SentinelOne Singularity Endpoint Reviews

I use SentinelOne Singularity Endpoint for endpoint detection and response on the endpoint, and I use it with Purple AI, which is the most important model for this product.

The best features of SentinelOne Singularity Endpoint are Purple AI and the network containment option, with Purple AI being the most important feature and the network containment model being the best feature.

SentinelOne Singularity Endpoint has helped me consolidate security solutions as it is also used as a single solution.

I use the Ranger functionality, which is used for finding known and unknown devices.

The Ranger functionality provides clear network and asset visibility by showing how many endpoints are in the network and how many endpoints are not in the network.

The ability to ingest and correlate across various security solutions is used for detection, incident detection, and response, which is related to the high severity of incident detection and preventing malware and ransomware attacks.

Purple AI plays a crucial role in amplifying my team knowledge by being used for threat hunting and incident summarization on indicators of compromise like file hashes, IP addresses, and domains, helping us find the root cause of attacks.

Purple AI impacts streamlining threat investigations on my SecOps workflow by enabling faster threat detection, reducing investigation time, and improving incident response.

SentinelOne Singularity Endpoint frees up about twenty percent of my time.

It has reduced my mean time to detect and my mean time to respond to incidents within fifteen minutes.

In SentinelOne Singularity Endpoint, there is room for improvement in custom rules and the dashboard for finding rules and blocking actions.

I have been using SentinelOne Singularity Endpoint for the last three years.

SentinelOne Singularity Endpoint is the most stable product, which I also rate at nine.

For scalability, I rate it at nine.

I rate the technical support for SentinelOne at nine.

Compared to CrowdStrike, SentinelOne Singularity Endpoint is better for finding and responding in less time, and its threat hunting is very fast with deep visibility being a very important feature while the incident investigation is also very clear, functioning as an automated response tool.

I have one hundred thirteen customers, and with SentinelOne Singularity Endpoint, there are multiple alerts, meaning twenty to thirty alerts per day.

The pricing of SentinelOne Singularity Endpoint is expensive and considered moderate.

My clients using SentinelOne Singularity Endpoint are medium and large enterprises.

I would recommend SentinelOne Singularity Endpoint to other users because it is the best for endpoint security, addressing any attack surface, and the network containment option is the best, being very effective for the attack, mapping MITRE ATT&CK techniques and tactics accurately, while the AI detects threats and machine learning utilized from SentinelOne Purple AI provide deep visibility. I rate this product at nine.

My main use cases for SentinelOne Singularity Endpoint include endpoint protection, threat protection, threat detection, and automated response. I primarily rely on it to monitor endpoints for suspicious activity, identify and stop malware, ransomware, and other advanced threats, and provide visibility into security incidents across environments.

I utilize SentinelOne Singularity Endpoint to support automated remediation of any kind of threats, investigation support, and improving overall security posture by reducing response times and helping my security team quickly understand and contain potential threats.

The best features of SentinelOne Singularity Endpoint include AI-powered threat detection and prevention, autonomous response and remediation, Storyline incident tracking, ransomware protection and rollback, and endpoint detection and response capabilities. It also has a single lightweight agent, protection across different environments, deep visibility, and investigation tools, and it offers identity and attack path context with related Singularity capabilities.

The AI-powered detection and autonomous response capabilities have helped my team by improving our ability to identify and respond to threats quickly instead of relying only on manual investigation or signature-based detection. SentinelOne Singularity Endpoint helps to detect suspicious behaviors and emerging threats in real time while reducing the workload on my security team by automatically containing threats, stopping malicious processes, and helping prevent further impacts.

SentinelOne Singularity Endpoint has positively impacted our organization by strengthening our overall endpoint security and improving our ability to detect, investigate, and respond to threats. Its AI-driven detection and automated response capability have reduced the time needed to identify and contain security incidents, improved visibility across endpoints, streamlined security operations, and reduced the manual efforts required for threat investigation and remediation. By automating key response actions and providing better incident context, SentinelOne Singularity Endpoint has helped my team improve efficiency, minimize risk, and maintain a stronger security posture, which has resulted in reduced team operations time.

SentinelOne Singularity Endpoint provides strong protection and automation capabilities, but there are a few areas where it could be improved, such as enhancing the user experience with more intuitive dashboards and simplified workflows. These improvements would make it easier for administrators to quickly access important insights and manage threats. Additional customization options for alerts, reporting, and automation policies would also be valuable, allowing organizations to better tailor the platform to their specific security needs. Improvements in integrations with a wide range of third-party security tools would also be beneficial.

I have been using SentinelOne Singularity Endpoint for the last two years.

SentinelOne Singularity Endpoint is very stable because it is used for threat detection, threat prevention, and automated remediation for any kind of security operations.

SentinelOne Singularity Endpoint has handled our organization's growth and expansion effectively.

Customer support was very good, and I would give customer support a rating of eight out of ten.

I did not previously use a different solution, and we did not use any solution before SentinelOne Singularity Endpoint.

I have seen a positive return on investment with SentinelOne Singularity Endpoint. The main value has come from reducing manual security operations, improving incident response times, and consolidating multiple security capabilities into a single platform, with relevant improvements including faster threat detection and response.

My experience with SentinelOne Singularity Endpoint's pricing, setup cost, and licensing has been generally positive. The licensing model is straightforward, and the setup cost is low.

I did not evaluate other products before choosing SentinelOne Singularity Endpoint.

For organizations considering SentinelOne Singularity Endpoint, I recommend evaluating it based on your specific security requirements and environments. I would give this product an overall rating of ten out of ten.

SentinelOne Singularity Endpoint agent is installed on every user's PC and server in our environment and it is protecting our machines and also collecting all the logs from them.

For example, it detects external attacks when a user opens a malicious website and blocks it. Additionally, when our managers would like to check particular employees and what they are downloading or modifying, we have this data in SentinelOne AICM.

Whenever an employee attaches an external drive, SentinelOne often blocks if any of the files are malicious, so it helps to keep our computers safe.

I appreciate most that it has many AI and machine learning features that decide which situations are dangerous for the PC and which are potentially malicious. In the past when we used a different product, we had this data, but the decision had to be made manually, which provided a huge workload for us as administrators. Right now, decisions are made by agents from SentinelOne and we only have to deal with some exclusions when a legitimate process is blocked, but these situations are really rare.

It is straightforward when we have an alert in SentinelOne; we can create an exclusion directly from this alert and do it within seconds or a minute. If we need to define something broader, then it is also easy to build an exclusion from scratch.

Purple AI, the agent that is able to search through all the telemetry and all the security data from endpoints, is a really helpful feature. With a few sentences of natural language, I can find the data or information about processes I need. This really speeds up the work and helps.

The process of securing our endpoints is much more automated. There is no need or there are only a few cases when we need to do something manually. In most cases, it just runs on the endpoint and protects it without any intervention required. The workload for administrators has been reduced.

In the past, I needed to spend an hour or even two per day. Now I am only checking the logs and alerts, and it takes me 15 to 20 minutes a day.

The number of alerts has been reduced by 70 to 80 percent. Now we have many alerts that were displayed as separate ones in the past, consolidated in one threat by SentinelOne AI mechanism.

The time needed to detect threats has been reduced from minutes to seconds because the agent is working directly on the endpoint and making a decision to block the threat directly on the endpoint without any manual intervention.

The response time is also immediate because the response is automated by SentinelOne agent.

SentinelOne could prepare more native integrations for downloading data from external sources. There are already many integrations available, but it would be beneficial if Purple AI could search also through the data ingested to Data Lake and generate alerts based on external data which is uploaded to AICM.

Regarding functionalities, it is among the best protection that I have checked. However, the price and the fact that each functionality such as vulnerability management or cloud funnel requires additional licenses raises the yearly cost for the company.

I have been using this product for 15 months.

I did not notice any serious issues for the last 15 months.

It is really good. We do not have on-premises infrastructure for management. We use the cloud console and we did not encounter any issues.

I think support is really great from SentinelOne.

They respond quickly and are equally effective at solving the issues.

We replaced our previous security solution one-to-one, but we are evolving and using more and more SentinelOne functionalities, making our infrastructure increasingly secure. We also use vulnerability management and identity security. We do not consolidate but we improve and use new features that we did not use in the past with other products.

We used ESET antivirus with their XDR solution and SentinelOne offered us a better price and we found the solution better in action. The detection ratio is better and AI modules helped us to reduce the amount of manual work needed to operate with XDR.

We use part of the out-of-the-box integrations, so Microsoft Azure and Office 365, and they were included in our license. We did not need to purchase any additional module. It was straightforward to implement. There is good documentation available from SentinelOne, so it was really simple and it works really well.

We are cooperating with one SentinelOne partner and we work with them only for purchasing SentinelOne, with no other relationships.

We were considering also keeping ESET and switching to CrowdStrike, but we finally decided to go with SentinelOne.

I would rate this solution almost a 10, maybe a 9 because of the price. It is not a cheap solution, but it works really well.

It is a really good solution that efficiently protects your endpoints and servers. Even if the price is not as competitive as some other solutions, the functionalities are worth it.

I give this product an overall rating of 9 out of 10.

SentinelOne Singularity Endpoint's main use case is that it includes EDR, XDR, and NGSM. SentinelOne Singularity Complete has the ability to ingest and correlate across security solutions extensively. It functions as an EDR, XDR, and MDR mix with Purple AI and NGSM real-time monitoring tools.

Ranger functionality is a network discovery and control feature. Its primary role is to identify and manage unmanaged devices on the network. It detects devices in our network, ingests logs from network sources, and captures threat metrics, including IOCs. Ranger functionality is effective for identifying rogue devices in our network.

What I appreciate most about SentinelOne Singularity Endpoint is the fastest response of EDR and the rollback VSS capability. The rollback feature is my top preference, followed by the fastest response from the EDR side.

SentinelOne has helped reduce alerts for us by almost 50%. Before implementing SentinelOne Singularity, my colleague told me that we were using an AV, but I do not have knowledge about which AV we were using. After using SentinelOne Singularity platform, the time has reduced by 50%.

There is up to 30 to 40% mean time reduction in MTTD.

For mean time to resolve, whenever we get the alert from the console, we integrate SentinelOne Singularity with a sub-console, so it raises the alert within five minutes.

For SentinelOne Singularity Endpoint, the first issue I dislike is the high CPU utilization, and the second is a very high number of false positive alerts from the EDR.

Data security is very important in today's organizations when using Purple AI with endpoints in the SentinelOne Singularity network and applications everywhere. However, SentinelOne Singularity does not have strong features for data security. Purple AI is used to find IOCs, hashes, zero-day vulnerabilities, or CVEs found in the network. We use it for that purpose only. From a data security perspective, SentinelOne Singularity does not have a major role. With Purple AI, we ask questions about an IOC or provide a query and receive answers from Purple AI, but that is the extent of its functionality.

I have been working with this solution for eight months.

SentinelOne Singularity Endpoint protection runs continuously. I heard news about one or two years ago that CrowdStrike had a blue screen issue, but I have not heard any news about SentinelOne lagging or crashing. I have been using it for the last eight months with no issues from the Singularity application.

Scalability with SentinelOne depends on your organization and how many licenses you have. I am a co-worker of Softcell, and we have a license for 7,000 to 8,000 endpoints. Currently, we have only 6,000 endpoints implemented for our customers and for our use only. Scalability-wise, it is very scalable and depends on how many licenses your organization has purchased from SentinelOne.

Support is very important for SentinelOne Singularity Endpoint. Because it is a SaaS product, whenever we get stuck, we require a TAC team or support team. For instance, two days ago, one of our customers was hit by a ransomware attack. We required the support team to help us with root cause analysis to find out why the ransomware entered our client's organization. The support team helped us all night, standing with our customer while providing support to us. Support is very important for SentinelOne, and the TAC team is essential.

If I were to rate the support on a scale from one to ten, I would give it a nine. Support is important for us.

Before SentinelOne Singularity Endpoint, I used an AV, but I do not have knowledge about which AV it was.

SentinelOne Singularity Endpoint's initial deployment is very easy. I have eight months of experience with it and take on some admin responsibilities. We have to set up the tenant, though I do not have access to do so. I am downloading the packages during our initial deployment. Downloading the packages and installing them is very easy. We just require the site token from the management console. For our organization's pilot deployment, I downloaded some SentinelOne Singularity Endpoint packages on laptops. With eight months of experience as a fresher, I can install the endpoints on laptops. The initial setup is very straightforward.

I have not used any alternatives to SentinelOne Singularity Endpoint. I have knowledge of other solutions, but I am using SentinelOne for the first time. Before this company, I was a college student, so this is my first company and my first tool.

SentinelOne Singularity Endpoint has helped reduce alerts for us by almost 50%. Before implementing it, my colleague told me that we were using an AV, but I do not have knowledge about which AV it was. After using SentinelOne Singularity platform, the time has reduced by 50%.

There is up to 30 to 40% mean time reduction in MTTD.

For mean time to resolve, whenever we get the alert from the console, we integrate SentinelOne Singularity with a sub-console, so it raises the alert within five minutes.

I would rate this solution a 9 out of 10 overall.

Our customers are primarily seeking an XDR platform with Singularity Platform, which combines their EDR, next-gen antivirus, vulnerability management, and integration with their existing security portfolio. Singularity Platform is used for XDR requirements, extended detection and response, for their EDR, next-gen antivirus, vulnerability management, and the requirement to integrate with their existing security solutions like their firewalls and proxies from an XDR perspective.

From an overall security perspective, it is not related to supply chain processes as specific to the supply chain process. When customers have interactions or business relationships with their vendors or the third parties that they use as part of their business, Singularity Platform can be used to scan the internet traffic or through their XDR functionalities to determine what kind of data they are sending, if any vulnerabilities exist in their systems, and whether those vulnerabilities are exploitable or not. Those kinds of features can be mapped to a supply chain from Singularity Platform's perspective.

Singularity Platform's functionality for ransomware rollback is quite useful because if you have a ransomware attack, most EDR solutions do not have the feature to do a rollback and bring the system to its earlier state, but that is one of the unique features that Singularity Platform has which can be a game changer for customers.

Singularity Platform's customization feature is also strong; we were able to customize the dashboards and reports based on the different compliances that the customer has. We have customers in BFSI, manufacturing, and pharma, so based on their requirements, because every customer or every business has a different set of requirements, the customization of dashboard and reporting perspective is good in Singularity Platform. From an analyst level to a C-level executive, we can have different sets of dashboards with a specific set of purposes aligned with what roles they play.

The real-time monitoring capabilities in Singularity Platform are good. Some enhancements that could be made are to make it more readable or understandable to the person who is monitoring those dashboards, because sometimes what happens is it becomes too verbose or too much data is displayed from the monitoring perspective, especially from the EDR perspective. Analysts have to make sense of what logs or what alerts they are monitoring; they have to go through a lot of data before they can take any decision on whether it's a false positive or an actual threat that they should look at. If they make it easier and more understandable for the analyst, they can make an informed decision quickly. Currently, what Singularity Platform has is a bit clunky, verbose, and has too much data that might be useful or might not be useful based on the analyst, so if they simplify it, it will be more effective.

From the end user perspective regarding Singularity Platform, the deployment is very easy, which makes life easy for the administrator. Implementation doesn't require a reboot or these kinds of things after installing the agent, which is one more advantage. Additionally, it doesn't use many system resources and doesn't make the system heavy, but still works in a good way, so you're not using much of the CPU or RAM. The detection ratio is good, and we haven't seen many false positives or many attacks at our customers where Singularity Platform has been deployed. This is one added advantage because you need to spend less time on alerts or incidents, allowing your administrators to focus on different jobs rather than spending time analyzing on Singularity Platform. The deployment and installation are easy, which saves time and money from bandwidth and network perspectives and from the time that an analyst or administrator spends on deploying or installing the agent.

I do not recall a real-time personalization kind of feature in Singularity Platform.

If ranking is applied, I would rank CrowdStrike as one, Singularity Platform as two, and Palo Alto's Cortex as three. The issues mentioned in Singularity Platform are well taken care of in CrowdStrike, and CrowdStrike now has a bigger portfolio in terms of data security, identity security, and AI security. The new-age integrations are better in CrowdStrike, and I'm sure Singularity Platform will catch up, but as of now, CrowdStrike has an added advantage.

From an XDR perspective, if Singularity Platform could expand their existing set of supported log sources, that would be better. As of now, they have a limited set of security solutions that can be integrated as part of their XDR platform, and if they increase that, it would be better because not all customers will have the set of supported log sources that they have. Additionally, they don't have a scheduled scan feature; you have to do it through a different mechanism. If they can bring it as part of the platform, the scheduled scan feature would improve usability. Apart from that, from an operations or overall security perspective, we haven't found any such issues with the platform.

I have been working with Singularity Platform for three plus years.

I would rate stability for Singularity Platform as an eight from a better perspective.

Scalability is not an issue for Singularity Platform because it is delivered as a SaaS service, so scalability is taken care of by SentinelOne. I would rate it as a nine.

Technical support from SentinelOne is somewhat dependent on the engineer you are assigned. Some TAC cases are solved in a good time, but some cases faced challenges because the engineer was not competent or was not able to understand the issue or take it to its logical conclusion. I would rate it around six.

Positive

From the end user perspective regarding Singularity Platform, the deployment is very easy, which makes life easy for the administrator. Implementation doesn't require a reboot or these kinds of things after installing the agent, which is one more advantage. Additionally, it doesn't use many system resources and doesn't make the system heavy, but still works in a good way, so you're not using much of the CPU or RAM. That is one more benefit; additionally, the detection ratio is good, and we haven't seen many false positives or many attacks at our customers where Singularity Platform has been deployed. This is one added advantage because you need to spend less time on alerts or incidents, allowing your administrators to focus on different jobs rather than spending time analyzing on Singularity Platform. The deployment and installation are easy, which save time and money from bandwidth and network perspectives and from the time that an analyst or administrator spends on deploying or installing the agent. That is where I see more of the benefits.

From an XDR perspective, if Singularity Platform could expand their existing set of supported log sources, that would be better. As of now, they have a limited set of security solutions that can be integrated as part of their XDR platform, and if they increase that, it would be better because not all customers will have the set of supported log sources that they have. Additionally, they don't have a scheduled scan feature; you have to do it through a different mechanism. If they can bring it as part of the platform, the scheduled scan feature would improve usability. Apart from that, from an operations or overall security perspective, we haven't found any such issues with the platform.

It's a shadow process; they require our help during the initial implementation stage for Singularity Platform, but since it's quite easy to configure, it's a plug-and-play kind of thing. You just have to enable or disable the toggle buttons, and then you are good to go. From the deployment perspective or from the help perspective, at the initial level, they require our assistance. Once the training and handover process are done, they can easily manage it on their own.

I would compare Singularity Platform with CrowdStrike and Palo Alto's Cortex XDR.

I use SentinelOne Singularity Complete on our servers, specifically in our remote desktop services environment. I also use it alongside ESET for our workstations. Our environment isn't huge, with about 30 people, although we've had up to 50 users. I mostly use it as a security solution.

We have noticed a reduction in alerts since implementing SentinelOne Singularity Complete. 

The security aspect is the most valuable feature for me. Although SentinelOne Singularity Complete is marketed as providing superior blocking capabilities, my experience has varied. It has helped reduce alerts compared to other security solutions, which can be a positive feature since constant alerts tend to be overwhelming. However, this also leads to uncertainty about whether the solution is doing its job effectively.

The solution could improve its notifications and communications. For example, I don't receive much information about what threats have been blocked. A weekly report logging blocked threats would be helpful. Additionally, there should be a balance between too many notifications and no notifications at all, as neither product I'm familiar with strikes a comfortable medium.

An agent of ours clicked a link in an email that initiated what appeared to be a ransomware attack. The only thing that prevented the attack from succeeding was a free version of Malwarebytes that was running on the session, which effectively protected against it. The MSP confirmed that SentinelOne failed to detect the threat, but the free Malwarebytes version ultimately prevented it from impacting or compromising our systems.

Singularity Complete's interoperability with other SentinelOne solutions works well, but it doesn't work well with other third-party tools. Initially, it conflicted with the ESET we use on our workstations and the staff computers, and then they had to set up a white list for that.

I have a year and a half of experience with SentinelOne Singularity Complete.

SentinelOne Singularity Complete sometimes conflicts with third-party solutions. Initially, it conflicted with ESET on my workstations, requiring a whitelist setup. This indicates room for improvement in stability when interacting with other solutions.

My deployment is relatively small, and SentinelOne Singularity Complete works within those constraints. However, it is more of an add-on than a tool for consolidating security solutions within my organization.

My experience with SentinelOne's customer support has been mixed. We were performing a software upgrade for our Office Suite, which required temporarily disabling SentinelOne on the server. This was necessary because we were removing and reinstalling software. However, we couldn't simply request that our MSP disable it immediately. SentinelOne's policy required the MSP to contact their company and schedule the deactivation at least 24 hours before. Although we notified the MSP 12 hours before our intended start time, we could still not proceed as planned. Consequently, we had to postpone the project by an additional 24 hours.

Neutral

We previously used ESET on our servers, but our managed service provider recommended switching to SentinelOne Singularity Complete. ESET provided more frequent notifications, alerting us when it blocked something, which was helpful, although sometimes a bit excessive, similar to Norton products. While not quite as intrusive, finding a comfortable balance between ESET's transparency and Singularity Complete's lack of communication is challenging. Neither product offers the ideal middle ground; it's either an overwhelming number of notifications or none at all.

The initial setup was handled by the MSP, and I was somewhat against it from the start because I had heard rumours about it being a significant resource hog. My only concern was that I didn't want anything that would negatively impact the environment and slow it down, as the agents don't have time for that. Unfortunately, right from the start, we experienced the very impact I feared. Agent logins, which usually took around ten seconds, took six to seven minutes.

The deployment was completed in one day.

My implementation involved three people: myself, the marketing VP, and a former IT staff member. I had to reboot the servers, which caused minimal downtime.

Other than some delays initially with the agents and then during a software upgrade, there hasn't been any significant impact on ROI.

I did not notice a significant increase in cost after adding SentinelOne. It was close to the previous year's cost, which could be an annual increase unrelated to SentinelOne.

I rate SentinelOne Singularity Complete seven out of ten.

When we first deployed SentinelOne Singularity Complete with remote desktop services on our RDS server, we encountered problems. The software was running multiple instances of itself, one for each user session, in addition to the instance running on the actual server hardware. This caused the server to run extremely slowly, with users experiencing login times of six to seven minutes before reaching their desktops. To fix this issue, the MSP changed it to where it wasn't running independent sessions. It would just run on the server itself. It took the MSP half a day to make the changes.

SentinelOne Singularity Complete can be a decent solution for environments with newer hardware that can handle the overhead. It has a reputation for being secure, but its impact on performance was not suitable for my environment.

I use SentinelOne Singularity Endpoint for my customers.

I help our customers implement SentinelOne Singularity Endpoint because its initial setup is straightforward and not complicated. However, there are cases where they are not integrated with Active Directory, so I assist them by sending the link or email to the end user so they can download the agent, and the rest can be done through the console.

My customers purchase SentinelOne Singularity Endpoint from us. I place the order with SentinelOne distributors because local support is more important for customers, and they want to be locally supported by resellers or vendors. If you buy from AWS, then there will not be any support.

My experience working with SentinelOne Singularity Endpoint has been fantastic.

The most valuable features I have found in SentinelOne Singularity Endpoint are MITRE ATT&CK, continuous monitoring, and threat vectors.

The drawbacks I have identified with SentinelOne Singularity Endpoint are that they should work on being more responsive than CrowdStrike. CrowdStrike has a very strong team here in the Middle East and they are very frequently available to discuss any kind of issues or challenges. In comparison to these, they are a bit slow.

I think in the next release of SentinelOne Singularity Endpoint, they should be working on a SIEM solution so that customers can have data logs for 30 days or 90 days.

SentinelOne Singularity Endpoint's R&D team should learn from CrowdStrike's approach, looking at the technologies that protect endpoints, customer protection, and providing extra features that customers can utilize and be loyal to them. For example, CrowdStrike gives seven days data retrieval for end users in the SIEM without any charges. If SentinelOne does something similar, they might gain more loyalty and more customers.

I have been dealing with SentinelOne Singularity Endpoint for more than five to six years.

When it comes to functionalities and performance, SentinelOne Singularity Endpoint is fine, and there are not many issues with SentinelOne Singularity Endpoint products once deployed.

I would rate their technical support around a nine out of ten. Every solution has some kind of drawback, but it is a pretty good score.

Its initial setup is straightforward and not complicated. However, there are cases where they are not integrated with Active Directory, so I have to assist them by sending the link or email to the end user so they can download the agent, and the rest can be done through the console.

I find SentinelOne Singularity Endpoint's pricing to be competitive because if I look at the pricing of CrowdStrike, they are competitive to CrowdStrike.

I cannot say SentinelOne Singularity Endpoint is the best option on the market at the moment, but I can say it is the second best. If I look at CrowdStrike, they have many other features and come with various other solutions including identity protection, SIEM, data protection, and firewall management. In terms of technology, SentinelOne is doing good and very competitive in the market, but CrowdStrike is still ahead of them.

I have not gone through SentinelOne Singularity Endpoint's Purple AI that much. I believe it is an AI feature. It is similar to all other AIs where you can ask questions about technical issues or challenges through the portal and it can access security, indicating if any configuration is missing or if there are any attacks or vectors, or if some users are inactive for longer periods. This can help them keep track of users in case some are offline for longer days or if their agent has not been updated. I would rate this review an eight out of ten.

This is an Umbrella platform that provides endpoint security as well as cloud security and provides ingestion like identity and network protection. These are the use cases we work with our clients as per managed security services. It provides great endpoint and cloud security services.

With the AI-based capabilities and the high detection rate, the mean time to detect and mean time to resolve the complete dwell time is less on that particular point. This really directly helps in that area.

The feedback is very good. Detection time and mean time detection, all the security metrics like mean time to detect and dwell times, make SentinelOne Singularity Complete great from the Sentinel point of view. It also provides the MITRE ATT&CK metrics on the dashboard, which helps us to understand tactics and techniques.

There are multiple features such as network controls and device control. We can manage the device as well as detect any unprotected or rogue identity and rogue endpoints across the enterprise. All of these are great features from SentinelOne Singularity Complete.

It reduces the manual intervention time. It reduces the alert noise and now has the AI capabilities to drill down that particular event or incident.

In terms of enhancement, SentinelOne Singularity Complete may increase to include some agent for email protection.

I have demo experience, not production work on the AI Purple where we can take the data from multiple vendors or from Sentinel, and it will provide the enhanced observability and visibility. I have a couple of demo level experiences because that product we are not using right now.

Scalability is also a nine.

Technical support is also good. I would rate it around nine. When we have any escalation or something, it is very helpful in that area.

Positive

It is a simple process.

We are the managed service provider, so we help our clients. Sometimes it requires some advanced level of configuration or implementation.

CrowdStrike is the main competitor, along with Palo Alto Cortex and Microsoft Sentinel. These are the three main competitors for the product range from SentinelOne.

It is very hard to compare on this point until we have any kind of detailed one-to-one comparison. It actually depends on the use case on how we are implementing and which services we are opting. SentinelOne provides MDR and EDR detection, so it is a very great portfolio when compared. However, every peer competitor is also evolving day by day, so it is very hard to tell on that point.

It is helpful because it provides the data ingestion from other vendors also. SentinelOne Singularity Complete, from the end user perspective, provides the complete security protection, which is the first thing we are looking for. It has very few false positives. With device control, we can manage the device inventory as well as compliance as per the standard working. These are the features which SentinelOne Singularity Complete provides.

SentinelOne Singularity Complete is a very great product. Network discovery and device control and these features are very helpful for administrators and cybersecurity analysts to help the cybersecurity portfolio correctly.

I would rate this review a nine overall.

We have it for all of our client machines and servers. It is the antivirus solution for all clients and servers. We are also looking into going further with their log analysis portion. We are working with them in terms of pricing.

The overhead on the CPU is minimalistic, not taking up too many system resources.

Making exceptions and exclusions through the console interface is smooth, providing a very good experience. The clients communicate with the web console in less than a minute, which is much faster than other solutions such as Malwarebytes.

SentinelOne has helped us with consolidation. We have Malwarebytes installed along with SentinelOne, and we are moving just to SentinelOne. SentinelOne has the most widespread and up-to-date coverage because of the fact that we can deploy it fairly quickly. Its rogue detection feature helps catch systems missed during initial deployment. We are the most up-to-date now. 

It saves time for the staff once it is up and running. Once the system has gotten used to everything, it just works. There is a six to eight-month learning curve for the system to get used to your servers and software.

In the beginning, we had a fair number of false positives coming across, but once the system got set up, it has been pretty much running on its own. If we are running a lot of internal IT scripts for applications that are triggering the antivirus, it might detect that as suspicious. We have to configure it to exclude things. Overall, it is pretty smart. Its automation is working fairly well for us that way. 

As a strategic partner, they have been very vocal with us. They have been communicative and supportive. The product itself is robust. We have not had any situation where it failed and broke the computer. There is no CrowdStrike-type scenario going on.

Based on the updates they have done, they are focused on advancing the product. There is a constant evolution going on. The system is getting more robust. We are advancing and not digressing anywhere in terms of technology.

We moved from ESET, and we find that the licensing scheme, particularly how the licenses are attributed to clients, is pretty nice compared to what ESET offers. We work in a highly virtualized environment. We have roughly 150 to 160 virtualized clients that are refreshed daily. Every night, the systems refresh. With the old antivirus solution, the licensing would count into the thousands, necessitating manual deletion. Luckily, SentinelOne has a feature to decommission automatically, which has been fantastic. 

One area for improvement is automated deployment. I use it through a group policy. I put in the PC name, and when the user logs in, if the PC is in that group, it attempts an MSI install through Active Directory via GPO. That seems to play a little havoc and can conflict with manual installs, causing issues where it wants to delete and reinstall the client. To resolve this, I remove the computer from the security group, and it then stops complaining. The automated installation could improve in this regard.

We have been using SentinelOne for one year.

I would rate their support an eight out of ten. The rating would be better if they picked up the phone and had someone talk immediately. We are using the automated email process for support, and they respond within an hour or two hours sometimes.

Positive

We had moved from ESET.

We have not been hit since using it. I have experienced a ransomware attack only once, a few years ago, with minimal damage. Since then, I have not faced any intrusions, which is one reason I chose SentinelOne over ESET.

It has not helped us save costs. We are increasing costs because we are going more toward the avenue of protecting as a city. We have been watching other cities around us get hit, so there is more focused attention on protection at this level. We are moving to the complete license solution and looking at expanding that into Vigilance.

When it comes to interoperability, we are going to look at some integration with our FortiGate system for the firewall to help analyze the logs that come through there. We are slowly moving from stopping the intrusion to more like a preemptive, preventative focus.

To those considering using this solution, I would advise digging into the console and taking the time to learn. Some people complain and find it confusing, but understanding the system's ins and outs is crucial. The console is well laid out, so it is worth taking the time to learn it.

The quantity of detection is quite a lot in the first few months. The product has a learning curve, so you have to guide it in the beginning so it gets used to the scripts and applications that are running in your system. We have created quite a list of exclusions, and I always take the time to look at each one. Since September 2024, false positives have been reduced to one every two weeks.

Overall, I would rate it a nine out of ten.

My main use case for SentinelOne Singularity Endpoint is running the Picus Breach and Attack Simulation tool in our lab environment. After performing attacks on specific EDR tools, we understand which tools require which kind of exclusions to complete the attacks properly. We also determine how we can tighten the security policy, what kind of rules we can add, or which options we can tighten. After the prevention section, we can integrate with the API endpoint on SentinelOne Singularity Endpoint, and thanks to that, we can also fetch some logs and validate the operation in the detection side.

The best features that SentinelOne Singularity Endpoint offers include the EDR visibility. It helps me understand which kind of operation Picus has done on the system, the timeline, the process tree, and which kind of command has been executed. Thanks to that, we can write the proper exclusions or write the proper security tightening rules. The visibility provided by SentinelOne Singularity Endpoint is the best part.

On the integration side, we integrate SentinelOne Singularity Endpoint with Picus to collect the logs from the host where SentinelOne Singularity Endpoint is installed. We can collect the logs and the alerts related to the specific machines. In different products, we can see some delay on the ingestion time. After a couple of attacks, sometimes we lose some of the logs because the security solution only logs a couple of the attacks but not all of them. However, we did not encounter this issue on SentinelOne Singularity Endpoint. Each time we can access all the logs created by Picus itself, which means SentinelOne Singularity Endpoint does not miss the logs. We also did not encounter any ingestion time delay issues on SentinelOne Singularity Endpoint. In some other products, we can encounter logs that have been created after the attacks have been finished, long after the fact. We did not encounter this issue on SentinelOne Singularity Endpoint. I can conclude that SentinelOne Singularity Endpoint is good at logging and alerting.

SentinelOne Singularity Endpoint has positively impacted our organization in that we do not use SentinelOne Singularity Endpoint in the whole company. We are only using SentinelOne Singularity Endpoint on the lab environments to validate the Picus attacks. Based on our experience, SentinelOne Singularity Endpoint's score is high when I compare it with well-known EDR solutions. I can say that SentinelOne Singularity Endpoint is one of the good products.

I cannot think of anything to suggest to improve SentinelOne Singularity Endpoint. If I find something, I can create a feature request for them.

The reason I provide an eight for SentinelOne Singularity Endpoint is that it is easy to use and detection is faster than the other EDR products. There is no delay, ingestion delay, or missing logs on SentinelOne Singularity Endpoint. However, I do not provide a ten out of ten because when I compare it with different products, SentinelOne Singularity Endpoint is at the third position. This means that on the prevention side, it might be better. This is the reason I provide an eight. Additionally, when I log into the system, sometimes I encounter some problems. For example, it asks for username and password. After the username and password, it asks for the token, meaning the OTP, but it turns me back to the first page without any notification. I just enter username, password, and OTP again to log into the system. I do not know which kind of problem I encountered, and it just did not throw an error. Instead of that, it just turned me back to the login page. This is not a good issue. I also encounter some problems on the support side. When the policy override was first announced for the Breach and Attack Simulation tools, we as Picus provided some feedback related to the policy override because it does not work for Picus. We contacted the support team, provided our observations, and explained why it does not work and what kind of enhancement could be done. However, the support team ignored us and just said they would look at it. I am not sure whether anybody looked at it, because it did not change. Still, when sometimes we encounter a customer using the policy overrides instead of the exclusions suggested by Picus, they encounter the problem where SentinelOne Singularity Endpoint kills the Picus services. After we connected to the system, we understood that the customer was using the policy override, but the policy override does not work. Perhaps the support responsiveness might be enhanced.

I have been using SentinelOne Singularity Endpoint for approximately three years.

I notice that integration is faster with SentinelOne Singularity Endpoint. It is also a kind of product that is easier to use. In some products, I do not want to mention the names of them, but some of them are hard to use, whereas SentinelOne Singularity Endpoint is easy to use. I did not use SentinelOne Singularity Endpoint before starting at Picus. Even though I did not use it before starting at Picus, I easily got used to it because the UI is easy to use and everything seems clear. I only use SentinelOne Singularity Endpoint in the lab environment. We did not use it in the whole company. However, if we had been using it, we would have benefited from it. I can say SentinelOne Singularity Endpoint offers faster detection.

I looked at the console and I see some numbers related to the different EDR vendors for both simulation speed and also the result itself. SentinelOne Singularity Endpoint's score is demonstrated as the third highest score in the system. It is also the third speediest one. This means that overall, SentinelOne Singularity Endpoint has demonstrated good performance. I provided a rating of eight out of ten for SentinelOne Singularity Endpoint.