What does EDR cost when you build it on open source?
Comparing a per-endpoint EDR or MDR quote with a self-hosted Wazuh, Velociraptor or osquery design is not a software comparison. The licences for these tools are free to use, so the recurring cost is mostly people, infrastructure and operations. Your bill will track endpoint count, log volume, retention period, whether you need 24x7 coverage, and who writes and tunes detection content. Before you compare numbers, confirm which of these you will pay for directly: servers and storage in your own cloud or data center, engineering time for deployment and detection content, monitoring staff across shifts, and any support subscription or incident response retainer you choose to buy.
Infrastructure is the most predictable line. Wazuh splits into an indexer, a server, a dashboard and agents, and the server can run as a cluster, so ask your team to size each tier against expected event rates and retention. Velociraptor's server stores its data in files rather than a database, so storage growth is the number to model. Ask any implementation partner to state the assumptions behind a quote: endpoints per node, events per second, days of hot and archived retention, and whether high availability and backups are in scope. Those assumptions are where two quotes most often differ.
The largest and least visible cost is detection engineering and triage. Someone must decide which rules fire, tune out noise, test response actions and keep content current as operating systems and threats change, and someone must answer alerts at 2 a.m. if you promise around-the-clock response. Commercial EDR and MDR bundle these labor pools into the per-endpoint price, so compare the staffing model explicitly. Ask for the hours per week assumed for content and triage, the escalation path, the cost of a retainer for incident response, and the subscription terms for upgrades. Treat any quote that leaves those lines out as incomplete.
Which cost components apply to in-house, partner and SaaS models
This table compares who pays for each EDR cost component under an in-house build, an implementation partner engagement and a commercial SaaS or MDR contract, and marks which items are one-time and which recur. Read each row as a question to answer in your own quote: the software line is often zero, while people, sizing and retainers carry most of the ongoing spend.
| Cost component | In-house build | Implementation partner | Commercial SaaS or MDR |
|---|---|---|---|
| Software licence | Wazuh is GPL v2 and Velociraptor is AGPL-3.0, so no licence fee applies to the core tools. Confirm add-on or enterprise modules separately. Recurring: none for core | Same open-source terms apply. The partner fee covers design, build and handover. One-time for the project | Per-endpoint or per-user subscription, usually recurring. Confirm what tiers include response and triage |
| Servers and storage | Recurring infrastructure for the Wazuh indexer, server and dashboard, plus Velociraptor server. Sized by agent count, event volume and retention | Often included in the scoped sizing study. Recurring hosting remains with the client | Usually included in subscription. Confirm where telemetry is stored and for how long |
| Wazuh indexer and server sizing | Internal architects size nodes, cluster and storage. Re-sizing is recurring as the estate grows | One-time sizing and load test, documented in the scope. Re-sizing is a later change order | Vendor-managed. Ask what happens to cost when event volume rises |
| Detection engineering | Recurring internal staff time to write, tune and retire rules and artifacts | One-time baseline rule set and tuning period, then optional retainer for ongoing tuning | Included in platform content updates. Confirm whether custom detections are billed separately |
| 24x7 monitoring staff | Recurring: shift coverage, on-call and training. Usually the largest ongoing line | Not included unless a managed service is contracted. Optional recurring retainer | Recurring MDR fee covers analyst coverage. Confirm escalation times and who responds on the host |
| Incident response retainer | Not usually funded; internal responders or emergency vendor rates apply | Optional retainer, recurring, for hunts and containment support | Often a separate retainer or add-on. Confirm response hours and included effort |
| Support subscription | Community support is free; paid support tiers are a separate, optional recurring cost where offered | Partner support is a recurring retainer; upgrades and patches are scoped separately | Support is bundled into the subscription. Confirm severity levels and response targets in writing |
| Agent deployment and upgrades | One-time rollout by internal staff, then recurring patch cycles across endpoints | One-time deployment scope, including packaging and pilot. Recurring upgrades under a retainer | Agent rollout usually included. Confirm who handles exceptions and legacy hosts |
What moves the cost up or down
Open-source EDR has no license fee for the core platform, so the bill is driven by infrastructure, people and content work. The six drivers below decide how much each of those grows as the estate, the telemetry and the obligations grow.
Endpoint count and OS mix
Each endpoint adds an agent to deploy, patch and monitor, and the cost per host differs by platform. Windows, Linux and macOS agents are supported by Wazuh and osquery, while agentless devices such as firewalls depend on syslog collection and API polling that someone must configure and maintain. Ask a partner to price the estate by OS family and by agentless source, not as a single headcount number. Confirm which platforms each candidate tool covers at your own version levels before costing it.
Telemetry volume and indexer storage
Storage is the cost that scales most directly with event volume. Wazuh stores alerts in its indexer, so verbose collection on servers, process auditing and noisy log sources multiply disk and memory needs. Before sizing hardware, ask for an estimate of events per second per host class and a test of the expected daily volume. Storage needs should be modeled from measured data in your environment, not from assumptions.
Retention periods by sector
How long endpoint and log records must be kept is set by sector rules, contracts and your own policy, and every extra year multiplies storage and backup cost. Healthcare, financial services and public sector organizations often hold records longer than the default settings of a typical deployment. Confirm the retention requirement for each data class with your compliance lead and ask the partner to show separate tiers for hot search data and archived evidence.
24x7 triage versus business hours
Staffing is usually the largest recurring cost. Covering alerts around the clock needs a rota of analysts, a documented escalation path and on-call cover, which costs far more than a business-hours queue. A partner quote should separate monitoring hours, triage depth and escalation targets, and state who is paid for each. Ask which alerts are auto-triaged and which need a human, because that split sets the size of the rota.
Detection content tuning effort
Default rules produce false positives in every environment, and tuning them is ongoing engineering work that a commercial vendor would otherwise do for you. Budget for custom rules, suppression of noisy hosts, osquery or Velociraptor artifacts for your own use cases and review after each platform upgrade. Ask the partner who owns tuning, how changes are tested before production and how many hours of tuning are included in the fixed scope.
Offline and air-gapped hosts
Hosts without internet access need an offline installation path, an offline vulnerability repository in place of the Wazuh Cyber Threat Intelligence feed, and media transfer for rule and artifact updates. Each transfer cycle adds handling work, change records and sometimes cross-domain approvals. Ask for the update cadence and the staff time per cycle in writing, and confirm which vulnerability data sources are permitted inside the enclave.
Which costs are one-time and which recur every year
The one-time costs of an open-source EDR program are mostly labor and design work, not licenses. They include the architecture decisions (how many Wazuh indexer, server and dashboard nodes, whether the server runs as a cluster, where storage sits), the deployment itself, and the first agent rollout across Windows, Linux and macOS endpoints. Wazuh documents several installation paths, including a prebuilt OVA, Docker, Kubernetes, Ansible and Puppet, and the path you choose shapes how much of the build is reusable automation and how much is hand work. Setup also includes custom decoders and rules, the first Velociraptor artifacts, and integrations with your SIEM, ticketing and SOAR tooling. Ask any partner to price these as separate line items, with the deliverables for each named in the written scope.
The recurring costs are where open-source EDR is most often underestimated. Infrastructure for indexer storage, server capacity and backups grows with endpoint count and retention, and it is paid every year. Upkeep is continuous: Wazuh shipped 4.14 patch releases on 17 March, 23 April, 1 July, 29 July, 23 September and 14 October 2026, roughly one every one to two months, and Velociraptor 0.77.3 was released on October 5, 2026 with an update to address multiple CVEs. Each release needs testing and a maintenance window, and detection tuning, staffing for alert triage and any support subscription or retainer continue for as long as the program runs. Confirm with each vendor what its support tiers cover before you compare totals.
How to build your own EDR cost estimate
This sequence turns an open-ended question about endpoint detection cost into a line-by-line model that a build, partner or SaaS quote can be measured against. Each step produces an input that the next step depends on.
Count endpoints and server classes by operating system
Start with an inventory of every system that needs telemetry, grouped by operating system, version and role: Windows workstations, Windows servers, Linux servers, macOS devices, Unix hosts and any container nodes. Pull the counts from your asset inventory and CMDB, then reconcile them against directory and cloud account data to catch gaps. The output is a table with one row per OS and role, plus a list of systems that cannot take an agent, such as legacy hosts or OT devices, which will need a different collection method and usually a separate line item.
Define telemetry and retention for each framework
Decide which events each endpoint must produce and how long they must be kept, using the obligations your regulators, auditors and contracts set rather than a default. Record the framework, the control it maps to and the evidence an assessor will ask for. Retention periods drive storage more than any other input, so ask your compliance lead to confirm them in writing. The output is a telemetry matrix that lists event sources per OS class, the retention period for each, and the owner who approved it.
Size the indexer and storage from expected event volume
Estimate daily event volume per endpoint class by running a pilot on a representative sample of machines for a period you choose, then multiply by endpoint counts and retention. Include indexer replicas, backups and growth headroom. Wazuh's indexer stores alerts and the server can run as a cluster for horizontal scaling, so capacity planning should cover both compute and disk. The output is a sizing sheet with compute, storage and network lines for each environment, plus the assumptions behind them.
Decide monitoring hours and who staffs them
Define the hours during which alerts must be triaged and who performs triage: in-house analysts on shift, an outsourced 24x7 provider, or a hybrid where a partner covers nights and weekends. Staffing is usually the largest recurring cost, so model it as full-time equivalents needed to cover each hour, including leave, training and turnover. The output is a coverage calendar and a staffing model that states who is paid for each role, whether employee, contractor or provider.
List detection engineering and response retainer needs
Identify the ongoing work of writing and tuning detection rules, hunting queries and response playbooks, and decide who owns it. Separately, decide whether you need an incident response retainer with a forensic firm for severe cases, and what hours and expertise it covers. Velociraptor hunts and offline collectors can support investigations, but they still need trained operators. The output is a role list for detection engineering with estimated recurring effort, and a written scope for any retainer with its activation terms and fee structure.
Add support subscriptions and infrastructure
Add the costs of any paid support, vendor subscriptions, managed hosting, cloud accounts, backup storage, licenses for supporting tools and hardware refresh. Confirm the licensing model of each component before you assume it is free to run in production, because some projects offer open-source core code with separate enterprise or cloud editions. The output is a list of one-time and recurring items, each marked with its billing unit and renewal date, so that the total can be compared with commercial quotes.
Compare with per-endpoint commercial quotes using the same scope
Request quotes from commercial EDR vendors, MDR providers and implementation partners using the same endpoint counts, OS mix, retention, monitoring hours, response actions and contract term as your model. Ask each one to separate license, data storage, monitoring, response hours, professional services and renewal uplifts. Ask whether agents, log storage and extra retention are priced per endpoint or per gigabyte. The output is a side-by-side comparison in which every line maps to one row of your model, so differences reflect the platform and service rather than unequal scope.
Document the assumptions and re-run the model annually
Record every assumption, including event rates, staffing ratios, retention periods and license terms, with its owner and source. Schedule a review each time you upgrade a platform, change a regulatory obligation or add a system class, because each change moves the totals. The output is a versioned cost workbook that finance, security and procurement can all read, with a clear note of which lines are one-time and which recur.
How each operating model shifts effort between your team and a partner
Building in-house means your own staff own sizing, deployment, detection content and on-call. The software cost is zero because Wazuh is distributed under the GNU General Public License version 2, and Velociraptor is licensed under AGPL-3.0, so the main costs are people, servers, storage and time. Your team keeps full control of where telemetry lives and which rules run, but it also absorbs every upgrade and every alert at night.
- Sizing and infrastructure: You estimate agent counts, event volume, indexer storage and retention, then buy or provision the servers and disks.
- Detection engineering: Your analysts write, tune and retire Wazuh rules and Velociraptor artifacts, which is ongoing work rather than a one-time task.
- Patch cadence: Wazuh 4.14 patch releases arrived six times in 2026, so someone must test and apply them on a recurring schedule.
- 24x7 coverage: Your staff or an outsourced team must cover nights and weekends, which is usually the largest recurring cost.
- Skills: Confirm you can staff Linux, indexer administration and forensic collection before committing.
Before choosing this path, ask your team to estimate its hours per month for patching, rule tuning and on-call, and compare that figure with the staffing you already have.
An implementation partner runs a fixed-scope build, then hands the platform to your team with documentation, runbooks and tested recovery steps. DeployOpen works this way: scope, deliverables and timelines are agreed in writing before work starts, and the platform runs inside your own cloud accounts, data centers or air-gapped networks. You pay for the build as a one-time project and can add a retainer for upgrades, testing and support if you want continuing help.
- What you keep: Data location, tenancy, admin credentials and the decision on which detections go live.
- What the partner hands over: Deployed components, configuration as code, rule and artifact inventory, and operating runbooks.
- Optional retainer: Upgrades, security testing and support are priced separately from the build and recur only if you buy them.
- Knowledge transfer: Confirm how many training sessions are included and who on your side will own each runbook after handover.
- Recurring costs that remain: Infrastructure and your own 24x7 staffing still sit with you, because a build does not monitor alerts for you.
Ask the partner to show the written scope, the list of deliverables and the exact handover acceptance criteria before you compare quotes.
A SaaS or managed detection and response (MDR) service charges a per-endpoint or service fee and the vendor owns detection content, tuning and most triage. You get faster time to coverage and vendor-run monitoring, but you accept less control over data location, rule logic and retention. Commercial pricing is set by each vendor, so you should request written quotes rather than rely on list prices.
- What you keep: Business decisions on response authority, escalation contacts and the scope of what the vendor may isolate.
- What you hand over: Detection engineering, rule updates, after-hours triage and most platform upgrades.
- Data location: Confirm in writing which regions store telemetry, how long it is retained and whether you can export it to your own SIEM.
- Lock-in: Ask how you export detections, cases and raw telemetry if you leave, and whether the agent can be removed cleanly.
- Cost drivers: Endpoint count, retention period, included response hours and any charge for forensic support.
Before signing, ask for the vendor's data processing terms and a sample incident report so you can judge the evidence quality yourself.
Questions buyers ask about open-source EDR cost
Is open-source EDR free to run?
The software licence is usually free, but running it is not. Wazuh is distributed under the GNU General Public License version 2, and osquery can be used under Apache-2.0 OR GPL-2.0-only, so you do not pay per endpoint for the core tools. You still pay for the servers and storage that hold agent telemetry and alerts, the engineers who build detection content and tune rules, the monitoring staff who triage alerts, and any support subscription or retainer you choose. Confirm the licence terms for every component you plan to use, because some add-ons and enterprise directories carry separate commercial licences.
How much staff effort does open-source EDR need?
Effort depends mostly on endpoint count, the number of operating systems you cover, how much detection content you write, and how many alerts need a human decision each day. Expect recurring work in four areas: patching and upgrading the Wazuh server, indexer and dashboard, maintaining agent configuration across the fleet, reviewing and tuning rules to reduce false positives, and running investigations. Wazuh shipped 4.14 patch releases on 17 March, 23 April, 1 July, 29 July, 23 September and 14 October 2026, so plan for regular maintenance windows. Ask any partner to show the staffing model behind its quote, including who triages alerts outside business hours.
Can a small security team run open-source EDR alone?
A small team can run a basic deployment alone if it has Linux administration skills, time for agent rollout, and a clear rule for who responds to alerts during working hours. The harder part is coverage outside those hours and the depth of detection engineering needed to keep alert volume manageable. Teams often start with a self-run pilot on a limited set of systems, then decide which tasks stay in-house, such as daily triage, and which go to a partner, such as tuning, incident response or 24x7 watch. Write down the on-call model before you decide, because gaps there are the most common source of unplanned cost.
How long does a build and handover take?
The timeline depends on the agreed scope: how many endpoints and operating systems, whether the environment is cloud, data center or air-gapped, how many integrations with a SIEM or ticketing system are included, and how much detection content is written before handover. No fixed duration applies to every project. Ask any partner for a timeline tied to a written scope, with named milestones for pilot, rollout, tuning and handover. Ask also which steps depend on your change windows and approvals, since those often set the pace more than the technical work.
What does the client need to provide for an EDR build?
Expect to provide administrative access to the target environment, such as cloud accounts, virtual machine platforms or privileged access to the network segment where the servers will run. You also need named data owners who can approve retention periods and who may see endpoint telemetry, change windows for agent rollout and server upgrades, and a contact who can accept or reject detection changes. Agent deployment usually depends on your software distribution tools and endpoint management policies. Confirm each dependency in the written scope so that the partner and your teams agree on what is blocking progress at each stage.
When does commercial EDR or MDR still make sense?
Commercial EDR or managed detection and response can be the better choice when you need around-the-clock monitoring that you cannot staff, a vendor contract with defined response times, or a product with prebuilt coverage for platforms your team does not support. It also suits organizations that prefer a single supported product over several open-source components. Open-source EDR tends to fit when you need data kept inside your own infrastructure, want to avoid per-endpoint licence fees, or have engineers who can maintain the stack. Compare total cost over the same endpoint count, retention period and service hours, and ask each vendor what their service covers in writing.
How framework evidence changes the cost
Framework obligations often decide how large the logging and retention bill becomes, not the agent license. The HIPAA Security Rule at 45 CFR 164.312 requires audit controls that record and examine activity in systems containing ePHI, along with unique user identification and person or entity authentication. The FTC Safeguards Rule at 16 CFR 314.4 requires covered financial institutions to implement multi-factor authentication for any individual accessing any information system and to monitor and log the activity of authorized users. Both duties apply to endpoint telemetry, so the cost of storing, searching and reviewing that telemetry grows with how long you keep it and how many hosts feed it.
For a self-hosted Wazuh or Velociraptor estate, the recurring costs sit in the indexer storage, backup copies and the staff time to pull records on request. Ask your auditor which retention periods apply to endpoint logs, authentication events and investigation records, and whether they expect the same period for each. Those answers set the storage tier and the size of the indexer cluster, and a managed partner will price them differently from a commercial EDR vendor that keeps telemetry on its own platform. Confirm where each record lives, who can alter it and how it is exported during an examination.
DeployOpen prepares systems, controls and evidence for compliance assessments, including configuration exports, access reviews, log retention settings and examples of alert handling. It does not issue audit reports, attestations or certifications, and an independent auditor decides whether the evidence is sufficient. When you request a quote, ask for the evidence package in writing: which logs are retained, how long, how they are protected, and which MFA events are captured. Those items should be in the fixed-scope document before work starts so the cost of producing them is visible up front.
How DeployOpen scopes and delivers a fixed-scope EDR build
DeployOpen helps teams compare the cost of running open-source endpoint detection in their own infrastructure with the cost of a partner-run or SaaS model. We start from a written scope, so the cost components, responsibilities and recurring items are agreed before any build work begins.
How we scope
- Written scope lists endpoint counts, operating systems, sites and any hosts that cannot take an agent.
- Cost model separates one-time build work from recurring server, storage and staffing costs for your environment.
- Scope states who runs 24x7 triage, whether in-house, by a partner or by a retainer, and at what hours.
How we build
- Deploy Wazuh and Velociraptor on your own cloud accounts, data centers or air-gapped networks, sized to the agreed endpoint count.
- Tune detection content and response actions, then test coverage against the detections and playbooks in the agreed scope.
- Document sizing assumptions, storage retention settings and licensing terms so that each cost line can be checked later.
How we hand over
- Deliver runbooks, architecture records and a cost register that maps each recurring item to an owner.
- Walk your operations and security staff through alert handling, hunts and evidence collection before handover.
- Record open items and the vendor or component versions in use, so future upgrade costs are visible.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, priced separately from the build.
- Retainer scope can cover patch releases, detection tuning and periodic review of server sizing and storage growth.
- Ask any partner, including DeployOpen, to confirm in writing which support hours and response terms apply.
