How security is priced
- Endpoint
Per device
CrowdStrike and SentinelOne price endpoint protection per device, with modules and managed detection on top. Microsoft Defender for Endpoint is priced per user.
- Identity
Per user
Okta prices workforce identity per user per month, with governance and threat protection as add-ons. Microsoft Entra is priced per user.
- Network
Hardware plus subscriptions
Palo Alto Networks and Fortinet sell firewall hardware by model and throughput, with annual security subscriptions and support on top.
- SASE
Per user or bandwidth
Zscaler, Palo Alto's Prisma Access and Fortinet's SASE offerings are priced mainly per user, with some bandwidth-based options.
- SIEM
Per GB ingested
Microsoft Sentinel and similar platforms are priced largely on data ingested, with commitment tiers for volume.
Platformization changes the renewal
The biggest shift in security buying is consolidation. Palo Alto Networks, CrowdStrike, Microsoft, Zscaler and others sell multi-product commitments under one agreement, with deeper discounts for more products. Renewals increasingly become cross-sell or displacement events rather than like-for-like renewals of a single tool.
Consolidation can lower unit costs and simplify operations. It also concentrates spend, makes each product's price harder to see and reduces leverage at the next renewal.
Where renewal costs build
- Modules
Add-ons that become the baseline
Modules added during the term for identity, cloud or data protection are part of the renewal count.
- Counts
Devices and users that do not come down
Retired endpoints and departed users are not always removed before renewal.
- AI
New AI tiers and meters
AI analysts and automation are being packaged into higher tiers or priced on credits.
- Hardware
Refreshes paired with renewals
Firewall refreshes and subscription renewals often arrive together, priced as one.
Where Deal IQ comes in
This page covers how security pricing works and where the cost builds. Getting a better price on your own contracts is the negotiation itself. Deal IQ negotiates security renewals across Palo Alto Networks, CrowdStrike, Zscaler, Okta, Fortinet, Microsoft and others, as part of $20B+ in contract value negotiated across 3,000+ negotiations with 600+ vendors. We negotiate directly with the vendor or behind the scenes with your team, and our fee comes from the savings.
Frequently asked questions
How are cybersecurity products priced?
By metric: endpoint protection per device, identity and SASE mostly per user, firewalls by hardware model plus subscriptions, and SIEM largely by data ingested.
What is platformization in cybersecurity?
Vendors selling several security products under one multi-year agreement, with deeper discounts for consolidating more of the security budget with them.
DEAL IQ IN NUMBERS
