SentinelOne Singularity Cloud Security Reviews

We are a relatively smaller organization of roughly 250 people. We utilize SentinelOne for patch management, vulnerability assessments, and remediation. So whenever one of our users has an issue on their machine, we get an immediate notification to let us know what that intrusion, infection, malware, whatever it might be, where it is, what file may have caused it, and then we can immediately take action. 

There are also default settings for ensuring the software that SentinelOne installs on all our client machines. The latest agent is up to date everywhere. They have a couple more insights, however, that's our main use case.

The big thing for us was just having optics on vulnerabilities, being able to ensure that we have a secure way to get month-over-month assessments of our security stats, and ensuring that there's something in place that can make sure that we're secure. We also wanted something that could keep up with current demands without having any sort of interference or impact on the user's end.

The biggest thing for us is the level of minimal intrusion on our user's experience. The previous EDR we were using, Sophos, was not ideal. Whenever an update came out, there would be different things that were affected. At one point, an update from Sophos had completely disabled public Wi-Fi for our users. And when dealing through their message boards, dealing with their support, they, unfortunately, did not have a resolution other than disabling security elements of their software. With SentinelOne, we have not seen a single instance of that. You can get down to the user level of tweaking different elements of their security system. You can even quickly add exclusions based on rules. Being able to tailor to our users and making sure that our users don't feel like something is running on their machine is the biggest advantage.

The remote shell and the remediation are the two that really stand out as valuable features. The remote shell function that it offers is something that I use almost daily. It allows us to quietly and discreetly sign in on a user's computer, but only as admin. It prevents any sort of security issues or security risks to a user, which would be probably our favorite. 

The remediation is really nice as it gives a very clear understanding of where a file came from. For example, in our use of it, there are a couple of files that we had that we didn't even know that we had. There was software that no one was aware was installed on these machines more than three years ago; we actually learned about that software once SentinelOne was installed. The level of optics it gives you is just incredible.

With that software, as soon as we installed SentinelOne, there were a couple of different applications and software that were immediately flagged as tracking user information and things like that. We found out that there was actually some sort of remote surveillance software that the past iteration of the IT team had installed and tested that just never got removed. We ended up tracking down the vendor for that and getting their assurance that that was no longer being used.

The real-time detection and response capabilities overall are great. I've never used anything that was as fast as this. The software that we used to use, Sophos, was comparable, however, it had a noticeable impact on the user. The bigger thing for me is that there isn't an impact on my end users. When we are actually running a scan, let's say, if we find that there's an impact, it's very quick. We've tested it by throwing malicious software onto our test machines just to see how quickly SentinelOne actually picks it up. And it's literally within seconds. When you actually do a scan, you can scan your higher fleet, and it's done relatively quickly as long as those machines are powered on. And it will act the second that those machines power on and connect to the Internet again to get that signal.  I've never used anything as quick, personally. 

The forensic visibility into the Linux terminal is not something we use as we actually don't use any Linux machines ourselves, so I couldn't speak to that. As far as visibility goes, we're primarily a Mac organization, and we have ten percent of our users on PC. As far as Mac goes, the visibility is fantastic. Same with the PC side of things. 

The historical data record, from what they had shown us in the demo, looks pretty incredible. We thankfully have not suffered an attack that required historical data. 

In terms of our mean time to detect, I don't think we ever had it. Since we're a small organization, we haven't had any real issues with genuine malware attacks. I can't speak to a scenario where while we were on Sophos, we experienced one. When we've had security audits that have tried to pen test for us, we have not had any issues with SentinelOne whatsoever. Every time that we've attempted to see how accurate and how quickly it can detect an infection or intrusion, it's being caught immediately.

The same is true for mean time to remediate. Any remediation that we do, for example, as soon as we block off a file, the automatic remediations are nice. In the event that we want to have something behave differently on another machine, we can quickly change that once we see it in any incident log. Setting those permanent rules is very helpful since, if you know something's malicious, chances are you don't want it showing up anywhere else.

The product has helped free up your SOC staff to work on other projects or tasks. The work that we used to have to do with our previous provider in going through our vulnerability assessments on a monthly basis and in trying to track down the install path of different applications was a headache and a half. With SentinelOne, the application management, and vulnerability assessments, are easy. You can see directly to the file path. It cuts a significant enough time out of our day.

It's had a positive impact on our overall productivity. Being able to dig through and find applications faster has drastically cut down our vulnerability position. When we first started using Singularity, we were somewhere in the thousands. Within the first month of having used it for our vulnerability assessments, we were down to just 1600, and now we're sitting well under the 500 mark when it comes to critical vulnerabilities. It's been very drastic and exponential at that. Now, any time a vulnerability does pop up, it's very quick and easy for us to track down where it is and take immediate action.

The interoperability with third-party solutions is fine. We don't currently use Kubernetes in our organization, however, we do utilize a VPN and it has no issues with adapting to that VPN. We also utilize different storage, including cloud storage accounts. There are no issues there either.

They've been fantastic at supporting innovation. We've had their support; they're always very responsive and very quick to give us the right advice on how we can execute what we're looking to do. Making sure that you have access to the necessary system without interrupting your user and without your user feeling at risk of their privacy being invaded is huge.

Currently, we would have to export our vulnerability report to an .xlsx file, and review it in an Excel spreadsheet, and then we sort of compile a list from there. It would be cool if there was a way to actually toggle multiple applications for review and then see those file paths on multiple users rather than only one user at a time or only one application at a time.

I've been using the solution for nine to ten months. 

I've had no stability issues at all. We have not experienced any performance decreases.

As far as deploying to more devices, there's not a problem with scaling at all. We've automated in our MDM so any device that we start in our MDM automatically installs SentinelOne, and those devices immediately show up. If we spin up a new device on Mac OS, it shows within the set the SentinelOne console within seconds.

Their support has been fantastic. They are quick to respond. 

I've never had an issue with their support. What little time I did have one scenario where it was not something that they could help with, they'd been able to provide us with all the articles and information necessary to act on it on our own, which is really all you can ask for.

Positive

We were previously using Sophos. The biggest issue that we had with them was the fact that we were a fully remote company, so a lot of our users would be traveling for client meetings or even traveling abroad for client meetings. Reliance on a secure public WiFi solution is a very big deal for us. When it comes to users on a VPN, Sophos with MacOS's more recent updates would completely cut off Wi-Fi - which was very difficult for us to work around as a remote company. Thankfully, with multiple different tests in multiple different scenarios, we've never had that issue with SentinelOne. 

The other big thing is the capability to remove a device from the network. In the event that a significant intrusion or malware, malware, ransomware, whatever it might be, is detected the ability to just isolate that one user from internet access is huge. You would hope that that's how an EDR would behave instead of completely removing all internet no matter what.

The initial setup was pretty straightforward. Our organization uses Kagi MDM. And in using that MDM solution, it was very easy for us to just quickly put together an automated installer and deploy it. 

We have multiple different groups of users, including PC and Mac. With the smaller percentage of PC users, we were able to just change the group ID in the installer, and that ensured that they were placed into the proper place for their groups. Being able to tweak and ensure that from the back end within the SentinelOne console, we could ensure that everything is set up the way we want it to be once that user gets that package installed, makes life a lot easier. You don't need to worry about signing on with a user and changing any of those settings. The installer package that they get is going to be everything that they need. Once that installs, that's it. It was very seamless. If anything, removing Sophos was the hardest part of the installation process.

We were able to deploy using a team of three people. Hypothetically, one person could do it alone as long as they are well versed in MDM.

As far as the application itself is concerned, there was no need for maintenance. You can control everything from the console. When there is a new agent to install you receive a notification when you log in to the management console. You can control when that update gets deployed to your organization. You can break it up into different groups within your organization. For ourselves, we always test on a smaller number of users. And then once we see stability, we deploy to the rest. That's what little maintenance is involved. It's a drastic improvement versus other solutions that I've used.

We were able to do the initial setup completely in-house. We were able to do that on our own. We were able to very, very quickly deploy SentinelOne to pretty much our entire fleet.

Our ability to get in and review our vulnerability stance, whether daily, monthly, weekly, or whatever it might be, has drastically improved over our prior provider. Our users have less of a performance drain when attempting to use it. That's always huge when it comes to EDR. It pretty much checks every single box for us. It's the one software in our stack that we are happiest with.

For us, the pricing is very fair. They were willing to meet our price point. With very little negotiation involved, we just let them know what we could pay and they were willing to meet us at slightly above what we paid with Sophos, which was still very fair for what we were looking at. 

We reviewed quite a few solutions. The big selling point for this product was that they were willing to work with us on a price point as a smaller organization. That was a huge reason for us actually going with them. The fact that they were willing to work with us as far as the pricing goes was the main reason that we ended up going with them. It was nice to see that they work with the little teams.

We're a customer and end-user.

We thought something as good as SentinelOne would be out of the question for an organization of our size. We assumed it would be something that's suited to larger organizations - money, obviously, being the main concern. However, the fact that they were willing to work with us changed that. Seeing that they're willing to work with smaller organizations is cool. I like that they actually give back to the tech sector that way.

I'd rate the stability ten out of ten.

I'd advise new users that they're going to need to invest a little bit of time upfront in order to make sure that their organization is set up for proper deployment. We probably spent about a week or two configuring everything and getting it to work the way we wanted. However, after that initial investment of time, the maintenance that you have to do is pretty minimal.

We currently use Cloud Native Security for cloud security posture management, leveraging both the CWP module and the authentication security tab. While we regularly utilize these features, we're planning to onboard the cloud detection and response module, along with the ISIS scanning functionality.

We implemented Cloud Native Security as a secondary control measure to complement our existing security posture. In our Prisma Cloud environment, we have a detection score threshold set at 70 or above. As Cloud Native Security was a new entrant in the market, we wanted to evaluate its capabilities. Fortunately, Cloud Native Security's unique features and policies proved valuable. For instance, Cloud Native Security detected an alert when a developer accidentally committed VS Code files to a public GitHub repository. This helped us promptly remove the VS code from GitHub.

Cloud Native Security is easy to use.

The feature that has been most effective in threat detection for our cloud environment has been the cloud visual attack tab.

Our cloud security is managed by Intel and Azure Entra. We download a report from them and send it to our team to address any identified issues.

I appreciate that Cloud Native Security incorporates evidence of exploitability into their reports, making them more reliable.

Cloud Native Security's offensive security engine excels at validating potential exploit paths and prioritizing the most critical vulnerabilities. This enables us to proactively identify and address these risks, ultimately strengthening our security posture.

Cloud Native Security has helped reduce our false positives. We can investigate and mute any false positives so they don't appear going forward.

Cloud Native Security helps us actively identify threats, ultimately improving our security posture.

Cloud Native Security has reduced our mean time to detect by 10 percent.

Cloud Native Security facilitates collaboration between our cloud security application developers and AppSec teams. This collaboration is further enhanced by a shared console that provides visibility into all active tickets. This transparency helps to reduce redundant requests, saving time.

Cloud Native Security offers a valuable tool called an offensive search engine. This tool has been helpful for us. It allows us to search for vulnerabilities and provides evidence directly on the screen. Additionally, Cloud Native Security offers a feature called Graph Explorer. This feature allows us to drill down into specific resources, search for them on the console, and view details such as open security rules and graph features.

While only 5 percent of our workload resides on the Google Cloud Platform, we would still like Cloud Native Security to be configured with automatic remediation capabilities for GCP.

In Prisma, there's a dedicated tab for managing high and medium-severity alerts. This allows us to easily enable or disable specific policies based on our current needs. With Cloud Native Security, we can't selectively enable or disable alerts based on our specific use case.

I have been using Cloud Native Security for six months.

I would rate the stability of Cloud Native Security 7 out of 10.

The only downtime we had was when switching from V1 to V2 but it was smooth.

I would rate the scalability of Cloud Native Security 8 out of 10.

The technical support is good.

Positive

For the past three years, Prisma Cloud has been our go-to security solution. Recently, we've added Cloud Native Security to our toolkit to further strengthen our security posture.

The initial deployment was straightforward. First, we onboarded the UAT account. Then, we added our product support account and other accounts. We then tested the UAT environment accounts. The entire deployment took one week to complete. Two people were involved in the deployment.   

I would rate Cloud Native Security 9 out of 10.

Our primary cloud security monitoring solution is Prisma Cloud by Palo Alto Networks, with Cloud Native Security as a secondary control measure.

We have 19 users overall in our cloud security team that utilize Cloud Native Security.

The only maintenance required is for updates.

I would recommend Cloud Native Security to others.

To address our client's infrastructure vulnerabilities, we implemented Singularity Cloud Security by SentinelOne. This security solution effectively identifies and resolves security issues, streamlining the process of ensuring our clients' infrastructure remains secure.

For the past year and a half, we've been managing AWS infrastructure for a client, originally using basic AWS security tools. While these provided a workable solution, Singularity Cloud Security offered a significant advantage. It prioritizes vulnerabilities by severity, high, medium, or low, allowing us to focus on the most critical issues first. This centralized tool gathers information and displays all details on a single dashboard, significantly reducing manual work. The dashboard helps us identify problems, understand their meaning and potential impact, and follow clear resolution steps. This streamlined process enables us to address security concerns quickly and effectively, ultimately enhancing our client's infrastructure security.

Singularity Cloud Security was convenient and effective for threat management. In the past, we relied on daily information gathering and alerts, requiring us to manually address the findings. Now, Singularity Cloud Security provides continuous threat detection and simplifies our work, significantly improving our security posture.

The automated security responses have significantly improved our overall security posture.

Singularity Cloud Security is easy to use as it gives us the proper step-by-step methods to solve that vulnerability.

I would rate the evidence-based reporting for helping prioritize and solve important cloud security issues nine out of ten.

It is helpful that Singularity Cloud Security includes proof of exploitability in the evidence-based reporting. Although it isn't perfect, it gives us the right solution to mitigate vulnerability.

Our infrastructure configuration is defined using an Infrastructure as Code template. This template allows us to scan our entire infrastructure for potential issues, including pre-production problems within templates or container configuration files. Previously, we stored infrastructure details in a format that required manual data retrieval via CSV files. Now, with IaC, we have a centralized control system that manages multiple accounts and provides vulnerability listings based on severity for each account.

Our previous default AWS security tool wasn't sufficient, so we adopted Singularity Cloud Security based on a client recommendation. It's been a huge improvement. Whereas our old tool took three months to gather data, Singularity Cloud Security provides a daily updated dashboard with vulnerability information. This allows us to prioritize and address security risks based on criticality, saving us significant time and effort compared to the past.

Singularity Cloud Security has helped reduce the number of false positives by 70 percent.

Singularity Cloud Security streamlines manual work by providing insightful information on security vulnerabilities. It not only identifies issues we might miss but also offers in-depth analysis, including potential future costs and the severity of the threat. Additionally, it presents basic details tailored for users with less security expertise, empowering them to understand and address vulnerabilities effectively.

Singularity Cloud Security has improved our risk posture by 80 percent and has reduced our mean time to detection by 85 percent.

Singularity Cloud Security has reduced our mean time to remediation by 70 percent.

It has streamlined collaboration between our cloud security, application developers, and AppSec teams. This tool automates manual tasks, reducing our team size from ten to five. It provides us with the information we need to effectively identify and address vulnerabilities, making our cloud environment more secure.

It has been a huge time-saver for our engineering team, saving them weeks of work.

We have saved around 70 percent of our overall time with Singularity Cloud Security. 

Singularity Cloud Security has positively impacted our operational costs. The time saved by reducing manual work and resource requirements translates directly into cost savings.

Singularity Cloud Security's AI empowers us with improved security solutions. When faced with uncertainty, the tool can quickly provide insights to help us gain a clear understanding of the situation. 

The most valuable aspect of Singularity Cloud Security is its unified dashboard. This reduces manual work by centralizing all security information, allowing us to see vulnerabilities categorized by severity, low, medium, high, and critical. This clear prioritization streamlines the process of understanding, addressing, and resolving security issues, making threat mitigation significantly more efficient.

A recurring issue caused frustration: a vulnerability alert would appear, and we'd fix it, but then the same alert would return the next day. We reported this to both our internal team and SentinelOne for investigation and resolution. This needs improvement to prevent these repetitive alerts.

In a future update, it would be beneficial to have both an AI chat function and a more modern user interface.

I have been using Singularity Cloud Security by SentinelOne for eight months.

I would rate Singularity Cloud Security's stability nine out of ten.

I would rate Singularity Cloud Security's scalability eight out of ten.

In AWS, we previously relied on Amazon Inspector, a built-in service that automatically scans for vulnerabilities including VDF findings, a type of assessment finding in our resources. This not only provided a default security solution but also integrated with AWS Security Hub, allowing us to centrally address critical security issues. We migrated to Singularity Cloud Security by SentinelOne because our prior tools were labor-intensive and lacked a unified dashboard. Previously, identifying which accounts had vulnerabilities required manually checking each one. Now, Singularity offers a single pane of glass for all our accounts, displaying both account details and any security findings. This significantly reduces manual work and simplifies our security posture.

The deployment took weeks and involved ten people.

Singularity Cloud Security by SentinelOne is cost-efficient.

I would rate Singularity Cloud Security by SentinelOne nine out of ten.

Singularity Cloud Security is deployed in multiple departments and we have five users.

Singularity Cloud Security occasionally requires scheduled downtime for maintenance, which allows our technicians to identify and address any potential problems.

I recommend Singularity Cloud Security. It's streamlined our operations by reducing manual work and simplifying problem-solving. The user interface is intuitive, allowing even new hires to become proficient after just a few weeks of training.

We utilize SentinelOne Singularity Cloud Security for Cloud Security Posture Management and real-time cloud configuration monitoring. SentinelOne Singularity Cloud Security identifies vulnerabilities at the resource level and generates reports. It also includes defense modules that investigate potential exposure of secrets in public or private repositories. Additionally, the scanning module can identify vulnerabilities and analyze how they correspond to and impact other modules.

We chose SentinelOne Singularity Cloud Security as our cloud security solution for its ability to identify misconfigurations, both intentional and unintentional, within our infrastructure. Additionally, SentinelOne Singularity Cloud Security generates reports that facilitate security compliance audits and help us identify inactive user accounts. It further integrates with our Jira instance, allowing for seamless data visualization on our security dashboard.

SentinelOne Singularity Cloud Security is user-friendly. The portal is well-designed and intuitive. SentinelOne Singularity Cloud Security boasts excellent customer engagement. They keep us informed with monthly updates on new features and upcoming releases, providing opportunities for learning and raising any challenges we encounter. Their approach is both proactive and professional.

It's evidence-based reporting system prioritizes and assigns reported issues to the appropriate teams based on their severity. This ensures that critical issues are addressed first. Reports are initially delivered to our CTO and then disseminated to the relevant teams for action.

Our agentless vulnerability scanner helps us discover vulnerabilities across our cloud infrastructure by analyzing cloud logs and log flows. It then provides detailed information and guidance on the identified vulnerabilities.

We find the offensive security engine that verifies actual exploit paths and prioritizes breach potentials to be very useful.

Using SentinelOne Singularity Cloud Security streamlines our cloud configuration validation process. We no longer need to spend excessive time and effort planning or using other tools to ensure our configurations meet industry standards. This reduces the training burden on our team, keeping them current with security best practices. Additionally, SentinelOne Singularity Cloud Security acts as a safety net, providing peace of mind and increased confidence when deploying updates, rolling out new policies, or making any security-related cloud configuration changes. Our experience and trust in SentinelOne Singularity Cloud Security are well-founded. Their support has consistently addressed any concerns we've raised throughout the year. This report demonstrates the value of maintaining a compliance center, and SentinelOne Singularity Cloud Security plays a critical role in making that possible.

SentinelOne Singularity Cloud Security has been instrumental in reducing false positives during login deployments. For example, when our server load balancer or cluster switches between servers. During this brief window of usually just a few seconds, the DNS isn't mapped to any background resources because it's being transferred from the old load balancer to the new one. While this is a minor, expected occurrence, it was previously flagged as a critical issue. Resolving these false positives took several hours. While SentinelOne Singularity Cloud Security likely detects these discrepancies in real time, it validates and corrects them based on a specific schedule. This delay in resolving the alerts prompted us to report the issue and request suppression of these expected findings. Highlighting this problem helped draw the attention of our executives and senior management.

SentinelOne Singularity Cloud Security has significantly improved our security posture. In the past, developers occasionally exposed credentials to the public unintentionally. SentinelOne Singularity Cloud Security effectively detects and reports these incidents to senior management, allowing us to address them promptly. Additionally, during infrastructure testing, security gateway code might be unintentionally exposed. However, SentinelOne Singularity Cloud Security helps us swiftly identify and mitigate these issues before any damage occurs.

Thanks to SentinelOne Singularity Cloud Security, we've significantly reduced our mean time to detection. It delivers the critical data we need, eliminating the need for dedicated full-time staff.

SentinelOne Singularity Cloud Security has helped us improve our mean time to remediation. Now, we can get prompt support from their team, allowing us to work together to mitigate issues quickly.

SentinelOne Singularity Cloud Security has improved collaboration between our cloud security team, application developers, and AppSec teams. Notably, secret configuration detection allows us to collaborate effectively with developers to swiftly resolve any emerging issues. Our DevOps team handles cloud security, and all teams are satisfied with SentinelOne Singularity Cloud Security's implementation. They actively participate in monthly meetings.

The collaboration has freed up some of our engineers' time. Once we enabled the module and it began identifying issues, engineers were able to plan their work more effectively. The analytical dashboard also helps them manage tasks efficiently, eliminating the need to hire additional staff.

SentinelOne Singularity Cloud Security offers comprehensive security posture management. Its success stems from its ability to analyze DNS mappings. While we may have access to the DNS record itself, the underlying infrastructure associated with that domain might be decommissioned. This creates a potential risk, as the domain could be remapped to a malicious website, leading to data breaches or credential theft. However, SentinelOne Singularity Cloud Security proactively detects and alerts us to such accidental exposures of sensitive information, including SaaS credentials. These are some of SentinelOne Singularity Cloud Security's most valuable features.

There is room for improvement in the current active licensing model for SentinelOne Singularity Cloud Security. As both a customer and service provider, I believe a more comprehensive package could be developed that would be mutually beneficial.

I recommend including endpoint monitoring functionality in a future release of SentinelOne Singularity Cloud Security. While we currently scan our endpoints manually through an external vendor, integrating this capability within SentinelOne Singularity Cloud Security would offer significant advantages. Additionally having real-time detection of malicious activity in our network would be beneficial. 

I have been using SentinelOne Singularity Cloud Security for 2.5 years.

SentinelOne Singularity Cloud Security is stable.

SentinelOne Singularity Cloud Security is scalable.

The technical support is responsive and they stay in contact with us.

Positive

As an energy company, SentinelOne Singularity Cloud Security helps us ensure compliance across our many providers, which is essential for our business expansion.

The pricing for SentinelOne Singularity Cloud Security in India was more reasonable than other competitors.

I would rate SentinelOne Singularity Cloud Security eight out of ten.

We have 15 people in our organization that use it. SentinelOne Singularity Cloud Security is responsible for the maintenance.

It is a sophisticated and fast-growing product with great services. 

We did a PoC, but we did not go ahead with SentinelOne Singularity Cloud Security. It is currently on a test cluster. It is not in production.

We were looking for a CSPM tool to monitor all of our AWS resources. We also wanted it to give us an alert in the case of a vulnerability. If, for example, a zero-day vulnerability is there, it should scan all of our tools.

We used agentless vulnerability scanning. It helped us to see all the vulnerabilities without deploying any third-party component in our system.

We used SentinelOne Singularity Cloud Security's Offensive Security Engine. It helped us to identify all the CVEs. We could see what kind of CVEs were there and what severity level they had, such as normal or critical. It helped visualize all the severities.

SentinelOne Singularity Cloud Security changed our security posture a lot. In one dashboard, we were able to see all the information. We could see which resources are vulnerable and which ones have critical bugs. It helped us with that.

SentinelOne Singularity Cloud Security did not reduce our mean time to detect and mean time to remediate.

SentinelOne Singularity Cloud Security helped with collaboration, but in my organization, developers are not directly involved with SentinelOne Singularity Cloud Security. There was mainly the infrastructure component where we deployed agents and based on our particular role or access, they were able to send all the data to the SentinelOne Singularity Cloud Security server. We were able to see all the reports and all the details in the UI.

We liked the search bar in SentinelOne Singularity Cloud Security. It is a global search. We were able to get some insights from there.

The reporting feature is good. It is able to generate reports.

Its UI is very good, and it is easy to adapt. Any new person will be able to navigate, and within a week, he or she will be able to understand SentinelOne Singularity Cloud Security.

We wanted it to provide us with something like Claroty Hub in AWS for lateral movement. For example, if an EC2 instance or a virtual machine is compromised in a public subnet based on a particular vulnerability, such as Log4j, we want it to not be able to reach some of our databases. This kind of feature is not supported in SentinelOne Singularity Cloud Security.

If there is any virtual machine running on your public subnet, it is accessible outside your network. It is accessible via the Internet. If it has any Log4j or remote accessibility vulnerability, the attacker would be able to access the machine. From the private machine, the attacker can do NS Lookup and reach our DBs. It creates a channel for vulnerabilities. Such a feature is not present in SentinelOne Singularity Cloud Security.

It is stable. We have not had any issues.

It is scalable.

They were helpful. They helped us with the configuration. They were available through the Zoom call. Initially, they also provided us with a demo of all the features. They showed us all the features that we could use.

The speed of their support was good. I would rate their support a 9 out of 10.

Positive

We are using Orca. We did a PoC with SentinelOne Singularity Cloud Security, and there were some cost benefits. 

SentinelOne Singularity Cloud Security is a SaaS solution. I was involved in its initial deployment. It took around three months.

We used their support. Its implementation requires at least two people.

Its pricing was a little less than other providers.

I would advise doing a PoC with all the similar tools and then making a decision based on the capabilities, features, and price. 

Overall, I would rate SentinelOne Singularity Cloud Security a 9 out of 10.

We have AWS for most of our infrastructure, however, we don't have a dedicated security team. There are a lot of potential vulnerabilities which we are concerned about. We use SentinelOne Singularity Cloud Security for security. For example, if there are open ports or incorrect configurations, we would get alerted and could fix them.

They have dedicated cloud-based configurations, which are quite helpful. 

The product works well with AWS. It can help us manage AWS security. If there are any groups or details that are incorrect or unsafe, or even misconfigured, it helps protect us. 

The product offers ISE scanning, which basically scans all activities for issues. 

We can pick up on pre-production issues. It's very helpful. They've helped us by providing a lot of CI/CD tools. Everything gets scanned so that we can get a sign-off before a deployment.

The ease of use is very good. I'd rate the ease of use 8 out of 10. They have nice UI and templates and the docmentation is very helpful. It's very thorough. 

They also have a good support system for users. If something is not working, they have a good SLA, and within a day or so, they will reach out and help you with whatever you need. 

The agentless vulnerability scanning is great.

If a protocol is not being properly followed, we'll be alerted. This helps us react faster to any production issues. 

We do use the offensive security engine. It's good for verifying exploit paths and prioritizing items. We have recently started using this. It allows us to see which endpoints, for example, are publically accessible, or what code repositories have vulnerabilities in terms of libraries we are using that may be outdated. For example, if we've noted our NGINX server is very publically exposed we can change things. 

The benefits of the product were felt almost immediately as it allowed us to handle issues in the pre-production phase. We didn't have to make anything live before finding issues. Within an hour, we'd begin to see issues, and within 4 to 6 hours, we'd have a full survey of security vulnerabilities. We also get regular notifications when the system sees something is off. Based on the information we receive, we're able to react and fix things very quickly.

We're able to see both high and low-priority issues so that we can accurately prioritize what to do first. That helps us manage bandwidth in terms of resources. 

SentinelOne Singularity Cloud Security has helped us reduce the amount of false positives we see. We've reduced false positives by around one-third. 

Our mean time to detect has been reduced, as well as our mean time to respond. We used to rely on a third-party provider to find issues, and now we can do it in-house. This means we no longer have to sync our AWS information on a daily basis. Now, we have a direct integration with SentinelOne Singularity Cloud Security. We used to have a delay of 36 to 48 hours before we would recognize if there were any vulnerabilities. On top of that, there was a reaction time delay of 4 to 6 hours, meaning issues wouldn't be dealt with until maybe 50 or so hours after the vulnerability was detected. We've reduced all of this down to maybe 8 to 10 hours.

The collaboration between cloud security, application developers, and AppSec teams has been better. It's mostly been positive for us. 

They could improve on their UI.  Sometimes it's not clear where to look when seeking information. Support often can direct us by giving us the correct link to what we are looking for. 

I'd like to see better onboarding documentation. If we want to be able to integrate something new, such as new assets, it can be difficult. 

I've used the solution for more than 2 years now. We started using it around December 2021 or January 2022. 

I haven't faced any lagging or crashing. 

For our use case, it has been scalable. 

The support they provide is good. They give you very detailed information and documentation which they have created internally. They are very informative. They've even shared their own internal documentation in terms of AWS issues or questions. 

They are quick to respond, You can rely on them. 

Positive

We did use a different solution, however, it didn't offer direct AWS integration. Due to this, we had to wait up to 48 hours for information on vulnerability issues. We were already having security issues in that timeframe, so we needed something that could help us detect faster. 

The initial deployment was easy. However, having more initial onboarding documentation would have been better. However, we've created some internal docs that have helped us with our use case. How long it takes to deploy depends on the use case, however, we were able to have it up in 12 to 14 hours. We had 2 people working on the deployment. 

SentinelOne Singularity Cloud Security did offer some assistance with the setup.

I'm not sure of the exact pricing. However, my understanding is that it is very economical. 

We did explore Crowd Strike at some point. Crowd Strike was a very big platform and we were not sure how much support we'd get. We wanted to make sure we had priority support.

I'd rate the solution 9 out of 10. The usability is very good. Both their new and mature products are good in terms of their overall usability.

We adopted Cloud Native Security for its offensive security engine, which no other tools provide. It checks to see if any file or domain has public access. We also use it for cloud configuration scanning. Now, we are integrating it with cloud detection and response and plan to integrate it with CloudTrail and logs. Multiple team members use the solution. Our cloud security team has more than 10 members. We sometimes forward issues to the application team.

When creating cloud infrastructure, Cloud Native Security evaluates the cloud security parameters and how they will impact the organization's risk. It lets us know whether our security parameter conforms to international industry standards. It alerts us about anything that increases our risk, so we can address those vulnerabilities and prevent attacks. 

Compliance management is critical for every organization. Our compliance score was pretty low when we started using Cloud Native Security. Now, we've started seeing improvement every quarter.  We're around 85 to 95 percent compliant. When we see any alerts related to configuration, we raise a ticket with our follow-up team unless the issue is resolved automatically. We eliminate false positives and identify and work on any problems with our policies or other issues. 

Cloud Native Security has reduced our detection time by 15 to 20 percent through automation. The solution makes it easier by showing every impacted resource on a single dashboard. If we didn't have an automated tool to show us all the affected assets, we wouldn't know what's happening on every server or the resources we have created. Without this solution, we had to go to the documentation page for every cloud provider and implement the change. Now, we can check a single dashboard to get an overall idea of how something impacts our resources, and it helps us to automate. 

The solution has improved collaboration between our teams regarding security posture. We can say to the cloud security team that they need to follow a particular posture-related practice or adopt a network configuration, like blocking public access to a resource. We give these requirements to the network development and application teams.

Cloud Native Security has reduced our vulnerabilities and misconfigurations, improving our security posture. We had about 10,000 alerts when we started, but we brought that down to around 500. That was a considerable improvement in six months. 

I have worked on most of the tools in the market, and every product has distinctive features. Cloud Native Security's standout feature is offensive security. That's something no other product offers. All the other products have the same core features, such as vulnerability scanning. 

The UI is user-friendly, and the recommendations are easy for everyone to understand. If any misconfiguration happens, all four teams can read the options and understand how to implement them. To achieve these goals, we can also create an automated template according to cloud security best practices

SecOps plays a crucial role in our deployment and testing in the software lifecycle. In the course of building and deploying our applications, we need to look at our vulnerabilities and configurations. It's easy to identify these things and fix them before deployment by integrating Cloud Native Security.

The solution's evidence-based reporting is helpful because it provides real-time information. If a file has been opened and we haven't provided access, it gives us the evidence. It tells us the domain, and we try to investigate by going to the team that owns the file. We require them to make the file private, so it can't be accessed from the internet.

Cloud Native Security's reporting could be better. We are unable to see which images are impacted. Several thousand images have been deployed, so if we can see some application-specific information in the dashboard, we can directly send that report to the team that owns the application. We'd also like the option to download the report from the portal instead of waiting for the report to be sent to our email. 

We started using Cloud Native Security last year.

Cloud Native Security doesn't have any bugs or glitches. It's fairly stable.

I rate Cloud Native Security nine out of ten for scalability. 

I rate Cloud Native Security support nine out of ten. They have email support, but there is no option to raise tickets from within the portal. Now, they have Intercom, and we raise tickets through that. 

Positive

We previously used Prisma Cloud, which has many of the same features, such as cloud-based configuration, Kubernetes scanning, vulnerability assessment, etc., but Cloud Native Security has the Offensive Security Engine. That is the main reason we switched.

Our organization started with a POC for a month and a half before presenting Cloud Native Security to our VP and senior leadership. They gave us the go-ahead, and we finalized the product. It took us less than a week to implement, but the deployment time depends on the organization. It might take time if they need to get approval from leaders. 

I rate Cloud Native Security seven out of ten for pricing. It's cheaper than many other products. 

I rate Cloud Native Security nine out of ten. It's a mature solution that includes all the features found in other products on the market. 

We use the product across all of our entities for EDR, threat detection, and response methods.

We wanted a solution for protection. We had a number of entities with various EDR solutions. We wanted to centralize under one EDR solution, and we wanted one that was efficient and easy to manage with a small team.

The biggest thing for us was getting to a single platform. A single pane of glass has been nice. The ability to segment various sites out. The R-Back involved is super helpful for us as we are a multi-company organization. In general, the time has been greatly reduced for incidents.

The ease of use of the platform is very nice. The console provides excellent visibility into events that occur and, in general, the wide range of tools that are built into the agent itself.

My impression of the product's real-time detection and response capabilities is good. It definitely is a little bit different. It takes a little bit more time to learn than some of the other solutions that we have worked with in the past. Once you do understand it and once you're capable of running through the GUI and you understand what the logs and various windows they're trying to tell you, it's fairly straightforward.

The solution's automated remediation is good. I like that you can segment it into four options. You can choose to kill it at any time in the kill chain, so you can choose to quarantine it, you can choose to remediate, you can choose to roll back, you can choose to let it run. Being able to choose how far along you want those events to get is pretty nice.

The historical data record provided by the solution after an attack is decent. It gives you a flowchart of the attack. All along the processes you get good visibility and see all that were detected. Definitely, from a post-incident analysis perspective, it's very strong.

The solution has helped reduce our organization's mean time to detect by 20% to 30%. Given that extra 20% to 30%, it frees us up to focus on other items. 

The solution's impact on our organization's productivity is good. It provides robust whitelisting capabilities and improves our productivity. 

Agent releases need to be more stable before being pushed out. 

Bugs need to be disclosed quickly.

The reporting, and the logging visibility, are not there. It's very, very crude and simple. It needs to be drastically expanded. 

They need to expand their third-party integrations with SIM tools, and sites need to be given the option to expire at the end of the contract as well.

They could expand their integration with Kubernetes. They are trying to build out their third-party integrations. It does work well on Windows and Mac. 

I've used the product for three and a half years. 

Agent stability and communication with the console and agents going offline can be an issue. It can be time-consuming to coordinate and fix. However, the cloud console is very resilient. It's mostly the agent releases where we might have issues. CrowdStrike agents seem a little more stable. 

We have about 3,000 users using the solution.

Scaling is no issue. 

Technical support is hit or miss. We have worked with some good agents and some less knowledgeable. 

Positive

We have used different solutions, including the fact that we still CrowdStrike at a couple of companies. We are now moving more fully towards SentinelOne.

The simplicity and ease of use were big and where SentinelOne stands out. It's a set-and-forget policy. Based on what we saw in testing, it was the best option. 

In terms of telemetry data, we were all over the board.

The initial setup was a little more complex when we first started. However, they've smoothed a lot of their implementation out and so it's gotten easier over time. It took us a couple of weeks to a month to deploy. About 20 were involved in the deployment. We have 30 to 40 companies around the world and it's across every company and every department. 

The solution does require maintenance. You need to have agents up to date and cases closed properly. It does require you to be invested. 

We have witnessed ROI. It's comprehensive in its detection capabilities and has saved us from multiple attacks. We've likely saved 30% based on prevented attacks. 

The solution is relatively cheaper and is willing to work with companies on pricing. 

We are customers.

For those who believe they already have a continuous monitoring solution in place, I'd advise that SentinelOne knows its own product. They can provide that extra confidence that nothing gets missed. And if you see a high number of alerts, they're able to really help you discern those and get down to the ones that matter most.

The solution doesn't affect our ability to innovate one way or another. It doesn't hold us back.

I'd recommend the solution and advise running a POC in your environment. It's good to run against CRowdStrike. They are seriously contending against CrowdStrike.

I'd rate the solution eight out of ten.