Microsoft Security Copilot vs Google Security AI vs CrowdStrike Charlotte AI: Real Cost per Security Analyst
Short answer
Only one of these three has a genuinely published, metered rate card: Microsoft Security Copilot, billed at $4 per Security Compute Unit (SCU) per hour, confirmed directly on Microsoft's own pricing page. CrowdStrike's Charlotte AI has no published per-unit pricing at all — it requires an existing Falcon deployment and its cost is entirely a matter of enterprise negotiation. Google doesn't sell a directly comparable standalone "security AI" product with its own rate card the way Microsoft does — Gemini's security capability is built into Google Security Operations (Google's SIEM/SOC platform) rather than sold as a separate, metered AI layer, which makes a clean three-way price comparison genuinely difficult to do honestly.
Pricing at a glance
| Microsoft Security Copilot | Google Security AI | CrowdStrike Charlotte AI | |
|---|---|---|---|
| Public rate card | Yes — confirmed directly on Microsoft's own pricing page | No standalone rate card found — Gemini's security capability is built into the Google Security Operations platform rather than sold separately | No — CrowdStrike does not publish per-unit pricing |
| Billing unit | Security Compute Units (SCUs). Confirmed billing mechanic: provisioned capacity (minimum 1 SCU) is billed per hour at $4/SCU-hour, monthly; overage capacity is billed on-demand at $6/SCU. The separate M365 E5/E7 bundled allotment is stated by Microsoft in flat "SCUs per month" terms, and Microsoft's own documentation does not spell out the exact mechanism by which that monthly figure offsets the hourly provisioned-capacity meter — this article treats the two as related but not confirmed to be directly interchangeable unit-for-unit (see note below) | Bundled into Google SecOps platform cost (see the companion SIEM article) rather than metered independently | Enterprise negotiation, layered on top of an existing Falcon subscription |
| Underlying product requirement | Standalone, or bundled capacity for Microsoft 365 E5/E7 customers | Google Security Operations (SIEM) subscription | CrowdStrike Falcon endpoint platform — Charlotte AI has no standalone product for non-Falcon environments |
| Reported/estimated always-on cost | 1 continuously-provisioned SCU ≈ $2,920/month ≈ $35,000/year | Not separately quantifiable — folded into SecOps ingestion/platform pricing | Reported to come through negotiated enterprise pricing, not comparable to a published per-unit rate |
| Notable inclusion | As of July 2026, Microsoft 365 E5/E7 customers get 400 SCUs/month per 1,000 licensed users bundled at no extra cost, up to a cap of 10,000 SCUs/month | Gemini capability is described as "built in" to Google SecOps rather than a separately licensed add-on | N/A |
A separate, narrower Google AI security product exists but isn't the same thing: Google Workspace's Gemini Business/Enterprise add-on tier includes an "AI Security" feature reportedly starting at $10/user/month — but this is a Workspace productivity-suite security feature, not a SOC-analyst investigation tool comparable to Security Copilot or Charlotte AI, and shouldn't be confused with a genuine competitor to either.
What headline pricing excludes
Microsoft's $4/SCU/hour rate applies specifically to provisioned capacity, not a simple per-use charge — you commit to a minimum of 1 provisioned SCU (billed whether or not you use the full capacity that hour) and can scale up with pay-as-you-go overage at $6/SCU when demand exceeds what you've provisioned. A team that provisions too little capacity pays a 50% premium on overage; a team that provisions too much pays for idle capacity. Getting the provisioned-capacity number right matters more than the headline $4 figure suggests.
A distinct, separate mechanic worth understanding on its own terms: Microsoft states that eligible Microsoft 365 E5/E7 customers receive "400 Security Compute Units (SCUs) per month for every 1,000 user licenses, up to 10,000 SCUs per month" — worked examples on Microsoft's own pricing page show a 400-seat organization getting 160 SCUs/month and a 4,000-seat organization getting 1,600 SCUs/month. Microsoft's documentation states this bundled amount in flat "SCUs per month" terms, separately from its explanation that provisioned capacity is billed hourly. Microsoft's public documentation does not spell out the precise mechanism by which this monthly bundled amount offsets or converts against the hourly provisioned-capacity meter — whether it functions as a monthly consumption credit, an equivalent number of provisioned SCU-hours, or some other mechanism isn't stated in the FAQ or pricing page reviewed for this article. This article treats the bundled allotment as a real, meaningful inclusion for E5/E7 customers, without presenting a precise dollar-equivalent conversion between "SCUs bundled per month" and "provisioned SCU-hours billed," since Microsoft's own documentation doesn't confirm that conversion.
Charlotte AI's "cost" isn't really a standalone number at all — it requires an existing CrowdStrike Falcon deployment, so any total-cost conversation has to start with Falcon's own endpoint pricing (covered in our CrowdStrike vs SentinelOne vs Microsoft Defender guide) before Charlotte AI's negotiated add-on cost is even a separate line item.
Google's security AI capability isn't priced as an "AI layer" the way Microsoft's is. Gemini's investigation and detection-categorization capability inside Google SecOps is described as built into the platform rather than metered separately — which means the honest way to think about Google's "AI cost" here is that it's bundled into whatever Google SecOps' ingestion-based SIEM pricing comes out to, not a separate number you can isolate and compare directly against Microsoft's per-SCU rate.
Hidden costs
- Microsoft's bundled M365 E5/E7 SCU allotment (400 SCUs/month per 1,000 licenses) is a real, meaningful inclusion for enterprises already on those licenses — a company evaluating Security Copilot without checking whether it already has this bundled capacity from its existing Microsoft licensing could significantly overestimate its need for standalone spend. That said, since Microsoft's documentation doesn't spell out exactly how the monthly bundled figure offsets hourly provisioned billing, a company should confirm the practical conversion directly with Microsoft or its usage dashboard rather than assume a specific dollar-for-dollar equivalence.
- CrowdStrike's ISO/IEC 42001 certification for Charlotte AI (an externally audited responsible-AI-governance standard) is a genuine differentiator worth knowing about, though it doesn't translate into a cost figure — a company weighing Charlotte AI against Security Copilot on governance/compliance grounds, not just price, should factor this in separately from the dollar comparison.
- Adopting Charlotte AI without already running Falcon means adopting the entire Falcon platform first — this is described plainly by multiple sources as a platform migration, not a tool addition, and the true cost of "adding Charlotte AI" for a non-CrowdStrike shop is really the cost of migrating the entire endpoint security stack.
Worked scenarios
3-person SOC
A small SOC's SCU needs depend heavily on actual investigation volume, but most guidance suggests starting with 1–3 provisioned SCUs and scaling from there.
| Estimated monthly cost | |
|---|---|
| Microsoft Security Copilot (2 provisioned SCUs, standalone) | 2 × $4 × 730 hours ≈ $5,840/month, confirmed math for standalone provisioned capacity |
| Microsoft Security Copilot (if already on M365 E5/E7) | This team may draw down some or all of its usage against the organization's bundled monthly SCU allotment instead of paying the standalone rate above — but since Microsoft's documentation doesn't confirm the exact conversion between the bundled monthly figure and hourly provisioned billing, this article does not state a specific dollar figure for this case; treat it as a real, meaningful reduction of unknown exact size rather than a confirmed $0 |
| Google Security AI | Not separately quantifiable — cost is embedded in whatever Google SecOps ingestion tier this SOC runs |
| CrowdStrike Charlotte AI | Not publicly quantifiable — requires a negotiated quote on top of an existing Falcon subscription |
10-person security team
| Estimated monthly cost | |
|---|---|
| Microsoft Security Copilot (5 provisioned SCUs, standalone) | 5 × $4 × 730 ≈ $14,600/month ≈ $175,200/year, confirmed math for standalone provisioned capacity |
| Microsoft Security Copilot (M365 E5/E7 bundled allotment) | A company with roughly 1,000+ E5/E7 licenses receives 400+ SCUs/month bundled — a real offset against this team's usage, though this article does not convert that monthly figure into an exact dollar-equivalent against the standalone rate above, since Microsoft's documentation doesn't confirm that conversion |
| Google Security AI | Not separately quantifiable |
| CrowdStrike Charlotte AI | Negotiated, on top of Falcon licensing for this team's endpoint coverage |
Enterprise SOC
At enterprise scale, Microsoft's bundled-SCU mechanic becomes genuinely significant in scope: a company with 10,000+ E5/E7 licenses can receive up to 10,000 SCUs/month bundled at no additional charge, per Microsoft's own worked examples. This represents a real, sizeable offset against a large SOC's AI-assisted investigation workload — but this article does not translate that monthly bundled figure into a precise dollar-equivalent against the standalone $4/SCU-hour rate, since Microsoft's own documentation states the two in different terms (a flat monthly quantity versus an hourly provisioned-capacity charge) without confirming the exact conversion between them. Google's and CrowdStrike's enterprise costs remain unquantifiable from public information — both are genuinely negotiated at this scale, with total cost depending heavily on existing platform commitments (Google SecOps ingestion volume, CrowdStrike Falcon endpoint count) that vary enormously between organizations.
Break-even and crossover
The one calculable, genuinely useful crossover in this category: an M365 E5/E7 customer's bundled SCU allotment versus standalone SCU pricing. At 400 SCUs/month per 1,000 licenses, a company needs to actually check its expected usage against this bundled allotment — using Microsoft's own capacity calculator and usage dashboard, since Microsoft's public documentation doesn't spell out a simple manual conversion — before assuming it needs to pay anything at all for Security Copilot. A mid-sized E5 shop may find its AI security-analyst tooling is substantially or fully covered by capacity already included in software it's already paying for, while a smaller or non-Microsoft-licensed shop faces the full standalone rate.
Who pays more, and when
- A Microsoft 365 E5 or E7 shop should check its bundled SCU allotment via Microsoft's own capacity calculator and usage dashboard before assuming Security Copilot requires new standalone spend — for many mid-sized deployments, it may be substantially or fully covered, though the exact conversion between the bundled monthly allotment and hourly provisioned billing isn't spelled out in Microsoft's public documentation.
- A CrowdStrike Falcon shop gets a natural extension path via Charlotte AI, but should expect a negotiated enterprise cost rather than a predictable per-unit rate — and should not expect this comparison to be apples-to-apples with Microsoft's transparent SCU pricing.
- A Google Security Operations shop effectively gets Gemini's investigative capability as part of the platform rather than as a separately priced decision — the real cost driver to model is Google SecOps' own ingestion-based SIEM pricing, covered in our Microsoft Sentinel vs Splunk vs Google SecOps comparison, not a standalone "AI fee."
- A team not already committed to any of the three underlying platforms faces a genuinely different decision than a price comparison alone can answer — the AI layer is, in every case here, an extension of an existing platform choice, not an independent product decision.
Limitations and uncertainty
Microsoft's SCU pricing is the only fully confirmed, official rate in this article, pulled directly from Microsoft's own pricing page — this includes the $4/SCU-hour provisioned rate and the $6/SCU overage rate, both stated explicitly with worked billing examples. The M365 E5/E7 bundled allotment (400 SCUs/month per 1,000 licenses) is also confirmed as a real inclusion, with worked seat-count examples provided by Microsoft — but Microsoft's documentation does not confirm the precise mechanism by which that monthly figure offsets the hourly provisioned-capacity meter, so this article deliberately avoids presenting a specific dollar-equivalent conversion between the two. Google does not appear to sell a standalone security-AI product with its own published rate comparable to Microsoft's SCU model — this article has not forced a false equivalence by inventing a Google figure, and the "Google Security AI" comparison in this article's title is better understood as "Gemini's role within Google Security Operations" than as a separately priced product. CrowdStrike Charlotte AI's cost is confirmed by multiple sources to be entirely negotiated and not publicly quantifiable; any Charlotte AI dollar figure found elsewhere should be treated as unconfirmed.
Official sources
- microsoft.com/en-us/security/pricing/microsoft-security-copilot/ (the source of the only fully confirmed rate in this article)
- No official standalone pricing page exists for a directly comparable Google "Security AI" product or for CrowdStrike Charlotte AI; other figures in this article are reported/third-party estimates