX 360 is priced by discovered devices, daily record ingest and lookback period. We do not repeat buyer-reported figures here, because they depend on the scope of each contract. To get quotes you can compare, ask each vendor in writing for the billing unit and the price per unit, with the five questions above. Our sourced comparisons with Darktrace, Vectra AI and ExtraHop, and the three-way comparison, list the public sources.
How NetSenX prices
NetSenX publishes its prices and charges per device, where a device is a host running the NetSenX agent — and one agent on a SPAN or TAP port monitors a whole network segment and counts as one device. That means a 200-person company pays for the segments and hosts it chooses to monitor, not for 200 seats.
- Free: €0, up to 3 devices, no time limit.
- Starter: €49 per month, up to 10 devices.
- Pro: €99 per month, up to 25 devices, including OT/ICS protocol visibility and shadow AI detection.
- Business: €249 per month, up to 100 devices, including SIEM export.
- Enterprise: from €999 per month, unlimited devices, on-premises and white-label options.
Prices exclude VAT; annual billing is also available. The agent is software that runs on a host you choose — there is no NetSenX appliance to buy — and every plan includes the plain-language explanation on each alert and EU data residency. The full feature matrix is on the NetSenX pricing page; for vendors that do not publish prices, see our sourced NDR comparisons, and for the difference between NDR, EDR and SIEM, read NDR vs EDR vs SIEM for teams without a SOC.
FAQ
How much does Darktrace cost?
Darktrace does not publish a price list; it quotes each deployment. Buyer-reported prices on procurement platforms depend on the scope of each contract, so ask Darktrace for a written quote that states the billing unit.
Does any NDR vendor publish its prices?
NetSenX publishes its prices, from a Free plan to Enterprise. Darktrace, Vectra AI and ExtraHop publish no price list in the sources we reviewed; ExtraHop states the units RevealX 360 is priced by.
Can I try NDR without paying?
Yes. NetSenX has a Free plan with no time limit; its device limit is on the pricing page.
Sources
Statements about other vendors as reviewed on 24 September 2026; products and prices change.
- Darktrace — products
- Vendr — Darktrace (buyer-reported prices, no public list price)
- Software Finder — Vectra AI (quoted per customer, no public list price)
- ExtraHop — product FAQ (pricing basis, deployment models)
Written by the NetSenX Team at TriStiX S.L. Questions: info@netsenx.com.