Red Canary Pricing 2026: Ultimate Guide for Security Products

This guide covers Red Canary’s pricing structure for 2026, its plans, and how its billing works. Red Canary pricing starts at $100 per user account and $120 per endpoint for a 12-month contract on AWS Marketplace, and the final cost depends on how many endpoints, identities, cloud resources, and networks you protect.

Disclaimer: the per-unit prices below are Red Canary’s public list prices on AWS Marketplace, read on October 20, 2026. Red Canary, now part of Zscaler, prices its plans by request, so a direct quote or private offer can differ from list.

A Red Canary contract grows with every laptop, server, account, and cloud resource you add, and the bill is settled in quarterly true-ups. UnderDefense Agentic AI SOC works on top of the security tools you already run and publishes one per-device starting price, compared side by side at the end of this guide.

How Much Does Red Canary Cost?

Red Canary publishes list prices on its AWS Marketplace listing, Red Canary Managed Detection and Response, sold by Red Canary and read on October 20, 2026. A 12-month contract prices four coverage units separately.

Longer terms cost less per year. The listing labels its 24-month contract “save up to 50%” and its 36-month contract “save up to 67%”. It ties no unit price to a plan, so Core, Complete, and Enterprise are priced by request, and a direct quote or an AWS private offer can differ from list. The listing also notes that additional AWS infrastructure costs may apply.

Red Canary Is Now Part of Zscaler

Zscaler completed its acquisition of Red Canary on August 1, 2025, according to Zscaler’s press release. The release said Red Canary would initially operate as a separate business unit within Zscaler, branded “Red Canary, a Zscaler company”, and that Zscaler would integrate Red Canary’s agentic AI with its Data Fabric for Security.

The transition shows on Red Canary’s own sites in October 2026. Redcanary.com now opens Zscaler’s Managed Detection & Response (MDR) page, headed “Red Canary is now part of Zscaler”, and the Red Canary documentation and support sites describe the “Zscaler MDR platform”. The AWS Marketplace listing still carries the Red Canary name. If you also run Zscaler Internet Access, UnderDefense’s Zscaler pricing guide covers the rest of the portfolio.

How Red Canary’s Resource-Based Pricing Works

Red Canary prices coverage by the assets you protect. You buy a quantity of each coverage unit for the contract term, and the bill follows the size of your environment: more endpoints, accounts, cloud resources, or networks in scope mean more units on the contract. The plans page described it the same way: “All plans feature resource-based pricing”, varying with the endpoints, identities, and cloud resources you want protected.

You combine the units on one contract and buy the ones in scope. A team that needs endpoint and identity coverage buys Endpoint and Account units, and adds Resource or Network units when cloud or network telemetry joins the contract.

How Red Canary Counts Servers, Workstations, and Virtual Machines

Red Canary’s endpoint licensing documentation records the servers and workstations online each month and counts the two differently. For servers, it takes four samples a day with a one-hour look-back window and averages them at the end of the month, the method for customers who joined from September 2024. Customers who bought earlier, except those with an MDR Cloud subscription, are counted by Max Daily Active Servers, the highest daily server count in the month.

Workstations count once a month for every machine whose data Red Canary processed, including laptops that collected data offline and synced later. Virtual machines with an identical hostname and identical IP addresses count as one endpoint for licensing, which matters for VDI pools. A virtual machine whose IP list differs by one address counts as an additional license use.

How Red Canary Counts User Accounts

For identity coverage, Red Canary counts the active identities in each integration every day and takes the monthly median. The integration with the highest median sets the month’s “Total Monitored Identities”. Suspended, archived, or administratively disabled identities that can’t log in are excluded, and so are members of out-of-scope groups.

Red Canary Overages and True-Ups

Red Canary keeps processing data from every endpoint when you exceed your licensed count, according to its documentation. It reviews usage every three months and trues everything up at that point. If you had an overage, you choose between increasing your license amount, prorated for the rest of the contract, or paying a one-time overage.

On AWS Marketplace, usage-based pricing applies to overages and additional usage on top of the contract price. Each overage rate in the pricing table above is about one-twelfth of that unit’s 12-month price. For identities, the identity licensing documentation adds that Red Canary typically forgives small temporary overages.

Two questions keep a true-up predictable: which server counting method your contract uses, and whether your VDI pool reuses hostnames and IP addresses. The License Usage page in the portal lets you download the monthly counts as a CSV and check them before the quarterly review.

Red Canary Pricing Comparison Table

Choosing the right Managed Detection and Response (MDR) plan depends on your organization’s security needs, budget, and IT infrastructure. Red Canary offered three plans, Core, Complete, and Enterprise, each with a different level of detection, response, and support. The table follows Red Canary’s pricing page as last published in July 2026; that address now redirects to a Zscaler contact form.

Note: Pricing varies with organization size, feature requirements, and customizations. For a price on a specific plan, request a quote from Zscaler, which now sells Red Canary as Zscaler MDR.

Red Canary Products Overview

Red Canary offered three MDR plans for different organizational requirements, and its pricing page described them as “Packages for companies of every size”:

• The Core Plan delivers 24×7 detection and response in a single domain.
• The Complete Plan adds identity, endpoint, and cloud protection with threat intelligence.
• The Enterprise Plan adds strategic SOC augmentation with dedicated support and advisory.

All plans use resource-based pricing, which varies with the number of endpoints, identities, and cloud resources you want protected. Red Canary also sold add-ons on top of any plan: Active Remediation, Managed Phishing Response, Security Data Lake, Training & Tabletops, and SIEM Jumpstart, a six-week engagement to optimize Microsoft Sentinel.

Red Canary Core Plan Pricing and Features

The Core Plan provides foundational MDR coverage, including 24/7 threat detection and response, automated response playbooks, and executive dashboards. Red Canary prices it by request. The AWS Marketplace list prices of $120 per endpoint, $100 per user account, and $250 per cloud resource for 12 months apply per unit and are tied to no plan.

Red Canary’s page headed the plan “24×7 Detection & Response”, for teams that need MDR in one domain, such as endpoints.

Key Features of Red Canary Core Plan:

The Core Plan’s page listed five inclusions:

• Single domain MDR, monitored 24×7.
• 99% threat accuracy, as Red Canary states it.
• Automated response playbooks for detected incidents.
• Executive dashboards that summarize security posture.
• Emergency hotline access.

Every higher plan includes all of these.

Pros of Red Canary Core Plan:

The Core Plan’s strengths follow from what Red Canary published:

• It delivers 24×7 detection and response with automated playbooks in one domain.
• It is agentless and uses telemetry from the security tools you already run.

Both points keep the first contract small.

Cons of Red Canary Core Plan:

The limits are the features Red Canary reserved for higher plans:

• Identity and cloud coverage need the multi-domain Complete Plan.
• The data exporter, API access, and advisory start in the Complete Plan.

Check both before you sign, because adding a domain later changes the plan.

Red Canary Complete Plan Pricing and Features

Red Canary prices the Complete Plan by request, and its cost grows with the endpoints, user accounts, and cloud resources in scope. The Complete Plan includes every Core feature and adds multi-domain protection for identities, endpoints, and cloud environments. Red Canary’s page marked it “Most popular” and headed it “Identity, Endpoint & Cloud Protection”.

Key Features of Red Canary Complete Plan:

On top of everything in Core, the Complete Plan listed seven additions:

• Complete, multi-domain MDR across identity, endpoint, and cloud.
• Threat research and insights.
• File integrity monitoring.
• Red Canary Copilot.
• Red Canary API access.
• A configurable data exporter, Canary Exporter, to send data to S3, a SIEM, or local storage.
• Detection and response advisory with Red Canary experts.

The exporter matters if you keep your own SIEM as the system of record.

Pros of Red Canary Complete Plan:

The Complete Plan’s advantages come from the added domains and tooling:

• It covers identities, endpoints, and cloud environments under one plan.
• It adds threat intelligence and advisory on detection and response topics.

Together they cover the common entry points for account compromise.

Cons of Red Canary Complete Plan:

Two limits are documented on Red Canary’s own pages:

• Dedicated technical support, threat hunter collaboration, and unlimited integrations sit in Enterprise.
• The number and type of integrations depend on the plan you select.

Map your integrations to the plan before you compare quotes.

Red Canary Enterprise Plan Pricing and Features

The Red Canary Enterprise Plan suits large organizations with complex security requirements. It includes every feature of the Core and Complete Plans and adds strategic support and advisory, which Red Canary’s page headed “Strategic SOC Augmentation”. Red Canary prices the Enterprise Plan by request, for each client.

Key Features of Red Canary Enterprise Plan:

The Enterprise Plan includes these features, the Complete Plan’s among them:

• 24×7 detection and response across endpoints, networks, cloud environments, and identities.
• Multi-domain MDR, the same as in Complete.
• Threat research and insights, plus file integrity monitoring.
• Red Canary Copilot.
• API access and a configurable data exporter.
• Detection and response advisory.
• Dedicated technical support.
• Custom intelligence briefings.
• Threat hunter collaboration and tailored security discussions.
• Unlimited integrations.

The last four items are what separate Enterprise from Complete.

Pros of Red Canary Enterprise Plan:

Enterprise customers get the widest coverage and the most direct access to Red Canary’s experts:

• Coverage spans endpoints, cloud environments, identities, and networks.
• Custom intelligence briefings and threat hunter collaboration add intelligence for your environment.
• Strategic advisory comes from a bench of threat hunting, intelligence, and detection experts.
• Unlimited integrations remove the plan limit on connected tools.

Enterprise suits teams that want an extension of their SOC.

Cons of Red Canary Enterprise Plan:

The trade-offs concern price visibility:

• Its price is set by request, with no plan figure on the AWS listing.
• Like every plan, it is billed on the coverage units you buy.

Budget for it with a quote in hand.

How Can UnderDefense Help You Improve Your Security Posture?

An IT Director pricing Red Canary usually needs two things: 24/7 coverage without staffing a night shift, and a budget that holds when the endpoint count moves between true-ups. UnderDefense builds an agentic AI platform for security operations and compliance on top of the stack you already own. The Agentic AI SOC investigates every alert with AI agents, and analysts on shift 24/7 make the decisions.

The table compares the two pricing models using what each company publishes, read in October 2026.

UnderDefense’s pricing page labels the $11 figure “indicative” and quotes its paid tiers individually. When a critical alert fires at 2 a.m., an UnderDefense analyst responds within the 20-minute SLA, and your team wakes up to the investigation, with the Splunk, Sentinel, or CrowdStrike you run still in place.

Pricing four coverage units and a quarterly true-up? Compare a per-device quote

Frequently Asked Questions