NORTH STAR | ENDPOINT SECURITY QUOTE COMPARISON
Worksheet version: 2026-09-20
Blank buyer worksheet. No prices, vendor scores or recommendations are supplied.
Use the same scope for both proposals. Unknown is not zero or included.
Keep completed quotes private. Do not include personal data, credentials, endpoint
names, IP addresses, access tokens, carrier or recovery codes, or incident evidence.
This file submits nothing and performs no calculation or vendor verification.

1. SHARED COMPARISON SCOPE
Reviewer and review date:
Business requirement / decision owner:
Workstations / operating systems:
Servers / operating systems:
Other workloads or identities required:
Coverage start date and comparison period (months):
Billing currency:
Tax treatment (inclusive / exclusive / recoverability not assessed):
Required monitoring hours and escalation contact coverage:
Required retention and evidence exports:
Required response actions and approval boundaries:

2. PROPOSAL RECORD: COMPLETE ONCE FOR EACH QUOTE
Provider / quote identifier / date / validity:
Quote source document / URL and vendor confirmation date:
Exact product, edition and managed service:
Protected scope and excluded devices/workloads:
Endpoint/server quantities and billing units:
Minimum purchase quantity or minimum fee:
Billing currency and any documented exchange-rate assumption:
Contract length / renewal / cancellation / exit terms:

Cost line | Amount | Currency | Unit | Quantity | Billing period | Included elsewhere? | Source
Endpoint licences:
Managed monitoring and response:
Other required subscriptions:
Onboarding / deployment (one-time):
Internal administration (hours per month x documented hourly assumption):
Recurring service or reporting extras:
Incident response outside the bundle (basis / unknown):
Recovery work outside the bundle (basis / unknown):
Exit / offboarding charges:
Tax treatment and unresolved currency conversions:

Do not add a bundled item twice. Do not mix monthly, annual and one-time amounts.
For a 12-month comparison only: annual recurring amount = monthly amount x 12,
or per-device monthly amount x the agreed device quantity x 12, as applicable.
First-year planned cost = documented annual recurring amounts + one-time costs
+ documented internal-time allowance. Separately list contingent incident,
recovery, exit and other unknown costs. Do not treat unknown charges as zero.
For another comparison period, use that period explicitly; do not label it annual.
No currency conversion or tax result is provided by this worksheet.

RESPONSIBILITIES: RECORD NAME/ROLE, HOURS, AUTHORITY AND WRITTEN QUOTE REFERENCE
Who deploys agents and checks missing/unhealthy coverage?
Who investigates alerts, including outside business hours?
Who can isolate a device, and when is customer approval required?
Who owns identity or policy actions, if included?
Who contacts the customer's authorised decision-maker?
Who restores systems and data after containment?
Who retains incident evidence, and how is it exported at exit?
Customer work that remains / required internal availability:
Each unresolved responsibility, clarification owner and due date:

3. NORMALISED DECISION RECORD
Do both proposals cover the same agreed devices and period? Yes / No / Unknown
Is each compared item actually included and documented? Yes / No / Unknown
Are currency, taxes, minimums and renewal conditions comparable? Yes / No / Unknown
Have bundled items been counted only once? Yes / No / Unknown
Do response and recovery responsibilities have named owners? Yes / No / Unknown
Are contingent or unknown costs listed separately? Yes / No / Unknown
Written clarifications required before comparison:
Scoped pilot acceptance criteria / authorised non-production test:
Pilot observations and evidence (leave blank until performed):
Business fit, trade-offs and remaining exceptions:
Decision / approver / date:

A lower subtotal with missing coverage is not a like-for-like saving.
This worksheet does not establish detection quality, compatibility, insurance
acceptance or regulatory compliance. Confirm actual capabilities and scope with
the responsible providers; do not run attack simulations without authorisation.

Guide: https://northstarit.ca/compare/huntress-vs-sentinelone/