SentinelOne Singularity Cloud Security Reviews

When we receive a ticket about a SentinelOne detection on a specific host, we will first go to the SentinelOne console and look up the endpoint and the case. If there are any threats related to the host, we will then review the activities that have taken place within a specific time frame. We can look at the processes that have run, and how they have propagated from one process to another. We can also look at the timeline of events, from the top down, to see what happened when each process was run. This will help us to determine if any malicious activity has taken place.

We use the cloud-based management console to install SentinelOne on each employee's or host's device. SentinelOne can be installed through the cloud.

Singularity Cloud Workload Security provides us with better security detection and more visibility. It is another resource that we can use to detect vulnerabilities in our company's systems. For example, it can help us detect new file processes that we are not familiar with, which could be used by attackers to exploit our systems. Singularity Cloud Workload Security can also help us diagnose and analyze data to determine whether it is malicious or not. Singularity Cloud Workload Security is like another pair of eyes that can help us protect our systems from cyberattacks.

The real-time detection and response capabilities of Singularity Cloud Workload Security are very helpful. When we receive alerts in real-time, we can take action immediately. Within Vigilance, they look at things for us in real-time and let us know if they detect something malicious. This allows us to investigate the incident and see what is happening. If it is a zero-day attack, we can take action immediately to try to mitigate the damage. Having real-time alerts helps us take action more quickly than waiting for a few days for something to happen.

The automated remediation feature works from a database. We upload anything that we have detected before or anything that we can filter into this database. For example, we would upload the known IP addresses of analysts who do penetration testing for us within the company. If one of these IP addresses comes in and is malicious to the company, the solution will detect it. Singularity Cloud Workload Security will check the IP address and automatically classify it as benign. This saves us time because we don't have to manually review the IP address or contact our colleagues. This frees up our time so that we can focus on other things, such as investigating more malicious threats. IP addresses are just one type of data that can be filtered. File processes can also be filtered. Any type of automated filtering helps us reduce the time it takes to investigate a ticket so that we can focus on the most malicious threats.

The historical data record provided by SentinelOne after an attack is helpful in identifying what we can do to protect ourselves from future attacks. We can use this data to understand the cause of the attack and put in place preventive measures, such as educating employees about security best practices. SentinelOne allows us to access up to three or four months of historical data without a request. For data that goes back six months to one year, we need to submit a request. This data can be specific to a particular host, if necessary.

Singularity Cloud Workload Security is a great product. It is very robust and versatile. There are many things we can do with it, even things I have explored in the past two years. We can use different types of queries to narrow down our searches. It is a very powerful tool that has been very helpful to our SOC in analyzing specific incidents.

The solution has decreased our mean time to detect through the automated response process and visuals that give us time to focus on other important things. It definitely gives us the actual time to look at other things instead of focusing on one ticket that may take us 30 minutes to an hour to resolve. This could definitely decrease the coverage time.

The solution has decreased our mean time to remediate. We have many detection systems in our organization, and it takes a lot of manpower to focus on all of them. Integrating SentinelOne into our organization has given us more time to focus on other things, rather than having to look at minor incidents, such as low-severity incidents. SentinelOne detects and remediates these incidents for us, so we don't have to worry about them. This has been a great help, and we no longer need to dedicate as much manpower to these incidents.

The solution helps to free up our SOC staff time to work on other projects and tasks. Thousands of false positive tickets no longer have to be looked at by our SOC team, saving them a lot of time.

The solution has helped our organization become more productive by allowing us to focus on more severe issues instead of wasting time on minor ones.

The management console is the most valuable feature. It offers a variety of options for us to view. If a threat is detected, there is a specific area where we can view the different incidents that have occurred. This is the threat that is associated with that host.

We can also have deep visibility into the activities within the host within a specific time frame. This is very useful, especially when we can view the process tree. This allows us to see how one process propagates to another process, and so on. We can then look back to the beginning of the process to see where it came from. How was it downloaded? Which URL did it come from? Was it internal or external? This information has been very helpful when we are diagnosing a specific incident.

The File Fence feature is also useful. When we view a file within Singularity Cloud Workload Security, we can put it into our sandbox to see what type of file it is and whether it is malicious or not. There is also the scan feature, which is very helpful. When we scan a host remotely, it can return to us with information about the detections that were made on that host. This can help us to identify and alert others about any potential threats.

Whenever I view the processes and the process aspect, it takes a long time to load. I think this is because the dashboard or management console is slow, especially during downtime or when updates are being applied. Even when I search for a specific query, it takes a while to load. I believe that increasing the bandwidth for query processing would help.

I have been using SentinelOne Singularity Cloud for three years.

I think the stability is decent. However, if they fixed the bandwidth issue, it would be a top contender. Sometimes, when I need to look at the process timeline, it is very difficult to load and takes a long time. We don't always have the time to wait for it to load. I think the stability is okay, but it could be improved.

We used Carbon Black. Carbon Black's stability is pretty good. Its downtime is not as high as SentinelOne's. Carbon Black is a little bit easier to use than SentinelOne. Its user interface is a little bit easier than SentinelOne's. In terms of stability, I think SentinelOne is just a little bit behind Carbon Black. Not by much, but just a little bit.

The scalability is fine.

The technical support is very responsive, and courteous, and provides great customer service. If we need something right away, they will definitely put us on the priority list. We have a special chat channel or a specific team dedicated to our company. We can also email them, and they will usually respond quickly.

Positive

I previously used Carbon Black and Tanium for a short time. When I first started at my current organization, they were using both Carbon Black and SentinelOne. However, SentinelOne provides the same level of security as Carbon Black at a lower cost, so the organization stopped using Carbon Black.

If I were to compare SentinelOne to Carbon Black, I would say that they have the same functionality, but Carbon Black has a faster response time. If SentinelOne could improve its bandwidth in this area, it would be a more competitive product.

I would rate Singularity Cloud Workload Security a seven out of ten. I noticed some lagging, especially when loading a specific storyline. I also experienced some lag when I had too many windows open.

Based on the company's size and infrastructure, SentinelOne offers different tiers of service for small, medium, and large businesses. For a really small company that doesn't generate a lot of logs, a robust system like SentinelOne may not be necessary. However, for a medium-sized company, SentinelOne can be a valuable asset. It has helped us to reduce our response time, gain more visibility into our security posture, and receive alerts if any devices are lost or stolen. SentinelOne is also more versatile than other solutions in terms of the resources it uses to detect malicious activity. I would recommend that any company considering SentinelOne do their research and talk to other users to see if it is the right fit for their needs.

Singularity Cloud Workload Security is a cloud-based solution that does not require much maintenance. The only maintenance required is to keep the filtering list up to date. This can be done with the help of the SentinelOne team.

The interoperability of the solution is fine. I don't have any issue with it.

In my line of work, we innovate by detecting and analyzing specific incidents. Singularity Cloud Workload Security definitely helps us out a lot in terms of detection, creating new queries, and creating new filters.

I suggest they research the solution and test it out. I believe SentinelOne offers a trial version, so they can try it before they buy it. See how they like it. We love it and don't think we can live without it. It gives us so much free time to focus on other things. It's like a home security system. If we miss something, they contact us. If the doors unlock, they let us know. If the battery is dying, they let us know. It has helped us out a lot. It gave us the visibility we didn't have before and continues to give us the visibility we need. I don't know what we would do without it.

Our cloud security posture is managed with SentinelOne Singularity Cloud Security, a tool that identifies and highlights potential security weaknesses in our systems.

It is user-friendly.

SentinelOne Singularity Cloud Security helps reduce the number of false positives by 20 percent.

In evidence-based reporting, demonstrating that a vulnerability can be exploited is crucial. This information allows us to directly address the issue through manual remediation.

SentinelOne Singularity Cloud Security has improved our risk posture and has reduced our mean time to detection by 50 percent.

SentinelOne Singularity Cloud Security has reduced our mean time to remediation by 30 percent.

The user-friendly dashboard offers both convenience and security by providing quick access to solutions and keeping us informed of potential threats.

SentinelOne Singularity Cloud Security filtering has some areas that cause problems, and to achieve single sign-on functionality, a break-glass feature, which is currently unavailable, is necessary.

I have been using SentinelOne Singularity Cloud Security for one year.

I would rate the stability of SentinelOne Singularity Cloud Security nine out of ten.

SentinelOne Singularity Cloud Security is scalable.

The technical support is good.

Positive

We previously used Prisma Cloud but when we would request a feature we had to wait until the next release. That is the advantage of SentinelOne Singularity Cloud Security.

The deployment took a few weeks to complete.

SentinelOne Singularity Cloud Security falls somewhere in the middle price range, neither particularly cheap nor expensive.

I would rate SentinelOne Singularity Cloud Security nine out of ten.

We have around five people working with SentinelOne Singularity Cloud Security.

No maintenance is required for SentinelOne Singularity Cloud Security.

The company purchased SentinelOne Singularity Cloud Security primarily for container security and IoC scanning. We also were looking into image scanning for Docker components. Now, we have enabled secret scanning and the Cisco pipeline as well. 

We are mostly dealing with code-level security issues the organization might have. There are issues in TerraForm and whatever else we see in our DevOps pipeline. 

SentinelOne Singularity Cloud Security has improved the organization's Docker container security, and we can mitigate many of the issues to avoid serious vulnerabilities or attacks. We start to see these benefits within 2 or 3 months of deployment. The tool took almost a month to learn the structure of our organization and environment. After that, it started detecting issues and vulnerabilities. 

We don't get many false positives because we eliminated many of them in the early stages. SentinelOne Singularity Cloud Security can mark detections as false positives, so they won't appear in the future. 

SentinelOne Singularity Cloud Security has reduced our detection time. Before implementing SentinelOne Singularity Cloud Security, it took us around 7 or 8 hours to determine whether an issue was inside our organization. Now that we have deployed SentinelOne Singularity Cloud Security, we have an agent list running on our Docker containers, and SentinelOne Singularity Cloud Security is identifying the issues inside the Docker containers. When it scans periodically, we can detect the issues within 2 or 3 seconds. It has reduced 7 hours of work to a few seconds. 

While it hasn't reduced our remediation time on mid-level or low-level issues, it has drastically improved our remediation time for critical Docker issues and high-priority problems in our environment. We can handle them before they make it into production. 

SentinelOne Singularity Cloud Security has improved collaboration between our developers and security teams. The tool has a feature where we can send issues to developers, but it requires them to reply with recommendations.

SentinelOne Singularity Cloud Security's integration is smooth. They are highly customer-oriented, and the integration went well for us. SentinelOne Singularity Cloud Security is also responsive to our feature requests. The interface isn't difficult to understand for a layperson, and we're familiar with it. There's also built-in support, so we can get help when we have a problem. 

The evidence-based reporting is a critical feature because we can correlate to the issues in the system. We have compared it with free tools that are on the market, and SentinelOne Singularity Cloud Security gets better results. From the perspective of remediation, resources, and security, SentinelOne Singularity Cloud Security is the best option. 

The agentless vulnerability scanning has worked well for us. Removing agents from the equation takes about half the work out of it, and the agentless scan fetches the details every millisecond. SentinelOne Singularity Cloud Security's agentless mechanism is monitoring everything that happens on the system.

Proof of exploitability is an important aspect of SentinelOne Singularity Cloud Securitys evidence-based reporting. When we ask a developer to fix an issue, they ask for evidence of its exploitability and whether it's a critical issue. If SentinelOne Singularity Cloud Security didn't provide this information, we couldn't convince the developer to fix it. SentinelOne Singularity Cloud Security provides the expertise to convince the developer by finding the vulnerabilities and providing explanations.  

The infrastructure-as-code scanning helps identify container configuration issues and other problems before they go into production. We used a script, and we needed to enable everything before going to production, so we have it enabled on the production and pre-production side. We can check the issues and block them before going to production. Before it becomes publicly accessible via the internet, we want it to be safer than it was in pre-production.

I would like SentinelOne Singularity Cloud Security's detections to be openly available online instead of only accessible through their portal. Other tools have detections that are openly available without going through the tool. 

We have one feature request that we've already discussed with SentinelOne Singularity Cloud Security. We want a category feature for exceptions that developers have already accepted. We don't want SentinelOne Singularity Cloud Security to identify the issue next time because the developer has already done the risk assessment. 

We have used SentinelOne Singularity Cloud Security for nearly a year.

SentinelOne Singularity Cloud Security is stable. 

SentinelOne Singularity Cloud Security is scalable.

I rate SentinelOne Singularity Cloud Security support 9 out of 10. 

Positive

We previously worked with many open-source solutions and Prisma, one of its competitors. Ultimately, budget issues made us come back to SentinelOne Singularity Cloud Security. SentinelOne Singularity Cloud Security is a budget-friendly and user-friendly tool. A layperson can start using the system and understand it within 1 or 2 days. It also has more capabilities than the other tools.

Deploying SentinelOne Singularity Cloud Security was straightforward. It took 3 or 4 people to deploy. We are currently enrolled on 2 clouds. We had it on AWS, but now it's on GCP and Azure. It's more than 2,000 endpoints and around 2,000 APIs.

It doesn't require much maintenance because the updates are automatically happening on the cloud. When new features are released, we connect to the SentinelOne Singularity Cloud Security team to understand how it will impact our environment. 

SentinelOne Singularity Cloud Security is reasonably priced, considering the value it offers to our organization. We had a few conversations with them, and they understood our posture. Initially, they offered one amount, but we got them to offer a discount that would meet their expectations. Their customer team is excellent and understanding.

I rate SentinelOne Singularity Cloud Security 8 out of 10. SentinelOne Singularity Cloud Security will meet all your requirements if you're looking for a cloud tool that covers IoC scanning, cloud misconfiguration, secret scanning, integration into the DevOps pipeline, and cloud-image scanning. It's a one-stop solution for all these requirements. It's a user-friendly tool that's easy to handle, and the support is excellent. 

We use Singularity Cloud Workload Security for our production and build workloads.

We implemented the solution to simplify the deployment of forensic tools, including EDR, into our cloud infrastructure, where it may be difficult to install an agent.

We have a hybrid deployment, with an estimated 8,000 to 70,000 cloud workloads. We serve a customer base of nearly one billion people, including 700 million current EA subscribers. Handling this workload is no small feat. The estimate is so broad because we do not own or control every AWS, Azure, or GCP account; studios use this infrastructure without our help. We are still in the discovery phase of trying to determine the exact number of workloads. There are thousands of Kubernetes clusters.

Singularity Cloud Workload Security's real-time threat detection capabilities are good. We recompeted SentinelOne against fifteen or twenty different AV vendors over the course of 2018 and 2019 and found SentinelOne to be superior in virtually every possible way.

Forensic capabilities are now excellent. When we started, we had a contractual agreement with SentinelOne to improve deep visibility to match our current toolset, Carbon Black Response. Over the course of two years, they delivered everything we could get from Carbon Black and even more.

The visibility of workload telemetry is excellent, and the hunting capabilities are second to none.

When no human intervention is required Singularity Cloud Workload Security detects and remediates nearly instantaneously.

Our MTTD is sub 30 days.

Our MTTR is seven days after detection for most instances.

The interoperability with third-party solutions is great.

The most valuable feature is the ability to gain deep visibility into the workloads inside containers.

Sometimes the Storyline ID is a bit wacky. It's not that the data is inaccurate, but the threat item that's flagged can sometimes point to a storyline that's not relevant to the hunting object we're looking for. In short, Singularity Cloud Workload Security can sometimes take us on a roundabout way to get to where we want to be when using Storyline ID.

I would like a public repository for CWPP. Having to request a script from SentinelOne to deploy CWPP is not ideal, and this is true for all of the tools, including the Linux agent. Without a public repository, when a deployment team needs something like a GPG key to validate the image, we have to request a signed copy of the software. This is not ideal because it removes our ability to self-serve. Therefore, if I had to ask for anything to make it easier, it would be signed images that are GPG signed and a public repository where we can get the bits from.

I have been using Singularity Cloud Workload Security for over four years.

Singularity Cloud Workload Security is stable. No lag, no crashing, no downtime. The joy of running as a container is that it doesn't break the other parts. 

The Singularity Cloud Workload Security auto-scaling feature is great.

Technical support is excellent. One of the selling points of SentinelOne is the incredibly good support.

Positive

The initial deployment was straightforward, but only because I had to obtain a script from SentinelOne. I completed the deployment myself.

Our three-year renewal with SentinelOne this year was shockingly expensive. In fact, covering our 50,000 endpoints would have nearly bankrupted most security programs, even well-funded ones like ours. The sticker shock is real. I understand that SentinelOne is a market leader, but the bill we received was astronomical.

We evaluated a few application security tools, but CWBB is only a software opportunity. SentinelOne has become our primary solution for all aspects of endpoint security. Therefore, when we considered adding detections for cloud workloads, it made sense to choose SentinelOne as the ideal solution.

I would rate Singularity Cloud Workload Security nine out of ten.

To someone who doesn't think they need CWPP because they already have a continuous security monitoring solution in place, I would say, Consider the old security adage that they are not currently free of malicious items. They have them, but they just don't know where they are.

We have an upgrade policy for maintenance purposes. We need to implement the upgrade policy, but we do this through Chef automation. Writing Chef automation for this can be a bit complex, but it is not impossible.

SentinelOne Cloud Workload Security's ability to be innovative is excellent. I'm a big fan of SentinelOne's API, which has allowed me to develop some creative solutions. I'm actually the only SentinelOne administrator at my organization, so in terms of innovation, it's probably the best tool I've ever used. I've been able to create an automated "one-man army" using SentinelOne.

I recommend deploying a test environment. Do not try to deploy this into an existing environment and test there. It's a bad idea. Not from a SentinelOne perspective, but I'm not much of a Kubernetes expert. I know it can be dangerous, and we tried to do this in a test environment of a live production environment and had a lot of trouble. Not because of SentinelOne, but because of our Kubernetes deployment. Having to complete a bad Kubernetes environment with little knowledge of CWPP basically made getting it working very difficult. So my advice would be to build a clean, industry-standard test environment that can be broken with no risk.

We use SentinelOne Singularity Cloud Security for our AWS cloud used in my project and to check the account's vulnerabilities.

SentinelOne Singularity Cloud Security has improved our organization a lot. Before using SentinelOne Singularity Cloud Security, we had not covered many points according to vulnerabilities. We have used the solution's dashboard, which shows the criticality of issues, and we have rectified and resolved many issues according to their severity.

SentinelOne Singularity Cloud Security has a dashboard that can detect the criticality of a particular problem, whether it falls under critical, medium, or low vulnerability. If it is not a critical problem, we can try to solve it within 4-5 hours. If it's very critical, then we can take action immediately.

SentinelOne Singularity Cloud Security takes 4-5 hours to detect and highlight an issue, and that time should be reduced. Sometimes, the solution shows false alerts. The comments section has also been turned off for the last 10 to 15 days. These are the two issues I'm facing right now in SentinelOne Singularity Cloud Security.

I have been using SentinelOne Singularity Cloud Security for the last three months.

SentinelOne Singularity Cloud Security is a stable solution, and I haven’t come across any bugs or glitches.

I rate the solution an 8 out of 10 for stability.

The solution has good scalability. Around 10 users in my team use the solution.

I rate SentinelOne Singularity Cloud Security's scalability an 8-10 out of 10.

SentinelOne Singularity Cloud Security's pricing is good because it provides us with a solution.

Suppose we find a volume not attached to any EC2 instance during scanning. SentinelOne Singularity Cloud Security detects such vulnerabilities, and we try to resolve them. SentinelOne Singularity Cloud Security is an easy-to-use solution. Everybody in my team works with SentinelOne Singularity Cloud Security to monitor any vulnerabilities it detects.

SentinelOne Singularity Cloud Security is a good tool for security and vulnerability detection for me and my team. The solution is easy to use, and we are very familiar with the dashboard, which shows the criticality of particular problems. It also shows the link to a particular vulnerability or problem so that we can directly go to that particular problem.

Through the solution's dashboard, we can see problems and detect vulnerabilities. Then, we assign each problem to another and try to resolve it. In the pre production environment, we used to try a blue/green deployment. If we try to get any alerts from that particular dashboard, SentinelOne Singularity Cloud Security will detect them.

SentinelOne Singularity Cloud Security has improved our risk posture by 50% to 60%. Earlier, we couldn't identify the things created by mistake during production. If something is created by mistake or if we are unable to detect mistakes in the production environment, SentinelOne Singularity Cloud Security scans and alerts us of any vulnerabilities.

SentinelOne Singularity Cloud Security takes approximately 4-5 hours to detect an issue. We conducted a test by creating one issue, which was highlighted in the SentinelOne Singularity Cloud Security dashboard within four to five hours. The issue was still present in the SentinelOne Singularity Cloud Security scan after we resolved it, and it was removed after four to five hours.

SentinelOne Singularity Cloud Security has helped reduce our mean time to remediate, and we immediately take action on the issue. In my opinion, SentinelOne Singularity Cloud Security is really collaborative, and other teams use it at the utmost level. The solution is really helpful for us regarding system security.

SentinelOne Singularity Cloud Security has helped us save around 30% to 40% of engineering time. We just see the SentinelOne Singularity Cloud Security dashboard for issues it has detected and try to resolve them as soon as possible. SentinelOne Singularity Cloud Security has helped us save approximately 30% to 40% of our resources, time, and money.

SentinelOne Singularity Cloud Security is integrated with the AWS tool our team uses to detect vulnerabilities. SentinelOne Singularity Cloud Security is a SaaS (Software as a service) solution. We have five to six accounts on SentinelOne Singularity Cloud Security and use them in multiple locations. The solution does not require any maintenance. I would recommend the solution to other users.

Overall, I rate SentinelOne Singularity Cloud Security a 9 out of 10.

We use SentinelOne Singularity Cloud Security to identify threats and vulnerabilities in our AWS accounts and the compute resources that are hosted on those cloud accounts.

We implemented SentinelOne Singularity Cloud Security to address network-related issues, such as communication between individual components (part-to-part or node communication). SentinelOne Singularity Cloud Security's Graph Explorer feature also helped us understand the overall network landscape, including the attack surface. This feature allows us to discover and explore various components within our AWS environment. In essence, SentinelOne Singularity Cloud Security helped us identify how different networks connect and how microservices within our system interact with each other.

We've implemented SentinelOne Singularity Cloud Security across all our core companies, including acquisitions. Previously, managing separate AWS accounts for each company with dedicated DevOps and security teams was a significant challenge. SentinelOne Singularity Cloud Security helped us consolidate these accounts into a single platform, simplifying the process. Now, we can easily track key security metrics. For instance, SentinelOne Singularity Cloud Security provides frequent alerts for critical events such as publicly exposed instances or security groups with significant traffic changes from any source. Monitoring these elements across multiple accounts and security groups was previously difficult without a centralized platform. SentinelOne Singularity Cloud Security has been instrumental in streamlining this process.

We recently made some changes to our information systems. SentinelOne Singularity Cloud Security helped identify instances that were inadvertently made public. This identification is important for compliance purposes, as it allows us to track how well these public instances adhere to regulatory frameworks.

SentinelOne Singularity Cloud Security's compliance monitoring capabilities have provided us with some benefits, particularly in understanding our overall security posture. However, it's important to note that SentinelOne Singularity Cloud Security only monitors our cloud infrastructure. There might be internal deployments with compensating controls that address missing controls identified by SentinelOne Singularity Cloud Security (e.g., control X is missing but mitigated by internal control Y). These internal controls wouldn't be visible to SentinelOne Singularity Cloud Security. Therefore, while SentinelOne Singularity Cloud Security provides a valuable starting point at the surface level, manual review is necessary to ensure complete compliance coverage.

SentinelOne Singularity Cloud Security is easy to navigate. Its menus are straightforward and intuitive, making the overall user experience smooth.

One of the key benefits of the evidence-based reporting is its proof of exploitability. This feature allows us to prioritize vulnerabilities that have been demonstrably compromised and take immediate action to mitigate the risks.

The offensive security engine feature constantly scans and lets us know if any vulnerabilities in our environment can be exploited. While the offensive security engine for verifying exploit paths and prioritizing breach control is valuable, it lacks context awareness. For instance, it might flag something we intentionally made public, like a new website for an upcoming event. In those cases, we can safely ignore the alert. Overall, the engine is a useful tool. We extract the information it provides and prioritize it. A dedicated team reviews the alerts and, if necessary, escalates them to our DevOps team for further action.

By centralizing cloud infrastructure monitoring with SentinelOne Singularity Cloud Security, our security team's productivity, and MTTR have been significantly improved.

Over time SentinelOne Singularity Cloud Security has reduced the number of false positives by 40 percent.

SentinelOne Singularity Cloud Security has significantly improved our organization's risk posture. Since implementing it, we've been able to assess the risk associated with recently discovered CVEs much faster than before. This efficiency is due to the proactive identification and scanning capabilities. Now, we start each day with a clear summary of potential risks, allowing us to prioritize effectively.

SentinelOne Singularity Cloud Security has reduced our mean time to detection by 90 percent. This is because it scans every day and sends us real-time email alerts, allowing us to take immediate action.

SentinelOne Singularity Cloud Security has reduced our mean time to remediation by 40 percent.

We have a dedicated channel where we collaborate with SentinelOne Singularity Cloud Security and our internal teams.

The collaboration helped save our engineering time by 60 percent.

The user interface and ease of use have had a positive impact on our security operations. For example, we recently needed a list of assets deployed in a specific GN in a cloud account for a particular incident. We went straight to SentinelOne Singularity Cloud Security and were able to quickly obtain the assets along with a map of the security groups linked to them. The UI's simplicity helped us save significant time by eliminating the need to search for information manually.

Notifications about the latest vulnerabilities are a valuable feature. SentinelOne Singularity Cloud Security automatically updates itself with the newest threats and scans our infrastructure across all integrated data accounts for them. This is helpful because it's difficult to keep up with the volume of CVEs, especially the critical ones.

The UI is responsive and user-friendly.

There's room for improvement in the graphic explorer. We'd like something that helps us visualize traffic between different ports and containers. Currently, we can see host networking, like communication between instances or perhaps within Kubernetes. However, we're looking for a tool that can also visualize port-to-port communication and display it as a graph. This would give us a clearer picture of our network traffic and help strengthen our network security.

The dashboard currently displays CVEs, but it would be beneficial to receive proactive email notifications in addition to this.

I would also like to have runtime security in SentinelOne Singularity Cloud Security.

I have been using SentinelOne Singularity Cloud Security for 7 months.

I would rate the stability of SentinelOne Singularity Cloud Security 9 out of 10.

I would rate the scalability of SentinelOne Singularity Cloud Security 8 out of 10. We can easily add new cloud accounts.

The technical support response time is good. For feature requests, they can be a little slow.

Positive

The time invested in security operations for threat detection and monitoring has yielded a return on investment of 70 percent. We've also seen a financial benefit by avoiding the need for additional staff to monitor and correlate all database accounts individually by 40 percent. SentinelOne Singularity Cloud Security automates these tasks efficiently.

SentinelOne Singularity Cloud Security is less expensive than other options.

I would rate SentinelOne Singularity Cloud Security 8 out of 10.

We're planning to integrate SentinelOne Singularity Cloud Security with our CI/CD pipeline and Slack. Currently, our only integration is with an email system, which means we receive alerts and notifications via email. We're evaluating the effectiveness of this approach. Integrating with tools like Jira or Slack could help manage the issue of false positives and notification overload, which currently requires the manual closing of alerts. We're still assessing the best course of action, but integration with Jira is a strong possibility.

Around 15 people from our security and DevOps teams use SentinelOne Singularity Cloud Security. SentinelOne Singularity Cloud Security is a SaaS that is integrated with our main company and all our acquisitions.

SentinelOne Singularity Cloud Security does not require maintenance from our end.

I recommend SentinelOne Singularity Cloud Security to others for its cloud security capabilities. I particularly appreciate its offensive security approach. Coming from an offensive security background, I find PingSentinelOne Singularity Cloud Securityafe excels at identifying real threats that we can address immediately. This proactive approach is a major advantage of SentinelOne Singularity Cloud Security. While the defensive side might involve some assumptions and possibilities, I believe the offensive capabilities are the key reason we use SentinelOne Singularity Cloud Security.

We use SentinelOne Singularity Cloud Security as a cloud security posture management tool. SentinelOne Singularity Cloud Security is integrated with our GCP, Azure, and AWS accounts. It will identify all the misconfigurations and security issues on all these cloud platforms and alert us. In addition to the CSPM capabilities, SentinelOne Singularity Cloud Security has several other features like vulnerability management, container security, Kubernetes security posture management, and secret scanning

All of these features are bundled inside SentinelOne Singularity Cloud Security. It combines all the telemetry from the cloud, containers, and the Kubernetes platform. The vulnerability scanners are connected to the registries and give us a holistic picture of what else is vulnerable versus all the dummy data others would give.

Before SentinelOne Singularity Cloud Security, we didn't have visibility into the security aspects of our cloud environment. SentinelOne Singularity Cloud Security allows us to see all the misconfigurations and security vulnerabilities. Certain native tools from AWS are quite expensive and not as reliable, but SentinelOne Singularity Cloud Security fixes that issue. Also, for highly regulated companies, having a cloud security posture management tool is a hard requirement.

Regarding risk posture, there are two kinds of risk: perceived and actual. SentinelOne Singularity Cloud Security has helped us reduce the actual risk. Our compliance score went up from 70 percent to more than 95 percent now.

We realized SentinelOne Singularity Cloud Security's benefits maybe 1 or 2 months after the deployment. We integrated the regional module, and the extra features were there. About 6 months in, we really scaled it up. 

SentinelOne Singularity Cloud Security has helped reduce the number of false positives we deal with. They've been highly proactive. We have a Slack channel with their support team. We tell them the false positive you're seeing, and they get on a call with you in 30 minutes to solve that issue. 

The detection time is immediate. It finds vulnerabilities almost instantly, so the detection time has decreased considerably. In terms of remediation, it depends on how we are doing it. The remediation time has gone down, but not to the extent that we need it to. 

SentinelOne Singularity Cloud Security has improved cooperation between the DevOps and security teams by helping identify critical issues that must be prioritized instead of just going through and fixing each one. 

SentinelOne Singularity Cloud Security released a new security graph tool that helps us identify the root issue. Other tools give you a pass/fail type of profile on all misconfigurations, and those will run into the thousands. SentinelOne Singularity Cloud Security's graphing algorithm connects various components together and tries to identify what is severe and what is not. It can correlate various vulnerabilities and datasets to test them on the back end to pinpoint the real issue.  

For example, let's say you have a vulnerability in a public instance of AWS EC2, and there's a relationship between that instance and the Kubernetes platform. From there, Kubernetes is connected to a container with a misconfiguration or vulnerability. That attack path is the root cause of the issue in your environment. It doesn't simply tell you whether something is public. That is a feature AWS provides natively. Native AWS tools provide us binary results about whether the instance is open, but SentinelOne Singularity Cloud Security can break down the data to identify the core issues. 

SentinelOne Singularity Cloud Security is one of the easiest platforms to use. It's super intuitive. I have used CSPM tools in the past like CrowdStrike. This is much easier. With one click, you can deploy it in an hour. It automatically picks up a lot of the telemetry on its own. You don't need extra configuration steps because the scripts are all there. We can launch the cloud automation templates, and SentinelOne Singularity Cloud Security just directly deploys.

Agentless scanning is convenient for us. It will automatically copy the registry details from AWS, Azure, or GCP without any additional configuration before. If you have registries saved outside of your cloud environment, you can input the client key and secret file, and SentinelOne Singularity Cloud Security will integrate and scan it automatically. You don't need to deploy the agent because it does it on the back end. The best part is that they take this element and bring the cloud security posture management along with it. It will integrate the vulnerability scan into the containers, Kubernetes platform, and the entire cloud platform.

The offensive security engine isn't SentinelOne Singularity Cloud Security's standout feature, but it's an add-on that gives you insight into vulnerabilities in your cloud environment and how attackers can exploit them. 

We have integrated SentinelOne Singularity Cloud Security's infrastructure-as-code features into our GitHub platform, enabling us to scan all the TerraForm and Kubernetes YAML code for vulnerabilities. That is a nice feature that allows you to detect issues in your code before it is deployed. It's inside the pipeline. It will scan the code and block the deployment if it doesn't meet preset criteria.

I want SentinelOne Singularity Cloud Security to integrate additional third-party resources. For example, SentinelOne Singularity Cloud Security is compatible with Azure and AWS, but Azure AD isn't integrated with AWS. If SentinelOne Singularity Cloud Security had that ability, it would enrich the data because how users interact with our AWS environment is crucial. All the identity-related features require improvement.

I have used SentinelOne Singularity Cloud Security for a year.

I have not experienced any instability, yet. SentinelOne Singularity Cloud Security is pretty solid. 

SentinelOne Singularity Cloud Security is scalable if you have the licenses. 

I rate SentinelOne Singularity Cloud Security support 8 out of 10. From the deployment until December of last year, SentinelOne Singularity Cloud Security's support was stellar and proactive. The support hasn't been as good since SentinelOne Singularity Cloud Security was acquired by another company. It's similar to what I've seen with other acquisitions. When it was a startup, you got more personalized support. You could even get the CTO to get on the call with you, which was nice. They have room to improve, but maybe they are undergoing a transition period after the acquisition. 

Positive

We used a different solution, but the correlation wasn't as good, and it was expensive. 

Deploying SentinelOne Singularity Cloud Security is effortless because it's a cloud-based platform. It's pretty intuitive, and we had lots of support from SentinelOne Singularity Cloud Security. If we had issues, we just got them on a call, and they fixed them. SentinelOne Singularity Cloud Security requires no maintenance on our end after deployment. 

SentinelOne Singularity Cloud Security is cost-effective for the amount of infrastructure we have. It's reasonable for what they offer compared to our previous solution. It's at least 25 percent to 30 percent less. 

I rate SentinelOne Singularity Cloud Security 9 out of 10. I recommend that new users onboard as many features as possible. Don't just stick to the cloud security part. Integrate the cloud security with your containers and GitHub or Bitbucket repositories. Perform all the integrations whether you need them or not, and it will take care of everything on the back end for you.

We use the solution basically for AD protection. We get to see at a deeper level the different processes that are being run on computers.

We've been able to stop any potential malicious actions that are being taken on various computers.

Their detection of potentially malicious stuff is probably the most beneficial feature and their new Singularity XDR is an awesome platform.

The solution's real-time detection and response capabilities are very good. Pretty much anytime that there is something that we might see as potentially malicious is caught. Depending on the type of computer it is, it does a great job of blocking those actions that are being taken. 

It's really easy to configure enterprise-wide, which actions we want to stop. It's very easy to stop malicious stuff.

The solution's automated remediation is really good. We're doing the rollback also now. That way, if something does happen, it's able to roll back to the state before the process happens.

The solution's forensic visibility into our Linux kernel in regards to deep visibility is really good. It is very granular. It's able to show everything that it did. 

The historical data record provided by the solution after an attack is great. You're able to search by different computers. You can get a whole scope of computers - as much as you want. You're able to get as granular as you want as well and can identify different cross processes than indicators and different files that were launched during a period of time.

It helped reduce our organization's mean time to detect very significantly. We had Endgame before this. It did not stop the processes in a manner of time that you would like it to. This definitely improved our response time to anything that we saw. It's very fast. It's improved the response time by 50% to 75% from just detection time to our response. 

The solution reduced the organization's mean time to remediate. It is as fast as the potentially malicious process that's launched. It'll stop it right then and there. It'll remediate the action immediately. 

It helped free other staff to work on other projects or other tasks. We basically just had to do a bunch of upfront configuring. With it, we do not have to spend as much time in the console.

The solution's impact on your organization's productivity has been impressive. We just had to put a bunch of time upfront. However, ever since then, we haven't had to really do much there besides analyzing threats.

There's the singularity marketplace, which they've expanded a bunch. However, there are some other APIs that I'd like to see. We'd like to be able to connect to them from a SIM perspective.

The Automation tab is an add-on that doesn’t work properly. They provide a list of scripts that don’t work and I have asked support to assist but they won’t help. When running on various endpoints the script doesn’t work and if it does, it’s only a couple. There are a lot of useful scripts that would be beneficial to run forensics, event logs, and process lists running on the endpoint.

I've used the solution for about a year and a half.

The stability is very good. I'd rate stability ten out of ten. I've never had issues. It's never been down. 

We have four different properties on which agents are one and 1,700  workstations as well as 250 servers. 

The product is scalable. We have about 2,000 endpoints. If we had 4,000 or 10,000 it really wouldn't be an issue. It's just a matter of configuring your groups. It's good at autoscaling based on workload demands. 

Technical support is really good. Whenever a threat comes into our environment, they will comment and give analysis. That's been very helpful in covering items we're not totally sure of. 

Positive

I previously used a different solution called Endgame. We did a POC with Crowdstrike and SentinelOne and SentinelOne was a much cleaner, easier-to-use console.

The initial setup did take some understanding on our part of how we wanted to split and group. We needed to figure out how to split our servers and workstations. That was the hardest part. After that, we had to get our policies in order. 

We were able to get everything up within a week to where we were comfortable with how everything was running. We're still tweaking little things. 

We had three people on our team and two people from professional services. 

Maintenance is minimal, such as adding exclusions to threats or alerts. 

We did initiate the setup with professional services. 

We have noted a good ROI and haven't had a single incident since implementing the solution. 

The solution is fairly priced for what they're offering especially compared to other platforms. It gives you great visibility into the different processes that are running on different computers. It's fairly priced, especially for a cloud platform.

We are customers and end-users.

If someone doesn't think they need a singularity cloud workflow protection platform because they have a continuous security monitoring solution, I'd say it depends on whether you're able to block potentially malicious stuff or not. This solution gives you just about the fastest understanding from a machine-learning perspective. 

This is much better than our previous solution. They've innovated a lot in terms of their deep visibility and singularity XDR (which is more granular).

I'd advise potential users to do a POC no matter what. That said, this is a great product. I rave about it to everybody. It's likely my favorite product for our environment.

I'd rate the solution ten out of ten.