The number that decides everything
Public MDR pricing in 2026 sits between $25,000 and $200,000 per year for a small business package, plus per-endpoint fees that typically run $5 to $20 per host per month. There is a minimum because the SOC has fixed staffing costs and you are paying for a slice of human attention.
That is fine if your annual revenue is in the millions. It is not fine if you run a side project on a $5 VPS, an inference host that you spun up last Tuesday, or a three-person startup with eight months of runway.
Where the MDR money actually goes
An MDR contract is paying for four things: the EDR agent license, the SIEM ingest, the SOC analyst hours, and the process around all of it. Roughly 60-70% of the line item is human labor. The rest is software you could in principle install yourself.
The labor part is the one that does not scale down. A SOC analyst earns the same per hour whether they are watching 50 endpoints or 5000. So vendors set a floor. Below that floor they decline the deal, because the analyst time is not fractional.
Human-in-the-loop does not scale to a $5 VPS
A single Linux host generates hundreds of security-relevant events per day under normal load. Most are noise: a process ran, a port opened, a user logged in. A SOC analyst can realistically read maybe 200 enriched alerts a shift before quality drops. Even at the cheapest contract that is roughly $1.50 per alert reviewed.
For a $5 VPS, the math is simply broken. The host costs less per year than a single hour of analyst time. Asking a human to read its events is asking the wrong question.
What autonomous triage replaces
The SOC analyst's job, on a typical alert, is a decision tree. Look at the event. Look at the context. Match it against a playbook. Decide: ignore, block, escalate. About 90% of the alerts on a small fleet end with the same answer the playbook would produce.
Inner Warden runs that decision tree in software. A local LLM looks at the event plus the surrounding context (who logged in, what they ran, what changed on disk) and produces a confidence score. Above a threshold, the agent acts. Below it, the event goes to an audit log. Same outcome, no analyst, no minimum contract.
What you give up, honestly
You give up two real things. First, threat hunting: a human who proactively goes looking for things the rules did not catch. Inner Warden has correlation rules but it does not improvise. Second, you give up the relationship. An MDR vendor will pick up the phone during an incident. We will not, unless you are on a paid support plan.
For most small operators, those two things are not worth $30,000 a year. For a regulated bank with PCI auditors, they are. Pick the tool that fits your actual risk profile.
The same outcomes, written down
An MDR is supposed to do three things on every alert: decide if it matters, take action when it does, and leave an audit trail. Inner Warden does each of those without a contract:
Decide: 49 detectors plus AI confidence scoring, with 65 MITRE ATT&CK technique IDs mapped. The same taxonomy your auditors expect.
Act: automatic IP blocks with TTL, process kill, kernel-module quarantine, and Cloudflare failover when the volume is too high for the local firewall.
Audit: hash-chained JSONL log of every detection and every action, locally stored, exportable. Same evidence package you would get from a SIEM, just without the SIEM.
Try the install before the quote
The fastest way to know if Inner Warden is enough for your risk profile is to install it on the host you would have quoted, leave it for a week, and read the audit log. If the decisions match what you would have made, the MDR was paying for confidence you can now produce yourself.
curl -fsSL https://www.innerwarden.com/install | sudo bashRead more: Fail2ban vs Inner Warden · The autonomous EDR thesis