Arctic Wolf Pricing in 2026: Concierge Security Cost

The concierge model

Arctic Wolf's central marketing claim is the Concierge Security Team model. Each customer is assigned a named Triage Security Engineer (responsible for daily alert triage and customer communication) and a named Concierge Security Engineer (responsible for relationship management, monthly security operations review, and quarterly risk-posture briefing). The named-team approach is meant to address the most common complaint about rotating-pool MSSPs, which is that the customer feels like a ticket number rather than a relationship.

In practice, the concierge model works well at smaller scale (under 500 employees) where the assigned team can genuinely know the environment and the customer leadership. At larger scale (above 1,500 employees), the model thins out: the Concierge Security Engineer is managing 10-20 customers and cannot maintain the same level of relationship depth. Customers above the 1,500-employee threshold often report that the concierge value-proposition delivers less than the marketing suggests, which contributes to the per-employee pricing becoming less defensible at scale.

The model also depends on the customer maintaining an active relationship with the team. Customers who treat the MSSP as a black box (forwarding alerts and not engaging in the monthly reviews) often miss the value the concierge model provides. Arctic Wolf's own customer satisfaction data, surfaced in analyst reports including the Gartner Peer Insights MDR market, consistently shows high satisfaction at the smaller end of the customer base and more mixed satisfaction at the larger end.

Tier breakdown and what is included

The bundles below are Arctic Wolf's own list prices as filed in its Texas DIR public-sector price list (February 2025). Silver, Gold, and Platinum are the concierge service tiers (depth of the assigned Concierge Security Team), and the per-user rate rises with the tier. Prices are per user per year before the standard 5% DIR public-sector discount; a $15,000 Aurora Platform base fee applies on top, and server licences are priced at the same per-unit rates.

Standalone and add-on line items on the same list: an MDR user licence at $200 per user per year, Managed Risk at $100 per user, Managed Security Awareness at $30 per user ($42 for the Plus variant), an IR JumpStart retainer at $5,000 per organisation, and Threat Intelligence at $3,800 ($6,400 for the Plus variant) per organisation. The AWS Marketplace listing Arctic Wolf sells directly is a separate published anchor: MDR Basic at $44,000 on a 12-month contract for up to 100 users, re-checked 23 September 2026. Above 100 users that listing offers only a Custom Pricing dimension set in a private offer, so there is no published rate for a larger estate; the listing also sells 24 and 36-month terms and notes the 12-month option saves up to 6%. Commercial (non-public-sector) quotes vary from these list figures by deal size, vertical, and competitive context; discounts of 15-30% are typical for multi-year commitments or competitive replacements.

Hidden costs and contract clauses to watch

The first hidden cost is the EDR licence. Arctic Wolf does not include EDR licences in the per-employee price; the customer brings CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint separately. That adds $40 to $80 per endpoint per year, which for a 500-employee company is $20,000 to $40,000 incremental.

The second hidden cost is incident response surge hours. The standard MDR contract includes a pool of IR hours per year (often 40-80 hours). Anything above the pool is billed at $250-$500 per hour. A serious incident easily consumes 200-400 IR hours, which produces a surge bill of $50,000 to $200,000 on top of the annual fee. The right mitigation is to attach a separate IR retainer with an independent firm rather than letting the MSSP handle both monitoring and IR.

The third clause to watch is the data ownership and transition clause. Arctic Wolf operates on its own SIEM and platform, so when the contract ends, the customer does not retain the historical investigation data or detection content the Concierge team built. The transition to a different MSSP requires rebuilding both, which typically takes 6-9 months. Customers who think they might switch should negotiate a 90-day post-termination data-export window into the original contract.

Where Arctic Wolf fits best

The sweet spot is mid-market organisations (100-1,500 employees) without significant internal security staff. The per-employee pricing is competitive in that band, the concierge model genuinely delivers relationship value at that scale, and the turnkey nature reduces the customer's need to manage tools or write detection content. Arctic Wolf is the dominant mid-market MDR brand in North America in 2026, with the broadest channel partnerships and the most familiar name to mid-market CISOs and IT directors.

Less good fits include very small organisations (under 100 employees) where lower-cost managed EDR from Huntress or Blackpoint (both quote per endpoint rather than publishing a list price) is materially cheaper, and large enterprises (above 2,500 employees) where the per-employee math becomes expensive relative to MSSPs that price per-endpoint or on flat-rate tiers. Customers with significant internal security capability also tend to prefer co-managed models (Critical Start, Deepwatch, ReliaQuest) where they can run their own SIEM rather than depending on Arctic Wolf's platform.

For broader MSSP pricing context, see the MSSP pricing page. For comparable vendor profiles, see the eSentire, Expel, and Secureworks cost pages.

Related pages

Frequently Asked Questions