We have it for all of our client machines and servers. It is the antivirus solution for all clients and servers. We are also looking into going further with their log analysis portion. We are working with them in terms of pricing.
SentinelOne Singularity Platform
SentinelOneExternal reviews
External reviews are not included in the AWS star rating for the product.
Has efficient licensing, minimal overhead, and fast client communication with the web console
What is our primary use case?
How has it helped my organization?
The overhead on the CPU is minimalistic, not taking up too many system resources.
Making exceptions and exclusions through the console interface is smooth, providing a very good experience. The clients communicate with the web console in less than a minute, which is much faster than other solutions such as Malwarebytes.
SentinelOne has helped us with consolidation. We have Malwarebytes installed along with SentinelOne, and we are moving just to SentinelOne. SentinelOne has the most widespread and up-to-date coverage because of the fact that we can deploy it fairly quickly. Its rogue detection feature helps catch systems missed during initial deployment. We are the most up-to-date now.
It saves time for the staff once it is up and running. Once the system has gotten used to everything, it just works. There is a six to eight-month learning curve for the system to get used to your servers and software.
In the beginning, we had a fair number of false positives coming across, but once the system got set up, it has been pretty much running on its own. If we are running a lot of internal IT scripts for applications that are triggering the antivirus, it might detect that as suspicious. We have to configure it to exclude things. Overall, it is pretty smart. Its automation is working fairly well for us that way.
As a strategic partner, they have been very vocal with us. They have been communicative and supportive. The product itself is robust. We have not had any situation where it failed and broke the computer. There is no CrowdStrike-type scenario going on.
Based on the updates they have done, they are focused on advancing the product. There is a constant evolution going on. The system is getting more robust. We are advancing and not digressing anywhere in terms of technology.
What is most valuable?
We moved from ESET, and we find that the licensing scheme, particularly how the licenses are attributed to clients, is pretty nice compared to what ESET offers. We work in a highly virtualized environment. We have roughly 150 to 160 virtualized clients that are refreshed daily. Every night, the systems refresh. With the old antivirus solution, the licensing would count into the thousands, necessitating manual deletion. Luckily, SentinelOne has a feature to decommission automatically, which has been fantastic.
What needs improvement?
One area for improvement is automated deployment. I use it through a group policy. I put in the PC name, and when the user logs in, if the PC is in that group, it attempts an MSI install through Active Directory via GPO. That seems to play a little havoc and can conflict with manual installs, causing issues where it wants to delete and reinstall the client. To resolve this, I remove the computer from the security group, and it then stops complaining. The automated installation could improve in this regard.
For how long have I used the solution?
We have been using SentinelOne for one year.
How are customer service and support?
I would rate their support an eight out of ten. The rating would be better if they picked up the phone and had someone talk immediately. We are using the automated email process for support, and they respond within an hour or two hours sometimes.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
We had moved from ESET.
What was our ROI?
We have not been hit since using it. I have experienced a ransomware attack only once, a few years ago, with minimal damage. Since then, I have not faced any intrusions, which is one reason I chose SentinelOne over ESET.
It has not helped us save costs. We are increasing costs because we are going more toward the avenue of protecting as a city. We have been watching other cities around us get hit, so there is more focused attention on protection at this level. We are moving to the complete license solution and looking at expanding that into Vigilance.
What other advice do I have?
When it comes to interoperability, we are going to look at some integration with our FortiGate system for the firewall to help analyze the logs that come through there. We are slowly moving from stopping the intrusion to more like a preemptive, preventative focus.
To those considering using this solution, I would advise digging into the console and taking the time to learn. Some people complain and find it confusing, but understanding the system's ins and outs is crucial. The console is well laid out, so it is worth taking the time to learn it.
The quantity of detection is quite a lot in the first few months. The product has a learning curve, so you have to guide it in the beginning so it gets used to the scripts and applications that are running in your system. We have created quite a list of exclusions, and I always take the time to look at each one. Since September 2024, false positives have been reduced to one every two weeks.
Overall, I would rate it a nine out of ten.
Secure and gives the sense that our endpoints are protected
As something we use daily the console is inutitive and easy to use. We have very rarely used customer support but when we have they have been great.
Enhances endpoint security with user-friendly detection tools
What is our primary use case?
SentinelOne Singularity Complete is primarily used for endpoint protection and integrating vulnerability reports from assessments. It also provides device control, exclusion management, and block listing capabilities.
Our clientele represents a diverse range of industries, including insurance and manufacturing.
How has it helped my organization?
Singularity offers complete interoperability with other SentinelOne solutions and third-party tools, and our clients have reported no issues.
The Ranger functionality provides network and asset visibility, allowing identification of installed and uninstalled assets within the environment. This capability contributes to maintaining a clean and organized environment.
It can prevent unauthorized access and use of USB drives, a common source of malware. Personal USB drives can carry malicious software that infects an entire network. Therefore, SentinelOne Singularity Complete plays a crucial role in protecting organizations from these external threats.
SentinelOne Singularity Complete enables in-depth root cause analysis and the ability to add exclusions as needed, effectively minimizing alert volume.
SentinelOne Singularity Complete helps users save approximately one-third of their time, allowing them to focus on other tasks.
SentinelOne Singularity Complete helps reduce our mean time to detect and helps reduce our mean time to respond by 25 percent.
SentinelOne Singularity Complete helps reduce environmental risk by identifying vulnerabilities.
What is most valuable?
The visibility feature is crucial for effective detection analysis. The user-friendly console ensures ease of use and learning, even for beginners. Furthermore, the tool's capacity to consolidate various security solutions and perform risk correlation analysis enhances its value.
What needs improvement?
The primary issue is the console's random automatic logouts, requiring users to repeatedly re-enter their username and password. This problem needs to be addressed.
For how long have I used the solution?
I have been using SentinelOne Singularity Complete for about six months.
What do I think about the stability of the solution?
The system has experienced interoperability challenges and high resource utilization, particularly with CPU and RAM.
What do I think about the scalability of the solution?
SentinelOne Singularity Complete is highly scalable.
How are customer service and support?
The response time of customer service could be improved.
How would you rate customer service and support?
Neutral
How was the initial setup?
The initial setup involves configuration policy setup and deploying the agent, which is straightforward if done through tools like SCCM.
Deployment can be managed by one person when using SCCM or similar tools.
What about the implementation team?
What was our ROI?
The manual effort used for tasks like remediation has been reduced, contributing to ROI.
What's my experience with pricing, setup cost, and licensing?
While SentinelOne Singularity Complete carries a higher price tag than some endpoint security solutions, customers find its robust features and return on investment justify the cost. However, it remains a more budget-friendly option compared to CrowdStrike.
Which other solutions did I evaluate?
CrowdStrike is a comparable endpoint integration solution. SentinelOne is priced higher than CrowdStrike.
SentinelOne's console offers a more user-friendly experience compared to CrowdStrike and Trend Micro One, making it particularly well-suited for beginners.
What other advice do I have?
I would rate SentinelOne Singularity Complete nine out of ten.
We have many endpoints in multiple locations.
Maintenance is only required if an agent is disabled or cannot connect to the controller; otherwise, no manual intervention is needed.
As a security partner, SentinelOne is on par with CrowdStrike and has strong potential to become a leader in its field.
I recommend SentinelOne for its ease of use and management, especially for new customers. The user-friendly console and straightforward deployment process facilitate a quick learning curve. Furthermore, its cloud-based architecture minimizes the burden of updates.
Our security analysts can efficiently manage incidents and investigations with its succinct interface
What is our primary use case?
We have the Singularity Endpoint Detection platform along with the MDR service. We are using their Singularity Enterprise offering along with Vigilance Pro.
We are currently in the process of deploying it. We started with the deployment earlier this calendar year with a goal of reaching 30,000 endpoints this year. We have deployed to about 25,000 endpoints to date. Our end goal is 100,000, but that will be phased in over the next year.
How has it helped my organization?
Our deployment experience has been excellent. We have received a ton of support from their customer success team. We are using this initial deployment to tune the product to make sure it is not causing performance issues on our endpoints. We are going about it in a very methodical fashion.
It has helped us achieve business goals in a few areas. Even though we are early in our adoption, there are a few areas where I have seen benefits. One is around the technology, the solution itself. It provides our security analysts with a very succinct and usable interface that they can use to effectively and efficiently manage incidents and investigations.
The second area is around the MDR. This has been a huge benefit to us compared to our prior solution. We used to get a lot of false positives. That took up the time of our security analysts, which then took away time from addressing real problems.
The risk management at Lenovo has improved greatly over our prior toolset. We have identified risks that we would not have otherwise identified with our prior implementation.
Our analysts' efficiency has gone up tremendously. We are not chasing false positives. The tool provides timely and relevant information to our analysts so that they can address the events with confidence. They know they are working on the right activities, and then along with the managed service, they are not chasing rudimentary incidents. Those are being resolved before they can get to our team.
It has definitely helped us reduce noise. In the prior platform, which we are phasing out, the false positive rate was tremendously high. That caused a huge amount of inefficiency in the team.
It has helped us increase our incident response because we are working as a team. We not only have an improved platform for detecting and managing incidents; we are also partnering with SentinelOne on the MDR and the managed service aspect of it.
It has helped us improve our mean time to respond from a perspective of seeing what is happening. I do not have any metrics related to the percentage of that improvement.
It has highlighted the risk of insider threats, and we have found that on multiple occasions. It is hard to compare if they would have been caught in our prior solution, but we have increased visibility into what is going on across our network and the machines that are connected to it.
SentinelOne is an integral part of our AI strategy. We have recently got a chief AI officer in our organization. He happened to be our chief security officer, so we take AI very seriously. There are two things that AI can impact. We can leverage SentinelOne to help us protect the AI models that we develop and use, but we can also leverage AI for endpoint protection in the product itself. We can utilize the AI offering to improve our response rate and mean time to respond.
What is most valuable?
We are freeing up our resources and our security analysts' time to focus on the most critical threats to our landscape by not having to chase down false positives. In conjunction with the MDR, many of those incidents and events are mitigated and resolved without any intervention from our team.
What needs improvement?
SentinelOne can continue to make the presentation of relevant and timely data to the analysts as succinct and clear as possible. It will allow analysts to execute remediation or resolution with the least amount of clicks.
For how long have I used the solution?
We started with the deployment earlier this calendar year.
How are customer service and support?
The support from SentinelOne has been second to none, exceeding expectations. Maybe we are in the honeymoon period, but they have definitely exceeded expectations. I have been part of many deployments, not just of cybersecurity platforms but also of other platforms, and SentinelOne, in comparison, has been second to none.
How would you rate customer service and support?
Positive
What's my experience with pricing, setup cost, and licensing?
We purchase it through CDW.
Which other solutions did I evaluate?
One of the primary considerations in evaluating EDR and identity security vendors was around the effectiveness of the detection and the ability to tune the solution to fit our needs. The presentation of the data to our analysts and the ability to detect events and threats that were not detected by our prior platform played a big role in that. We also were able to test out the MDR service as part of our proof of concept. That pushed it over the edge from anything we experienced with other vendors.
Earlier, we had a high false positive rate coming in, which would take up our analysts' time. In addition to that, our prior vendors or other vendors would report threats and incidents to our team but not what action to take to resolve them. The huge difference that we have seen is that we are now getting feedback from SentinelOne and the MDR team, and it is coming back completely resolved and completed. We are more on an information basis, and we do not have to spend any time on resolution or investigation.
What other advice do I have?
Anyone considering changing their endpoint detection or SIEM solution should consider SentinelOne. It offers benefits in the product and technology aspect, service aspect, and partnership, allowing us to influence the roadmap and plan our cyber defenses.
Even though we are early on in our adoption, we have had a direct line of contact with the product team. We have been able to provide feature requests. We are not simply a customer of SentinelOne. We view it as a partnership. We can influence the roadmap. Likewise, SentinelOne is providing us a vision of their roadmap, and we can plan accordingly how to steer our cyber defenses.
As it stands today, I would rate SentinelOne Singularity Complete a nine out of ten simply because we are so early in our adoption that we are not taking full advantage of all the aspects of the solution. We will continue to grow and mature alongside the product.
Top-notch support, well-designed console, and is less expensive than others
What is our primary use case?
We use SentinelOne Singularity Complete for all of our endpoints, including virtual machines, physical servers, and laptops.
How has it helped my organization?
The solution gives us a good sense that the systems are secured against malware, drive-by fileless attacks, and advanced behavioral attacks. This is our primary reason for having the product, and it does a good job in that regard.
It does not require a lot of management. It is hard to quantify the time savings but it does not require a lot of our time. If I spend an hour a week on it, that is a lot.
It is hard to quantify the reduction in the mean time to detect unless you are a pretty big organization and you are tracking that. However, it has been able to detect things and alert about them pretty much instantly in the console. We also get emails right after that. In terms of the Vigilance MDR service, one Saturday morning, I tripped an alert for something I was doing. I thought of waiting and seeing how long it would take on a Saturday morning at 10 AM for them to jump in and figure it out. They took about 20 minutes.
Any good endpoint security product should reduce your organizational risks, and SentinelOne Singularity Complete has done that. It is almost impossible to quantify the reduction.
We were able to easily realize its benefits within 30 days.
What is most valuable?
The console is light years better than the CrowdStrike console, which had just a bunch of different screens cobbled together. It is much more unified and much easier to work with. It is very nicely designed. It is one of the better user interfaces I have ever seen for web application management.
The product is pretty easy to manage and pretty easy to deploy. It also has a pretty low resource footprint.
What needs improvement?
The false alerts can be annoying, especially during administrative tasks. We have had a number of occasions where the software impacted a third-party application, so the application would either not run or exhibit other technical issues. We were also not getting any alerts in the console to indicate that SentinelOne was having a negative interaction with the product. Finally, after hours of troubleshooting, we turned off the endpoint security for the product, and the application just started working fine. We have probably had a good half dozen of those. It is quite annoying.
For how long have I used the solution?
I have had experience with SentinelOne Singularity Complete for two years.
How are customer service and support?
Their support is top-notch. I have been in the business for thirty years, and I have dealt with just about every support company out there. I am used to mediocre enterprise support, but SentinelOne's support is very good, deserving a ten out of ten.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
We were running CrowdStrike prior to SentinelOne. We were using CrowdStrike Complete, but it was simply way too expensive to sustain for our budget. We were looking for something that was equally capable and did not have a huge price tag with it, so we ended up going with SentinelOne and their Vigilance MDR service.
SentinelOne Singularity Complete has not helped us consolidate other solutions. It was a one-for-one replacement for CrowdStrike. It has not helped us to get rid of anything at this point.
I have used Bitdefender in the past. We had their GravityZone Ultra, which had XDR Complete, but there were so many alerts. We would literally spend hours. We would pick a day a week or a day every couple of weeks and try to trace down alerts and clear out the console. From that perspective, SentinelOne does give off fewer false positives. However, when we are dealing with administrator or network administrator or developer tools, for obvious reasons, they tend to trip the alerts on the product. For normal end-user work, there are seldom any false positives or alerts that are not valid. It is almost never. I am the IT director, and it is always tripping on things I am doing. When I install some encryption software or disk wipe software, I get many alerts in SentinelOne, but for the actual end-users, typically, we do not get any false positives.
How was the initial setup?
We use their public cloud. We deploy the agents ourselves. We do the updates through their public cloud, but we do the initial deployment ourselves.
The initial setup was pretty straightforward. There are some nuances to the product, naturally. It is an enterprise-class endpoint security product, so there are things that you need to learn and understand about how it works. The same is true of CrowdStrike, Palo Alto Cortex, or any other product in the same category.
We have multiple locations with about 35 remote users.
What about the implementation team?
We used their onboarding service, which was very helpful because we would have meetings every week or two with the actual SentinelOne employee engineer to talk about our deployment and ask questions about particular features and best practices. It was worth the extra expense.
I had one other network administrator working on it with me, and I just assigned him the task of deploying software and working with me on some of the policy configurations.
I do most of the maintenance on it. The maintenance typically requires adding an exclusion here or there, troubleshooting an issue, or uploading logs for support to look at an issue or a question that we have. I do not spend 50 hours a year on it.
What's my experience with pricing, setup cost, and licensing?
SentinelOne is significantly less expensive than CrowdStrike. I recently did a price comparison between CrowdStrike and SentinelOne to determine where we are going for the next three years. CrowdStrike is 200% to 300% the cost.
For their complete service, we were paying CrowdStrike 45K for 85 endpoints for a year. We have stepped down, and we are doing MDR and not having SentinelOne manage our policies and things. We have 200 endpoints, and our yearly cost is 17K, so we have gone from 45K to 17K. From a detection standpoint, depending upon which MITRE framework tests you look at, both vendors jockey up and down in the top ten. They are pretty comparable from a performance and efficacy standpoint, so there is not a 200% to 300% gap there.
Which other solutions did I evaluate?
I always do a round-robin. My final three ended up being Palo Alto Network's Cortex product and CrowdStrike's Falcon product, the lesser version of their MDR Overwatch product.
The thing that I did not like about Overwatch was that they would tell you that something was going on and here is what you should do, but they would not help you with it. SentinelOne was a little bit more helpful in terms of hopping in. Ultimately, Palo Alto is not support-friendly. I use Palo Alto Firewalls, and their support is not that great. It has not been for a while, so I hesitate to go into their endpoint security as well. It is also expensive. It requires a lot more infrastructure and cost to deploy. It is probably more akin to CrowdStrike from a cost perspective.
I briefly considered Bitdefender's MDR solution using GravityZone where they did the MDR piece of it. It was probably half or a third of what we would have spent for SentinelOne, but I did not have the sense that it was quite the next-gen product that I was looking for, even though it scored pretty well.
All these are very similar because they base their activity on what a piece of software is trying to do on the system. It is a real-time behavioral analysis. They do not use predefined signatures from the last 25 years. They are trying to do things in real time. In terms of how long it takes to have visibility into what an application is doing and how quickly they can lock it down once they have the visibility, each vendor scores differently, but each of these three would generally be considered in anybody's top five.
SentinelOne is fairly innovative. I like what they are doing with the integration of their Purple AI for being able to do real-language queries of their telemetry data. You do not need to know all the correct syntax, which helps us non-SecOps folks who have to dabble in it periodically. We can do real-world queries. I have not asked for pricing on that. It is probably more than I want to pay for it, given that we do not get too much use out of this kind of feature, but they are continuing to innovate in that regard. From that perspective, it is a good product.
What other advice do I have?
SentinelOne Singularity Complete is very mature at this point.
We have not yet had an occasion to integrate it, although, in a couple of weeks, we are going to be integrating their Cloud Funnel service with another MDR provider, Red Canary. We have not done that yet, and we have not made use of their other interoperability pieces.
They have two Ranger products. One is the Ranger Identity Protection product, which is kind of an add-on product, and the other one is more of a rogue detection product. We did subscribe to the Ranger Identity Protection product, but it was so difficult to work with that we finally stopped using it. It was a subscription.
Our correlation is whatever is going on in the endpoints. We are not pulling in Palo Alto firewall telemetry, or Okta or O365 data at this point, but we are moving in that direction. We are simply using it for endpoint security and for their Vigilance MDR service.
SentinelOne is good as a strategic partner. We are in the third year of our three-year contract and plan to continue with them. We are not going to go directly to them. We are going to go through one of their partners, Red Canary, but we will be using the SentinelOne Complete product and then using Red Canary to do the MDR along with active remediation and SIEM ingestion of our Okta data, our Palo Alto firewall data, and our O365 data. They can then begin to cross-correlate events and attacks across different attack surfaces of ours.
I would rate SentinelOne Singularity Complete a nine out of ten.
Lightweight and Fast Agent to Deploy
Easy to manage, zero-trust option and supports both Linux and macOS
What is our primary use case?
It's endpoint protection that also takes care of the server.
Mainly, we [my company] have a lot of systems on Linux. So when we were looking for an EDR solution, we evaluated all three top options: SentinelOne, CrowdStrike, and Carbon Black. We found CrowdStrike to be slightly better than SentinelOne in terms of features. But the only reason we chose SentinelOne was that its Linux agent was far superior.
We review our EDR solution every year. So far, it's been SentinelOne. Earlier, it was Trend Micro, I think. So we evaluate and change our protection software almost every year.
How has it helped my organization?
It is quite easy to manage our environment with the Singularity console.
We have policies in place to isolate any suspicious behavior from the network immediately. There's even a zero-trust option that we utilize.
Moreover, visibility into the attack surface and risk is good. It's protecting quite well. We do have incidents regularly, but no major ones at all.
When it comes to threat detection and prevention, it's quite sensitive and quite good.
We do the evaluation every year, so we always see something new that comes in. We evaluate across products and then choose the best one.
What is most valuable?
SentinelOne supports both Linux and macOS. All SentinelOne features were equally supported across Windows, Linux, and Mac, whereas CrowdStrike was more heavy on the Windows side. They did not support all features on Linux.
The Singularity console provides a unified view. But we already had similar dashboards available to the ones we had engineered ourselves. So it's not a deal-breaker. For us, it was about supporting multiple operating systems. That was more important. So, these dashboards we have are third-party tools integrated with SentinelOne.
What needs improvement?
SentinelOne could work on a more centralized dashboard.
Also, it didn't have much incident management built in.
For how long have I used the solution?
We've been using it all across for the last three years.
What do I think about the stability of the solution?
So far, I didn't face any major issue with stability. They communicate in advance about any maintenance downtime or updates. But so far, we haven't faced any outages.
What do I think about the scalability of the solution?
Scalability is quite seamless. We have people who work from home also. There are no issues. It scales across geographies, and we haven't had any problems.
How are customer service and support?
The customer service and support are good. Their responses are quick. We normally interact with them only over emails or their forums.
We never had to talk to them or call anybody. It's always been emails or forums, and it's been efficient.
The forums are really good, actually. As long as you follow their forums, that's more than enough, at least for us. I don't know about others, but for us, we found that asynchronous communication is more than sufficient.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
CrowdStrike was a bit better in terms of features. They had a much more centralized dashboard for tracking, In case of investigating incidents, the evaluating mitigation plans from the community were also good. They were much more mature in those incident management scenarios.
SentinelOne was just detection and isolation; it didn't have much incident management built in. But we have our own incident management function, so that wasn't a deal-breaker.
How was the initial setup?
The initial setup was quite easy and very straightforward.
What about the implementation team?
My team is familiar with most of these products, so for them, it was a breeze. There were no issues.
We normally take an evaluation period of 45 days. That's the trial period they give, during which we test everything and then give them the results.
What's my experience with pricing, setup cost, and licensing?
Overall, the price is very competitive. It's just relatively low compared to other products. The team told me it's something like 12% cheaper than CrowdStrike.
SentinelOne is much more cost-effective compared to other software because they offer a lot of flexibility in terms of licenses, which you can scale every month.
But others might have a more user-friendly, centralized console. If that's a need, then you have to pay a premium for that.
What other advice do I have?
Overall, I would rate the solution a nine out of ten. Considering what happened with CrowdStrike recently, it is all over the news.
The main point is that if you want feature parity across Mac and Linux, they should go with SentinelOne, not CrowdStrike. CrowdStrike may be very good for Windows, but that's also in question right now. We feel SentinelOne is a little better for Windows.
It integrates well with other platforms, is user-friendly, and is stable
What is our primary use case?
As a company with 30,000 employees and 26,000 endpoints worldwide, we have diverse operational needs that SentinelOne Singularity Complete effectively addresses.
SentinelOne Singularity Complete effectively addresses numerous challenges. As a cloud-based SaaS solution, it seamlessly protects office and remote workers, safeguarding laptops and other devices. Its comprehensive coverage extends to cloud infrastructure across multiple operating systems like iOS, Linux, and Windows, including Kubernetes environments. This versatility, coupled with its ability to fulfill various use cases, has made SentinelOne Singularity Complete our trusted security solution for the past four years.
How has it helped my organization?
SentinelOne Singularity Complete integrates with our other security solutions, correlating data from NDR, ADR, SIEM, and XDR tools. All this information is consolidated within SentinelOne, providing a centralized access point.
SentinelOne Singularity Complete has helped us streamline our security operations by consolidating multiple solutions into a single platform. We are currently in the process of acquiring a threat intelligence platform to complete our security stack.
We use Ranger to monitor our network and track connected devices. This is crucial because it helps us quickly identify unauthorized machines connected to our infrastructure, including personal devices. We have additional security measures in place, but Ranger provides an extra layer of protection. It also alerts us if the SentinelOne Singularity Complete agent is missing from any new or existing machines, allowing us to take appropriate action.
SentinelOne Ranger's agentless and hardware-independent nature is crucial for our environment with 26,000 endpoints, as manual management of such a large number would be extremely challenging.
Ranger uses a multi-layered approach to prevent vulnerable devices from being compromised. We employ scanners, network configurations, and a risk scanner to assess devices, endpoints, servers, and cloud infrastructures. Vulnerability reports and timelines for remediation are shared with device owners or custodians. This proactive strategy enables us to address vulnerabilities efficiently and secure our infrastructure.
SentinelOne Singularity Complete has significantly enhanced our security posture. While no system is impenetrable, this solution has brought us closer to achieving a high level of protection, ensuring we maintain at least a 90 percent security level.
Our team is dedicated to refining alerts and eliminating false positives from our solutions. Additionally, a team is responsible for identifying and excluding alerts from the solution. We can manually expedite this process by reviewing these elements and utilizing our security tools. We have been able to reduce the alert volume by 20 percent.
Our 30-member Security Operations Center team has been able to redirect their focus to other tasks due to the time saved after implementing SentinelOne Singularity Complete.
SentinelOne Singularity Complete has helped us improve our mean time to detect threats, which we accomplish using the Vigilance service for detection and response.
SentinelOne Singularity Complete has helped us decrease our organizational risk. We utilize the Security Scorecard to manage our security posture, which has remained steady at 90 percent.
What is most valuable?
Unlike other endpoint solutions like Kaspersky or Trend Micro, SentinelOne's agents are exceptionally lightweight, updating seamlessly without consuming significant network or system resources. This ensures smooth operation and user-friendly control. Moreover, SentinelOne's support team is highly competent, providing timely assistance and going the extra mile to resolve any issues.
What needs improvement?
When SentinelOne Singularity Complete is used as the central hub for viewing alerts from all integrated security solutions, it is challenging to identify the specific solution that triggered each alert.
For how long have I used the solution?
I have been using SentinelOne Singularity Complete for almost four years.
What do I think about the stability of the solution?
SentinelOne Singularity Complete is stable.
How are customer service and support?
The technical support team is quick to respond to and resolve our issues.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
Our hybrid environment has raised security concerns for management, leading them to seek an all-in-one solution. After conducting multiple proof-of-concept tests for endpoint security, they determined that Kaspersky was insufficient for their needs due to inadequate functionality and management complexity. As a result, they transitioned to SentinelOne Singularity Complete.
SentinelOne is actively developing new innovations and introducing additional integration platforms.
What other advice do I have?
I would rate SentinelOne Singularity Complete nine out of ten.
SentinelOne Singularity Complete offers comprehensive endpoint security by automatically updating without impacting bandwidth. Unlike traditional signature-based solutions, it employs a behavior-based approach to detect and immediately address malicious or suspicious files and processes.
We are 100 percent confident with SentinelOne as a strategic security partner.
Maintenance has been seamless, and while SentinelOne does notify us in advance of any required downtime, I haven't experienced any interruptions in the past year and a half.
With 30,000 employees and 26,000 endpoints worldwide, our organization has implemented SentinelOne Singularity Complete across all endpoints.
Reduces organizational risk, low on machine load, and helps prevent ransomware
What is our primary use case?
We primarily use the solution for EDR, which it does in a brilliant way. We are also using it for log management. We can use it for investigations, reporting, and security incident management.
What is most valuable?
The most important aspect of the solution is that the load on the machine is not very high. It doesn't take up battery resources.
The solution prevents ransomware and other threats.
So far, it is working brilliantly. The dashboards and UI are user friendly, as is the ability to configure as needed.
It seems to have a lot more capabilities. The XDR capabilities, in particular, look very strong. We're currently looking into that.
If we want to do integrations with third parties, we don't have very many challenges around that.
The ability to ingest and correlate across our security solutions is very useful. It's impressive. The AI engine it has is excellent.
It helps us consolidate our security solutions.
While it does not allow us to reduce alerts per se, it does a good job of correlating. The way it's integrated into the SIM, it's working to the expectations we have.
The solution helps free up people so that they can work on other tasks. We don't have to grow our team too much now. My security team is actually quite small - about five people. We all get more time to handle other tasks.
We've noted that it does help reduce mean time to respond. We can identify events easier and those that are most critical are brought to the forefront. Previously, we were in the dark. Now we have so much more visibility. It's been a huge improvement.
It's effectively helped to reduce organizational risk.
What needs improvement?
They are still largely an EDR product. The MDR side needs to be demonstrated. They need to make zero trust more robust.
For how long have I used the solution?
I've used the solution for around two years now.
What do I think about the scalability of the solution?
I'd rate the solution's ability to scale eight to nine out of ten.
How are customer service and support?
The SLA is good and the support team is quite impressive. They are very quick. I never need to escalate.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
We were using Sophos and Symantec previously. We switched as SentinelOne took up fewer resources and could support a Linux environment.
How was the initial setup?
The initial setup is fairly straightforward.
What was our ROI?
It's giving me confidence that my network is protected. The ROI is not so much cost savings as security on offer. We can safely sustain our business and secure our data assets. However, the time and cost savings we've seen are quite good.
What's my experience with pricing, setup cost, and licensing?
The solution is moderately priced. It's a valuable solution to have, however.
Which other solutions did I evaluate?
We are evaluating Crowd Strike at the moment.
What other advice do I have?
We are a SentinelOne customer.
The quality and maturity of the product are good. It's one of the market leaders. It's delivered on what it's supposed to do.
I'd rate the solution nine out of ten.
They are a good strategic security partner. They have the right credentials. They're offering a relevant service and it helps me communicate to my customers. I rate them very highly.
Effectively ingests and correlates data from all our security solutions
What is our primary use case?
We use SentinelOne Singularity Complete for network protection and response.
How has it helped my organization?
SentinelOne Singularity Complete effectively ingests and correlates data from all our security solutions, providing a unified view for better threat detection and response.
SentinelOne Singularity Complete aggressively identifies and quarantines potential threats. It effectively catches threats that other EDRs might miss. Overall, we find this level of aggressiveness acceptable for an endpoint protection solution and are satisfied with SentinelOne Singularity Complete's performance. We saw the benefits immediately.
SentinelOne Singularity Complete significantly reduces alerts by filtering out many false negatives. This allows us to identify actual threats as soon as they are categorized, separating true positives from the filtered noise. This helps us focus on the real threats, eliminating the need to sort through irrelevant alerts. The number of alerts has been reduced by 75 percent. It also helped to free up a significant amount of our time to work on other tasks.
SentinelOne Singularity Complete has significantly improved our ability to detect threats, even those previously unknown. This advanced EDR solution provides alerts for any suspicious activity, regardless of classification, allowing us to proactively assess and mitigate potential risks.
While SentinelOne Singularity Complete shows promise in reducing our organization's costs, the solution is still new to us and we haven't quantified the exact savings yet.
It improved our organization's security posture by enabling us to proactively identify and neutralize emerging cyber threats, thereby reducing overall risk in the ever-present threat landscape.
What is most valuable?
SentinelOne Singularity Complete stands out for its threat-hunting abilities and the agility of its agents in detecting malicious content across our gateways and endpoints. We're impressed by the breadth of threats covered by their constantly updated signature base, providing full protection against new cyber threats. While we're still exploring the platform's full potential, Singularity Complete's extensive capabilities, and superior coverage compared to our previous solution have already given us a significant security advantage.
What needs improvement?
SentinelOne Singularity Complete offers competitive pricing, but there's always potential for even better value.
For how long have I used the solution?
I have been using SentinelOne Singularity Complete for one year.
How are customer service and support?
SentinelOne's technical support was good at assisting with onboarding through troubleshooting actions and resolving configuration problems.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
After using Symantec and Fortinet's EDR solutions, we migrated to SentinelOne Singularity Complete seeking a more comprehensive defense. SentinelOne's aggressive threat detection capabilities were a major factor in our decision.
How was the initial setup?
The initial setup was seamless thanks to the SentinelOne support team. We had three people involved with the deployment from our local team and the support engineers online.
What about the implementation team?
The SentinelOne support team helped us with the implementation in-house and it was seamless.
What's my experience with pricing, setup cost, and licensing?
The pricing for SentinelOne Singularity Complete is competitive.
Which other solutions did I evaluate?
We evaluated several endpoint detection and response solutions, including Symantec, SentinelOne, CrowdStrike, and Bitdefender. While Symantec offered a phased migration option from on-premises to cloud and maintained endpoint interoperability, its EDR and threat-hunting capabilities fell short compared to SentinelOne. SentinelOne's robustness ultimately outweighed the advantages of the other options, including CrowdStrike's strong detection capabilities but higher price point, and Bitdefender's overall offering.
What other advice do I have?
I would rate SentinelOne Singularity Complete nine out of ten.
We're in the process of consolidating our security solutions by migrating some services to the SentinelOne platform. While SentinelOne is a strong contender, we're also evaluating other tools to diversify our security posture and avoid vendor lock-in. This multi-platform approach will ensure we have the full protection needed.
As of now, no maintenance has been required for SentinelOne Singularity Complete.
SentinelOne is a strategic partner for our security operations. Their solution helps us maintain the safety of our internal systems, applications, and users. As security is a top priority, we consider them a top-tier partner in our overall operations.
I recommend SentinelOne Singularity Complete for anyone needing a robust Endpoint Detection and Response solution. However, to ensure it meets your specific needs, thoroughly evaluate its capabilities against your current operational requirements. If it aligns with your needs, consider a trial to experience SentinelOne's operation firsthand before committing to a contract.
Considering our sensitive data and security needs, we require a top-tier endpoint protection solution. SentinelOne Singularity Complete stands out as a market leader, achieving high ratings and verification from industry experts like Gartner.