SentinelOne Singularity Cloud Security - AI Powered CNAPP

Our current organization operates in an AWS-centric environment with SentinelOne Singularity Cloud Security . We use everything on AWS , and all our resources require vulnerability detection and dependency issue management. Those detections are straightforward, and any tool can identify vulnerabilities. However, SentinelOne Singularity Cloud Security  provides an extension on top of basic detection. Any CNAP currently in the market can tell you about vulnerabilities, but how to detect them and whether an attack is continuously happening on our traditional systems—and how to stop them at that moment—is critical. Runtime vulnerability checks are very important for us and help significantly with Kubernetes  workflows as well as cloud infrastructure level operations.

We have extensively used the Kubernetes  security features in SentinelOne Singularity Cloud Security, specifically the KSPM. We followed that with cloud work through what is called Cloud Workload Protection. Because we receive substantial data from AWS , the CWP has provided us with good information around what is going wrong. When attacks happen, we understand what to do and how to identify our system's vulnerabilities before they are exploited, ensuring things work properly without any security issues.

In my use case with SentinelOne Singularity Cloud Security, what I have used extensively is for Kubernetes and other infrastructure components.

Runtime protection is exceptional. The initial setup of SentinelOne Singularity Cloud Security is one of the best available. I have never had an easier integration than this, as everything is cloud-managed.

The positive impact I have observed is that runtime issues, which SentinelOne Singularity Cloud Security solves, are very good. Many times with Kubernetes and infrastructure that have numerous vulnerabilities, those issues can only be caught at the runtime level. SentinelOne Singularity Cloud Security provides the best runtime protection I have seen. I have not faced any problems, and regarding the engineering aspect, I have not been worried about this. That is a very good thing.

When it comes to the maturity of SentinelOne Singularity Cloud Security, it is not currently at the level of more established solutions. For example, we previously used CrowdStrike, which has been established for ages. CrowdStrike had an incident with an agent issue that was catastrophic, and despite that, people did not unsubscribe. CrowdStrike has something called Falcon  that helped us in great ways before. Investigation is easier with SentinelOne Singularity Cloud Security—you can go through the screen and check everything, whereas with CrowdStrike it was more of a headache. However, the ecosystem is more mature at CrowdStrike compared to SentinelOne Singularity Cloud Security. There are not many users that need this in the market, and the CNAP market is very large. SentinelOne is specifically targeting AWS-first companies and is not extending its solution to Azure  or GCP , which might help potentially.

We have been using SentinelOne Singularity Cloud Security for one and a half years now, following an incident with CrowdStrike where we experienced a complete blue screen crash. After that issue, we switched to SentinelOne Singularity Cloud Security.

We have never faced any outage or problem with SentinelOne Singularity Cloud Security. All the SLAs are in place. I don't think we have specific metrics to measure this, but if it had been down, we would have known. We have always received reports and have created a pipeline using a monitoring tool called Signoz that fetches everything from the SentinelOne report and provides that information to Slack every day at 8:00 a.m. IST. This has helped us identify any ongoing vulnerability and has never failed since its one-time setup. SentinelOne Singularity Cloud Security operates consistently, and that is how a product should work—you should not have to worry about it.

We have not faced any scalability issues with SentinelOne Singularity Cloud Security, and since our organization is not large, this is acceptable.

I do not communicate often with technical support regarding SentinelOne Singularity Cloud Security because our VP of Engineering handles that. My work focuses on the integration aspect. I am an end user in terms of how the solutions are working, and vulnerability catching happens in the code. If something goes wrong during infrastructure deployments, I need to investigate what happened and assess the problem. I need to check how things are looking and whether we have the visibility we need or if any threat hunting is happening, which is something very important.

Before choosing SentinelOne Singularity Cloud Security, we were using CrowdStrike, and we also evaluated Wiz . Wiz  was acceptable, but compared to SentinelOne Singularity Cloud Security, their pricing was higher. They also provide similar features and are known better because they have something called agentless cloud visibility, which would have been a better opportunity for us to adopt, but their costing is very high. We opted for the runtime aspects instead.

My organization is small in terms of the scale of use cases with SentinelOne Singularity Cloud Security, so we did not have any issues. Even with CrowdStrike previously, it was also performing well. However, due to constraints regarding our customers who specifically asked us not to proceed with it, we had to move to SentinelOne Singularity Cloud Security.

The installation of SentinelOne Singularity Cloud Security was straightforward. First, we onboarded through AWS by connecting our AWS account from the SentinelOne console. We had to configure some privilege issues, and policies had to be configured beforehand. We created a cross-account IAM  role before integrating SentinelOne, which helped ensure that SentinelOne could run on multi-cloud environments. After that, we enabled CloudTrail  integration and configured some AWS configurations. Then we proceeded to Security Hub and enabled GuardDuty. We started the agent asset discovery, which helped us deploy the provided solution quickly.

For Kubernetes, each step was straightforward. We had one EKS cluster where we deployed a SentinelOne Kubernetes component via Helm chart. The admission policy of the controller had to be configured at that point, and we enabled the KSPM scanning. The onboarding aspect was something I completed extensively, and I remember the steps involved. It was very straightforward, I did not face many issues, and the documentation was appropriate and to the point.

I am not the right person to provide details about the cost aspect of SentinelOne Singularity Cloud Security because the company has already integrated it. I evaluated the solutions and provided a report, but the costing aspect is handled by the cost analysis or FinOps team. From articles I have read, SentinelOne Singularity Cloud Security appears fairly priced, but when dealing with many vulnerabilities, the runtime cost becomes somewhat high. However, I do not have much exposure to the pricing aspect.

As we are a smaller firm and need significant automation, we opted for SentinelOne Singularity Cloud Security. I would rate this solution a solid nine out of ten. Everyone has some room for improvement, but a nine is something I consider very good.

Our use case for SentinelOne Singularity Cloud Security  is to use it for endpoint detection to safeguard our client's infrastructure, so we have deployed the use case as per our client recommendations. We are not a customer, partner, or reseller; we work as an MSSP  and provide services for our clients.

In my scenario, the best features of SentinelOne Singularity Cloud Security  are that it gives a very quick response and has rollback capability. The benefit for my customer is that it is fully autonomous where mostly everything is automated, and the threat detection engine operates on a real-time basis, so it is almost fully automated and that is the major capability that SentinelOne Singularity  has.

Since implementing SentinelOne Singularity Cloud Security, it has detected alerts in real-time, which obviously has affected our client's security, so we can rely on that very much.

The impact on our MTTR for incident investigations has been quite positive because the investigation feature shows us detections in the UI only, as it detects threats in real scenarios, so it is much more reliable.

I feel there is room for improvement in SentinelOne Singularity Cloud Security, particularly in creating custom dashboards since it only has a default dashboard feature, and a capability for creating custom dashboards would help us a lot as analysts. Additionally, there is a high number of false positive alerts when new clients come, as the default use cases are only enabled for that client, resulting in resource consumption and increased CPU utilization, which could be improved in the future.

I have been using SentinelOne Singularity Cloud Security for more than a year.

As for stability, I find it very much stable since we have not experienced any downtime for more than a year, and if we ever do, we connect with OEM customer support, getting a quick response for whatever the issue may be. I would rate the stability of SentinelOne Singularity Cloud Security a 10 because as of now we have not faced any stability issues.

SentinelOne Singularity Cloud Security is very much scalable, as it charges on a per-endpoint basis, allowing us to scale up or down depending on any requirements. I would rate its scalability an eight.

I would rate the technical support for SentinelOne Singularity Cloud Security a 10.

It is easy to deploy SentinelOne Singularity Cloud Security.

I have not been part of integration but know that it is very easy; we just install the agent on any endpoint.

SentinelOne Singularity Cloud Security saves a significant amount of time because it detects in real-time and is fully automated, thus allowing us to detect and respond to any threats efficiently compared to other solutions for SIM and SOAR  products.

Although I am not the person responsible for pricing, I know that SentinelOne pricing depends on how many endpoints the client is using, and it is discussed on a per-device basis.

Compared to other vendors, I would say the reliability of SentinelOne Singularity Cloud Security is higher; we can rely on it very much as the detection and remediation features are very quick, and it is much easier to grasp even for beginners due to its user interface and rollback capabilities, keeping SentinelOne at a top tier compared to other solutions.

Our mean time to response, every time a malware or any malicious file is detected in an endpoint, the alert is generated, and as analysts, we take a response accordingly, so we try to respond to the alert as soon as 15 minutes for our client. Although SentinelOne automatically quarantines malicious files, our purpose as analysts is just to raise the alert with our client.

I would say the MTTR has reduced by about 50%. For MTTD, I would say it detects files in real-time, so as soon as the file is detected, it gives us an alert in real-time, so I would say about 80-90%.

For overall scanning, we conduct activities to check for any unknown devices that should not be present. During scanning, a higher number of alerts are generated, which is expected, but we can rely on scanning as it is crucial to check every endpoint or desktop.

SentinelOne Singularity Cloud Security's unified platform experience has helped streamline our security operations significantly because the threat detection and the incidents we manage daily, including checking hash and other factors, are greatly aided by the platform.

We are using it as an XDR , not for cloud, so I cannot provide a specific reduction amount for MTTR in cloud incident investigation. We have SentinelOne Singularity Cloud Security deployed in an on-prem model.

There are around five to six members managing more than 15 or 16 clients with SentinelOne Singularity Cloud Security. In our organization, many specialists work with SentinelOne Singularity Cloud Security; we are a large team working in SOC and SOAR , sharing the same infrastructure, totaling more than 40 members. Our clients are mostly medium-sized businesses.

SentinelOne Singularity Cloud Security does require maintenance, such as basic updates and patching for new versions.

I would advise anyone looking to implement SentinelOne Singularity Cloud Security to choose it if they want a very reliable product because it is fully automated and very reliable, and it is the best option within the price range everyone is looking for. I give this review an overall rating of 10.

We were using SentinelOne Singularity Cloud Security  as an endpoint security platform to get threat intelligence regarding malware and threats.

We have an MDR platform, and we are using it as a log ingester for log collection and then we are deploying webhooks for incident response.

Power Queries are useful in deep threat hunting and deep visibility.

SentinelOne Singularity Cloud Security  maps any threat or incident with all the applicable MITRE ATT&CK techniques and also provides behavioral detection. This would be useful when an endpoint has a zero-day threat involved in the incident, as it will have better detection because of the behavioral detection engine and dynamic detection engine. The mapping of the MITRE ATT&CK techniques provides deep understanding of what the threat actor is trying to do.

Meantime threat response is quite fast. There is no doubt about that. The reason we are migrating to Defender from SentinelOne Singularity Cloud Security is not because of the cost or features. It is just a managerial decision taken in order to save money as we are already having some other tooling with different licensing. There is no doubt that the MTTR and MTTD are quite great in SentinelOne Singularity Cloud Security and it is quite effective in detecting threats and responding to incidents effectively.

SentinelOne Singularity Cloud Security has a dynamic and behavioral detection engine which examines the files based on their behavior and tries to map it with the MITRE ATT&CK techniques. Even if there is a zero-day threat, it would be able to detect it because of its behavioral detection capabilities.

Pricing is on the higher side. I would rate it at seven or eight.

The price is high, and of course it could be lower. The market is changing and SentinelOne Singularity Cloud Security has a very good competitor in Microsoft Defender. SentinelOne Singularity Cloud Security should innovate more and come up with features which clearly justify the purchase if someone is already having Microsoft Defender inbuilt with Microsoft 365 licensing. Suppose my organization is moving to Defender because they already have Microsoft Defender in E5 licensing and opted for it in order to save money that was being spent on SentinelOne Singularity Cloud Security. SentinelOne Singularity Cloud Security should come up with innovative and new features that justify organizations staying with SentinelOne Singularity Cloud Security and not opting for a Defender-solution.

I would not say the functionality was missing. However, for example, Defender provides correlations from an identity perspective. In SentinelOne Singularity Cloud Security, the identity module was available, but it needed to be purchased separately and did not come with the base licensing.

SentinelOne Singularity Cloud Security should include the identity module in their base subscription so that their value gets increased. Nowadays the threats are evolving and moving towards identity-based attacks. If a customer has to purchase an identity module of SentinelOne Singularity Cloud Security separately, they will get hesitant because their competitor, Microsoft Defender, is providing that for free in their base subscription. SentinelOne Singularity Cloud Security must work on their subscription pricing in order to stay relevant in the market.

I have been working with SentinelOne Singularity Cloud Security for five years.

Stability is a benchmark at ten, and I would rate it at eight.

Scalability is also eight because it can be easily scaled up if more endpoints need to be covered. They just have to have the agent installed on them and the license should have that many seats.

The technical support is acceptable, and I would rate it at eight.

In the company where I work as a security engineer, we used to have SentinelOne Singularity Cloud Security in our environment, but the company has decided to migrate to Microsoft Defender. The reason is managerial, not technical. The migration is in process and we will soon stop using SentinelOne Singularity Cloud Security and use Microsoft Defender instead.

The deployment is much justified as it is a cloud-based setup.

SentinelOne Singularity Cloud Security is a separate endpoint security technology. It does not come or integrate with other platforms such as email platforms or cloud platforms. Because it is a separate technology, the deployment is not particularly tough.

If you want a comparative score, it will not be good because Microsoft Defender is coming as a free offering in the Microsoft E5 licensing. Whichever organization is having E5 licensing of Microsoft Office 365  is literally getting Defender for free. If they were using SentinelOne Singularity Cloud Security or CrowdStrike and are already having Microsoft E5 licensing, then this move will save a lot of money from their security budget. SentinelOne Singularity Cloud Security has aggressive pricing, but they will get an equivalent product or maybe better in the Windows environment. If they use Microsoft Defender, they will get correlation from Microsoft Defender for Identity , for cloud, for cloud apps, for endpoints, and Microsoft Entra ID  and Active Directory. Threat intelligence and correlation would be better because most organizations are using Microsoft Office 365 , so they will get two things if they use Microsoft Defender.

The first benefit is that they would not have to spend a lot of money on an endpoint security tool separately, because they will get the Defender endpoint security suite for free as they already have the E5 licensing. It comes with E5 licensing, so no additional money. Suppose an organization is spending ten thousand dollars on SentinelOne Singularity Cloud Security; if they were having Microsoft 365 E5  licensing, they would just straight save ten thousand dollars. The spending will come from ten thousand dollars to directly zero, as the license is already included in E5.

The second thing is that the threat intelligence will be enriched due to Microsoft Office 365 having various products such as Entra ID and Azure  resources. Microsoft Defender integrates by default with all those Microsoft toolings, so the threat intelligence would be much enriched as compared to SentinelOne Singularity Cloud Security.

In the company where I work, we are migrating from SentinelOne Singularity Cloud Security to Defender.

I am using it, but it will soon go away from the organization where I work.

Microsoft Defender is the alternate solution.

My recommendation depends upon the budget, client expectation, and their existing security stack.

Ranger is a module in SentinelOne Singularity Cloud Security which scans all the network and determines the OS, whatever devices there are, their OS, and their versions.

Integration is acceptable, neither easy nor tough.

I would rate this review at eight overall.

I have recently used SentinelOne Singularity Cloud Security . We also have the CrowdStrike EDR tool, which is similar to SentinelOne Singularity Cloud Security  and other EDR solutions. We used the CrowdStrike tool two to three months ago.

We can check multiple types of alerts and triggers, and we can analyze these. There are many types of functions such as Kill, Quarantine, and remediate rollback types of features, which we can use for client safety.

The rollback feature is the best feature because it is only used in SentinelOne Singularity Cloud Security. We have used multiple types of EDR, but the rollback feature is unique to SentinelOne Singularity Cloud Security. When many types of attacks happen in an organization, the rollback feature deletes all types of malicious files and other malware-type files and completely cleans your system. This feature is very interesting according to me.

SentinelOne Singularity Cloud Security provides many types of features such as Kill and Quarantine, which are very interesting features for security operations. There are deep visibility features, and Purple AI  is also one of the best features. It is easy for security operations and incident response. We can check log analysis with the help of deep visibility, and any types of attacks, malware, and phishing attacks are detected by SentinelOne Singularity Cloud Security. Many types of security operations can be tracked and observed with the help of SentinelOne Singularity Cloud Security.

Purple AI  is one of the interesting features in SentinelOne Singularity Cloud Security. Deep visibility is one of the best features in SentinelOne Singularity Cloud Security. You can find any types of logs and any types of devices through searching portals, similar to Google search. It gives you information regarding this. With deep visibility, you can search for any name. For example, we can search for any name and check what is happening with that person's laptops, what USB is connected or disconnected, and whether the network is connected or not. This is with the help of Purple AI.

According to me, there is one thing I dislike, which is the dashboard. SentinelOne Singularity Cloud Security does not provide a custom dashboard according to our mindset. There are more types of EDR that give custom dashboards, but SentinelOne Singularity Cloud Security does not provide the custom dashboard. This is the only area for improvement.

I have been working in my current field overall for the last five years, but I have used SentinelOne Singularity Cloud Security for the last two years.

We do not observe any lagging or crashing.

There is low maintenance because it is a cloud platform. It is very low maintenance according to my experience. We can observe our organization, and it is very low maintenance for small organizations. They can easily maintain this.

Technical support is the best for my side. We can raise any ticket for help from the OEM side. It gives a 10 to 15-minute reply, and for anything that is emergency, they schedule a call and solve our problems. According to me, the technical support is good. I give them 10 out of 10 for technical support.

SentinelOne Singularity Cloud Security provides the most features compared to other EDRs, and it is easy to understand. The features are very compact in SentinelOne Singularity Cloud Security, not vast types of features. It is easy to understand for both any fresher or any experienced person. The integration part is also easy compared to other EDR solutions. Newly joined persons can also integrate this because the steps are very easy. According to me, SentinelOne Singularity Cloud Security is the best compared to other EDR devices.

It is easy. Any person newly joined or not belonging to the IT field can follow the steps very easily according to me. The integration parts do not require more types of servers and anything. It is very easy to deploy, and the installation part is also good. There is only one to two minutes installing SentinelOne Singularity Cloud Security agent in each and every endpoint. I think this is the best for SentinelOne Singularity Cloud Security.

Our organization is an MSSP , not a client. We provide the license about our client base. We manage multiple clients through the MSSP  portal. We also manage and resell. We provide this license for SentinelOne Singularity Cloud Security and also we manage. There are 8 to 10,000 agents installed on our client side. We manage around 20 to 30 clients, and there are 8 to 10,000 endpoints installed with SentinelOne Singularity Cloud Security on the client side.

Overall, I give it a 10 out of 10 because SentinelOne Singularity Cloud Security is the best for me. We have used multiple types of EDR, but SentinelOne Singularity Cloud Security provides the best features for our organization and client organization to safely do any activity or go to internet sites, which is why we can give 10 out of 10.

The pricing is basically not very low and very high. It is in the middle range for easy buying for any small organization and big organization. According to me, it is the best price for the EDR. We can check multiple types of EDR, and their prices are so high, but SentinelOne Singularity Cloud Security is not. SentinelOne Singularity Cloud Security is not lesser and not more. It is in the middle range of price.

SentinelOne Singularity Cloud Security has multiple types of policies. One of them is the offensive security. There are also behavioral policies and static AI policies and suspicious policies. There are 10 to 11 types of policies. Anything that triggers the alerts belongs to these policies, which happen through behavioral analysis and offensive security analysis. There are multiple types of policies. Any alert triggered in SentinelOne Singularity Cloud Security comes with the help of these policies.

I have been using this solution overall in my career for the last two years.

There is an AI-based feature. You can create any use case according to our side. Many organizations are not using RDP tools such as AnyDesk  or TeamViewer . Most organizations do not allow these features. At that time, the AI gives you the most types of generated codes. With the help of this code, you can create according to your side for creating any custom rules to keep your organization and clients secure.

I give this solution a 10 out of 10 rating.