In short
Cisco XDR is ordered as one PRP-XDR-SEC-SUB subscription plus an Essentials (PRP-XDR-ESS) or Advantage (PRP-XDR-ADV) tier, licensed per covered user on a 1, 3 or 5-year term, prepaid or billed annually or monthly. Forever Systems, a Cisco Partner, supplies XDR through Cisco's MSP programme, with terms confirmed at quote.
Get a quote for Cisco XDR licences
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What you order for Cisco XDR
A Cisco XDR order under Cisco's Provider Pricing has two lines. The top line is the subscription, PRP-XDR-SEC-SUB, which sets the term and start date. Under it you enter the number of covered users for one tier:
| Tier | Part number | What it covers |
|---|---|---|
| XDR Essentials | PRP-XDR-ESS | Cisco security portfolio integrations; up to 2 GB of data ingestion per user per month; 90 days of data retention by default |
| XDR Advantage | PRP-XDR-ADV | Essentials, plus commercially supported and curated integrations with selected third-party tools |
Essentials suits an organisation whose security stack is mainly Cisco: Secure Endpoint, Email Threat Defense, Secure Firewall, Duo or Umbrella. Advantage suits a mixed estate, where XDR also needs to correlate alerts from other vendors' tools.
For what Cisco XDR does day to day and a fuller comparison of the tiers, see Cisco XDR (opens in a new tab) and Cisco XDR cost and tiers (opens in a new tab) on our Cisco security site. This page covers the part numbers and how to buy them.
Not sure which tier fits? Ask us
Tell us what you need and we will recommend the right tier for your organisation, with a quote.
How Cisco XDR licensing works
Cisco XDR is licensed per covered user: you enter the number of covered users against the tier you choose. Cisco's providers' guide describes a covered user as an internet-connected employee, subcontractor or other authorised individual covered by the deployment, so you count people rather than devices.
- Term: XDR subscriptions run for 1, 3 or 5 years.
- Billing: prepaid for the whole term, or periodic billing, annually or monthly, over the term.
- Data: each tier includes data ingestion of up to 2 GB per user per month and 90 days of data retention by default. If you expect to need more, tell us when you ask for a quote.
The Provider Pricing codes below are the ones Cisco publishes in its providers' ordering guide. XDR is also available as a standard Cisco subscription and under Cisco's Managed Services License Agreement (MSLA); we confirm those codes, terms and billing when we quote. Premier tiers are quoted on request.
Vendor documentation: Cisco Security Ordering Guide for Providers (Provider Pricing for Secure Access, XDR and Security Suites), updated 13 Mar 2026 (opens in a new tab).
Cisco XDR part numbers
Cisco's Provider Pricing codes for XDR. Order one PRP-XDR-SEC-SUB subscription line per customer, then the tier you want with the number of covered users.
| Part number | Description | Unit | Term | Route | Basket |
|---|---|---|---|---|---|
| PRP-XDR-SEC-SUB | XDR subscription (top line, sets term and start date) | Subscription line | 1, 3 or 5 years | Monthly MSP | |
| PRP-XDR-ESS | XDR Essentials tier | Per covered user | 1, 3 or 5 years | Monthly MSP | |
| PRP-XDR-ADV | XDR Advantage tier | Per covered user | 1, 3 or 5 years | Monthly MSP |
Part numbers from Cisco Security Ordering Guide for Providers (Provider Pricing for Secure Access, XDR and Security Suites), updated 13 Mar 2026 (opens in a new tab), checked 2026-11-08. Add the licences you need to your basket and request a quote: we confirm the right part numbers, quantities and terms when we quote.
Is Cisco XDR licences the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Buying XDR monthly through Cisco's MSP programme
Provider Pricing is Cisco's programme for managed service providers buying XDR, Secure Access and the security suites for their customers. Forever Systems supplies Cisco security mainly through Cisco's MSP programme and also through the MSLA, so XDR can be billed monthly per covered user, with terms confirmed at quote.
Monthly billing suits organisations that want security costs spread evenly across the year; prepaid suits a budget set once for the whole term. Either way the term is set on the PRP-XDR-SEC-SUB line, and we can keep your Cisco renewals on one account.
Cisco XDR inside the Breach Protection Suite
XDR is also part of Cisco's Breach Protection Suite. Breach Protection Essentials bundles XDR Essentials with Secure Endpoint Advantage and Email Threat Defense; Breach Protection Advantage moves up to XDR Advantage and adds Secure Endpoint Premier, Secure Network Analytics and Cisco Telemetry Broker. If you are buying endpoint protection and email security as well as XDR, the suite can be the simpler order, with one subscription line and one user count.
See Cisco security suite part numbers for the suite codes, or Cisco Secure Endpoint for the endpoint codes on their own. We can quote XDR on its own and as part of a suite so you can compare. Other XDR products we supply are listed under EDR, XDR and MDR.
How we help
Tell us how many people need protecting and which security tools you want XDR to draw on, Cisco and third-party. We can recommend Essentials or Advantage, check whether a suite fits better, and quote the Provider Pricing codes with monthly or prepaid billing. You can add the codes below to your basket and send them with your enquiry, or simply contact us and we will build the quote with you.
If you would rather have XDR run for you as a service, read about managed XDR (opens in a new tab) on our managed security site.
How Forever Systems supplies your software licences
Forever Systems supplies business software subscriptions to UK organisations from one account, with one invoice and a team who know the products.
- Help choosing the right edition: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from our engineers, not just a reseller account
- Consolidated billing and renewal reminders to help stop subscriptions lapsing unexpectedly
We can supply businesses, schools, charities and public sector organisations of all sizes.
Frequently asked questions
How is Cisco XDR licensed?
Per covered user: Cisco's providers' guide describes a covered user as an internet-connected employee, subcontractor or other authorised individual covered by the deployment. You choose one tier, Essentials or Advantage, for a 1, 3 or 5-year term, prepaid or billed annually or monthly.
What is PRP-XDR-ESS?
PRP-XDR-ESS is Cisco's Provider Pricing code for the XDR Essentials tier. It sits under the PRP-XDR-SEC-SUB subscription line, and its quantity is the number of covered users. PRP-XDR-ADV is the equivalent code for XDR Advantage.
Which XDR code sets the term?
PRP-XDR-SEC-SUB, the subscription line. It sets the 1, 3 or 5-year term, the start date and whether the subscription is prepaid or billed annually or monthly. The tier code under it, PRP-XDR-ESS or PRP-XDR-ADV, carries the number of covered users.
Can Cisco XDR be billed monthly?
Yes. Under Cisco's Provider Pricing, XDR can be prepaid or billed annually or monthly over the term. Forever Systems supplies XDR through Cisco's MSP programme, with terms confirmed at quote.
Is Cisco XDR included in a Cisco security suite?
Yes. The Breach Protection Suite includes XDR Essentials at its Essentials tier and XDR Advantage at its Advantage tier, together with Secure Endpoint and Email Threat Defense. We can quote both ways.
Still have a question about Cisco XDR licences?
Ask us and a member of our team will get back to you.