When we receive a ticket about a SentinelOne detection on a specific host, we will first go to the SentinelOne console and look up the endpoint and the case. If there are any threats related to the host, we will then review the activities that have taken place within a specific time frame. We can look at the processes that have run, and how they have propagated from one process to another. We can also look at the timeline of events, from the top down, to see what happened when each process was run. This will help us to determine if any malicious activity has taken place.

We use the cloud-based management console to install SentinelOne on each employee's or host's device. SentinelOne can be installed through the cloud.

Singularity Cloud Workload Security provides us with better security detection and more visibility. It is another resource that we can use to detect vulnerabilities in our company's systems. For example, it can help us detect new file processes that we are not familiar with, which could be used by attackers to exploit our systems. Singularity Cloud Workload Security can also help us diagnose and analyze data to determine whether it is malicious or not. Singularity Cloud Workload Security is like another pair of eyes that can help us protect our systems from cyberattacks.

The real-time detection and response capabilities of Singularity Cloud Workload Security are very helpful. When we receive alerts in real-time, we can take action immediately. Within Vigilance, they look at things for us in real-time and let us know if they detect something malicious. This allows us to investigate the incident and see what is happening. If it is a zero-day attack, we can take action immediately to try to mitigate the damage. Having real-time alerts helps us take action more quickly than waiting for a few days for something to happen.

The automated remediation feature works from a database. We upload anything that we have detected before or anything that we can filter into this database. For example, we would upload the known IP addresses of analysts who do penetration testing for us within the company. If one of these IP addresses comes in and is malicious to the company, the solution will detect it. Singularity Cloud Workload Security will check the IP address and automatically classify it as benign. This saves us time because we don't have to manually review the IP address or contact our colleagues. This frees up our time so that we can focus on other things, such as investigating more malicious threats. IP addresses are just one type of data that can be filtered. File processes can also be filtered. Any type of automated filtering helps us reduce the time it takes to investigate a ticket so that we can focus on the most malicious threats.

The historical data record provided by SentinelOne after an attack is helpful in identifying what we can do to protect ourselves from future attacks. We can use this data to understand the cause of the attack and put in place preventive measures, such as educating employees about security best practices. SentinelOne allows us to access up to three or four months of historical data without a request. For data that goes back six months to one year, we need to submit a request. This data can be specific to a particular host, if necessary.

Singularity Cloud Workload Security is a great product. It is very robust and versatile. There are many things we can do with it, even things I have explored in the past two years. We can use different types of queries to narrow down our searches. It is a very powerful tool that has been very helpful to our SOC in analyzing specific incidents.

The solution has decreased our mean time to detect through the automated response process and visuals that give us time to focus on other important things. It definitely gives us the actual time to look at other things instead of focusing on one ticket that may take us 30 minutes to an hour to resolve. This could definitely decrease the coverage time.

The solution has decreased our mean time to remediate. We have many detection systems in our organization, and it takes a lot of manpower to focus on all of them. Integrating SentinelOne into our organization has given us more time to focus on other things, rather than having to look at minor incidents, such as low-severity incidents. SentinelOne detects and remediates these incidents for us, so we don't have to worry about them. This has been a great help, and we no longer need to dedicate as much manpower to these incidents.

The solution helps to free up our SOC staff time to work on other projects and tasks. Thousands of false positive tickets no longer have to be looked at by our SOC team, saving them a lot of time.

The solution has helped our organization become more productive by allowing us to focus on more severe issues instead of wasting time on minor ones.

The management console is the most valuable feature. It offers a variety of options for us to view. If a threat is detected, there is a specific area where we can view the different incidents that have occurred. This is the threat that is associated with that host.

We can also have deep visibility into the activities within the host within a specific time frame. This is very useful, especially when we can view the process tree. This allows us to see how one process propagates to another process, and so on. We can then look back to the beginning of the process to see where it came from. How was it downloaded? Which URL did it come from? Was it internal or external? This information has been very helpful when we are diagnosing a specific incident.

The File Fence feature is also useful. When we view a file within Singularity Cloud Workload Security, we can put it into our sandbox to see what type of file it is and whether it is malicious or not. There is also the scan feature, which is very helpful. When we scan a host remotely, it can return to us with information about the detections that were made on that host. This can help us to identify and alert others about any potential threats.

Whenever I view the processes and the process aspect, it takes a long time to load. I think this is because the dashboard or management console is slow, especially during downtime or when updates are being applied. Even when I search for a specific query, it takes a while to load. I believe that increasing the bandwidth for query processing would help.

I have been using SentinelOne Singularity Cloud for three years.

I think the stability is decent. However, if they fixed the bandwidth issue, it would be a top contender. Sometimes, when I need to look at the process timeline, it is very difficult to load and takes a long time. We don't always have the time to wait for it to load. I think the stability is okay, but it could be improved.

We used Carbon Black. Carbon Black's stability is pretty good. Its downtime is not as high as SentinelOne's. Carbon Black is a little bit easier to use than SentinelOne. Its user interface is a little bit easier than SentinelOne's. In terms of stability, I think SentinelOne is just a little bit behind Carbon Black. Not by much, but just a little bit.

The scalability is fine.

The technical support is very responsive, and courteous, and provides great customer service. If we need something right away, they will definitely put us on the priority list. We have a special chat channel or a specific team dedicated to our company. We can also email them, and they will usually respond quickly.

I previously used Carbon Black and Tanium for a short time. When I first started at my current organization, they were using both Carbon Black and SentinelOne. However, SentinelOne provides the same level of security as Carbon Black at a lower cost, so the organization stopped using Carbon Black.

If I were to compare SentinelOne to Carbon Black, I would say that they have the same functionality, but Carbon Black has a faster response time. If SentinelOne could improve its bandwidth in this area, it would be a more competitive product.

I would rate Singularity Cloud Workload Security a seven out of ten. I noticed some lagging, especially when loading a specific storyline. I also experienced some lag when I had too many windows open.

Based on the company's size and infrastructure, SentinelOne offers different tiers of service for small, medium, and large businesses. For a really small company that doesn't generate a lot of logs, a robust system like SentinelOne may not be necessary. However, for a medium-sized company, SentinelOne can be a valuable asset. It has helped us to reduce our response time, gain more visibility into our security posture, and receive alerts if any devices are lost or stolen. SentinelOne is also more versatile than other solutions in terms of the resources it uses to detect malicious activity. I would recommend that any company considering SentinelOne do their research and talk to other users to see if it is the right fit for their needs.

Singularity Cloud Workload Security is a cloud-based solution that does not require much maintenance. The only maintenance required is to keep the filtering list up to date. This can be done with the help of the SentinelOne team.

The interoperability of the solution is fine. I don't have any issue with it.

In my line of work, we innovate by detecting and analyzing specific incidents. Singularity Cloud Workload Security definitely helps us out a lot in terms of detection, creating new queries, and creating new filters.

I suggest they research the solution and test it out. I believe SentinelOne offers a trial version, so they can try it before they buy it. See how they like it. We love it and don't think we can live without it. It gives us so much free time to focus on other things. It's like a home security system. If we miss something, they contact us. If the doors unlock, they let us know. If the battery is dying, they let us know. It has helped us out a lot. It gave us the visibility we didn't have before and continues to give us the visibility we need. I don't know what we would do without it.

We have deployed SentinelOne Singularity Cloud Workload Security to our servers and clients.

Singularity's real-time detection and response capabilities so far have been great.

I like the way we have options in how we set up the automated remediation. We can set it up to automatically take action, or we can set it up to just flag or let us know that there is something that needs to be investigated. It has been really good in that regard. There are many, many options in how we can configure it, and I have liked that quite a lot.

Compared to my previous solution, I am more comfortable with SentinelOne Singularity Cloud Workload Security. I was always concerned that the previous solution was not catching everything. There were a lot of false positives, and there were several cases where it did not catch everything. Even when it did catch something, the logging and forensic details were very limited. SentinelOne Singularity Cloud Workload Security is the opposite of that. It gives us deep visibility into what is going on and what has happened. The mediation is great, and the logging is much more detailed. It has been a huge improvement over what I was using before. Singularity Cloud Workload Security has given me peace of mind.

To date, all threats detected were false positives or test threats. No actual threats have been encountered, but test threats were detected quickly.

One thing I particularly like about Singularity Cloud Workload Security is that it supports older legacy operating systems that we have been unable to eliminate. This is a valuable feature that other clients do not offer.

The visibility is the best part of the solution. To see exactly what's going on in all the clients, and processes that are running, I have got a few false positives, but those are relatively easy to investigate and remedy, and flag them as false positives.

We use Singularity Cloud Workload Security with Citrix and a non-persistent VDI. It took us a while to configure the software to work well in this type of environment, as the support documents were not always clear. We eventually got it sorted out with the help of support, and I give credit to SentinelOne for that.

I have been using SentinelOne Singularity Cloud Workload Security for ten months.

I have not experienced any stability issues, client issues, or rogue agents causing problems. I have also not had any crashes. Overall, it has been great.

We have a relatively small environment, with fewer than a hundred endpoints deployed. So, scalability is easy for us. I don't know how it would work with thousands or even tens of thousands of clients, but I haven't had any issues so far.

The technical support is helpful.

Our previous solution, Trend Micro Worry-Free, in comparison, is quite poor. It did not give me very good visibility into what was happening with my clients, on the network, or what processes were running. If something happened, I was very limited in my ability to figure out what happened. In other words, the forensic capabilities of my previous solution were lacking.

There is no way to compare the turnaround time of obtaining telemetry data between the two solutions because Trend Micro Worry-Free did not provide any telemetry data. We would receive an email about a possible virus, but when we logged into the system to view the logs, there would be nothing there. Or, it would tell us that there was a virus, but it would not tell us which client was infected until we logged into the console. It was lacking in so many areas.

During the deployment, we conducted a test case. One of SentinelOne's sales engineers assisted us in setting up the software, configuring everything, and setting up notifications. They walked us through the process of setting everything up to my liking and how they would recommend setting up the software. They were instrumental in helping us deploy the system, and all of their assistance was included in the price of the system. We did not have to pay any additional fees. I found their assistance to be very helpful.

Without SentinelOne's help, the initial setup would likely be very complex. There are many options for configuring the product, which can be both beneficial and detrimental. On the one hand, it is beneficial if we are familiar with the software and know how to best configure it. This flexibility is a great advantage. On the other hand, if we are coming from a different product and do not know SentinelOne's software, it would be very helpful to have their assistance in walking us through the setup process and recommending a configuration.

I was the only person from our organization involved in the deployment.

I wasn't sure what to expect from the pricing, but I was pleasantly surprised to find that it was a little less than I thought.

I also evaluated Carbon Black. I read a lot of reviews, both official and user-generated, to learn what people were saying about the product. What really drew me to SentinelOne was its legacy software support. This was a key factor for me, and it helped me eliminate some of the other options.

I would rate Singularity Cloud Workload Security eight out of ten.

The software itself is very good. Singularity Cloud Workload Security provides deep visibility and support. I have found the support team to be very responsive and helpful whenever I have engaged with them.

One of our requirements was that the solution was simple enough for me to maintain myself without spending a lot of time managing the software. There are software agent packages that become available, and I need to go in and approve them and push them out. There are occasional false positives, but overall, it's not a lot of work.

For straightforward clients on a PC or laptop, Singularity Cloud Workload Security works well. However, in edge-case scenarios like ours with Citrix and non-persistent VDI, we need to test it out to see if it works well enough in our environment. We had some initial problems getting it started, but we were able to resolve them. So, my advice is that if the scenario is straightforward, there should be no problems.

Singularity Cloud Workload Security gave us the visibility we needed and freed up time to do other tasks. It narrows down the false positives that we got with the previous solution.

We use Singularity Cloud Workload Security to detect threats and protect our assets. We look at the threats that come in and whether they're being blocked. We use Singularity Cloud Workload Security as an anti-malware threat management product.

Our previous product took a lot of man hours to manage. Once we got Singularity Cloud Workload Security, it freed up our time to work on other tasks.

We had a couple of issues with the solution's deployment. We had to deploy the agent, and sometimes there were issues. It feels like we're battling a version of the software when we have to deploy an agent over another agent. It would be really helpful if the solution improves its agent deployment process.

I have been using Singularity Cloud Workload Security for over a year.

I haven't heard from our team about any stability issues with Singularity Cloud Workload Security. Singularity Cloud Workload Security is more stable than our previous solution.

Singularity Cloud Workload Security handles anything we throw at it. The scalability is good.

When we have an issue, an online engineer from their group helps us resolve it within an hour or two. I haven't heard anything negative about the solution's support from our team.

I was involved in the selection and the proof of concept process. I wasn't on the call for the installation, but I overheard our two engineers involved in the solution's installation. The solution's deployment was pretty quick, and they installed it in one day.

We implemented the solution with an in-house team.

Singularity Cloud Workload Security's licensing and price were cheaper than the other solutions we looked at. One product was a little bit cheaper, but its functionality and the overall product weren't as good as Singularity Cloud Workload Security. One of the vendors' prices was almost double what we would get thus far. Talking to their engineer and salesperson put our minds at ease when we got it. We knew they would be there for support, and they have been really good.

I'd ask users to take a good look at Singularity Cloud Workload Security because it brings a lot of value to the table. For its price, the solution does a good job compared to some other solutions.

Singularity Cloud Workload Security’s automated remediation works great.

The solution’s real-time detection and response capabilities work great for us. It frees up time, unlike our previous solution, where we had a lot of false positives.

It's granular, and you can take a deeper dive into something if you need to. You can analyze and get a verdict. It's easier to narrow it down and pinpoint it with more detail.

The solution helped reduce our organization’s mean time to detect. Singularity Cloud Workload Security is quicker than our previous solution. We are a small group of just five people, and we have to do instantaneous detection to stop things from coming in quickly. We like that part a lot.

The solution helped reduce our organization’s mean time to remediate. It lets us analyze an incident, report the status quicker, and escalate it quicker than our previous solution.

Singularity Cloud Workload Security helped free up SOC staff to work on other projects. It probably freed up 10 to 15 hours a week. Before, we spent a couple of hours a day sifting through events and trying to see if they were false positives. The solution freed up a lot of time.

We have seen an impact on our organization's productivity using Singularity Cloud Workload Security. With the freed-up time, we're able to do a lot of other work. We use other products and look at phishing emails. It frees up our time to study more than we did in the past.

I would have users look at their visibility across their environment. The solution's quick response to threats, ability to act on them, automated incident response, and forensic investigation capabilities are really good. The solution provides you with 24/7 threat monitoring detection.

We work eight hours a day when we have someone on call. It's nice to know someone else is also looking at our events. They're there to dive in with us when we need them to help increase our team. Even though they're not on our team, they're there to help us.

Overall, I rate Singularity Cloud Workload Security a nine out of ten.

We use Singularity Cloud Workload Security primarily as an EDR for protecting our endpoints. We also use it for incident response. We can track down issues or weirdness in our network via Singularity Cloud Workload Security and other tools we have.

We use it as an additional set of storage for our Splunk SIEM. It collects some of the less important events, and we keep them in Singularity Cloud Workload Security. We save money on storage space and the number of events that we have to search through.

The most valuable feature of the solution is its storyline, which helps trace an event back to its source, like an email or someone clicking on a link. This feature has helped our incident response team and SOC team to track stuff down and ensure that it hasn't spread further into the network than we're aware of. It also helps us see where it started and take appropriate steps.

While it is good, I think the solution's console could be improved. I'm the SME for Singularity Cloud Workload Security, and the amount of time I have to spend resetting passwords or accounts seems particularly high. We don't use SSO for the time being. It's fairly common for me to go in weekly and reset a password or reissue credentials to get people to log in. This process is very antiquated and could definitely be improved upon.

We have been using Singularity Cloud Workload Security for about two years now.

I have not experienced any issues with the solution's stability. Occasionally, we'll have an issue with an install where it may not install correctly, and we have to pull it out and reinstall it. Other than that, we have not had any serious issues with the solution's stability. Singularity Cloud Workload Security is significantly more stable than our previous solution.

We have not had any issues with the solution's scalability. As we grow and shrink and our offices open and close, we've never had an issue scaling the product according to our needs.

Singularity Cloud Workload Security's technical support team gets to your issue relatively quickly. I've never had an issue where I've had to call in to follow up on a ticket. Other than a complex issue that needed resolving, I've never had any serious issues with them.

Before Singularity Cloud Workload Security, we used a product called Endpoint Security. With Endpoint, it was almost as if the company that had created the solution had forgotten about it. Its updates were coming slowly, and it wasn't making any effort to improve itself. That was a big push. We saw that SentinelOne was a very new and good product that took many innovative steps. Hence, we decided to use Singularity Cloud Workload Security.

I feel Singularity Cloud Workload Security's initial setup was fairly straightforward. Deploying the product was not terribly difficult. It was more about scheduling and timing on the various teams' parts. Once we had that under control, the deployment of the product itself was very simple.

We deployed the solution by ourselves. We did have SentinelOne support available. A team was available for us, but we did roll it out on our own. Around five people were involved in the solution's deployment.

The solution has provided improvement in productivity and the time spent on issues. With the implementation of Singularity Cloud Workload Security, our teams have been able to more efficiently use their time to fight other fires, as it were.

Singularity Cloud Workload Security's pricing is good. It's pretty similar to a lot of newer products' pricing. A lot of legacy products don't really use it. This newer pricing model seems to be a better fit for our company, and I like that.

Before choosing Singularity Cloud Workload Security, we evaluated CrowdStrike and Symantec. I feel like CrowdStrike is probably an equal to Singularity Cloud Workload Security. However, we decided not to go for CrowdStrike because it was more expensive.

Singularity Cloud Workload Security is a SaaS product, so no equipment or installations are needed other than agents on the endpoints. The ability to be available if we were to have some type of DR incident was a huge plus. That way, we could still keep the tool working if there was some issue with one location or multiple locations. As always, cost was definitely an issue here as well. The features and the efficiency that was offered were also a big draw.

Other than the manual upgrades we do, Singularity Cloud Workload Security doesn't require any maintenance.

I would ask users to put the solution through the spaces, do what they normally do in response to an incident, and see how Singularity Cloud Workload Security acts. If you have a certain set of steps that you take for an incident, follow those in Singularity Cloud Workload Security. Whatever you do with your current product, do it in Singularity Cloud Workload Security, and make sure that every step you've taken in the old one works in the new one.

Singularity Cloud Workload Security's real-time detection and response capabilities seem to be pretty good. They're very on point. We don't have to deal with anything like signatures. It updates itself automatically. It works very quickly and efficiently so that we can track down issues and events without wasting a lot of time.

We don't use the solution's automated remediation too much because taking something out of the hands of the engineers doesn't make everyone very comfortable. So, we use it sparingly, but what it does, it does well.

Cloud Workload Security's forensic visibility is fantastic. We have a smaller Linux footprint than a Windows footprint, but the footprint we do have is very exposed to the internet and other nasty places that are out there.

Being able to look into those and make sure that things aren't open or open things are being remediated quickly is very important to us. We like the solution's forensic visibility feature quite a bit.

The historical data record provided by Singularity Cloud Workload Security after an attack is fantastic. We want to fix the problem initially, but when we do the rehash of the event, we'd like to go back and see where it all started. We'd like to see what happened in the meantime and ensure that everything that was infected, attacked, or damaged is listed and taken care of so that no things out there can reinfect us or cause more problems. So, we really enjoy that feature.

The solution has helped reduce our organization's mean time to detect. It's much quicker than our old solution. It's reduced the response time from 24 hours down to 12 hours for the most part. That's nearly a 50% increase in the response time.

The solution has helped reduce our organization's mean time to remediate. It's good, and it works really well. We haven't had to use it too frequently, but the times we've tested it or the times we have had to enable it have been very quick and successful without too many issues behind it.

I would say Singularity Cloud Workload Security has helped free up SOC staff to work on other projects. I don't think we have any true measurements of it. However, I feel like they have more freedom to explore or work on projects as a whole versus having to chase down incidents like they did in the past.

Singularity Cloud Workload Security has improved our organization’s productivity by at least 50%.

If someone is comfortable with another solution, they can stay with it. However, the threat landscape changes so frequently and so fast that not having an up-to-date feature-packed product could be a detriment. Singularity Cloud Workload Security is a good product that provides such an environment for big and small customers.

We don't have a large Kubernetes environment. From what I have seen via Windows and Linux, we have not had any serious issues with Singularity Cloud Workload Security's interoperability with any of those solutions.

We haven't really used autoscaling as we don't want to scale it mostly for over-licensing our products. It has never been an issue. We just don't want it to grab onto something that it doesn't need to grab onto or implement itself in an environment that doesn't need it. We don't really use that, but we have tested it on a smaller scale, and it has scaled easily without too much issue.

I think the solution can help us when we need a significant innovation, a new product, or a new system being implemented. For the most part, it hasn't hindered anything currently in the works, so I see it as a plus to innovate in the future as needed.

Overall, I rate Singularity Cloud Workload Security a nine out of ten.

We were looking for an XDR solution that we could deploy to all of our computers since all of our users are mostly remote, and we previously had firewalls at branch locations. When workers went somewhere else, it wouldn't provide any protection. We wanted to make sure that they had protection no matter where they went.

We were trying to cover as many security bases as possible, mostly around malware. A lot of people focus on antivirus, and most of the problems that businesses face are ransomware or malware. I wanted to make sure we had something that was competitive against that.

It's improved the organization in the sense that it's taken a lot off of our plate as far as having to track down trace vulnerabilities and remediate different threats against our end users, especially when they're in different locations all the time. The product gives us peace of mind no matter where our users are. They're always going to be protected if they have the endpoint installed on their computers.

The automation is great. Not having to focus on it is helpful. The portal itself is very easy to use. The amount of granularity that can be configured is really wonderful. There are a lot of things that it can do, however, since we're a small IT team, having it able to automate and remediate different flaws and things like that is very, very helpful.

The real-time detection and response capabilities are excellent. That's pretty much what sold us on it. We had that done in the demo, and we were shown how ransomware can be immediately stopped in real-time. That was huge.

Its automated remediation is useful for us. As a small IT team, that's something that we needed. We don't have time to be able to go in and track down and investigate every time there's a vulnerability. Being able to have it auto-remediate for us and being able to see what's going on is extremely helpful.

The historical data record provided by the product is good. We've seen a few vulnerabilities come through, and it has shown us everything we need to see. I have a somewhat limited experience with the small amount of vulnerabilities we've seen. That said, it seemed to show us everything that we needed to see. It was very good.

It has helped to reduce our organization's mean time to detect by four or five hours. It could be even more, depending on what the vulnerability is. It's at least several hours at this point. The same is true with our organization's mean time to remediate.

It's helped free up staff time so that they can work on other projects. We're a very small IT team and most of us do everything and it's helped reduce our workload. On average it has likely saved two to three hours a day.

It's also positively affected productivity. Most security solutions can sometimes hold up files from being downloaded and things like that. So far, it's been great. It's been completely transparent to our end users as far as I know. And that those things that it has remediated have been done on the back end and it alerted us admins so as to not affect end users.

The interoperability with third-party solutions has been fine so far.

Some of the navigation and some aspects of the portal may be a little bit confusing. That could honestly be just due to the fact that we're not used to it yet.

We just have the cloud-based version. The complete version has some extra deep-dive stuff. There are some features that we don't have or that I would like to have in there, however, we just aren't able to afford that at this point.

I've used the solution for probably two months at this point. We are fairly new to it.

The solution has been nothing but stable.

The product is deployed across our company and we have 450 users coast to coast. Most of our remote workers are based out of Houston.

It is scalable. As soon as we need to add somebody, we just add them to NinjaOne, and then we have a script set up where it automatically deploys and adds them to whichever group we need.

We're in a high-turnover industry. It's easy to add or remove people, especially with NinjaOne.

I have yet to use technical support.

We didn't use an XDR solution. We used SonicWall firewalls and we had a Check Point antivirus for a short time, however, Check Point was very intrusive, and it was difficult to work with.

With this product, everything is centralized. We don't have to go to more than one place to detect or figure out what's going on.

I was involved in the deployment. It was straightforward. We actually used another platform called NinjaOne. The process was very smooth.

We beta-tested the solution with about ten to 15 of our users and made sure it wasn't going to interfere with anything before we pushed it out completely. After testing for a week we pushed it out to the rest of the company.

We had three staff members who managed the deployment.

It does not require any maintenance.

We did not use any third parties. We simply used NinjaOne to help with the deployment.

We have witnessed an ROI. So far, we've saved tons of time having to remediate and detect - things of that nature.

The pricing was competitive. The price was very, very important to us, and it came down to the price when we were doing our evaluations WatchGuard and SentinelOne. They were similarly priced. SentinelOne seems like it's more mature. It was close enough to where it was worth it to go with the SentinelOne.

We also evaluated WatchGuard and a few other options. With this product and WatchGuard, there were not a lot of differences. That said, we did not use both in our production environment. This product seemed to be easier to navigate and was a little more user-friendly as far as finding remediation options, and vulnerabilities. We also had an easy experience with the licensing. WatchGuard's licensing seemed unnecessarily complicated.

We haven't had to look into the forensic side yet. I did again see that in the demo, yet we haven't in the real world had to do that. Hopefully, we won't have to for a very long time. Therefore, I don't have much experience with that yet.

I'd ask someone who doesn't think that they need a workload protection platform if they have a continuous security monitoring solution in place if whatever they have detects and remediates in real-time. I'd be surprised if there was something else out there that can do what this solution does for cheaper.

It supports our ability to innovate. We don't have to worry about security aspects. We really get a chance to focus on other things. That's nice for a small department like ours.

I'd rate the solution nine out of ten. It's been a great fit for our company. There are other solutions out there. This solution, however, is hard to beat.

We use the solution basically for AD protection. We get to see at a deeper level the different processes that are being run on computers.

We've been able to stop any potential malicious actions that are being taken on various computers.

Their detection of potentially malicious stuff is probably the most beneficial feature and their new Singularity XDR is an awesome platform.

The solution's real-time detection and response capabilities are very good. Pretty much anytime that there is something that we might see as potentially malicious is caught. Depending on the type of computer it is, it does a great job of blocking those actions that are being taken.

It's really easy to configure enterprise-wide, which actions we want to stop. It's very easy to stop malicious stuff.

The solution's automated remediation is really good. We're doing the rollback also now. That way, if something does happen, it's able to roll back to the state before the process happens.

The solution's forensic visibility into our Linux kernel in regards to deep visibility is really good. It is very granular. It's able to show everything that it did.

The historical data record provided by the solution after an attack is great. You're able to search by different computers. You can get a whole scope of computers - as much as you want. You're able to get as granular as you want as well and can identify different cross processes than indicators and different files that were launched during a period of time.

It helped reduce our organization's mean time to detect very significantly. We had Endgame before this. It did not stop the processes in a manner of time that you would like it to. This definitely improved our response time to anything that we saw. It's very fast. It's improved the response time by 50% to 75% from just detection time to our response.

The solution reduced the organization's mean time to remediate. It is as fast as the potentially malicious process that's launched. It'll stop it right then and there. It'll remediate the action immediately.

It helped free other staff to work on other projects or other tasks. We basically just had to do a bunch of upfront configuring. With it, we do not have to spend as much time in the console.

The solution's impact on your organization's productivity has been impressive. We just had to put a bunch of time upfront. However, ever since then, we haven't had to really do much there besides analyzing threats.

There's the singularity marketplace, which they've expanded a bunch. However, there are some other APIs that I'd like to see. We'd like to be able to connect to them from a SIM perspective.

The Automation tab is an add-on that doesn’t work properly. They provide a list of scripts that don’t work and I have asked support to assist but they won’t help. When running on various endpoints the script doesn’t work and if it does, it’s only a couple. There are a lot of useful scripts that would be beneficial to run forensics, event logs, and process lists running on the endpoint.

I've used the solution for about a year and a half.

The stability is very good. I'd rate stability ten out of ten. I've never had issues. It's never been down.

We have four different properties on which agents are one and 1,700 workstations as well as 250 servers.

The product is scalable. We have about 2,000 endpoints. If we had 4,000 or 10,000 it really wouldn't be an issue. It's just a matter of configuring your groups. It's good at autoscaling based on workload demands.

Technical support is really good. Whenever a threat comes into our environment, they will comment and give analysis. That's been very helpful in covering items we're not totally sure of.

I previously used a different solution called Endgame. We did a POC with Crowdstrike and SentinelOne and SentinelOne was a much cleaner, easier-to-use console.

The initial setup did take some understanding on our part of how we wanted to split and group. We needed to figure out how to split our servers and workstations. That was the hardest part. After that, we had to get our policies in order.

We were able to get everything up within a week to where we were comfortable with how everything was running. We're still tweaking little things.

We had three people on our team and two people from professional services.

Maintenance is minimal, such as adding exclusions to threats or alerts.

We did initiate the setup with professional services.

We have noted a good ROI and haven't had a single incident since implementing the solution.

The solution is fairly priced for what they're offering especially compared to other platforms. It gives you great visibility into the different processes that are running on different computers. It's fairly priced, especially for a cloud platform.

We are customers and end-users.

If someone doesn't think they need a singularity cloud workflow protection platform because they have a continuous security monitoring solution, I'd say it depends on whether you're able to block potentially malicious stuff or not. This solution gives you just about the fastest understanding from a machine-learning perspective.

This is much better than our previous solution. They've innovated a lot in terms of their deep visibility and singularity XDR (which is more granular).

I'd advise potential users to do a POC no matter what. That said, this is a great product. I rave about it to everybody. It's likely my favorite product for our environment.

I'd rate the solution ten out of ten.

We use the product across all of our entities for EDR, threat detection, and response methods.

We wanted a solution for protection. We had a number of entities with various EDR solutions. We wanted to centralize under one EDR solution, and we wanted one that was efficient and easy to manage with a small team.

The biggest thing for us was getting to a single platform. A single pane of glass has been nice. The ability to segment various sites out. The R-Back involved is super helpful for us as we are a multi-company organization. In general, the time has been greatly reduced for incidents.

The ease of use of the platform is very nice. The console provides excellent visibility into events that occur and, in general, the wide range of tools that are built into the agent itself.

My impression of the product's real-time detection and response capabilities is good. It definitely is a little bit different. It takes a little bit more time to learn than some of the other solutions that we have worked with in the past. Once you do understand it and once you're capable of running through the GUI and you understand what the logs and various windows they're trying to tell you, it's fairly straightforward.

The solution's automated remediation is good. I like that you can segment it into four options. You can choose to kill it at any time in the kill chain, so you can choose to quarantine it, you can choose to remediate, you can choose to roll back, you can choose to let it run. Being able to choose how far along you want those events to get is pretty nice.

The historical data record provided by the solution after an attack is decent. It gives you a flowchart of the attack. All along the processes you get good visibility and see all that were detected. Definitely, from a post-incident analysis perspective, it's very strong.

The solution has helped reduce our organization's mean time to detect by 20% to 30%. Given that extra 20% to 30%, it frees us up to focus on other items.

The solution's impact on our organization's productivity is good. It provides robust whitelisting capabilities and improves our productivity.

Agent releases need to be more stable before being pushed out.

Bugs need to be disclosed quickly.

The reporting, and the logging visibility, are not there. It's very, very crude and simple. It needs to be drastically expanded.

They need to expand their third-party integrations with SIM tools, and sites need to be given the option to expire at the end of the contract as well.

They could expand their integration with Kubernetes. They are trying to build out their third-party integrations. It does work well on Windows and Mac.

I've used the product for three and a half years.

Agent stability and communication with the console and agents going offline can be an issue. It can be time-consuming to coordinate and fix. However, the cloud console is very resilient. It's mostly the agent releases where we might have issues. CrowdStrike agents seem a little more stable.

We have about 3,000 users using the solution.

Scaling is no issue.

Technical support is hit or miss. We have worked with some good agents and some less knowledgeable.

We have used different solutions, including the fact that we still CrowdStrike at a couple of companies. We are now moving more fully towards SentinelOne.

The simplicity and ease of use were big and where SentinelOne stands out. It's a set-and-forget policy. Based on what we saw in testing, it was the best option.

In terms of telemetry data, we were all over the board.

The initial setup was a little more complex when we first started. However, they've smoothed a lot of their implementation out and so it's gotten easier over time. It took us a couple of weeks to a month to deploy. About 20 were involved in the deployment. We have 30 to 40 companies around the world and it's across every company and every department.

The solution does require maintenance. You need to have agents up to date and cases closed properly. It does require you to be invested.

We have witnessed ROI. It's comprehensive in its detection capabilities and has saved us from multiple attacks. We've likely saved 30% based on prevented attacks.

The solution is relatively cheaper and is willing to work with companies on pricing.

We are customers.

For those who believe they already have a continuous monitoring solution in place, I'd advise that SentinelOne knows its own product. They can provide that extra confidence that nothing gets missed. And if you see a high number of alerts, they're able to really help you discern those and get down to the ones that matter most.

The solution doesn't affect our ability to innovate one way or another. It doesn't hold us back.

I'd recommend the solution and advise running a POC in your environment. It's good to run against CRowdStrike. They are seriously contending against CrowdStrike.

I'd rate the solution eight out of ten.

SentinelOne Singularity Cloud is on our computers and servers, mainly for threat hunting. I use it to ensure our devices remain healthy and are virus-free, ransomware-free, and threat-free.

We've felt more comfortable having SentinelOne Singularity Cloud because we've had a safer environment. The benefits from the platform were immediate.

What is most valuable in SentinelOne Singularity Cloud is that it can detect any threat on a machine or is being installed on a machine, so it is a platform that helps keep the environment safe.

I also found the real-time detection and response capabilities of SentinelOne Singularity Cloud impressive because it is a platform that uses artificial intelligence to determine what is normal and what is abnormal and can lock down any virus it may encounter.

SentinelOne Singularity Cloud has good automated remediation capabilities. It can catch threats that other antiviruses do not.

The platform also has a very good deep visibility feature, enabling you to run scans and find what you need.

SentinelOne Singularity Cloud provides excellent historical data to find what you need.

The platform reduced my organization's mean time to detect and mean time to remediate anywhere from a week to sixty days.

SentinelOne Singularity Cloud also helped free up SOC staff, enabling staff to work on other projects or tasks. Through the platform, the team does not have to spend as much time trying to go through different objects on the machines manually.

SentinelOne Singularity Cloud hasn't had a direct, everyday impact on my organization's productivity. What it has an impact on is uptime whenever there is a threat on a computer because it blocks it.

The platform has good interoperability with third-party solutions and integrates smoothly.

SentinelOne Singularity Cloud is able to support my organization's ability to innovate. It is good in that aspect, though I have yet to work with that extensively.

SentinelOne Singularity Cloud sometimes has false positives, but the main area for improvement I want to see is for it to become less resource-intensive. Right now, it can slow down processes on the machine, and it would be a massive improvement if it were more lightweight than it currently is.

I've been working with SentinelOne Singularity Cloud for about three years.

I found SentinelOne Singularity Cloud stable.

SentinelOne Singularity Cloud is scalable, and it is pretty seamless in terms of autoscaling based on my organization's workload demands.

I have not contacted the SentinelOne Singularity Cloud technical support team.

My organization used Windows Defender but switched because SentinelOne Singularity Cloud was more robust.

Due to its notifications, you can also have the turnout time of obtaining telemetry data from SentinelOne Singularity Cloud automatically, so you do not have to watch it constantly to see the data. The platform automatically shuts down the computer, takes it off the network, and then reports to you versus Windows Defender, which requires you to do a little more research into the items, as it did not provide as much information.

I was involved in the initial setup of SentinelOne Singularity Cloud, which I found pretty straightforward.

We worked with a consultant in implementing SentinelOne Singularity Cloud.

Only two people were involved, and the process took about two weeks.

I believe there is ROI from SentinelOne Singularity Cloud because of its impact on productivity through its ability to remediate and self-resolve some of the items.

I have no information on how much SentinelOne Singularity Cloud costs.

We did not evaluate other options before choosing SentinelOne Singularity Cloud.

If someone were to tell me that they do not believe they need SentinelOne Singularity Cloud because they have a continuous security monitoring solution in place, I would disagree because, with the SentinelOne Singularity Cloud platform, you can allow or disallow items within the machine. It automatically disconnects the machine from the network, helping you determine what is happening.

My organization works with the cloud version of the platform. It is deployed in multiple departments, and about four hundred users work with the endpoints.

SentinelOne Singularity Cloud requires maintenance, but it's not difficult to maintain.

Only one person takes care of the maintenance of the platform.

My advice to other users who would like to start working with SentinelOne Singularity Cloud is that I would highly recommend it based on its abilities and what it can find and remediate for you. It is easy to deploy and maintain, so I would tell others it is a solid platform.

My rating for SentinelOne Singularity Cloud is eight out of ten.

We are a relatively smaller organization of roughly 250 people. We utilize SentinelOne for patch management, vulnerability assessments, and remediation. So whenever one of our users has an issue on their machine, we get an immediate notification to let us know what that intrusion, infection, malware, whatever it might be, where it is, what file may have caused it, and then we can immediately take action.

There are also default settings for ensuring the software that SentinelOne installs on all our client machines. The latest agent is up to date everywhere. They have a couple more insights, however, that's our main use case.

The big thing for us was just having optics on vulnerabilities, being able to ensure that we have a secure way to get month-over-month assessments of our security stats, and ensuring that there's something in place that can make sure that we're secure. We also wanted something that could keep up with current demands without having any sort of interference or impact on the user's end.

The biggest thing for us is the level of minimal intrusion on our user's experience. The previous EDR we were using, Sophos, was not ideal. Whenever an update came out, there would be different things that were affected. At one point, an update from Sophos had completely disabled public Wi-Fi for our users. And when dealing through their message boards, dealing with their support, they, unfortunately, did not have a resolution other than disabling security elements of their software. With SentinelOne, we have not seen a single instance of that. You can get down to the user level of tweaking different elements of their security system. You can even quickly add exclusions based on rules. Being able to tailor to our users and making sure that our users don't feel like something is running on their machine is the biggest advantage.

The remote shell and the remediation are the two that really stand out as valuable features. The remote shell function that it offers is something that I use almost daily. It allows us to quietly and discreetly sign in on a user's computer, but only as admin. It prevents any sort of security issues or security risks to a user, which would be probably our favorite.

The remediation is really nice as it gives a very clear understanding of where a file came from. For example, in our use of it, there are a couple of files that we had that we didn't even know that we had. There was software that no one was aware was installed on these machines more than three years ago; we actually learned about that software once SentinelOne was installed. The level of optics it gives you is just incredible.

With that software, as soon as we installed SentinelOne, there were a couple of different applications and software that were immediately flagged as tracking user information and things like that. We found out that there was actually some sort of remote surveillance software that the past iteration of the IT team had installed and tested that just never got removed. We ended up tracking down the vendor for that and getting their assurance that that was no longer being used.

The real-time detection and response capabilities overall are great. I've never used anything that was as fast as this. The software that we used to use, Sophos, was comparable, however, it had a noticeable impact on the user. The bigger thing for me is that there isn't an impact on my end users. When we are actually running a scan, let's say, if we find that there's an impact, it's very quick. We've tested it by throwing malicious software onto our test machines just to see how quickly SentinelOne actually picks it up. And it's literally within seconds. When you actually do a scan, you can scan your higher fleet, and it's done relatively quickly as long as those machines are powered on. And it will act the second that those machines power on and connect to the Internet again to get that signal. I've never used anything as quick, personally.

The forensic visibility into the Linux terminal is not something we use as we actually don't use any Linux machines ourselves, so I couldn't speak to that. As far as visibility goes, we're primarily a Mac organization, and we have ten percent of our users on PC. As far as Mac goes, the visibility is fantastic. Same with the PC side of things.

The historical data record, from what they had shown us in the demo, looks pretty incredible. We thankfully have not suffered an attack that required historical data.

In terms of our mean time to detect, I don't think we ever had it. Since we're a small organization, we haven't had any real issues with genuine malware attacks. I can't speak to a scenario where while we were on Sophos, we experienced one. When we've had security audits that have tried to pen test for us, we have not had any issues with SentinelOne whatsoever. Every time that we've attempted to see how accurate and how quickly it can detect an infection or intrusion, it's being caught immediately.

The same is true for mean time to remediate. Any remediation that we do, for example, as soon as we block off a file, the automatic remediations are nice. In the event that we want to have something behave differently on another machine, we can quickly change that once we see it in any incident log. Setting those permanent rules is very helpful since, if you know something's malicious, chances are you don't want it showing up anywhere else.

The product has helped free up your SOC staff to work on other projects or tasks. The work that we used to have to do with our previous provider in going through our vulnerability assessments on a monthly basis and in trying to track down the install path of different applications was a headache and a half. With SentinelOne, the application management, and vulnerability assessments, are easy. You can see directly to the file path. It cuts a significant enough time out of our day.

It's had a positive impact on our overall productivity. Being able to dig through and find applications faster has drastically cut down our vulnerability position. When we first started using Singularity, we were somewhere in the thousands. Within the first month of having used it for our vulnerability assessments, we were down to just 1600, and now we're sitting well under the 500 mark when it comes to critical vulnerabilities. It's been very drastic and exponential at that. Now, any time a vulnerability does pop up, it's very quick and easy for us to track down where it is and take immediate action.

The interoperability with third-party solutions is fine. We don't currently use Kubernetes in our organization, however, we do utilize a VPN and it has no issues with adapting to that VPN. We also utilize different storage, including cloud storage accounts. There are no issues there either.

They've been fantastic at supporting innovation. We've had their support; they're always very responsive and very quick to give us the right advice on how we can execute what we're looking to do. Making sure that you have access to the necessary system without interrupting your user and without your user feeling at risk of their privacy being invaded is huge.

Currently, we would have to export our vulnerability report to an .xlsx file, and review it in an Excel spreadsheet, and then we sort of compile a list from there. It would be cool if there was a way to actually toggle multiple applications for review and then see those file paths on multiple users rather than only one user at a time or only one application at a time.

I've been using the solution for nine to ten months.

I've had no stability issues at all. We have not experienced any performance decreases.

As far as deploying to more devices, there's not a problem with scaling at all. We've automated in our MDM so any device that we start in our MDM automatically installs SentinelOne, and those devices immediately show up. If we spin up a new device on Mac OS, it shows within the set the SentinelOne console within seconds.

Their support has been fantastic. They are quick to respond.

I've never had an issue with their support. What little time I did have one scenario where it was not something that they could help with, they'd been able to provide us with all the articles and information necessary to act on it on our own, which is really all you can ask for.

We were previously using Sophos. The biggest issue that we had with them was the fact that we were a fully remote company, so a lot of our users would be traveling for client meetings or even traveling abroad for client meetings. Reliance on a secure public WiFi solution is a very big deal for us. When it comes to users on a VPN, Sophos with MacOS's more recent updates would completely cut off Wi-Fi - which was very difficult for us to work around as a remote company. Thankfully, with multiple different tests in multiple different scenarios, we've never had that issue with SentinelOne.

The other big thing is the capability to remove a device from the network. In the event that a significant intrusion or malware, malware, ransomware, whatever it might be, is detected the ability to just isolate that one user from internet access is huge. You would hope that that's how an EDR would behave instead of completely removing all internet no matter what.

The initial setup was pretty straightforward. Our organization uses Kagi MDM. And in using that MDM solution, it was very easy for us to just quickly put together an automated installer and deploy it.

We have multiple different groups of users, including PC and Mac. With the smaller percentage of PC users, we were able to just change the group ID in the installer, and that ensured that they were placed into the proper place for their groups. Being able to tweak and ensure that from the back end within the SentinelOne console, we could ensure that everything is set up the way we want it to be once that user gets that package installed, makes life a lot easier. You don't need to worry about signing on with a user and changing any of those settings. The installer package that they get is going to be everything that they need. Once that installs, that's it. It was very seamless. If anything, removing Sophos was the hardest part of the installation process.

We were able to deploy using a team of three people. Hypothetically, one person could do it alone as long as they are well versed in MDM.

As far as the application itself is concerned, there was no need for maintenance. You can control everything from the console. When there is a new agent to install you receive a notification when you log in to the management console. You can control when that update gets deployed to your organization. You can break it up into different groups within your organization. For ourselves, we always test on a smaller number of users. And then once we see stability, we deploy to the rest. That's what little maintenance is involved. It's a drastic improvement versus other solutions that I've used.

We were able to do the initial setup completely in-house. We were able to do that on our own. We were able to very, very quickly deploy SentinelOne to pretty much our entire fleet.

Our ability to get in and review our vulnerability stance, whether daily, monthly, weekly, or whatever it might be, has drastically improved over our prior provider. Our users have less of a performance drain when attempting to use it. That's always huge when it comes to EDR. It pretty much checks every single box for us. It's the one software in our stack that we are happiest with.

For us, the pricing is very fair. They were willing to meet our price point. With very little negotiation involved, we just let them know what we could pay and they were willing to meet us at slightly above what we paid with Sophos, which was still very fair for what we were looking at.

We reviewed quite a few solutions. The big selling point for this product was that they were willing to work with us on a price point as a smaller organization. That was a huge reason for us actually going with them. The fact that they were willing to work with us as far as the pricing goes was the main reason that we ended up going with them. It was nice to see that they work with the little teams.

We're a customer and end-user.

We thought something as good as SentinelOne would be out of the question for an organization of our size. We assumed it would be something that's suited to larger organizations - money, obviously, being the main concern. However, the fact that they were willing to work with us changed that. Seeing that they're willing to work with smaller organizations is cool. I like that they actually give back to the tech sector that way.

I'd rate the stability ten out of ten.

I'd advise new users that they're going to need to invest a little bit of time upfront in order to make sure that their organization is set up for proper deployment. We probably spent about a week or two configuring everything and getting it to work the way we wanted. However, after that initial investment of time, the maintenance that you have to do is pretty minimal.

We have an environment in the cloud where we have a bunch of EC2 instances and S3 buckets. We have the SentinelOne agent installed on all of our EC2 instances, to monitor our environment, so we use it quite frequently.

We needed cloud-based endpoint protection that we could install to get a single pane of glass into our security environment. Specifically, we needed to see the version usage of the applications to ensure we didn't have any outdated applications.

It has definitely helped reduce our mean time to detect. It's much quicker than with our last platform. Singularity has also helped free up our staff to work on other projects. We don't usually come into the console unless we get an alert. In that sense, we have been working on many other projects in the last year. Now that everything is set up and running smoothly, we haven't had to spend as much time in the console as before.

And when I consider the solution's impact on overall productivity, features such as the reporting have helped. When we need to run a report on how many endpoints we have in our environment for regulatory requirements, we use the reporting feature of Singularity because we know it's installed on every endpoint, giving us full visibility. From a reporting standpoint, it has certainly helped us.

We really appreciate the Slack integration. When we have an incident, we get an instant notification. We also use Joe Sandbox, which Singularity can integrate with, so we can verify if a threat is legitimate. The third feature we use most often is the VirusTotal integration. That allows us to take the hash of a threat or virus and open it up in VirusTotal.

Also, it's amazing how quickly its real-time detection and response capabilities come through. There have been multiple times where either my coworker or I will be working on something—even in our elevated environment, and even just running a script. We wouldn't expect a pop-up, but it's good to know that it's checking for those anomalies, detecting them, and notifying us of them instantly. We love that feature.

In terms of the historical data record provided by Singularity after an attack, we like to use the Storyline feature for deep dives and threat hunting if needed. It has been very useful in our operations. We can see different event types on each endpoint, which comes in handy. Using the Storyline feature, we can dig in much quicker, connect the dots, and see what caused the alert. So it has quickened remediation.

And the SentinelOne Cloud engine detection types are useful when trying to determine whether a threat could be legitimate or a false positive.

One of our use cases was setting up a firewall for our endpoints, specifically for our remote users. We have a firewall on-premises that comes into play when someone is at our main campus. But we needed something more for our remote users. We were hoping to utilize SentinelOne's firewall capabilities, but there were limitations on how many URLs we could implement. Because of those limitations on the number of URLs, we weren't able to utilize that feature in the way we had hoped to.

I have been using SentinelOne Singularity Cloud for about two years.

Singularity has been very stable. It has never lagged or crashed that I've noticed. In my experience, there has been 100 percent uptime.

The interoperability with AWS has been very straightforward and streamlined, without any major bugs or issues that I've come across.

Its scalability is one of the main reasons we chose SentinelOne. Because it's hosted in the cloud, we can install as many agents as we're licensed for. We've never gone over that limit. As new servers and endpoints come online, it's easy to deploy. It's built into the image.

We do have a unique use case regarding scalability. We use a VDI environment in Azure, and it works. We haven't had any issues. But when we need to run updates on those machines, we have to rebuild the image. We can't have the agent built into the image because of our rebuild process. That makes it a manual process for us every month when we redeploy those desktops. We have it scripted out with a PowerShell script that helps, but it's a manual step for us. That's one area we're trying to address from a scalability standpoint.

As for auto-scaling, we're more of a static environment for most of our endpoints. The VDI is our only more fluid environment, since our VDI endpoints go up and down based on usage. Once the agent has been deployed to those images, the auto-scaling works flawlessly, and we haven't had any issues there.

We used ESET, but the decision to go with Singularity was made before my time with the company.

We have a couple different deployments: our end-user endpoints and our server fleet. I was involved with the server deployment. It was very straightforward, and we didn't run into any issues during that deployment.

The only maintenance involved is when we need to whitelist an application. For example, if a new user installs an application, we might get a false-positive pop-up. That's really the only maintenance we have to do.

We did it ourselves, and there were four people involved.

It's a fair price for what you get. We are happy with the price as it stands.

My advice is that if you want an easy-to-deploy solution where you can have a single pane of glass to get visibility into all of your endpoints and applications, and run reports on those application versions, Singularity makes it a very easy-to-use, straightforward, and streamlined process that has helped us over and over again.

If someone thinks they don't need Singularity because they already have a continuous security monitoring solution in place, using SentinelOne gives us an overarching view from the single console, giving us the entire picture of the timeline of events that happened. Going through the timeline and connecting those dots really helps when threat hunting. It helps to get the full picture instead of just a specific point in time, which is the way some of the legacy antivirus programs work.

The solution has an automated remediation feature, but we don't currently use it because we are a smaller team. We like to remediate manually. For the time being, we haven't had a reason to use the automation feature yet.

One area we're trying to innovate more in is the AWS Security Hub. Singularity, in their marketplace, has a couple of apps related to that. We're trying to build more automations within AWS Security Hub to get better overall visibility, not only of our EC2 endpoints but of our applications as well.