No more typing reviews! Try our Samantha, our new voice AI agent.
reviewer1663419 - PeerSpot reviewer
Head of Information Technology at a healthcare company with 201-500 employees
Real User
Jul 24, 2022
Responsive support with complete and total protection
Pros and Cons
  • "It has saved us from a couple of ransomware attacks already."
  • "It is very effective so far, it has saved us from a couple of ransomware attacks already, and the responsibility is taken off of us and onto them completely with complete and total protection."
  • "If they can extend their product further on the DLP side of it so that I don't have to have another agent run exclusively for DLP production, that would be ideal."

What is our primary use case?

We primarily use the solution for security. It’s for endpoint and response detection.

It is primarily protecting all my servers now, and most of the end users are connected to SharePoint OneDrive and emails, which are already taken care of from Microsoft through endpoint security. I don't have to really worry too much from the end-user point of view. Still, in case if they ever happen to click on any of the phishing emails or malicious files, it will block their computer immediately without even coming through the server level.

How has it helped my organization?

It is covering one of my IT audit purposes - not only from the protection of the data and doing security through my network but also addresses most of the compliances from an audit point of view.

What is most valuable?

It is very effective so far. It has saved us from a couple of ransomware attacks already. I'm very impressed.

They support most of the operating systems that we use - not just Windows or not just prominent versions of Apple or Linux. I have various versions that support almost all the operating systems in the market.

If there is any suspicious activity, they just straight away block the computer from further infection. The moment we call the support, they investigate everything in detail. Only then will they release it - if they find it is okay. During their own verification, they’ll see how it works and will not give access to the IT admin or to me. Only they will enable it when they are sure it is safe. The responsibility is taken off of us and onto them completely.

It is all automated. If any user or any Sentinel client is having an issue, the email alert will come, and we'll have to just look at it.

It's complete and total protection.

What needs improvement?

I cannot speak to any missing features. It has what we need.

If they can extend their product further on the DLP side of it so that I don't have to have another agent run exclusively for DLP production, that would be ideal.

Buyer's Guide
SentinelOne Singularity Endpoint
September 2026
Learn what your peers think about SentinelOne Singularity Endpoint. Get advice and tips from experienced pros sharing their opinions. Updated: September 2026.
915,817 professionals have used our research since 2012.

For how long have I used the solution?

I’ve been using the solution for a bit more than six months now.

What do I think about the stability of the solution?

The solution is absolutely stable. There are no bugs or glitches.

What do I think about the scalability of the solution?

I haven't seen all the features. However, I will probably start looking at it since it has saved us from a couple of cyber attacks. Probably I will take a walk-through again from the technical team to understand if there are any further scalable options to implement on my infrastructure.

We are using it for service only right now. However, we have decided to scale up for all the end users.

How are customer service and support?

Support is very good, and their help is immediate.

Which solution did I use previously and why did I switch?

I'm still using VDAT on Windows endpoints. We use Defender. Windows is comprehensive as well. Most Windows users with personal PCs have Windows Defender, and it works well. That said, I was not sure and still am not sure how well it will protect the servers if there is any ransomware attack on the network.

How was the initial setup?

It’s very easy to implement the solution. It’s not complex at all. I’d rate it a five out of five in terms of ease of implementation.

For me to implement across eight servers, it took maybe a day. Two days at a maximum.

It’s on the cloud and therefore doesn’t require maintenance.

What about the implementation team?

They did the implementation. However, I installed the agent. Everything and the configuration were already set. They just guided me through how exactly it was set up. They did the walk-through of the complete product, and that's it.

What was our ROI?

We’ve already seen a 100% ROI even after just a few months. I’d rate it five out of five.

What's my experience with pricing, setup cost, and licensing?

We pay to license every year. However, I’m not sure of the pricing. They might cost $100 each. It’s reasonably priced. I’d rate it four out of five in terms of affordability.

Which other solutions did I evaluate?

I did compare it to other solutions and found this product to be more compatible with more operating systems.

What other advice do I have?

We are using the latest version of the solution.

I highly recommend the solution to others.

We’re just customers.

I’d rate the solution nine out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
Jeffrey Agomate - PeerSpot reviewer
Information Security Engineer at Infoprive
Real User
Jul 8, 2022
Easy to set up with great AI and helpful technical support
Pros and Cons
  • "The product can scale."
  • "SentinelOne technical support is awesome."
  • "I'd like to see more documentation."
  • "Sometimes it causes a blue screen and causes the device to crash. It causes servers or computers to crash."

What is our primary use case?

We primarily use the solution for EDR to protect critical devices.

What is most valuable?

The AI feature is great, as are its automatic features. The solution can scan for malware easily. And then the ransomware protection is excellent.

It's pretty easy to set up.

The technical support is great.

The product can scale.

What needs improvement?

The solution just needs to step up and take on other solutions. Some are a bit stronger in comparison.

My improvements have been qualitative. For example, previously they didn't have a mobile device solution. However, two months ago, or three months ago they released the mobile version. Previously, they could only cover Linux, Windows, and macOS. However, two months, three months ago roughly, they start supporting mobile devices.

I'd like to see more documentation. 

SentinelOne documentation is only available to partners or people who own SentinelOne. There is no public documentation of SentinelOne. With other EDRs you can literally fix your problem by going to the documentation publicly. There is always public documentation. However, with this product,  public documentation is hidden from subscribers. If you Google some SentinelOne issue, you don't find any answers. There needs to be more public information about the product.

We added some sessions with a customer to go through testing, including a UAT session and testing session of the solution, and the customer listed some things they wanted to see in the solution. 

For how long have I used the solution?

I've been dealing with the solution for 14 months. 

What do I think about the stability of the solution?

Overall, the solution is between 90%  and 95% stable. Sometimes it causes a blue screen and causes the device to crash. It causes servers or computers to crash. That's a huge gamble. You could install SentinelOne on your computer and if you do, there's the risk that your production machine could go down when SentinelOne came on. Stability is a gamble for SentinelOne. There's more chance of crashing your computer. And the only solution when that happens is to go and install it through safe mode.

What do I think about the scalability of the solution?

The product is actually scalable.

Our customers are small, medium, and enterprise companies. We support all of them, both small and medium enterprising arms.

How are customer service and support?

SentinelOne technical support is awesome. If there is a five-star option, I'd give them six stars. They give good support.

How would you rate customer service and support?

Positive

Which solution did I use previously and why did I switch?

I'm also working with CrowdStrike Falcon. I have worked with Carbon Black as well. SentinelOne is better than Carbon Black.

The priority of EDR before any complex feature is the ability to detect and then prevent malware attacks. That will be main reason of an EDR. SentinelOne does a very good job of detection of online threats. Once you get targeted by a ransomware attack, SentinelOne will notice that. Carbon Black doesn't do that.

How was the initial setup?

The implementation process is pretty easy. 

What's my experience with pricing, setup cost, and licensing?

The pricing is reasonable. I'm an engineer and therefore can't speak to exact pricing. 

What other advice do I have?

We're a partner.

We sell SentinelOne. We implement and deploy. We have a partnership, basically. 

I'd rate the solution eight out of ten.

My advice to other users is if you are going to any solution out there, number one is to make sure if there are issues tey can be easily fixed. With this product, you won't have to have a problem going for three months unsolved or going for two months unsolved. 

Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
PeerSpot user
Buyer's Guide
SentinelOne Singularity Endpoint
September 2026
Learn what your peers think about SentinelOne Singularity Endpoint. Get advice and tips from experienced pros sharing their opinions. Updated: September 2026.
915,817 professionals have used our research since 2012.
Olaf Suchorski - PeerSpot reviewer
Security Expert at Infinigate
Real User
Jun 29, 2022
Easy certificate distribution, useful integration, cloud management and robust security
Pros and Cons
  • "The 365 management and analytics from the cloud is another great feature."
  • "The CapEX is very low because you don't have to buy any management tools or install them on your hardware."
  • "It would be good to see some small tools to test files or hashes that are a potential threat, I know there are already products offering this."

What is our primary use case?

We are a Dutch distributor working for Infinigate, a company specializing in distributing security solutions across Europe. One of our vendors is SonicWall. 

What is most valuable?

The instant rollback for Windows support is a nice feature.

Certificate distribution is quite easy, for example, using BitBucket SSL Inspection in conjunction with the firewall. More and more web traffic is via HTTPS, everybody is sending encrypted data, which needs to be decrypted for security purposes, then delivered. The integration of SentinelOne and the SonicWall Capture Client makes certificate distribution easy, which is needed for a SSL security setup.  

The 365 management and analytics from the cloud is another great feature.

What needs improvement?

It would be good to see some small tools to test files or hashes that are a potential threat, I know there are already products offering this.

For how long have I used the solution?

We have been distributing this solution to our clients for two to three years.

What do I think about the stability of the solution?

The stability is fine, I haven't heard about any serious issues. 

What do I think about the scalability of the solution?

Within the cloud, the solution is as scalable as required. The CapEX is quite low and you can scale this solution for thousands of users. 

Which solution did I use previously and why did I switch?

Within our company, we use a Sophos product, as we have been working with them for 25 years and have a more established relationship. 

How was the initial setup?

The initial setup of this solution is straightforward. As soon as you install it, the policy is sent from the cloud, and perhaps some certificates, and you are up and running, so that's relatively easy. I would rate the setup experience a four out of five, as there is always room for improvement.

When I open my browser, and I'm behind the SonicWall firewall without Capture Client my browser will tell me that I cannot browse the internet until I install the client. Then there is a button in the browser to install it, I click on it as a user, and after a few minutes, I'm up and running. Now I can browse again, but with a client, so it's pretty easy.

What about the implementation team?

As a distributor, we advise our resellers and they sell it to their end customers, so most of the time the resellers implement. I often give demos and training, where I show them how to do it. From a distributor role, most of the installations are done by our resellers.

What was our ROI?

The CapEX is very low because you don't have to buy any management tools or install them on your hardware. It's all based in the cloud and comes with cloud advantages. 

What's my experience with pricing, setup cost, and licensing?

Just buy the Capture Client and buy the installer itself in a license of 100,000, or whatever is needed. You don't need to invest in any management tools because they are already installed, and maintenance from the client will keep everything up and running. 

What other advice do I have?

I would rate this solution an eight out of ten.

I would advise people to consider this solution, because the combination of SentinelOne and SonicWall Capture ATP is very powerful. I would also advise people to have a look at the Capture Client and test the differences with other AVs.

SentinelOne has a patented feature with a Sandboxing technique, they have four Sandboxing techniques. They also have an AI technique, machine learning from SonicWall, and millions of sensors around the world to detect threats and zero-day attacks. This corroboration of security threat data shared by everyone makes the solution a powerful security engine. As Capture ATP also works on the firewall, it's not only their AV clients who are feeding the machine learning and the threat data, but also their firewalls.

Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
PeerSpot user
CEO at ERG Solutions
Real User
Jun 23, 2022
Simple to install and manage, providing aggressive defense at a competitive price
Pros and Cons
  • "SentinelOne is very simple to install and very simple to manage. It's very aggressive, so it does protection well, and it seems to be stopping attacks that other solutions cannot."
  • "The ability to integrate this product with an antivirus solution would be welcome. Even consolidation with more security products, like Umbrella networking abilities etc. to provide more on this platform, that would be great."

What is our primary use case?

We primarily use the solution for endpoint protection. 

What is most valuable?

SentinelOne is very simple to install and very simple to manage. It's very aggressive, so it does protection well, and it seems to be stopping attacks that other solutions cannot.

What needs improvement?

The ability to integrate this product with an antivirus solution would be welcome. Even consolidation with more security products, like Umbrella networking abilities etc. to provide more on this platform, that would be great.

For how long have I used the solution?

We have been implementing this product for our customers for a few months now. 

What do I think about the stability of the solution?

The solution is very stable.

What do I think about the scalability of the solution?

We have implemented this product for companies ranging from 10 to 200 endpoints, with many hundreds of users and it has been fine with this volume. 

How are customer service and support?

We get support from our local reseller in Israel and their support has been fine.

Which solution did I use previously and why did I switch?

We trialed an ESET product, but it didn't provide us with the solution we needed. 

How was the initial setup?

The implementation time depends on the size of the network but it's usually very short, no more than a day or two.  

What's my experience with pricing, setup cost, and licensing?

The pricing of the solution seems reasonable, we got a discount but it still seems reasonable. The licensing cost is $3 to $4 per endpoint and can be paid monthly or yearly, with the price changing according to commitment. 

What other advice do I have?

I would rate this solution a nine out of ten. 

I would say it is important to understand all the settings to deliver exactly what the customer requires. 

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
Cem BALIK - PeerSpot reviewer
Information Technologies Manager at VAS Bilisim Teknolojileri A.S
Real User
Jun 16, 2022
Reliable, easy to set up and easy to use
Pros and Cons
  • "The product can scale as needed."
  • "It's an easy tool and it offers a different experience."
  • "Security could always be better."

What is our primary use case?

We primarily use the solution for security purposes. 

What is most valuable?

It's an easy tool and it offers a different experience. It is a new generation product.

The initial setup was easy.

It's stable and reliable.

The product can scale as needed.

What needs improvement?

While I'm sure improvements are necessary, there isn't one specific area I've found to be lacking. 

Security could always be better. It always needs to be adjusted to keep up with what's happening. 

For how long have I used the solution?

I've been using the solution for two years. 

What do I think about the stability of the solution?

We haven't had any issues with stability. It's reliable. there are no bugs or glitches and it doesn't crash or freeze. 

What do I think about the scalability of the solution?

It's scalable. We are using management software on the cloud. Therefore, if we want to install 1,000 agents, it doesn't impact our business now. We can scale and it's got a central implementation method for agents.

How are customer service and support?

Technical support has been very good and we are quite pleased with them. 

How would you rate customer service and support?

Positive

Which solution did I use previously and why did I switch?

We actually use regular antivirus solutions as well, such as Sophos and McAfee.

How was the initial setup?

It's a simple, straightforward setup. It is not overly complex or difficult. 

We have a small IT team and have found that we just need to have one person managing the product. 

What about the implementation team?

We deployed it using an outside resource.

What's my experience with pricing, setup cost, and licensing?

I cannot speak to the exact cost. Our managers buy the licenses. That said, it is my understanding that we are using the subscription model and pay for it yearly. I'm not sure if there are any other ancillary fees beyond that.

What other advice do I have?

I'm a customer and end-user. 

I'm not sure which version of the solution I'm using. 

I'd rate the solution eight out of ten. It's a good overall product. 

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
Agile Product Owner at Micron Technology, Inc.
Real User
Jun 13, 2022
Great customer service and better value for a price lower than competitors
Pros and Cons
  • "I was extremely happy with their technical staff. The solution's tech support is top-notch. They have some really good engineers on their team."
  • "SentinelOne is a much better solution with better value and a lower cost than the McAfee ePO."
  • "Their CASB tool needs to mature. I think there are some CASB vendors out there that have a dashboard tool that's much more mature than SentinelOne. That would be the only constructive criticism that I have."

What is our primary use case?

Our primary use cases for SentinelOne are data endpoint management, document version tracking, and email security.

How has it helped my organization?

A concrete fact is that it allows us insight into our data and our security and helped us protect our intellectual property.

What is most valuable?

For us, the dashboard is the most valuable feature. The analytics that you can pull out of the actual tool are valuable.

What needs improvement?

Their CASB tool needs to mature. I think there are some CASB vendors out there that have a dashboard tool that's much more mature than SentinelOne. That would be the only constructive criticism that I have.

For how long have I used the solution?

I have been using SentinelOne for more than five years now. 

What do I think about the stability of the solution?

I have total confidence in the stability of the solution. 

What do I think about the scalability of the solution?

SentinelOne's scalability is very good. The solution is very flexible. 

How are customer service and support?

I was extremely happy with their technical staff. The solution's tech support is top-notch. They have some really good engineers on their team.

Which solution did I use previously and why did I switch?

We previously used McAfee ePO and we switched to SentinelOne just because of the customer service and the product.

How was the initial setup?

The initial setup was complex, but their technical staff are professionals and were able to help us custom-tailor the package we needed. On a scale of one to five, in terms of the complexity, with one being impossible to do and five effortless, I would put SentinelOne at about a four.

Deployment was about a six-month project for us and it included a discovery period and learning about our environments. We worked with SentinelOne to learn the environments and figure out what we needed to be successful. Then, we focused on an implementation period and then just monitored it after that. It was about a month and a half for each phase of that six-month period.

What about the implementation team?

We implemented it in-house but we worked directly with SentinelOne. Our experience with them was fantastic. I wouldn't want to do it without those folks again.

What was our ROI?

The ROI we saw was that for the first time we had actual dashboard data on our data usage for our cloud vendor that we chose and also for our on-premises. We purchased our servers from Dell and it allowed us to actually get a better grip on what we actually needed to buy versus what we were buying.

What's my experience with pricing, setup cost, and licensing?

SentinelOne's licensing costs are reasonable. I can't provide hard numbers, but I can say that SentinelOne is a much better solution with better value and a lower cost than the McAfee ePO. 

Which other solutions did I evaluate?

We did not evaluate any other options before switching to SentinelOne. 

What other advice do I have?

SentinelOne would be my go-to security provider. I would recommend that others go there first. They will get solicitations from McAfee and such because McAfee knows they're losing that business, but they just can't offer what SentinelOne offers.

Overall, I would give the product a nine out of ten rating. 

Which deployment model are you using for this solution?

Hybrid Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Other
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
Technical Team Lead at Alepo
Vendor
May 30, 2022
It scans quickly and doesn't use a lot of system resources
Pros and Cons
  • "I like that SentinelOne doesn't use a lot of system resources or make the system slow. It also performs a full scan quickly—within two hours. It has an easy-to-use end-user GUI."
  • "Since we implemented the solution, we haven't seen any big cyberattacks get through, which has happened before."
  • "We'd like SentinelOne to upgrade automatically. It doesn't automatically update the agent if some system has an older version of the SentinelOne. It has to be triggered from the console."

What is our primary use case?

Sentinel One protects our endpoints from malware, viruses, trojans, and other cyber attacks. We outsource the management of Sentinel One to another organization. They monitor for infections at any endpoint on the console and work to determine if it's a false positive or an actual attack.

Most of the time, Sentinel One can automatically identify an attack, and it quarantines the process to block the attack. If Sentinel One can't make that determination on its own, the third-party team will further investigate the suspicious traffic. 

How has it helped my organization?

SentinelOne is doing its job and protecting our endpoints from various cyberattacks. Since we implemented the solution, we haven't seen any big cyberattacks get through, which has happened before. Any malware and threats we've seen in the past have been resolved by SentinelOne.

What is most valuable?

I like that SentinelOne doesn't use a lot of system resources or make the system slow. It also performs a full scan quickly—within two hours. It has an easy-to-use end-user GUI. 

What needs improvement?

We want more communication about features that we request and when they will be added to the product. For example, they can tell us what is being done about it. part, if that can be shared for the new features. 

We've requested that SentinelOne's agent provide more reporting on the endpoint's OS, system host, modem, and serial number. It's not able to determine this now. If the SentinelOne team can provide us with some updates about whether they're working on it, that would be useful.Also, we'd like SentinelOne to upgrade automatically. It doesn't automatically update the agent if some system has an older version of the SentinelOne. It has to be triggered from the console.

For how long have I used the solution?

We have been using SentinelOne for a year now.

What do I think about the stability of the solution?

We've had SentinelOne for a year and haven't faced any major issues, so I would say it is reliable.

What do I think about the scalability of the solution?

SentinelOne is scalable, but we need to purchase additional licenses. We have purchased two licenses for 300 endpoints. The license not only applies to the users but also to some of the servers. We have SentinelOne installed on some of our critical servers. It can be scaled to whatever size we want if we purchase enough licenses.

How are customer service and support?

We haven't contacted SentinelOne support directly. When we need help, we reach out to our service provider. SentinelOne deals with threats when it detects them. If not, the service provider will analyze them. We haven't had issues with them so far. Their service is satisfactory and cost-effective.  

Which solution did I use previously and why did I switch?

This is the first time we have used endpoint security. We were using an antivirus solution before this. I would say Sentinel One is doing the job perfectly.

How was the initial setup?

Setting up SentinelOne is a pretty straightforward process. We have around 300 systems in our environment. Working with our security service provider and four other colleagues, we completed the deployment 10 to 15. It's worth noting that we were handling our daily tasks, so we weren't working on this the entire time. 

After deployment, we have to scan the endpoint for maintenance and upgrade. We also need to regularly update the endpoint agents from the console. Our security service provider primarily handles upgrades to the console itself. 

What about the implementation team?

We have outsourced this whole thing to a security service provider. They provide complete security services for SentinelOne. They worked with our in-house IT team, and I took the lead. Once I learned the process from them, I could deploy it on a few systems, and they did the rest.

What's my experience with pricing, setup cost, and licensing?

SentinelOne isn't cheap, but it's less expensive than CrowdStrike It's priced competitively. There are no add-ons. We have a Singularity Complete license, which includes everything we need for endpoint protection. 

Which other solutions did I evaluate?

We compared a few endpoint security solutions, including CrowdStrike before introducing SentinelOne to our organization

What other advice do I have?

I rate SentinelOne eight out of 10. It's a good endpoint security tool, and I wouldn't hesitate to recommend it to others. 

Which deployment model are you using for this solution?

Hybrid Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Other
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
Adam Peason - PeerSpot reviewer
Chief Information Security Officer at Lone Star National Bank
Real User
May 7, 2022
A good choice based on the cost and the services it delivers
Pros and Cons
  • "It is a good endpoint solution. That's the reason we chose it. We looked at other solutions, such as CrowdStrike, and based on the cost and the services it delivers, it was the better choice."
  • "I would like to see a better control panel for the managed service side of it."

What is our primary use case?

It is an endpoint solution. It is for our workstations and other devices to alert us to any kind of malware threats that might be lurking. 

In terms of deployment, it is through a managed service.

What is most valuable?

It is a good endpoint solution. That's the reason we chose it. We looked at other solutions, such as CrowdStrike, and based on the cost and the services it delivers, it was the better choice.

What needs improvement?

I would like to see a better control panel for the managed service side of it.

For how long have I used the solution?

We have been working with it for about six to eight months. 

What do I think about the stability of the solution?

It is stable.

What do I think about the scalability of the solution?

As far as I know, it is easily scalable.

How are customer service and support?

It is through a managed service.

How was the initial setup?

It takes a little time to put it in.

What other advice do I have?

It is a good solution. You just need to check out the managed service part of it.

I would rate it a nine out of ten.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
reviewer1506846 - PeerSpot reviewer
Network & Cyber Security Manager at a energy/utilities company with 51-200 employees
Real User
Mar 7, 2021
Cut our response times down to "nothing" and reduces our dependency on a SOC
Pros and Cons
  • "When there is an incident, the solution's Storyline feature gives you a timeline, the whole story, what it began with, what it opened, et cetera. You have the whole picture in one minute. You don't need someone to analyze the system, to go into the logs. You get the entire picture in the dashboard. The Storyline feature has made our response time very fast because we don't need to rely on outside help."
  • "The solution gives me peace of mind when it comes to the reliability of the computers on our system."
  • "All they need to do to improve it is for it to grow further. The hackers don't sleep. If the hackers don't sleep, the solution continually needs to be updated. They need to keep ahead of the hackers."

What is our primary use case?

We have the solution deployed on-premises and, for the last year, on the cloud as well. We have two systems.

Over the last year of Corona, we provided a lot of laptops to our workers to work at home. But because they're not connected, at first, to our network, they can't connect to the SentinelOne instance on-premises. We wanted something that would protect them when they're on the internet, and not only after they connected to our network. That is why we got the system that is in the cloud, to protect all the company laptops.

We don't have a lot of incidents because ours is a very closed network. We don't connect directly to the internet. So SentinelOne is only a barrier between us and the emails or between us and the files that go into our network. 

How has it helped my organization?

Three years ago, one of our employees got an email from someone and opened a file. It was ransomware. It started to infect the disks and I didn't know if it had started to encrypt the network routes. I stopped the computer, but I didn't know if another computer had also been infected. I waited for a company that was giving us support for those kinds of things. They got the disk and they started to check and analyze it. After four hours—and that was very quick, by their standards—I got the first analysis. If I had had SentinelOne the whole thing would have taken between 10 seconds and one minute. And then there was the cost of the SLA that we paid to the support company for that kind of support. A four-hour SLA costs a lot of money; the basic SLA is eight hours.

It has cut the response times to nothing. When we have an incident, we get an email in seconds and I can respond in a second to any threat. Even if it's a false alarm, I get the alarm immediately. For example, when we started to work from home, I accidentally installed a program that writes to the MBR partition in the laptop. It wanted to write to the MBR partition and SentinelOne stopped the file and it saved me from having to install the whole computer again. So it not only protects against threats but against mistakes. It's like having a big brother sitting behind you who protects you.

When you pay for a system like SentinelOne, along with the other systems that we have, we're less dependent on a SOC.

The solution gives me peace of mind when it comes to the reliability of the computers on our system. We can work through the internet, as has been happening recently with half of the company working from home, and I know that I have a system that has my back, that protects me. I know it does because I have tested it.

What is most valuable?

There isn't a single valuable feature, it's the whole engine and system. It's working online in  real-time and gives us alerts, on-click. We chose SentinelOne because in the millisecond that I clicked on the file, I got a block-alert.

SentinelOne's Static AI and Behavioral AI technologies are among the most effective for protecting against attacks because they analyze not only the file's surface, but the behavior of the file. When I described to my manager what I was going to buy, I described a system that analyzes file behavior. If you open a calculator, calc.exe, you know it's going to open calc.exe, and maybe open service X or Y, but it won't go to the internet, to an IP, and spread something. When you analyze the behavior or reaction of each file that works on your PC, it's something else. It's a different level of EDR.

When there is an incident, the solution's Storyline feature gives you a timeline, the whole story, what it began with, what it opened, et cetera. You have the whole picture in one minute. You don't need someone to analyze the system, to go into the logs. You get the entire picture in the dashboard. The Storyline feature has made our response time very fast because we don't need to rely on outside help. We see the whole picture in front of us, from the beginning to the end. We can see, with the click of a button, if that file ran on more computers, not only one or two, and how it spread to other computers. We can see the whole tree and we can immediately respond. We don't need to wait for analysis.

The UI is very clear. You don't need to look for something or to dig to understand where it is. It's all in front of your eyes.

What needs improvement?

All they need to do to improve it is for it to grow further. The hackers don't sleep. If the hackers don't sleep, the solution continually needs to be updated. They need to keep ahead of the hackers.

For how long have I used the solution?

I have been using SentinelOne for two years.

What do I think about the stability of the solution?

It has never gone down. In two years I haven't had any software or hardware problems.

What do I think about the scalability of the solution?

The scalability is driven by demand. If I need to buy 100 licenses, I can buy 100 licenses. We started with 50 and now we have 200 on-premises and 100 on the cloud.

In terms of expanding our usage, we have a SCADA network. It is our operational network. That network is 100 percent disconnected from the outside world. It's not connected to any network, not to IT and not to the internet. We use a regular antivirus there. We plan on deploying SentinelOne to support that and to remove the old antivirus.

Which solution did I use previously and why did I switch?

Prior to using Sentinel one we were using McAfee Endpoint Security. We switched because I understood that the systems that are only checking file signatures don't work anymore.

How was the initial setup?

We installed it, in the beginning, on-premises on our computer inside the network, and the installation was done with an integration company. Every three or four months we upgrade because our location is not connected to the internet directly.

The on-premises deployment took something like a week to get it deployed to everyone, but the installation itself was very quick, half a day. Then, to see what should be put in the blacklist or what to exclude took about two weeks. The deployment was done by me and the IT manager.

The cloud version was very simple, no problem. Things were done automatically.

What about the implementation team?

The integrator we used was DnA-IT. They only did the installation for the first implementation.

Now that we are going back to the workplace, I will start to work with them on an hourly basis, and we'll learn about all the features from them. They have good guys who know what I need and what we're going to do. I am one person who supports 400 people, so I need the time to sit with the system and to learn it. The system has a lot of features that we don't use or that we don't understand how to use because we haven't had a lot of time in the past year to research them and sit with the company to teach us. We work with the basic features, things like the blacklist and the USB restrictions. The integrator will show us how to use the more advanced features. I'm starting to think that if we can implement all the features from SentinelOne, I will be able to cut the antivirus that we are paying for.

We also use DnA-IT for support. If necessary, they open a ticket with SentinelOne.

What was our ROI?

It's cost-effective. The price of 100 licenses that I need in the cloud is cheaper than one Bitcoin I would need to pay in the case of ransomware. It's already paying for itself.

What's my experience with pricing, setup cost, and licensing?

The pricing is very fair for the solution they provide.

Aside from the standard licensing fee, the only other costs are for the hardware, because we use Hyper-V on-premises.

Which other solutions did I evaluate?

I don't remember the names of the other solutions we tested because it was more than two years ago. At that time, SentinelOne was a very young, small, Israeli company with a new product. We were using another startup on our OT network and I asked them if they knew of a good EDR company and they told me there's a little company like ours, our friends, check them out. We also checked two other companies.

We did a penetration test on some solutions. A company that we work with on pen testing planted malware in Excel files, in a macro. We tested how each of the solutions alerted us on the macro and about what it was doing. SentinelOne alerted us at the moment I clicked on the mouse. When I got the popup alert from SentinelOne, I said, "That's it."

In the other software that we checked, there was a little delay because the software got the file, transferred it to the cloud, waited for the cloud to handle the file, and then got the answer back. It took about half a minute or a minute. But in half a minute or a minute, an attack can destroy half of the network. In fact, one of the others didn't detect it at all.

What other advice do I have?

My advice is check out SentinelOne. See how the system works in a real-time attack. Only when you see how it works in real life, in real time, will you understand the ROI of the system. Simulate an attack, simulate a file, simulate that file changing something, and see how it works. I can say to my manager, "I have McAfee installed on my system, I'm safe," and they'll check the checkbox and move on, without understanding what they are doing. I need to sleep well at home and I can do so by knowing I have a system that has my back. That is what SentinelOne is.

Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
PeerSpot user
reviewer1480428 - PeerSpot reviewer
Head of IT at a transportation company with 501-1,000 employees
Real User
Feb 3, 2021
Straightforward to install, quick and detailed technical support, and application inventory is helpful
Pros and Cons
  • "In terms of the engines that SentinelOne uses, it has stopped various scripts from running and it's highlighted lateral movement that we weren't expecting."
  • "At the moment, we have a lot of trust in SentinelOne."
  • "With respect to product patches, it should have the ability to patch directly from SentinelOne, rather than be presented with a list and have to do it separately."

What is our primary use case?

Our primary uses are endpoint protection and application inventory.

The management is done through the SentinelOne web interface.

We work strictly in a Windows environment, using it for both workstations and servers.

How has it helped my organization?

At the moment, using SentinelOne brings us peace of mind. It has only highlighted a few things and generally, we've been quite lucky.

In terms of the engines that SentinelOne uses, it has stopped various scripts from running and it's highlighted lateral movement that we weren't expecting. From that perspective, it's been good.

We don't have a lot of incidents but SentinelOne has reduced our response time by a couple of hours, per incident. It does a lot more than what the previous AV products did.

What is most valuable?

The most valuable features are application auditing and malware detection.

Application inventory and auditing highlight which applications are installed on the endpoints, and whether there are any known vulnerabilities. If the endpoint is not patched then it will be reported. This helps us in terms of validating our patch management methodology.

On the malware protection, it looks like it stops all malware and detects things such as suspicious activity.

The automatic monitoring of OS processes is a good thing to have. However, I'm not totally familiar with the product in-depth. It gives peace of mind in terms of our security and it doesn't seem to have any impact from an end-user perspective.

We use the threat detection feature.

The Deep Visibility feature is something that we have used once or twice. It gives us visibility of all of the activities that took place, to determine what exactly was caused. We don't use this feature very much, purely because we don't have many things to look at. We did find some things that were suspicious, and we were able to resolve them. It highlights certain things that we weren't aware of, and then we were able to go in and understand them further. At that point, we either marked an issue as a false positive, or we denied it permission to continue. In either case, SentinelOne stopped it from proceeding. 

At the moment, my confidence is quite high with respect to the effectiveness of the distributed intelligence at the endpoint. I haven't had reason to determine if it's not working and at the moment, it seems to be doing what it says it does.

What needs improvement?

With respect to product patches, it should have the ability to patch directly from SentinelOne, rather than be presented with a list and have to do it separately. As it is now, it shows you what products require patching, but you need a separate application to install the patch. If you could initiate an update to the application from SentinelOne, that would be a nice feature. 

For how long have I used the solution?

I have been using SentinelOne for approximately a year and a half.

What do I think about the stability of the solution?

Overall, the stability is very good. We have had one version where it had a high CPU usage, but the later versions were better.

What do I think about the scalability of the solution?

We have not run into problems with scalability. It can be very good.

There are three users in the company including the IT department, helpdesk, and operations manager. At the moment, we have implemented 100% of our endpoints. Probably, as we add endpoints over time, our usage will increase slightly.

How are customer service and technical support?

The technical support is excellent. We have only had to use them two or three times, and the response has been very fast, very detailed, and very explanatory.

Which solution did I use previously and why did I switch?

Prior to SentinelOne, we used Symantec Endpoint Protection. We switched because SentinelOne offered various features such as Deep Visibility, threat analysis, and application inventory. There were a lot of features that SentinelOne had that Symantec didn't, at the time.

How was the initial setup?

The initial setup is very straightforward. It was pretty much all done for us. Essentially, all we had to do was install the agent on each workstation that was upgraded.

It took about three weeks to deploy, covering all 212 of our endpoints.

We didn't have a specific implementation strategy. We somewhat phased it in, and all of the new devices would be installed with SentinelOne. As we go through the different workstations, we replace what is necessary and upgrade the agent. It was a case of going through our four different offices and because we're quite small, we did it one by one.

There is no maintenance required, post-deployment.

What about the implementation team?

SentinelOne support assisted us with deployment and it was done pretty much right away. They were very good.

Once the tenant was created, they gave us an overview of how to use it. The product is quite straightforward and easy to use and. There are probably elements we could go through further with SentinelOne, but I don't know if it's because I buy through a third party. Maybe, the third party is supposed to do more, but I'm not sure.

The reseller that we purchased SentinelOne from is O2 Mobile, and the experience was fine.

What was our ROI?

Although there isn't a tangible ROI, the product gives us a lot more detail and insight into the threats, which is valuable. There has been ROI, but it's more time value rather than a hard dollar value.

What's my experience with pricing, setup cost, and licensing?

The price is reasonable in terms of what the product offers. SentinelOne is more affordable than some competing products, and it's not overly expensive for what you're getting.

Which other solutions did I evaluate?

We looked at Trend Micro before choosing this product. SentinelOne looked easier to use and it was almost a complete product. We didn't go into too much depth, and I cannot compare the detection capabilities, but the cost was a factor.

What other advice do I have?

My advice for anybody who is implementing this product is to fully understand all of the elements that it provides and to be aware of all of the features. For myself, I think it's important to have a deeper and better understanding of all of the functionality that the product offers.

At the moment, we have a lot of trust in SentinelOne. If it continues to stop future threats then I will continue to rate it highly, or even perfect. At this time, I wouldn't say it's perfect because I can't say that I haven't been compromised because of it.

I would rate this solution a nine out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
PeerSpot user
Buyer's Guide
Download our free SentinelOne Singularity Endpoint Report and get advice and tips from experienced pros sharing their opinions.
Updated: September 2026
Buyer's Guide
Download our free SentinelOne Singularity Endpoint Report and get advice and tips from experienced pros sharing their opinions.