SentinelOne Singularity Complete offers a ransomware warranty. In the event that any customer is attacked or falls victim to ransomware, they provide compensation of approximately one million dollars. Additionally, they offer 24-hour version monitoring, which allows them to continuously monitor the customer's environment. This monitoring helps them identify the source of any issues or attacks. They conduct thorough investigations to ensure everything is checked properly. Furthermore, they provide threat analysis reports.
Sales Director at CLOUD MIND
Offers MITRE ATT&CK reports, forensic investigation, and ransomware prevention
Pros and Cons
- "The most valuable features are forensic investigation and ransomware prevention."
- "The channel policy has room for improvement."
What is our primary use case?
How has it helped my organization?
SentinelOne Singularity Complete can ingest and correlate data across security solutions. It monitors the entire environment and accesses it in case of any incidents. It performs quarantining and provides detailed information to the customer about the origin of the incident.
It helped us consolidate our security solutions.
SentinelOne Singularity Complete helps reduce false alerts by 60 percent. It has also reduced our MTTD to 60 to 90 seconds.
Our MTTR has been reduced to 40 seconds.
SentinelOne Singularity Complete has saved us costs by preventing ransom attacks that could have cost us millions of dollars in the future.
SentinelOne Singularity Complete has helped reduce our organization's risks by 90 percent.
What is most valuable?
The most valuable features are forensic investigation and ransomware prevention.
What needs improvement?
The channel policy has room for improvement.
Buyer's Guide
SentinelOne Singularity Complete
September 2025

Learn what your peers think about SentinelOne Singularity Complete. Get advice and tips from experienced pros sharing their opinions. Updated: September 2025.
868,787 professionals have used our research since 2012.
For how long have I used the solution?
I have been using SentinelOne Singularity Complete for five years.
What do I think about the stability of the solution?
It is stable.
What do I think about the scalability of the solution?
SentinelOne Singularity Complete is scalable.
How are customer service and support?
The technical support is good.
How would you rate customer service and support?
Positive
What's my experience with pricing, setup cost, and licensing?
SentinelOne Singularity Complete meets all enterprise requirements and is priced accordingly.
What other advice do I have?
I would rate SentinelOne Singularity Complete an eight out of ten. They are a market leader and have been established for a significant period. Additionally, their MITRE ATT&CK reports are quite helpful.
SentinelOne Singularity Complete agent is light and easy to deploy.
SentinelOne Singularity Complete is a mature product that has been in the market since 2011, and the company is well aware of what to do and what not to do.
SentinelOne, as a strategic security partner, is satisfactory.
I recommend SentinelOne Singularity Complete for enterprise organizations with a sufficient budget to invest in their security.
Disclosure: My company has a business relationship with this vendor other than being a customer. partner

IT Manager at a construction company with 51-200 employees
It's an innovative platform that addresses issues automatically
Pros and Cons
- "SentinelOne has improved the overall security posture of the firm without creating a lot of hassle for our end users. Everything is a bit more secure. We think Singularity Complete has helped us reduce our organizational risks."
- "I rate Singularity Complete a seven out of ten for affordability. It's more expensive than our previous solution, but it does its job well. At the same time, there is some room for improvement. Cheaper is always better."
What is our primary use case?
We use Singularity Complete as our EDR software. It's replacing our old antivirus solution. It covers about 80 endpoints.
How has it helped my organization?
SentinelOne has improved the overall security posture of the firm without creating a lot of hassle for our end-users. Everything is a bit more secure. We think Singularity Complete has helped us reduce our organizational risks.
What is most valuable?
SentinelOne detects threats automatically and performs the remediation itself, so we don't need to constantly look at the logs. It reduces the meantime to respond because it automatically responds to the detected threats.
For how long have I used the solution?
We started using SentinelOne Singularity at the start of this year, so it has been nearly seven months.
What do I think about the stability of the solution?
I have had no stability issues so far.
What do I think about the scalability of the solution?
We only started using it at the beginning of this year, so the number of users has stayed the same. I have no experience scaling it up, but it's easy to add more devices to the platform. I don't foresee having any problems with scalability.
How are customer service and support?
We receive technical support from our partner, so I have no experience with SentinelOne support.
Which solution did I use previously and why did I switch?
We previously used Bitdefender as our antivirus solution. We switched to SentinelOne because we wanted to improve the overall security of our endpoints. SentinelOne offers more advanced and comprehensive protection than a traditional antivirus solution.
How was the initial setup?
We contracted with a partner to deploy SentinelOne, so I wasn't involved in the deployment. Our partner also handles the maintenance.
What was our ROI?
SentinelOne is more expensive than our previous tool, but we're hoping to see a return by saving money on recovering from some kind of incident.
What's my experience with pricing, setup cost, and licensing?
I rate Singularity Complete a seven out of ten for affordability. It's more expensive than our previous solution, but it does its job well. At the same time, there is some room for improvement. Cheaper is always better.
Which other solutions did I evaluate?
Though Microsoft's solution was suggested, we only seriously considered SentinelOne. That was the one that stood out during research. Also, I heard from my peers that it was the best one, so I didn't look at other options.
What other advice do I have?
I rate SentinelOne Singularity Complete a nine out of ten. I recommend it. SentinelOne works as advertised. It's an innovative solution, but it's hard for me to compare it to other products because I don't have much security expertise. It's a mature solution that has no bugs that I've experienced. I have confidence in it.
Which deployment model are you using for this solution?
Public Cloud
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Buyer's Guide
SentinelOne Singularity Complete
September 2025

Learn what your peers think about SentinelOne Singularity Complete. Get advice and tips from experienced pros sharing their opinions. Updated: September 2025.
868,787 professionals have used our research since 2012.
CEO at Sentree Systems, Corp.
Easy to navigate and use with helpful support
Pros and Cons
- "Their platform is really easy to work with."
- "I really haven't done enough to really see any improvements."
What is our primary use case?
We primarily use it the same way we would use Bitdefender. It's for security.
What is most valuable?
When it comes to security, the telemetry, the information that you get from the EDR part of it, and the ability to be able to parse it and use it is great. I really like their platform. You're able to go in and do some of the research and study. If there's an incident response needed, you can handle it with SentinelOne. That's what I really like about it.
It's just as good, if not better, than Bitdefender. The one thing I do like more about SentinelOne is working with their tech support. It's really easy to get to them and easy to work with them.
Their platform is really easy to work with. It's easy to navigate and use.
What needs improvement?
I really haven't done enough to really see any improvements. It really has all the telemetry markers that I look for.
For how long have I used the solution?
I just started using the solution. I've used it for five or six months.
What do I think about the scalability of the solution?
The scalability is very good. I'd rate it nine out of ten. It can expand well.
We have about ten people, admins, who are on the solution.
How are customer service and support?
Technical support has been great. They are helpful and responsive. I've only used them for onboarding assistance. I've never had an issue I needed help troubleshooting with.
Which solution did I use previously and why did I switch?
I've also used Bitdefender. I didn't stop liking Bitdefender. I love Bitdefender. I have nothing against Bitdefender. The only reason I did move to this product is due to the SOC that I work with. Bitdefender doesn't work with the stock that I use as well as SentinelOne does. SentinelOne also offers better support. Bitdefender's platform can be a bit more cumbersome to try to get through in terms of getting your agents to install, for example. SentinelOne is very simple.
How was the initial setup?
The initial setup is very easy. I'd rate the ease of implementation ten out of ten.
There is one person that handles maintenance on the solution. That would be me.
What's my experience with pricing, setup cost, and licensing?
There are a couple of different solutions that they offer. The one I use is $6 a month per device. Some are $4 and there are some that are more than that, and those offer an MDR part, which is the managed detection and response.
What other advice do I have?
I'm a partner.
To anyone using any of these MDR-type scenarios, one of the things they need to recognize with SentinelOne is that, only looking at SentinelOne telemetry, when it comes to the stock solution that they offer, it's not a true SOC. It is an internal SOC solution. That's why it's an MDR. So they're only looking at what their solution finds. If their solution finds ransomware and stops it, then you're only looking at that telemetry. That's why I offer an outside external stock since the external stock is looking at everything. If you have one device that has something on it or something with nothing on it, it's going to see it all. That's the big difference between an internal SOC as opposed to an external SOC.
I'd rate the solution ten out of ten.
Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
Product Consultant at M.Tech
The solution is stable, scalable, and easy to deploy
Pros and Cons
- "The AI solution makes it easy for customers to detect and manage policies, as well as documents that help customers manage their platform."
- "I would like to have the same features such as ransomware that are available on the cloud version of SentinelOne also made available for the on-prem version because a lot of people in our region are not ready for cloud solutions."
What is our primary use case?
I mainly focus on endpoint security. Customers often ask me about solutions to detect malware threats, and SentinelOne is one of the options I recommend. The main focus is detecting malware threats on endpoints.
What is most valuable?
The AI solution makes it easy for customers to detect and manage policies, as well as documents that help customers manage their platform.
What needs improvement?
I would like to have the same features such as ransomware that are available on the cloud version of SentinelOne also made available for the on-prem version because a lot of people in our region are not ready for cloud solutions.
For how long have I used the solution?
I have been using the solution for one year.
What do I think about the stability of the solution?
Our clients range from small, medium, to large scale and the solution is stable for all of them. I give the stability a ten out of ten.
What do I think about the scalability of the solution?
The solution is highly scalable. I give the scalability a ten out of ten.
How are customer service and support?
The technical support is very good, and quick.
How was the initial setup?
The initial SentinelOne setup is easy to set up in the environment and also easy to download the packet to install.
What's my experience with pricing, setup cost, and licensing?
We do not encounter a lot of issues with the pricing of SentinelOne. The pricing is reasonable.
The solution offers a standard licensing fee.
What other advice do I have?
I give the solution a ten out of ten.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer. Reseller
IT Support Director at Biotrial S.A.S.
User-friendly, easy to implement, and offers great visibility
Pros and Cons
- "It gives you good visibility of any threats or vulnerabilities that you might have on your network."
- "Some reports could be better."
What is our primary use case?
We primarily use the solution for security.
Cyber threats are growing. I have some other colleagues from other companies that have had some attacks. For us, SentinelOne or EDR solution was something appropriate.
What is most valuable?
It's pretty easy to implement.
It gives you good visibility of any threats or vulnerabilities that you might have on your network.
It's very simple to use, and user-friendly as well.
What needs improvement?
I don't know how complicated it would be, however, a patch solution should be included inside of this. If we find a vulnerability, we should also be capable of patching the PC right away.
Some reports could be better. Sometimes you need to search inside of SentinelOne to get some information. Only then could one be done.
A daily report would be helpful.
For how long have I used the solution?
I've been using the solution for six months.
What do I think about the stability of the solution?
The software looks to be okay right now. It is very stable. I have no complaints regarding that.
What do I think about the scalability of the solution?
It is very scalable. Most of the software that is on-demand is scalable.
We have about 350 licenses for the solution right now. If the company grows, we will increase usage.
How are customer service and support?
We use the SUP team that is provided by the provider of SentinelOne. However, I've never directly dealt with them.
Which solution did I use previously and why did I switch?
Previously we had an antivirus. That was Kaspersky. However, we didn't have an EDR solution. It can't be really compared.
Of course, with Kaspersky, now, with what's happening in Ukraine, there has been a break in trust.
How was the initial setup?
The implementation process is quite straightforward. It's not complex at all.
The deployment process took a maximum of a month. That said, we were doing very slowly since there were some computers that we knew would not have any attacks on it. However, there were others that were using acquisition data. We needed to install it and maybe wait a week to ensure everything conformed, and after that, we patched the rest.
Maybe five or six people are maintaining. However, no one really has to worry about it full-time. Really, only one to two people would be required.
What about the implementation team?
We did a third-party integration. Another company is hosting SentinelOne.
What's my experience with pricing, setup cost, and licensing?
Since we are a French company in France, we partnered with a company called Arrange which is our vendor. We did some quotes and found they have a reasonable price for this kind of technology. SentinelOne offers one of the best software quotes and has excellent reviews and everything.
The licensing is done per device.
I'm not directly involved in the licensing process and can't speak to the exact costs.
What other advice do I have?
This is an on-demand product. We are always on the latest version.
I'd rate the solution eight out of ten. It's a good product. We like working with it.
Which deployment model are you using for this solution?
Private Cloud
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Operations Manager at Proton Dealership IT
Excellent detection rate / allowed our team to focus on proactive management
Pros and Cons
- "The detection rate for Sentinel One has been excellent and we have been able to resolve many potential threats with zero client impact. The ability to deploy via our RMM allows us to quickly secure new clients and provides peace of mind."
- "One area of SentinelOne that definitely has room for improvement is the reporting. The canned reports are clunky and we haven't been able to pull a lot of good information directly from them."
What is our primary use case?
Everyone who is a client of ours gets SentinelOne by default. It provides ransomware protection, malware protection, and increased security. Those are our top-three selling points for SentinelOne when we talk to clients.
How has it helped my organization?
Prior to deploying Sentinel One, we had a team of staff members dedicated to ransomware prevention and malware alerts. Since deploying Sentinel One, we have been able to allow that team to focus on other proactive security measures for our clients.
The dashboard alerting is great and it has helped us out a ton.
SentinelOne has also greatly reduced incident response time, based on the toolsets and the ability to deploy it to new companies through a script. That has been very helpful. It has decreased the amount of time spent on incident response by 40 to 60 hours a month.
And when it comes to mean time to repair, while we haven't had a situation where we've had to reload an operating system or repair to that extent, we've used the 1-Click Rollback feature which saves several hours over a reload of a PC.
What is most valuable?
The detection and response feature is really good for us.
Also, there is a feature called Applications, and it shows all the critical applications that are on devices that may need to be reviewed.
The solution’s Static AI and Behavioral AI technologies are great when it comes to protecting against file-based, fileless, and Zero-day attacks. I would rate that aspect at eight out of 10. They have been great at detection.
The solution’s 1-Click Rollback for reversing unauthorized changes is also huge for us. That is one of the top reasons we have SentinelOne in place. For example, we had a site that had downloaded malware on a share for their sales office. It was trying to move laterally throughout the network but SentinelOne detected it. We then used the 1-Click option to remove it from the 10 or so PCs it had infected. Then we blocked it based on the information SentinelOne provided to us. That way if it happened again, it would already be blocked and wouldn't be allowed to launch.
What needs improvement?
One area of SentinelOne that definitely has room for improvement is the reporting. The canned reports are clunky and we haven't been able to pull a lot of good information directly from them.
Also, integration is almost non-existent. We would really like to see integration with ConnectWise. Within ConnectWise Automate, you're only allowed to deploy at the top-level group. Our company is dealership-focused, but if we have a parent dealership that has 10 sub-dealerships with SentinelOne, we have to treat them as one large group instead of one parent and 10 sub-groups. That's been a pain point for us. We've done some workarounds, but since there is no integration, it's tough.
For how long have I used the solution?
I have been using SentinelOne for about two years.
What do I think about the stability of the solution?
We haven't had any issues, outages, or upgrades. I would rate the stability at 10 out of 10.
What do I think about the scalability of the solution?
One of the features that we love about SentinelOne is that we don't have to buy licenses ahead of time. It just scales up as we grow. We're bringing on a client now that has 500 endpoints and I don't have to worry about contacting sales at SentinelOne and getting a PO for 500 licenses. It just scales up and we're charged based on what we use, which is awesome.
The solution is on 100 percent of our clients that we manage, and that's going to be the goal moving forward. Our sales team does not put in a contract without SentinelOne.
How are customer service and support?
SentinelOne technical support has always been very quick and responsive. We haven't used them a lot. We're a technology company as well and we're able to fix the minor stuff ourselves or by looking at a knowledge base.
One of our concerns or complaints at the beginning was the lack of training, which they fixed. They allowed us to schedule our staff to do the eight hours of free training, which was great. That would have been my only complaint, but that was resolved a few months ago.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
We didn't have any EDR solution in place like SentinelOne. We had Bitdefender for antivirus, but that has been removed. Our existing antivirus was failing in several ways. It wasn't detecting everything that was coming through. That was the big catalyst for the switch.
Originally, we had SentinelOne through SolarWinds, which was our previous RMM tool. And when we migrated to ConnectWise, we moved our existing licenses over.
How was the initial setup?
The initial setup was straightforward. It was through our RMM. We bought licenses and we had a one-click deployment to deploy that software. And when we migrated, the gentleman who helped us was awesome. We migrated 9,000 endpoints from that RMM directly into SentinelOne, and he did a lot of the heavy lifting. We just had to check and confirm things were getting moved over.
The migration of the 9,000 agents took 10 to 14 days.
Our implementation strategy included a deployment where we would do a test phase. We picked certain endpoints at different clients and we would deploy and set it in a "listen-only" mode and see what it caught. If everything was good, we would then turn it on to regular mode. That process helped a lot in the implementation.
We have about 75 people in our company using SentinelOne. The main roles among them are about 60 percent help desk, which is view-only; 20 percent client-side, which is reporting and view-only; and the rest are our engineering level where they have the ability to do rollbacks and fix certain issues that are coming in. There is very little maintenance involved with the solution, maybe a handful of hours a month. We have it set up to auto-update. Prior to that, we had to set up our script to download the most recent version, but that's all been replaced now with automation. Maintenance on the actual system is very minimal.
What's my experience with pricing, setup cost, and licensing?
In the past, we had to purchase licenses in advance, so if we hit our license limit, we could not expand until we got a signed agreement in place with the sales rep after the back-and-forth. That meant if a client had ransomware and they had 200 agents, we couldn't deploy right away if we were up against our limit. So we always had that balancing act of figuring out if we were close to our limit and whether we needed to buy more licenses? We ended up paying for licenses we didn't need because we had to buy them in packages of 100.
We now pay based on usage. They do an audit once a quarter and calculate any overages. We pay a set amount quarterly, based on our licenses in use, and then they true-up the figure. Right now we have 12,800 agents with SentinelOne on them. We charge our clients monthly, so it would be really difficult for us to write a check to SentinelOne, in advance, for a full year's worth, at that level. It's been great for us to have the quarterly payments.
Which other solutions did I evaluate?
We looked at CylancePROTECT in addition to SentinelOne. We liked the pricing better and the contract options better with SentinelOne. The deployment also seemed to be easier. In addition, SentinelOne detected things that others missed. We did a few quick trials of other solutions, but SentinelOne seemed to be the best in terms of detection. For example, we did a test with Mimikatz and SentinelOne detected it immediately, whereas some of the others bypassed or didn't see it at all.
And when we talked to the ConnectWise sales rep—because ConnectWise was integrated with Cylance at that point, and SentinelOne was not—the rep told us that they were actually dropping Cylance and moving to SentinelOne over the next year for integration, which was a big factor for us.
What other advice do I have?
My advice would be to implement SentinelOne immediately. It is one of the top things that we've implemented and it has saved us countless hours. It's really hard to quantify the savings, but if a client were to get ransomware, it could involve weeks of several team members working around the clock to get them back up and running. Since we've implemented this, we haven't had to do that in an environment where we had experienced having to do so previously.
The biggest thing I've learned from using SentinelOne is that there are a lot more attacks out there than a typical antivirus will display. Regular antivirus, rather than an EDR-type platform, gives people a false sense of security because there are a lot of processes running in the background that the typical antivirus solution is not equipped to catch. It was eye-opening when we started deploying this at clients, locations where we felt we had very good peace of mind in terms of what was happening. SentinelOne started detecting things left and right that were completely unable to be seen prior.
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor. The reviewer's company has a business relationship with this vendor other than being a customer: MSP
Deputy Chief Information Officer at a computer retailer with 201-500 employees
Provides deep visibility, helpful and intuitive interface, effectively prevents ransomware attacks
Pros and Cons
- "The most valuable feature varies from client to client but having absolute clarity of what happened and the autonomous actions of SentinelOne are what most people find the most assuring."
- "As a cloud-based product, there is a minimum number of licenses that need to be purchased, which is unfortunate."
What is our primary use case?
We are a solution provider and this is one of the products that we implement for our clients.
Sentinel One is being deployed as a replacement for any antivirus solution. In our case, we use it to primarily prevent ransomware and other malware from entering networks or computers, as they're deployed across the entire world now, in this new post-COVID environment.
We no longer have the luxury of the corporate firewall protecting everyone equally. This means that having SentinelOne on each box is providing a solution where we stop the badness before it can spread.
This is a cloud-based platform that we use in every capacity you can imagine. We use it on cloud components in both Azure and Amazon.
How has it helped my organization?
We have tested SentinelOne's static AI and behavioral AI technologies and it performs well. We actually put a laboratory together and we tested SentinelOne against CrowdStrike, Cylance, and Carbon Black side by side. We found that the only product that stopped every instance of ransomware we placed into the computers in the test lab, was SentinelOne. As part of the testing, we used a variety of actual ransomware applications that were occurring, live on people's systems at the time.
My analysts use SentinelOne's storyline feature, which observes all OS processes. They're able to utilize the storyline to determine exactly how the badness got into the network and touched the computer in the first place. That allows us to suggest improvements in network security for our clients as we protect them.
The storyline feature offers an incredible improvement in terms of response time. The deep visibility that is given to us through the storyline is incredibly helpful to get to the root cause of an infection and to create immediate countermeasures, in an IT solution manner, for the client. Instead of just telling them a security problem, we are able to use that data, analyze it, and give an IT solution to the problem.
SentinelOne has improved everybody's productivity because the design of the screens is such that it takes an analyst immediately to what they need next, to make the proper decision on the next steps needed for the client.
What is most valuable?
The most valuable feature varies from client to client but having absolute clarity of what happened and the autonomous actions of SentinelOne are what most people find the most assuring. The fact that it stops everything and lets you analyze it with great detail, including how it occurred, to improve your overall security infrastructure to prevent such an attack from occurring in the future, is really important to clients because it's almost like a security advisor or a security operation center in the tool itself.
When an event occurs, it gets stopped, and then they have a way to look into that data to find ways to improve the security of their network or what risk factors they need to tend to within the company through education or other means. For example, they may be constantly clicking on the wrong links or the wrong attachments in phishing emails.
Our people constantly use the Ranger functionality. The first thing we do is look for unprotected endpoints in the environment. This is critical because SentinelOne should be placed on everything in the environment for maximum protection. The second way we use it is if a printer or a camera or a thermostat is being used as a relay for an attack, through a weakness in that product, we are able to let them know exactly what product it is. The other advantage of Ranger is that it lets us put a block into the firewall of SentinelOne that's on every Windows computer, and we can stop the communications from the offending internet of things product to every system on the network with just a few clicks.
It's incredibly important to us that Ranger requires no new agents, hardware, or network changes. If you think about it, we're in the middle of an incident response every day. We have between 60 and 80 incident responses ongoing at any time, and having the ability to deploy just one agent to do everything we need to advise clients on how to improve their security and prevent a second attack, is incredibly important. It was a game-changer when Ranger came to fruition.
Various clients, depending on their business practices, are heavily in the IoT. Some are actually the creators of IoT and as they put new products on the air for testing, we're able to help protect them from external attacks.
What needs improvement?
As a cloud-based product, there is a minimum number of licenses that need to be purchased, which is unfortunate.
For how long have I used the solution?
I have been using SentinelOne personally, on and off, for approximately three years.
What do I think about the stability of the solution?
SentinelOne is very stable and the agent rarely fails. The only time I've seen an agent fail is normally on a compromised system. The fact that it even works to protect a compromised system in the first place is amazing, but that's the only time that we actually see the failure of an agent. Specifically, it can happen when there's a compromise to the box prior to loading SentinelOne.
On a pristine new load of a workstation or server where it has no compromises and no malfeasance exists, the SentinelOne agent is incredibly stable and we rarely have any issues with the agent stopping in function. I will add that in this respect, the fact that the agent cannot be uninstalled without a specific code gives us higher stability than others because even a threat actor can't remove or disable the agent in order to conduct an attack against the network. It's a unique feature.
What do I think about the scalability of the solution?
Right now, we have 54 analysts managing approximately 300,000 endpoints at any one time, globally. We operate 24/7 using SentinelOne.
How are customer service and support?
The technical support team is probably the fastest in the industry at responding, and they do care when we have to call them or send them an email due to a new issue that we've discovered. Most of the time, the problem is the operating system that we're dealing with is not regular, but they're still very helpful to us when it comes to protecting that endpoint.
I would rate their customer server a nine out of ten. I could not give anybody a ten. They are a continuous process improvement company and I'm sure that they are constantly trying to improve every aspect of customer service. That is the attitude that I perceive from that company.
Which solution did I use previously and why did I switch?
Primarily in the last year, the number one solution clients had, in cases where we replaced it, was probably Sophos. Next, it was CrowdStrike, and then Malwarebytes. The primary reason that these solutions are being replaced is ransomware protection.
Almost every client that I get involved with has been involved in a ransomware case. They've all been successfully hacked and we can place it onto their boxes, clean them up, along with all of the other malware that everyone else missed, no matter who it was. SentinelOne cleans up those systems, brings them to a healthy state, and protects them while we are helping them get over their ransomware event. This gives them the peace of mind that another ransomware event will not occur.
Personally, of the EDR tools, I have worked with Cylance, Carbon Black, and CrowdStrike. I've also worked with legacy antivirus solutions, such as McAfee and Symantec. However, this tool outshines all of them. It has ease of use, provides valuable information, and protects against attack. The autonomous nature of SentinelOne combined with artificial intelligence gives us the protection we cannot experience with any other EDR tool today.
How was the initial setup?
The initial setup is very straightforward. SentinelOne has incredibly helpful information on their help pages. They are probably the fastest company that I know of in the entire EDR space for responding to a client's email or phone call when you need to do something new or complex.
We have covered everything from Citrix networks to more complicated systems that work by utilizing the Amazon and Azure cloud to spin up additional resources and spin down resources. We were able to protect every one of those assets with it. The agent is easy to load and configure and the library allows us to quickly pivot on a new client and get their exclusions in fast enough to not impede business as we're protecting them.
What was our ROI?
When we were at a point of 50 clients, which is an average of 10,000 endpoints, we needed four analysts using Cylance. When we switched to SentinelOne for that same protection, the 50 clients could be covered by two analysts. We dropped our need for analysts in half.
The average cost of a security incident involving ransomware is a minimum of $50,000 USD, and this is something that SentinelOne can prevent.
The product has a rollback feature, where you can take a machine that's been attacked and partially damaged, and you can roll it back to a previously healthy state. That saves endless hours of system administrators' time rebuilding systems. That alone can reduce the cost of an incident from $50,000 down to $20,000. There is a cost because you still have to determine exposure and other factors with an incident response to determine if the threat actor has taken any data, things like that, but on the damage to the equipment, with the rollback feature and the restoration features built in the SentinelOne, and the fact that it stops everything but the most sinister lateral movements today, just means that an incident never has to occur.
This means that there is a great return on investment for a lot of companies. Another important thing to mention is that they don't lose people. Approximately 60% of businesses that are hit with a ransom attack go out of business within six months. If SentinelOne is preventing those incidents from occurring, that return on investment is worth almost the value of the entire company in some cases.
It is difficult to put an exact number on something like that, but the lack of pain and suffering of the employees of the company, because they didn't have to go through an incident response, and the lack of expense for the company to hire lawyers and professional companies to come in and help them during an incident, as well as their increased insurance costs of having an incident is also another factor.
Overall, it's difficult to judge but it's a true factor in the return on investment of owning SentinelOne and utilizing it to protect your environment.
What's my experience with pricing, setup cost, and licensing?
The pricing is very reasonable. Unfortunately, because it's a cloud-based product, it has a minimum count for licensing, but other than that, I've found their pricing to be incredibly reasonable and competitive with tools that are very similar.
Considering the invaluable nature of SentinelOne's autonomous behavior, I don't believe anyone else can measure up to that. That makes it an incredible bargain when compared to the cost of an incident for any company.
Which other solutions did I evaluate?
There are organizations such as MITRE and ESET Labs that have been doing testing that is similar to what we did three years ago. We just look at those results for the same truth that we discovered in the beginning, and the product continues to improve its performance.
What other advice do I have?
I have been a proponent of SentinelOne for many years. When I learn about somebody who has been hacked and wants to have protection against problems such as ransomware occurring, this is the one solution that I recommend.
The SentinelOne team is open to suggestions. They listen to the analysts and managers that are using their product and they innovate constantly. The improvements to the SentinelOne agent have enhanced its ability to catch everything and anything that comes in, including the detection of lateral movement attacks, which are the worst-case scenario.
When an unprotected agent penetrates the firewall and attacks a network, that unprotected asset has no protection on it so that the hacker can do whatever they want from that box with no impedance. But, the detection of it attacking from a lateral basis has been improved immensely over the last three years.
The improvement in the exclusions library has been phenomenal to help us get the new systems on the air with the new software. It allows the end-user to almost seamlessly get SentinelOne loaded and operational without impacting their business, which is incredibly helpful.
SentinelOne is working on something right now in the Ranger space that is going to allow us to remotely load endpoints that need the SentinelOne protection through the Ranger portion of the application. This is going to significantly improve the security of all of our clients, whether they be in long-term care or short-term incident response, it will help us protect them better. It's a significant improvement to our ability to protect the client.
Of all the products on the market today, I can say that they are the ones that I trust the absolute most to protect my clients.
I would rate this solution a ten out of ten.
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor. The reviewer's company has a business relationship with this vendor other than being a customer: Partner
IT Director at a wholesaler/distributor with 501-1,000 employees
Helps save us time, provides good service, and quick remediation
Pros and Cons
- "The most valuable feature is the quick response to attacks."
- "The SentinelOne portal is not user-friendly, which is one of its drawbacks."
What is our primary use case?
We use SentinelOne Singularity Complete to protect our environment.
How has it helped my organization?
SentinelOne Singularity Complete has helped us reduce the number of alerts we receive. I was attacked three times, and each time I received an alert. There were a lot of good features in SentinelOne that we were not aware of until we contacted them after we were hacked. SentinelOne took the role of fast response protection and took action.
SentinelOne Singularity Complete has freed up our staff's time to work on other tasks and projects. I made many changes to my department this year, including migrating all of my servers from on-premises to the cloud. With Singularity Complete, I was able to protect my cloud servers immediately and shut down my on-premises. I was also able to receive notifications of changes to IP addresses and users, which are common changes that occur during a migration. Sentinel was able to alert me every time there was a change.
What is most valuable?
In terms of service, SentinelOne has very great service. They respond immediately as soon as we open a ticket. I got attacked last year, and they were able to help me resolve my issues. So I got a fast response. Of course, we paid for it, but in terms of professionalism and support, they were extremely professional, and they have a lot of professional people working for them.
The most valuable feature is the quick response to attacks.
What needs improvement?
The SentinelOne portal is not user-friendly, which is one of its drawbacks. We have to search for options to disable and enable protection. We have to go through it on our own to find the options we need to add or remove notifications. SentinelOne did not tell us about these options until we encountered problems and had to contact them. We were not well informed. When we first implemented the solution all the options were turned off and we did not know that we had to navigate through and turn on what we required.
The MTTD has room for improvement. I was attacked last year and did not receive an alert from SentinelOne Singularity Complete until 24 hours after the attack occurred.
For how long have I used the solution?
I have been using SentinelOne Singularity Complete for two years.
What do I think about the stability of the solution?
SentinelOne Singularity Complete is stable and we have not encountered any issues.
What do I think about the scalability of the solution?
I would rate SentinelOne Singularity Complete's scalability an eight out of ten.
How are customer service and support?
We do not have a support package, so we pay per use, which is expensive. However, they are very professional and follow up well. They took charge immediately, found a solution immediately, and blocked the ransomware attack. They also gave us details on what to do next. Two to three days later, they called my department back and followed up with the system administrator to make sure everything was okay. Overall, I am satisfied with their service.
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
I previously used Microsoft Defender and Sophos. SentinelOne is a much better solution than Defender and has a quicker response time to alerts and attacks than Sophos.
How was the initial setup?
The initial deployment was straightforward. Implementing SentinelOne was not complicated, and more user-friendly than the others.
The deployment was completed by myself and one admin.
What's my experience with pricing, setup cost, and licensing?
SentinelOne Singularity Complete is expensive compared to Microsoft but not Sophos. However, it is worth the price for its quick response and immediate remediation options.
What other advice do I have?
I would rate SentinelOne Singularity Complete nine out of ten. SentinelOne is one of the best security solutions I have worked with. I would rank it in the top three best platforms for security.
SentinelOne Singularity Complete is an aggressive and accurate security solution.
No maintenance is required except for updates that we push out to all end users.
For organizations that want an aggressive security partner, I recommend SentinelOne Singularity Complete.
Although SentinelOne Singularity Complete is expensive, I have no qualms about investing more money in the security of my department and data. I would definitely recommend SentinelOne Singularity Complete. It gives me peace of mind knowing that my data is safe.
Which deployment model are you using for this solution?
Private Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Other
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Last updated: Mar 13, 2025
Flag as inappropriate
Buyer's Guide
Download our free SentinelOne Singularity Complete Report and get advice and tips from experienced pros
sharing their opinions.
Updated: September 2025
Product Categories
Endpoint Detection and Response (EDR) Endpoint Protection Platform (EPP) Anti-Malware Tools Extended Detection and Response (XDR)Popular Comparisons
CrowdStrike Falcon
Microsoft Defender for Endpoint
Fortinet FortiEDR
IBM Security QRadar
Microsoft Defender XDR
HP Wolf Security
Cortex XDR by Palo Alto Networks
Fortinet FortiClient
Elastic Security
WatchGuard Firebox
Trellix Endpoint Security Platform
Symantec Endpoint Security
Buyer's Guide
Download our free SentinelOne Singularity Complete Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- What is the biggest difference between Carbon Black CB Defense, CrowdStrike, and SentinelOne?
- Which is better - SentinelOne or Darktrace?
- What do you recommend to choose when replacing Symantec EDR: SentinelOne or CrowdStirke Falcon?
- Cortex XDR by Palo Alto vs. Sentinel One
- Which solution do you prefer: CrowdStrike Falcon or SentinelOne Singularity Complete?
- Does SentinelOne have a Virtual Patching functionality?
- What is the biggest difference between EPP and EDR products?
- What is the difference between EDR and traditional antivirus?
- What is your recommendation for a 5-star EDR with low resource consumption for a financial services company?
- Which is the best EDR for a logistics company with 500-1000 employees?