SentinelOne Singularity Complete Reviews

We use SentinelOne Singularity Complete for its end-to-end detection and response capabilities.

We started using SentinelOne Singularity Complete because I wanted to eliminate a number of our existing first-generation tools, which were designed primarily for on-premises use cases. I wanted to move to our new set of tools, which were designed predominantly for cloud deployment and cloud infrastructure. There were two primary drivers for this decision: to reduce complexity and cost and to move to a solution that was specifically designed for our new architecture.

One of the main reasons we bought SentinelOne was for its integration capabilities. We don't have a standalone tool to supplement our overall security architecture. This includes our security data link, analytics layer, and intelligence capabilities. So that was really one of the primary reasons.

SentinelOne Singularity Complete excels at ingesting and correlating data across the security solutions that it has visibility into.

It has helped consolidate two of our security solutions.

SentinelOne Singularity Complete has helped our organization by boosting our confidence in our ability to detect and respond to the broadest range of threats, reducing noise in our security operations capability and resulting in fewer false positives than ever before.

It helped reduce our alerts by around 60 percent per day. SentinelOne Singularity Complete helped free up 20 percent of our staff's time to work on other projects.

Although I do not have data to support the claim, SentinelOne Singularity Complete should reduce MTTD. SentinelOne Singularity Complete has reduced our MTTR. It has saved us around 18 percent of our costs.

I find two features particularly valuable. First, deployment is much simpler than with other solutions with similar capabilities. Second, the fidelity of the detections is excellent. We have had very few false positives or false negatives, which allows our analysts to focus on their work instead of dealing with noise.

SentinelOne plans to integrate its endpoint agents, but the process is slow. The company has multiple agents with different functions, such as the ED Ranger, and each agent has different actual clients. Combining the endpoint agents would be a good step.

The endpoint firewall capability is fairly primitive and basic. It does not use objects and different device types to create a single object that can be easily managed. There is a significant amount of work to be done on the firewall side.

I have been using SentinelOne Singularity Complete for almost seven months.

SentinelOne Singularity Complete is stable.

SentinelOne Singularity Complete is scalable.

Technical support has been excellent so far.

Positive

We previously used Tanium and Symantec, two separate sets of tools. Tanium is a first-generation tool that is not specifically designed for the cloud. It requires a significant amount of manual effort to configure and manage, rather than automate these tasks. Symantec does its job, but we are essentially buying two tools to do what SentinelOne Singularity Complete can do on its own. Therefore, the switch to SentinelOne is primarily a cost-saving measure.

The initial deployment was straightforward. The entire deployment took 16 weeks, with eight weeks spent deploying the endpoints and eight weeks spent deploying the service. A total of 20 people were required for the deployment.

We are beginning to see a return on investment in SentinelOne Singularity Complete due to the reduced number of alerts in the operations center and the high-fidelity data.

After negotiations, the pricing was found to be fair.

I would rate SentinelOne Singularity Complete an eight out of ten.

SentinelOne Singularity Complete is a really mature product and seems to be focused on enhancing core capability and not getting distracted by other stuff.

SentinelOne Singularity Complete is deployed across our entire estate. We have around 10,000 endpoints.

It requires maintenance, such as builds, policies, and other related tasks. We have a team of four responsible for maintenance and another three people for day-to-day operations.

They have stepped up as a strategic security partner.

I recommend organizations do a proper proof of concept with the SentinelOne Singularity Complete in their environment using their tools and their people.

It is an all-in-one agent on multiple operating systems that can detect malicious and suspicious activities. You can also use it to respond to different threat signals that you get from the platform.

There are multiple engines that run different types of detection, such as behavioral-type activities, that it can detect. It can also detect malicious activity based on a hash. It's a pretty great tool.

Overall, the level of detection and visibility we get have vastly improved, and that means the protection for our company has improved likewise.

Singularity has helped reduce the number of alerts we get. We were using FireEye at one point, and it was producing a ton of false positives. We have seen a major reduction in false positives, and that has saved our team's time. We have time to do other projects now.

In my previous company, we were using a Cisco product, and there was a ton of time wasted. Out of a 40-hour week, about eight to 10 hours were wasted, and with Singularity, we were able to get back about nine of those hours. Obviously, there are alerts coming in, and you have to investigate them, but the number was greatly reduced. In my current company, about 15 hours a week were wasted with false positives and wild goose chases and alerts. Now, we may put an hour into investigations. The great thing about SentinelOne is that you can get right down to what's going on with the events and deep visibility. It has saved us around 12 to 14 hours a week.

It's pretty quick when it comes to time to detect because you're right on the endpoint. Some agents have a delay in terms of when they report back to a console or a reporting server, but with SentinelOne, it seems that the agent is talking to the console right away. There isn't a huge delay.

Our mean time to respond is also very quick once we see the threat come in. It depends on the policy that is in place and the type of threat. If it is something suspicious, which we don't always have a set response for with the platform, we are able to easily look at what's going on a couple of minutes before the threat and what comes after. We can see the artifact on the endpoint, what is executed and what the user was probably doing. That means we're able to respond really quickly with all that visibility.

When it comes to cost savings, in the first company where I used SentinelOne, man-hours were saved, and it was cheaper to use SentinelOne than the Cisco product.

One use case where we've reduced risk has been due to users using something risky. They were trying to use an application that's like a keylogger. We've blocked it, and we've also created a rule using a star to detect when people are trying to use it. We have also set up rules to detect downloads of risky software, and that's protecting us too. It's protecting us from risk, but there's not a lot of reduction other than some protections and blacklists.

The deep visibility is a valuable feature. I can use it during threats or alert signals that we get. I can also use it when we have alert signals from other security tools that we have. I can use the SentinelOne platform to dive into those, even though there's no alert from SentinelOne, and zero in with a timestamp using its deep visibility to look at an endpoint and see if there's anything going on that might be correlated to a threat.

And Singularity's interoperability with other solutions has been a major bonus. You can put exclusions in place for other security platforms. For example, if you're using Symantec, you could easily put in an exclusion for that. The way that you can put them in, with the scope and the different groups, is really great. Singularity also provides pre-baked exclusions for interoperability with other pieces of equipment. For instance, for Microsoft SQL Servers, it already has pre-baked exclusions that you can put in for interoperability. It's far beyond the other platforms that I was using before.

In terms of ingestion, it's definitely taking in a lot of information at the endpoint level. You still need a human to do some of the correlation of the activities. The SentinelOne platform is looking at the endpoint, but you still need a human on the other end to analyze what the human at the other end of the endpoint was doing. But overall the solution does pretty well at correlating activities. I have seen some serious threats come in, and it definitely detects them right away with a pretty good correlation to the threat.

During my use of it over the years, they've been continuously improving it.

My biggest complaint is that when you're logged into the console there is the Help section where you can review all the documentation. But when you log in to the support portal, there is documentation there as well. They need to sync those two into one place so that I don't have to search in two different locations for an answer.

And I'm on the fence about whether to keep the agents a little bit longer than they do, before they go end-of-support. That might be an improvement, but I'm not positive about that.

I have been using SentinelOne Singularity Complete for about four years.

Uptime is all the time. 

I've only had one experience where there was a disconnect between the agents and the console. It was pretty brief, but that is when I opened a case with support. I had never seen that before, so the uptime is awesome. It's up 99.9 percent of the time.

It's very scalable. We are working on a special project, in which we want to set up a lab for a special event. I talked with our support, and they said we could set up another site. It's really scalable.

As I mentioned, I recently had a case because there were a lot of agents offline for a moment. Their support responded within one minute. That was an outlier. Every other case that I've opened up with them has not been a priority-one issue, but they usually respond within about five to 10 minutes, and they have been really great. I have not had an issue yet with support.

Everyone I've worked with in support is awesome. They always have the answers. Even if it's a complex issue, we usually get right down to it. I'm really happy with support.

Positive

I have used it in two different workplaces. Both workplaces were replacing platforms that just did not perform well and did not give you good visibility into what was going on on the endpoints. Both had a higher rate of false positives, and neither had the various detection engines that SentinelOne provides.

I was involved in the initial deployment of the solution in my previous place of employment and it was straightforward. It was only made complex by our own IT department.

There is a little maintenance. I check on a daily basis because you can build out multiple groups. When a new agent is deployed, I have it start off in a specific group to get the agent installed, and then it does a full disk scan. There is a little maintenance—and maybe no one else does this—but I log in and check for new systems. Once they have their full disk scan completed, I'll move them over to the production policy. You could do that on a weekly basis but I do it daily. The morning maintenance is less than five minutes for me, and you could definitely do that weekly as well.

I did it mostly by myself. I had another engineer working with me but that was it. It's really easy, a no-brainer. And that was for about 1,200 endpoints

I'm not a manager, but the return on investment may be in saving man hours.

When we were checking out different platforms we did get a price from Microsoft and it was unreasonable. SentinelOne was definitely reasonable and worth the money.

I've used several different platforms. We had a demo of the Carbon Black EDR, and I've used the FireEye EDR, Symantec, and Cisco.

We did a comparison between CrowdStrike, Carbon Black, and looked at Microsoft's EDR products.

As far as consolidation of security solutions goes, I have some suggestions for my leadership. I think we can definitely consolidate. For instance, we have a certain network segmentation where we have multiple security tools, including the SentinelOne agent and other agents on the devices. These devices are lower-end systems that don't have super-high specs like you might have on a power user's PC. In that area, we could eliminate one of the security agents and leave the SentinelOne agent. We would be covered in several different areas, such as FIM. I could create a custom rule to watch a certain configuration file, and if it changed, we would receive an alert. You can definitely use it to consolidate. Although we haven't done that yet, we're going to start because it's possible with the SentinelOne.

I believe we could save money by reducing the number of agents on those endpoints. If you walk that back to the yearly cost when we buy licenses, we should be able to save money on licensing for the other agent that we're using.

SentinelOne is very mature as an EDR platform. I would definitely put it in my top two. Across the breadth of everything I've dealt with using SentinelOne, even support, it's definitely top-two and you should check it out. I don't have a bad thing to say about it.

You definitely have to check out SentinelOne. They are firing on all cylinders for multiple areas that you want to consider when buying a tool like this. They're at 100 percent. When it comes to visibility, they present the information so that it's easy to read and understand. Responding is really easy to do. Support, which is a big factor nowadays, has faltered at some companies over the past four years, but support from SentinelOne has been awesome. Put SentinelOne in your PoCs. If you're looking at a couple of companies, you have to look at SentinelOne.

SentinelOne as a provider is a major player in hardening the protection of our environment.

I use SentinelOne Singularity Complete for endpoint protection and remediation. It protects all computers in my company and sends real-time alerts about malware, viruses, etc., that may have found a way through all of my company's defenses.

SentinelOne Singularity Complete has benefited my organization through its rapid ability to find new and existing malware that I must act on. As the solution uses AI technology, it's able to find both known and unknown threats.

My organization realized the benefits from SentinelOne Singularity Complete quickly from the time of deployment.

What I found most valuable in SentinelOne Singularity Complete is the ability to connect to the terminal remotely. The solution is pretty handy because it allows my company to do investigations and whatnot, wherever the person may be. After all, I belong to a hybrid organization, which means you never know if someone will be in the office.

It is another tool in the tool belt for looking at some of the files, which means that even if the file is not a virus, you can go in and do some investigation.

SentinelOne Singularity Complete has excellent interoperability with other SentinelOne solutions, including third-party tools. I was pleasantly surprised with how in-depth the APIs go because it's almost integrated with my company's SOAR solution, consolidating all alerts in one place and triangulating more per case. In my company, SentinelOne Singularity Complete is integrated with a third-party tool.

My impression of the ability of SentinelOne Singularity Complete to ingest and correlate data across security solutions is good so far, though right now, my company only set up SentinelOne Singularity Complete. Still, it's good that the integration option exists because, in the future, who knows? My company might do some integration depending on what the timing allows.

My company has not consolidated solutions yet because SentinelOne Singularity Complete is just one of the many tools used within my company. It's a helpful tool, but it's not the only player.

SentinelOne Singularity Complete helped free up staff for other projects and tasks and is time-saving, though I don't have specific data on that.

The tool has also helped reduce my organization's mean time to detect. However, I can't give an approximation just because SentinelOne Singularity Complete is the only solution my organization uses. The tool has also helped reduce my organization's mean time to respond because, together with the SOAR solution, SentinelOne Singularity Complete allows my company to go in and correlate everything to find out where the threat came from, so my company can go in and take the appropriate measures to shut down threats more reliably.

SentinelOne Singularity Complete has helped reduce organizational risk because it's one of the modern architecture tools, which gives more confidence in the detections my company sees. The tool also reduces the number of false positives and false negatives, so my company knows that if the tool shows a hit, then that truly warrants further investigation.

I'd give SentinelOne Singularity Complete an eight out of ten in terms of its ability to innovate because it's very much on par with a few other options out there, though I can't recall the names right now.

SentinelOne is an excellent strategic security partner that quickly incorporates my organization's feedback. My organization hasn't had any problems. If my team is looking for a feature, for example, SentinelOne either edits a roadmap or makes the change pretty quickly if there's bandwidth.

They say there is an investigation function in the interface of SentinelOne Singularity Complete, but it's not absolutely available for use. It's a function I've been looking for, but my company can't use it yet for some reason, so this is an area for improvement.

Another area for improvement in the tool is the larger learning curve that stems from it being full-featured, so there's a more significant learning curve in figuring out the environment versus using a more traditional antivirus. It's a lot more than just installing it on the machines.

The other disadvantage of SentinelOne Singularity Complete is that the agent doesn't auto-update, and my company found it more complicated than usual to get the agent updated and keep it updated.

I've been working with SentinelOne Singularity Complete for six months as an end user.

We didn't have any problems with the stability of SentinelOne Singularity Complete.

For the most part, SentinelOne Singularity Complete is scalable, but with my company's problem with auto-updates, it just means needing to rely on other tools to get new agents pushed out to the endpoints. It would have been better and more scalable if there was a way to update on the directory.

We found the technical support for SentinelOne Singularity Complete one of the best we've ever had to deal with, surprisingly, so we'd rate it as ten out of ten. If we open a ticket, we'll typically get some answers quickly, but for more complex issues, we have standing meetings with them that are set once a week so that they can go more in-depth.

Positive

My current organization only uses SentinelOne Singularity Complete, but in my previous organizations, more traditional antivirus was used, like BitDefender, and it was fine.

With SentinelOne Singularity Complete, I'm more confident that it can detect threats better and will miss fewer incidents coming in because of the more modern ways it detects malware.

I was not involved in the entire setup process for SentinelOne Singularity Complete, but it was mostly straightforward. However, getting the agents onto the machines was more complicated than the team would have liked.

The team started with a test machine and then expanded after issues arose, including figuring out how to fix the issues.

We implemented SentinelOne Singularity Complete in-house, with the support of the SentinelOne team, whenever we had questions.

I have seen ROI from SentinelOne Singularity Complete.

I have no information on the pricing or licensing cost for SentinelOne Singularity Complete.

I wasn't involved in evaluating solutions, so I'm unsure if the company evaluated other solutions before choosing SentinelOne Singularity Complete.

The organization I'm working for doesn't use the Ranger function of SentinelOne Singularity Complete. It uses a homegrown solution for network visibility.

I don't believe SentinelOne Singularity Complete has helped reduce alerts within the company, and it's not because it can't but because the SOAR solution handles the alerts and sends the alerts. Still, there is potential to improve the process.

I've not observed cost reduction or money saved from SentinelOne Singularity Complete just because it's such a small aspect in the grand scheme of things. It's tough to put a number on that.

Many people were involved in deploying SentinelOne Singularity Complete for the organization.

I'm the one maintaining the solution, and for my organization, in terms of scale, one person is sufficient to maintain SentinelOne Singularity Complete.

The solution is deployed on three thousand endpoints worldwide on both MacOS and Windows machines, along with an agent on the servers.

I advise others looking into implementing SentinelOne Singularity Complete to be prepared to work with the SentinelOne support team. Implementation is not hard to do, but the support team is there to help with much of the work and is happy to help. My standard advice is to ensure you're also checking out other providers. Just because the solution works for my organization, it doesn't mean it will work for yours. You have to find a solution that checks all the boxes for your organization.

I would rate SentinelOne Singularity Complete as eight out of ten.

We have it hooked up to our LogRhythm SIEM, which keeps track of all the events that are happening all around. That has been really helpful for us. We have SentinelOne Ranger that scans for devices on our network and finds the ones that do not have SentinelOne or the machines that we call rogues. The other function that we use is Deep Visibility. We pay for that, and it allows us to hunt for threats within our environment. It is also very important. We don't use Deep Visibility very often, but it is one of the more important things that we have in terms of the selection of products we pay for.

One of the big reasons we use it is for its ability to ingest and correlate across our security solutions. By virtue of going after an incident, we need to see step by step what happened. We have network solutions that show us where things came from network-wise. We have a vulnerability scanner for something that gets exploited, and then we have SentinelOne to see what is actually happening on machines. Maybe a process was launched. Maybe a file was clicked or an email was opened. That is a big part of how we use the tool.

Prior to having SentinelOne, we had CrowdStrike, which is a similar product. We decided to make the switch to SentinelOne because the biggest problem was that the previous endpoint detection response software we had did not support what we call legacy endpoints. Anything prior to Windows 7 was not supported by CrowdStrike. Being a manufacturing firm, we have quite a few old devices. That was one of the big things that sold us. SentinelOne also had significantly more competitive pricing than CrowdStrike, but the ability to protect older endpoints was the main motivating factor for us to make this switch.

We have been able to consolidate our security solutions. We had a handful of different solutions. SentinelOne Ranger scans for things. We used to have a product that did that, and we got rid of that. For deep visibility, we used to have a piece of software on each machine for historical data and events and things of that nature. We were able to get rid of that. Having an antivirus is also not really necessary because it is a next-generation AI-based antivirus. It does antivirus tasks, and it reduces the need for our traditional antivirus such as Kaspersky, Symantec, McAfee, etc. We were able to get rid of those as well, which is a good thing.

We have turned on the Ranger functionality. It is used for asset discovery, but only within a certain range and only if there are a certain number of machines. The way our settings are, if we have a cluster of five machines around it, it will essentially send out a signal and try to find the one without it. If we have five machines in our organization, it will look to see which one does not have SentinelOne around it. It can be helpful to find machines that were not deployed properly. It can also be helpful to find machines that were deployed by malicious actors and things of that nature. It also helps us to identify machines that have SentinelOne but are not responding right now.

It is a pretty big deal that Ranger requires no new agents, hardware, or network changes. We have deployed SentinelOne completely. There is probably no machine in our network that does not have it unless it has a very specific use case. Ranger helps us find those if they do exist. If need be, there is a setting within Ranger for deploying SentinelOne through Ranger. We have it turned off, but it is still useful. It is something we could use one day.

We typically use Ranger for vulnerability and not necessarily for the prevention of vulnerabilities, but it does give us a good idea of what is out there. For example, there is someone who is trying to do something malicious. It will heartbeat that, and it will see what is happening around that. If it sees, for example, command and control or something like that, it will identify it. It might quarantine it or turn your machine off to stop things.

Singularity Complete has helped to reduce alerts. One of the things we struggle with over time is trying to identify what is and what is not a real threat. It did take some tuning, but we went from having to investigate every little thing to being able to say, "Okay. This is a false positive. We know this. We have had this in our environment. We can exclude that." That frees up time for other things, so we can spend time focusing on malicious or bad things happening in our environment. We can work on projects and do some of the actual engineering.

Singularity Complete has helped free up our staff for other projects and tasks. We do not have to sit there and constantly monitor, which means that we can go ahead and do other things. We have a vulnerability scanner that we can use to start patching and tackling some of those vulnerabilities. We have our SIEM that we need to monitor for events and activities as well. We have network logs that should be gone through more. Because we have something that takes care of our endpoints, we can look at the focus of our business and do things there instead of having to worry about each machine individually.

The biggest thing that SentinelOne does is that it is constantly looking at our environment and other environments as a baseline of what should be happening or what could be happening. If something does not match the specific idea of what should be happening, it detects that and blocks that. If it is not sure what to do exactly, it quarantines a file or a folder or something like that until we have a chance to look at it. That is better than something getting through and causing damage before we can do anything about it. As long as a machine is connected to the network, it is pretty instant, but depending on what it is doing, it might take a little bit. There are some functions within it that do take a little more time to work. For example, the remediate and rollback functions do take time to work, but if it sees something as malicious, it will kill and quarantine that within a fraction of a second.

Singularity Complete has helped reduce our organizational risk. There is the part where it kills and quarantines things that are happening on machines, but there is also an element of visibility. Being able to see what we have gives us a better idea of what risks we have. From an inventory standpoint, everything is synced the second we deploy the image machine. Through that, we are able to see what is running on them, what they have installed, and things of that nature. We get a more holistic idea of what we actually have so that we know what to protect.

The terminating or killing remediation process that they use is top-notch. Pretty much anything that is even remotely malicious gets blocked by it within seconds. That is important for us. We have thousands of endpoints with tens of thousands of users. It is hard to do good security for that many people without some kind of automated detection and response. That is what SentinelOne does for us. It helps us automate that process.

Some of the reports that are exported through SentinelOne can be complicated for people who are not IT professionals. For example, we have some people within our leadership who would like to know why we are spending so much money on their product, and one of the ways that we are able to do that is through reports. Some of those reports are pretty easy to understand, and some of them are very complicated. Because they are not IT or security professionals, they may not have the same grasp. I wish their reporting feature was a little better. If they were able to export and make it a little more presentable, it would be great because this is something that we end up doing on our end where we take some of that data and make it look better. It would definitely save us time if it was a little prettier, for lack of a better word, from the beginning.

We have been using it for two and a half to three years. 

As far as I know, and I am the only one out of our three time zones who uses the tool, I have never had an issue with it. The only time we ever had problems was when someone made a change to some of the roles, but it was not a SentinelOne issue. For the most part, as long as you have set up the tool correctly, it functions pretty much 100%. I cannot think of a time when it was down.

We started out by having it deployed on a handful of machines as a proof of concept. From there, we were able to replicate it over and over in our environment. We are currently licensed for around 7,000 devices, and they made it pretty clear to us that if we decide to improve that or increase that, it would be a seamless process. They will just bump our licenses up and then we pay a little bit more. There is no real pain associated with that where you have to go back to the table, talk, and do things like that. It is a flip of a switch.

They were very helpful. They were knowledgeable. They definitely used the tool before. The questions they asked were good. They knew what logs to ask for. They knew what question to ask. They were pretty good. I would rate them a ten out of ten. They were knowledgeable. They were helpful. The turnaround time is good. They want to resolve the issue, and they are there to help.

Positive

We had CrowdStrike. We switched because of two things. One was the price. CrowdStrike was expensive, and the other thing was that we needed to protect legacy devices. As a manufacturing company, we have a lot of old software and hardware in our environment, and CrowdStrike did not protect those devices. We either had to come up with a solution where we network quarantine those machines or have them segmented somewhere so that they do not talk to anything else, or we just get SentinelOne and they function the same and require no extra work. As long as it is on there, it is protecting them, and it is much cheaper.

We have it almost entirely hosted in the cloud. We do deploy it via the deployment software that we use to deploy to our endpoints. We do have it in the cloud as well that we run through the command line and then point it to our management console, but we do not have it hosted on-premises. We like the idea of having things in the cloud at least for the specific instance.

I was not involved in its deployment. I came here a little bit later, but I got to talk to some of the people afterward. I am part of the deployment now, but I missed the boat by a handful of months.

It is pretty straightforward. The way it works is that you get what is called the management console URL, which is essentially when you install it, it tells you who the device belongs to. You put in your URL, you run a command from it on an executable, and then from there, it is on your machine. It is pretty straightforward.

The number of people involved in the deployment varies. We are a multi-continent and multi-country organization, so we had somewhere between 15 and 20 people working on it. In terms of the people who actually use it, there are probably five or six. We have one person who constantly works to deploy within North America and one person who works to deploy in APAC. We personally work to deploy it within EMEA and then the rest of it is us just working on maintaining it and making sure it is doing what it is supposed to be doing.

We previously had a different EDR solution called CrowdStrike, which was very robust but also very expensive. It did not have the features we were looking for from a legacy standpoint. My understanding is that we did a pretty good deal on SentinelOne. A part of that is because we were their customers very early on, and we also use their products a lot. We are interested in the new products that come out. We go to their demos, and we go to their events. We do save a lot of money. It is not cheap, but it is worth it. We spend a lot of money on a lot of things, and most of them do not do as much as SentinelOne.

It has gotten more expensive over time, but we have also gotten more features and value out of it. They have added things to it. From a pricing standpoint, it is expensive. It is one of the more expensive tools we have, but it also does more than almost every other tool that we have in our environment, so it makes sense.

We reevaluated CrowdStrike and realized that it was just not going to work for our purposes. I believe we looked at Sophos and Carbon Black. Carbon Black is a VMware product, and Sophos is a similar EDR solution.

From a quality standpoint, if you are willing to take the time to implement it and implement it well, it is a fantastic product. It is a massive part of our security posture. If you are looking to switch, doing a proof of concept will probably be good enough to make you realize the value it has. Sometimes, in the demos from vendors, you see the kind of things happening that are supposed to happen. It is, of course, going to block them, but during our proof of concept, we threw in different scenarios at it, and it handled every single one pretty flawlessly. That is a big part of why we ended up choosing it.

If you were a company that has legacy devices, it is a no-brainer as far as EDR solutions are concerned. If you are looking forward to an EDR solution in general, and you do not have legacy devices, SentinelOne is incredibly competitive. It has a lot of great features. It is priced very competitively. Their support is great, and the tool works. It does take some fine-tuning, but the tool works very well.

As a strategic security partner, SentinelOne is always trying to get us to work with some of their partners as well. From an integration standpoint, it does give us some options going forward where if, for example, we wanted to use a mobile device solution, they do have some integration with them. If you are a part of their ecosystem and you have a tool that you are interested in, they will let you know whether they have a partner that they work with. They will let you know that they have this tool. It works so far, and if you have a question or something like that, they can get you acquainted, which I appreciate.

Overall, I would rate it a ten out of ten. It is probably my favorite security tool from the ones we have.

We got rid of our previous vendor, and we went with SentinelOne. We basically use it as our AV platform. In other words, it is supposed to be a solution that is next-gen and can detect ransomware and give us the opportunity to roll back if we are attacked.

The organization wanted to take advantage of their rollback feature so that, if we ever did suffer ransomware, that would help us with triage or remedying the issues.

The rollback feature is the most valuable aspect of the solution. 

In terms of its ability to ingest and correlate across our security solutions, we're still early on. The implementation team has helped us turn on the XDR feature, however, we haven't utilized it as much as we should. We're still testing the capabilities. 

We did a pilot with the Ranger functionality. The organization opted not to purchase it just yet. Long-term, next fiscal year, we may adopt it. It does come at an extra cost. It may be added during the next renewal.

The previous vendor had a lot more features and capabilities under the license. For example, I lost DLP as Sentinel One does not have DLP. By choosing this solution, I created a security gap. 

It has not helped us reduce our alerts. In my last solution, I did not get alert fatigue. We are fresh into the implementation and are getting a lot of false positives. 

We just went live this past year. I would say we have been using the solution for maybe six to eight months.

The product has been up more than it's been down. We typically do get alerts if there is a maintenance window. That's appreciated. There have been times when we have had issues accessing the console. that tends to get resolved quickly. That said, no one vendor can boast resiliency. 

We only have one module or solution from them. We haven't tacked on multiples from a scalability side. However, from a licensing side, it's easy to add extra agents, it's easy.

I've contacted technical support multiple times. The level of satisfaction is 50/50. It depends on who picks up the ticket on their end. If it's a level one help desk versus an engineer will dictate how easily we get an answer or not. If someone is not well-versed on the backend, we'll need to escalate and that takes time. 

Positive

We previously used Trend Micro. It was cheaper and had more features under license. However, management was looking for cyber security insurance and methodology. Therefore, management decided to go through Sentinel One.

Getting the solution spun up and put into the environment, and getting it set up to where it's working smoothly, was okay in terms of a process. They are like any other vendor trying to give you a white-glove service.

I was involved in the initial setup.

Once we understood the methodology, it was pretty straightforward. 

I chose to rely on people who knew how the product worked. I relied on their input and insights. We did procure professional services to really get into training and understanding the solution.

The learning curve continues to be the false positives. I've had to create a new exclusion list from scratch. I'm still going through the process. 

New users need to have a work-in period. There will be a period to get all of the little anomalies tweaked out.

There were three of us implementing the solution.

There's no real maintenance to worry about. That's why we purchased the SaaS solution. We do need to update the agent. 

I implemented the solution with the assistance of professional services. 

Purely from a budget perspective, Sentinel One was more expensive than my previous vendor, plus I lost a lot of features. I can't say that I see cost savings yet while using the solution. 

We also piloted CrowdStrike. 

I haven't used the solution in conjunction with any other third-party solutions and can't speak to its integration capabilities. We will do that, we just haven't yet.

The solution hasn't freed up any time. It's the same as our old solution. 

So far, it has not changed our mean time to detect. However, I have not seen a true positive yet. I would need to see a real threat come into my environment yet. This is true with the mean time to respond. The process is exactly the same. I have it configured so that if anything is critical, I get real-time alerts. 

I'd advise new users to hone in on the subject matter experts and grill them during the POC. We were so accustomed to doing workflows a certain way, it was almost like how we had to learn how to walk again when we switched solutions. 

I haven't seen Sentinel One's innovation just yet. We have asked for adjustments or features. We're going through a feature request platform and I have yet to see them implement a feature we requested. My previous vendor, Trend Micro, was very willing to implement changes.

You can't just take it back if you don't like it. It's here to stay. There's no going back to the previous vendor. We need to make it work. We want to stay with them at least a good while.

I'd rate the solution eight out of ten.

I would advise new users to understand what workflows they are accustomed to and how their current setup works so that they can ask a lot of questions during the POC. It's important to fully understand Sentinel One's logic to be successful.

The whole purpose of having the product is to have endpoint security and visibility with those endpoints as well. After an evaluation period, we determined the product would be a fit for our organization.

The security and visibility we have on all endpoints helped our organization immensely.

There's not one particular item that stands out the most besides the availability of the product itself. We're a small organization. Having the visibility and the protection that it provides helped out greatly. Plus, it fits with our requirements.

The product does not have to go across a lot of different solutions. We don't have a cloud or anything like that where we have to push it in terms of visibility. The deployment is fairly simple. In the end, the overall visibility of it is very simple and the usability has been very simple for us as well.

So far, it helped to reduce our alerts. Based on the application that we would utilize prior to this product, the alert reduction is similar. It is not 100% the same, just similar. They gave us some visibility into what was going on, which provided a 30%, if not more, alert reduction.

It helped free up staff time. Using this solution, we don't have to keep our eyes on it 100% of the time.

It reduced our mean time to detect and respond. 

The product helped reduce organizational risk.

The overall product quality is good. I'd give it three and a half stars out of five. It checked all of our boxes. It met the requirements of the security we needed.

If for some reason, we were breached, it gave us the comfort of knowing that we could either automatically set the product to fix the issue or at least record it and let our team go in and resolve the issue. However, it also has the data to hunt the threat if need be. It's given us so much more than we would have expected from a product. Their dashboard is great. We log in and we get everything we need to know right out of the box on our dashboard. If we have anything that's infected it will tell us all of that information in real time. In our environment, it works without giving us any issues or slowing down our productivity in the process. The agent that runs on the system is not heavy. It's easily portable.

Initially, when we first deployed the solution, it caused some third-party connectivity issues. It would see it as an application that was not secure. However, we were able to put in a white listing, to help us operate well. We had to do that with around five applications that we ran. Once we applied those fixes, we haven't had any issues since.

I'd like them to make it easier to log in. 

I've been using the solution for two years. 

I have not experienced any downtime with it. It has not crashed. 

It won't run on our accounting server and we're not sure why the agent caused the conflict with this particular server. Beyond that, it's fine.

We deployed the solution to about 200 endpoints. 

We've only contacted technical support for the licensing portion of the process. They were very helpful and very straightforward. Everything was right on the money. Once we made the call over the ticket, we were contacted and it was resolved while we were on the phone.

Positive

We used Fortinet as well. We've used a few products and this solution does everything we've asked it to do. It was a good replacement for the free Fortinet solution and it protects against things Fortinet does not. 

In the past, for some reason, we found that somehow or another, the agent was disabled, and we have not determined as to why that is just yet. 

I was involved in the solution's initial deployment.

The deployment was fairly easy. We had a product that allowed us to push the agents out there. It was time-consuming based on the fact that we didn't have full automation. The only other drawback was when it was going through and doing some form of machine learning, it would block certain applications that we had to whitelist with the system in order to get it to work. However, we deployed it in less than thirty days, and it's been running everything well since then.

Our team, comprised of four people, handled the implementation. 

There isn't really any maintenance needed. All the agents update well. It is fairly automated.

The initial onboarding was done with SentinelOne. After that, we took it from there.

The pricing is good. It's a big factor for us. Their pricing comes in at much less than Fortinet or CrowdStrike.

We looked at similar products, such as CrowdStrike and other versions of Fortinet.

I'd rate the solution an eight out of ten.

I'd advise new users to do a proof of concept. That way, you get some time with the system before you deploy it into the environment and you can iron out issues. If you have 1,000 endpoints and only 1% of the issues that we ran into, it would still be significant and you'd want to deal with them head-on to make the full deployment easier. 

One of our use cases is that we wanted some type of visibility into our vulnerabilities and insight into our endpoints.

Ranger really helps us because, even though we're a smaller team of security professionals, it gives us a good eyes-on-glass approach. And if there is a known vulnerability, we can automatically see that without having to spend more time looking at it. In the past, we would do all of this manually. We would have to go into our systems and see which IP address is coming from the outside world and see the IP address, workstation, current version, hostname, MAC address, et cetera. Now, we can easily see that in the report that we get every day.

We used Rapid7, but Singularity has certainly helped reduce alerts. We have a threshold set in Singularity so that if one of our critical devices is vulnerable, we get automated email alerts. The alerts tell us what we need to look at in terms of logs and the like, and they help us automate some of our internal processes.

Personally, it has saved me a lot of time, about one-third of my day. And our mean time to detect has been reduced by anywhere from 45 minutes to an hour. But our mean time to respond has been pretty much about the same. I'm logging into SentinelOne every day and I see what's going on. If there is anything that needs to be talked about with our sysadmin team to get patches rolled out, we have a meeting about it every week. SentinelOne, overall, has brought our organizational risk down by at least 35 to 40 percent.

It helps us with our compliance efforts too, especially for auditing. If someone asks, "Do you have a list of all your endpoints?" we can definitely say "yes." And if they ask, "How is it categorized, by IP address, workstation, or OS?" we can see it's on this particular network and it's made by that manufacturer.

With Ranger, we can see the device inventory, the networks, how many workstations we have that it's scanning, how many printers, how many mobile and IoT devices, and servers.

It identifies what applications are vulnerable. If I go to the applications, such as Adobe Photoshop or Adobe Reader, I can see our current list of vulnerabilities: How many are vulnerable and how many need to be updated with patching. One of the most valuable aspects is the ease of finding specific vulnerabilities.

About every month, when I go into SentinelOne, if there is a vulnerability that we know about, I search for that vulnerability—for example, Adobe. There are different versions of Adobe, but I'm not able to compile them into one report. I have to create separate reports for those versions. Some of the reporting could be improved a little bit. I wish all Adobe products could be included together, or that you could mix and match Adobe with some other software or video player.

We have used SentinelOne for the last year and a half, and we're pretty happy with it.

I haven't had any issues with the platform. There hasn't been any crashing or lagging. Everything seems to be current. Overall, it's pretty seamless and I get really good results with it. I include it in my routine every morning and afternoon. I review the SentinelOne reports to see what vulnerabilities have been detected.

It is definitely scalable. You can really expand it and, for us, that is huge. As our organization grows, we will likely look at acquisitions, and, with those acquisitions, we will definitely get the other company's devices deployed through SentinelOne. It will allow us to grow and have their devices in the SentinelOne console as well, and have visibility.

I have contacted their support for a vulnerability issue, and they were able to help out with that. They told me how to get it remediated and what scan to perform.

It has helped us consolidate our security solutions. At one point, we had Rapid7 and SentinelOne. However, we realized we could take what Rapid7 has and consolidate it into one platform. At a high level, they're almost the same tool, but SentinelOne has a few more features and functionalities.

Also, we could see how many operating systems we have in our current environment through the standard image system we had. But now, we can see that through SentinelOne. That has been a key takeaway because we can see how many Windows, Linux, Apple, and Android devices we have.

In addition to Rapid7, we were looking at CrowdStrike for our endpoint detection, and at Sophos as well. Clearly, SentinelOne was the best for us.

SentinelOne is definitely a leader in the marketplace because it has a lot of features to offer. There are some pretty good integrations with it as well, and there are things you can change in the settings and how it's deployed.

The quality of the solution is great. I don't have any complaints other than that small reporting issue I mentioned. In terms of maturity, Singularity is one of the top-notch eyes-on-glass solutions that you can have, especially as it relates to your endpoints and vulnerabilities. It gives you that technical deep dive into what the vulnerability is, what workstation it's on, and whether there are any other endpoints affected.

There are some integrations that we could possibly use, but we haven't used any. There is one with KnowBe4 that we are looking to use.

As for maintenance, I don't have to do any in my role, but it does require some, such as upgrading versions.

If you're looking for a solution like SentinelOne, and you're looking to get an eyes-on-glass approach for your endpoint devices and your vulnerability management program, this could be one of your top solutions. Overall, I'm happy with it and my team is very happy with it. Our scans are fully automated and that is never an issue for us. It offers a lot of capabilities, expansion, and growth. If your company is looking to grow, it's definitely all there for you. You get a really good report on your devices and your networks.

We utilize SentinelOne Singularity Complete as an EDR and MDR solution for both our clients and internal operations.

We wanted to offer our clients a next-generation, AI-based antivirus solution for their endpoints, which is why we opted for SentinelOne Singularity Complete.

We incorporate SentinelOne Singularity Complete as a component of our multifaceted cybersecurity approach. Therefore, its capability for integration, as well as its capacity for data ingestion into NXDR, holds great significance for us.

SentinelOne Singularity Complete functions effectively in ingesting and correlating data across all our security solutions. While we employ an additional SOAR for more extensive correlation, SentinelOne Singularity Complete performs exceptionally well at the endpoint.

SentinelOne Singularity Complete is utilized as a component of our Managed Detection and Response service, resulting in a reduction in the number of alerts forwarded to us.

It helps free up our staff to focus on other projects.

SentinelOne has helped reduce our MTTD. It has also helped reduce our MTTR.

SentinelOne Singularity Complete helps our organization save money through pass-through cost savings.

It helps reduce the risk for our organization.

The most valuable feature is the machine learning capability, as opposed to the traditional rule-based antivirus. This is essential for effectively stopping malware attacks.

We are not utilizing all the features available with SentinelOne Singularity Complete, including the built-in XDR and Ranger, due to the substantial associated costs. There is potential for improvement in the cost aspect.

The area in which I would recommend SentinelOne to continue progressing is focused on enhancing its product. This involves not only internal development but also strategic partnerships similar to the Wiz integration which brings a lot of value.

I have been using SentinelOne Singularity Complete for three years.

It is stable. The downtime has been minimal.

The solution has met all of our scaling requirements.

I previously used ESET and McAfee. We sometimes still use Microsoft Defender for some use cases and we have some clients that still prefer to use CrowdStrike.

The implementation is carried out in collaboration with our partner, ConnectWise. While we handle the agent deployment, they manage all the configurations.

If we weren't using any protective measures, and we were consistently experiencing security breaches, this would result in an exponential level of risk when compared to an alternative solution. Expressing this concept can be quite challenging. How would we even identify if a breach has occurred? Typically, we'd notice something like data encryption taking place. 

So, I believe implementing robust cybersecurity measures is an essential aspect of operating in any technology-dependent field today. It's essentially become a fundamental requirement. That's how we perceive its significance in the present day. Therefore, we communicate this necessity to all our clients and that is where the return on investment can be perceived by using SentinelOne Singularity Complete.

The cost of utilizing all the features of SentinelOne Singularity Complete is high.

I rate SentinelOne Singularity Complete nine out of ten.

SentinelOne Singularity Complete EDR and MDR endpoint agent is a fantastic product. We layer that with other solutions as opposed to only using SentinelOne Singularity Complete.

SentinelOne is undoubtedly a market leader, and I believe it offers a comprehensive and excellent solution. It is on par with other next-generation or AI-based antivirus solutions available in the marketplace.

Depending on the organization's current solution, if they are transitioning from a product like ESET, then the approach to antivirus will be completely different. If they are transitioning from CrowdStrike, I believe the change will be less significant. Testing needs to be conducted, but I anticipate that they can observe immediate value from SentinelOne Singularity Complete. Furthermore, I am confident that they can deploy it without significant concerns about increased risk. Personally, I have never been worried about introducing additional risk by using SentinelOne Singularity Complete.