I have experience in both cloud and developer roles. In my cloud infrastructure role, I focused on the infrastructure itself, not the application level. We deployed SentinelOne Singularity Cloud Security across our cloud and data center environments for security purposes. This tool provided alerts and best practice recommendations, including vulnerability notifications. I would then use the Singularity console to address any issues promptly, which significantly reduced our mean time to resolution.
External reviews
External reviews are not included in the AWS star rating for the product.
Maximize security monitoring with adaptable threat detection
What is our primary use case?
How has it helped my organization?
SentinelOne Singularity Cloud Security has an intuitive dashboard and streamlined setup process, making it user-friendly for security teams.
It categorizes alerts into four levels: critical, high, medium, and low. Singularity Cloud Security automatically prioritizes security concerns, such as ransomware attacks or best practices, eliminating the need for manual intervention and presenting the most urgent alerts.
SentinelOne Singularity Cloud Security is important because its reporting includes proof of exploitability. This is very helpful for engineers as it provides alerts, identifies areas needing attention, and directs us to the relevant documentation.
The benefits of SentinelOne Singularity Cloud Security were immediately apparent after deployment in our data center and cloud environment.
SentinelOne Singularity Cloud Security helps reduce false positives and improves system accuracy through machine learning. The detailed alerts aid in investigating potential threats, enhancing our security posture.
SentinelOne Singularity Cloud Security reduces our mean time to detect.
What is most valuable?
SentinelOne Singularity Cloud Security offers valuable scalability suitable for organizations of all sizes, from small businesses to large enterprises. Its comprehensive ransomware protection includes rollback features and 24/7 threat monitoring, with managed services providing continuous monitoring and threat hunting.
What needs improvement?
While SentinelOne Singularity Cloud Security offers robust protection, its cost could be a barrier for some users. Additionally, compatibility issues may arise with older operating systems and legacy environments. Organizations with limited internet connectivity might also face challenges due to the cloud-based nature of the platform.
The Singularity Cloud Security console is experiencing delays in clearing resolved issues, which can take over an hour to be removed from the display.
For how long have I used the solution?
I have been using SentinelOne Singularity Cloud Security for about two years.
What do I think about the stability of the solution?
Sometimes, I experience lag issues with SentinelOne Singularity Cloud Security, which might be related to my laptop or Internet connection.
What do I think about the scalability of the solution?
SentinelOne Singularity Cloud Security scales well, making it suitable for organizations of all sizes, from small enterprises to large businesses.
How are customer service and support?
Customer support is knowledgeable about the company's software and operating systems, responding quickly within two to four minutes.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
While GuardDuty and CloudTrail offer some overlapping functionalities with SentinelOne Singularity Cloud Security in cloud environments, SentinelOne provides a more comprehensive and integrated approach to cloud security.
How was the initial setup?
The initial setup was somewhat straightforward but took about three to four days due to the extensive infrastructure involved. Testing added more time to the process.
What about the implementation team?
Our team of six or seven collaborated with a third-party installer and SentinelOne's technical support team.
What's my experience with pricing, setup cost, and licensing?
While SentinelOne Singularity Cloud Security offers robust protection, its high cost may be prohibitive for small and medium-sized businesses.
What other advice do I have?
I rate SentinelOne Singularity Cloud Security ten out of ten.
SentinelOne manages the maintenance of Singularity Cloud Security.
Gives centralized and real-time data and improves our security posture
What is our primary use case?
My primary use case for SentinelOne Singularity Cloud Security is for security purposes. It provides me with alerts.
By implementing this solution, we wanted notifications about any potential threats, such as port scanning or unauthorized access attempts. This is why we have deployed it on the cloud to monitor and secure our systems.
How has it helped my organization?
It has an intuitive dashboard, which streamlines the setup process. It is a user-friendly tool for security teams handling cloud or data centers.
For fewer false positives, they ensure that their threat intelligence databases are up to date. That reduces misclassification and improves system accuracy over time through machine learning.
SentinelOne Singularity Cloud Security has improved our security posture. We are almost 100% secure.
It has reduced our mean time to remediate by 40% and the mean time to detect by about 70%.
What is most valuable?
SentinelOne Singularity Cloud Security offers valuable features like runtime notifications. These alerts come to my account, ensuring that if any port or component within my infrastructure is opened or compromised, I am informed immediately. It highlights issues within minutes or even seconds.
It is very easy to use. It is user-friendly. Dashboards and other features are easy to use even for newbies. Someone new can easily understand the dashboard and other features.
What needs improvement?
The cloud-based operations might pose challenges in areas with limited or unavailable internet connectivity. Desktop features might be useful for smaller organizations with less complex security needs.
Moreover, there is a higher price point compared to traditional endpoint protection solutions, which may not be ideal for smaller organizations.
For how long have I used the solution?
I have been using SentinelOne Singularity Cloud Security for around one and a half to two years.
What do I think about the stability of the solution?
It is stable. I would rate its stability a nine out of ten.
What do I think about the scalability of the solution?
I would rate its scalability as seven out of ten because there might be issues due to internet connectivity or occasional lag when deploying for monitoring purposes.
It is being used at multiple locations and by multiple teams. In my team, there are about 12 people.
How are customer service and support?
I would rate the customer service and support as eight out of ten.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
Before SentinelOne Singularity Cloud Security, we did not use any solution in the cloud. We had no centralized system. We had to go through cloud services such as GuardDuty, but it took time to analyze the issue and the root cause.
We wanted to follow the best practices and have something centralized. SentinelOne Singularity Cloud Security gives us centralized and real-time data.
How was the initial setup?
We have multiple clouds and a data center. Its deployment is easy. The initial setup was straightforward, and it took a total of around five days, including testing time.
What was our ROI?
We have seen approximately 30% return on investment.
What's my experience with pricing, setup cost, and licensing?
It is a little expensive. I would rate it a four out of ten for pricing.
What other advice do I have?
I would rate SentinelOne Singularity Cloud Security an eight out of ten overall. I would recommend it to other users due to its effectiveness in providing centralized notifications and reducing the meantime to address issues.
Provides real-time inspection and supports multiple cloud engines
What is our primary use case?
We use SentinelOne Singularity Cloud Security for real-time alerts, enabling us to address potential threats proactively.
SentinelOne Singularity Cloud Security was implemented to enforce best practices, monitor runtime activity, and expedite troubleshooting.
How has it helped my organization?
SentinelOne Singularity Cloud Security provides easy-to-follow documentation on the steps required to resolve issues.
It offers a user-friendly experience with a centralized console for managing assets and delivering devices.
Singularity Cloud Security provides a real-time inspection for organizational growth, which makes it suitable for both small and large enterprises. It is interactive and easy to navigate, simplifying self-service.
What is most valuable?
Singularity Cloud Security's most valuable features are its ease of scalability and comprehensive security measures.
Singularity Cloud Security has a centralized console for managing assets and delivering devices.
Singularity Cloud security supports various cloud engines, such as Azure and AWS.
Once fine-tuned, Singularity Cloud Security reduces false positives by 80 percent.
Singularity Cloud security improves our risk posture. We have not had any security issues.
It has reduced our mean time to detect by up to 20 percent.
Our mean time to resolve has significantly improved with the implementation of Singularity Cloud security. Previously, our MTTR ranged from 15 to 20 minutes, but now it has been reduced to 5 to 7 minutes.
Singularity Cloud security has been a valuable asset to our application developers and AppSec team. Its support for various cloud platforms and user-friendly interface have greatly improved our security posture.
What needs improvement?
While SentinelOne offers robust security features, its higher cost may present a challenge for budget-conscious organizations. Additionally, some users have reported experiencing delays in issue resolution due to slower response times from the support team.
For how long have I used the solution?
I have been using SentinelOne Singularity Cloud Security for around two years.
What do I think about the stability of the solution?
I would rate the stability of Singularity Cloud Security nine out of ten.
What do I think about the scalability of the solution?
I would rate the scalability of Singularity Cloud Security ten out of ten.
How are customer service and support?
Sometimes, the response time of the support team is lagging.
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
How was the initial setup?
The initial deployment was straightforward and took three days to complete.
What about the implementation team?
Their customer service support team was on the call with us. Our team leads and technical people were there, and they jointly deployed Singularity Cloud Security on the data center as well as on the cloud.
What was our ROI?
Before SentinelOne, I used to take around 15 to 20 minutes to resolve an issue. After implementing SentinelOne, it takes about five to seven minutes.
What's my experience with pricing, setup cost, and licensing?
SentinelOne is more expensive compared to other security solutions.
I would rate the cost a seven out of ten with ten being the most costly.
What other advice do I have?
I rate SentinelOne Singularity Cloud Security a nine out of ten.
Singularity Cloud Security is deployed across our infrastructure, and we currently have 13 users.
I would recommend SentinelOne Singularity Cloud Security to other users for security purposes.
The AI/ML-driven backend engine effectively identifies and resolves threats
What is our primary use case?
As an application developer focused on AWS and cloud components, I rely on SentinelOne Singularity Cloud Security to stay informed about vulnerabilities and maintain best security practices.
How has it helped my organization?
I would rate the ease of use of Singularity Cloud Security a nine out of ten. It is very helpful for beginners due to its simplicity and straightforward integration with various cloud platforms like AWS, GCP, and Azure. Its user-friendly interface and familiarity across different cloud environments make it easy to understand and implement, regardless of prior experience.
Singularity Cloud Security prioritizes and resolves critical cloud security issues. When a problem arises in my infrastructure, SentinelOne alerts me, such as an open port in our AWS environment or a deviation from best practices. It provides alerts, suggests solutions, and offers documentation with best practices, which is helpful for those new to cloud platforms. This has reduced my response time by approximately 45 minutes.
The Offensive Security Engine, powered by impressive AI/ML capabilities, seamlessly integrates with cloud infrastructure to analyze data and provide optimal security solutions. Its AI/ML-driven backend engine effectively identifies and resolves threats, making it a powerful tool for comprehensive security monitoring and protection.
We saw the benefits of SentinelOne Singularity Cloud Security immediately.
SentinelOne Singularity Cloud Security categorizes risk into four levels: low, medium, high, and critical. Teams handle low and medium alerts, which are based on best practices that we must follow. High and critical alerts are very important and require immediate attention. When these critical alerts occur, we contact PingSafe or the SentinelOne data team for support. They help us resolve the issue, identify affected resources, and provide comprehensive information. Occasionally, we receive direct support from SentinelOne, collaborating with them using their tools. The system is reliable and accurate, with no false positives.
It significantly reduced our mean time to detect threats. Previously, we didn't use security tools, so I had to identify and address vulnerabilities independently. To ensure best practices were followed, I had to manually investigate issues within our AWS environment and troubleshoot them alone. SentinelOne has been instrumental in guiding us toward securing our infrastructure by providing insights into best practices and automating threat detection.
SentinelOne Singularity Cloud Security has helped reduce our mean time to remediate.
What is most valuable?
The most valuable feature is the notification system, providing real-time alerts and comparisons crucial for maintaining security. Additionally, the dashboard's user interface and user experience are intuitive and easy to understand, even for new users.
What needs improvement?
One potential drawback is the cost of SentinelOne Singularity Cloud Security, which may be prohibitive for smaller businesses or startups, particularly those in regions with lower average incomes, such as India.
For how long have I used the solution?
I have been using Singularity for around one year.
How are customer service and support?
The customer service and support team is knowledgeable and helpful. Throughout the migration, they remained available for several hours without complaint, providing assistance at every step.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
How was the initial setup?
The initial deployment was not difficult. It was smooth, with support from experienced team members and customer support during the two to three-day migration process.
What about the implementation team?
During migration, more than two people were involved, though only two were necessary.
What's my experience with pricing, setup cost, and licensing?
The pricing is somewhat high compared to other market tools. This cost can be particularly prohibitive for small businesses and startups.
Which other solutions did I evaluate?
What other advice do I have?
I would rate SentinelOne Singularity Cloud Security nine out of ten.
My responsibility within our infrastructure is limited to the infrastructure itself, excluding the application and database layers. As such, I can only offer guidance on the infrastructure aspects of our implementation. When we deployed SentinelOne Singularity Cloud Security in our hybrid infrastructure, both cloud and data center-based, the migration was smooth, taking approximately two to three days of testing to complete successfully.
Which deployment model are you using for this solution?
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Evidence-based reporting helps prioritize and solve cloud security issues
What is our primary use case?
In my organization, we use SentinelOne Singularity Cloud Security to enhance our security posture. The platform provides alerts and recommendations on best practices, policies, and necessary updates to strengthen our infrastructure security.
We implemented SentinelOne Singularity Cloud Security to strengthen our security posture. Previously, we lacked clear guidance on best practices, including password reset policies, patching procedures, and VM updates. SentinelOne provides these best practices and recommendations, significantly improving our infrastructure security.
How has it helped my organization?
SentinelOne Singularity Cloud Security is user-friendly.
Evidence-based reporting helps prioritize and solve cloud security issues. When an issue occurs in my infrastructure, I receive an alert on their dashboard and a notification is sent to our common email address. SentinelOne Singularity Cloud Security provides a direct link to the affected resource in the AWS console, allowing me to navigate to the issue and resolve it quickly.
SentinelOne Singularity Cloud Security has improved my organization's security posture significantly. Before its implementation, we lacked an understanding of best practices for security. The solution has clarified our path by providing guidelines and alerts, which have helped us secure our infrastructure effectively.
It has reduced the number of false positives significantly, providing accurate data for our security processes.
SentinelOne Singularity Cloud Security has significantly improved our risk posture.
Prior to implementing SentinelOne Singularity Cloud Security, our mean time to detect ranged from 30 to 35 minutes. Now, with SentinelOne, our MTTD has significantly improved, falling within the range of 5 to 10 minutes.
Our mean time to remediate has been reduced to five minutes since implementing SentinelOne Singularity Cloud Security.
What is most valuable?
SentinelOne Singularity Cloud Security offers several valuable features, most notably the rapid vulnerability notifications that provide timely alerts regarding our infrastructure. Furthermore, the platform's intuitive interface enables even novice team members to navigate the dashboard with ease, minimizing the need for extensive documentation.
What needs improvement?
I believe the UI/UX updates for SentinelOne Singularity Cloud Security have room for improvement. While the current interface is excellent, enhancements could make it more user-friendly. Additionally, an improved notification system that sends alerts about vulnerabilities directly to our centralized console would allow for a more prompt response.
For how long have I used the solution?
I have been using SentinelOne Singularity Cloud Security for almost one and a half years.
What do I think about the stability of the solution?
I rate the stability of SentinelOne Singularity Cloud Security as nine out of ten.
What do I think about the scalability of the solution?
I rate the scalability of SentinelOne Singularity Cloud Security as ten out of ten.
How are customer service and support?
I have contacted SentinelOne's technical support team once, and they were very helpful. Their communication and product knowledge were excellent.
How would you rate customer service and support?
Positive
How was the initial setup?
The initial cloud-based deployment was straightforward, taking approximately two to three working days with a team of three people.
What about the implementation team?
The implementation was handled internally by my team with guidance from a senior resource.
What other advice do I have?
I rate SentinelOne Singularity Cloud Security nine out of ten.
We have 150 users of SentinelOne Singularity Cloud Security.
I recommend SentinelOne Singularity Cloud Security to others because it is very important from a security standpoint.
Has significantly strengthened our security posture
What is our primary use case?
We use SentinelOne Singularity Cloud Security to maintain security best practices. The platform alerts us to security issues, ranging from low to critical severity, based on our infrastructure.
We chose SentinelOne Singularity Cloud Security for its targeted vulnerability recommendations and best practice guidance, which allow us to address alerts effectively and maintain a secure infrastructure.
How has it helped my organization?
SentinelOne Singularity Cloud Security is user-friendly and easy to understand.
SentinelOne Singularity Cloud Security's evidence-based reporting for helping prioritize and solve the most important cloud security issues is excellent.
The exploitability proof in reports is crucial, enabling me to pinpoint issues and solutions. Without it, identifying vulnerabilities and applying fixes would be impossible. The system alerts me to security events, pinpointing the problem's location with resource and account IDs. This detailed information allows for rapid resolution, saving valuable time.
Upon joining the company, the user interface was not very user-friendly. However, over time, upgrades were introduced, such as more issue resolution documentation and best practices, which enhanced the security of our infrastructure. I realized the benefits of SentinelOne Singularity Cloud Security within five months.
SentinelOne Singularity Cloud Security has significantly strengthened our security posture. Previously, we relied on AWS-managed security alarms, which provided a limited and reactive approach to threat detection. Singularity Cloud Security offers a more proactive and comprehensive solution, enhancing our ability to identify and respond to potential threats.
SentinelOne Singularity Cloud Security has reduced our mean time to detect by five to ten minutes.
SentinelOne Singularity Cloud Security allows us to complete remediation in five minutes.
What is most valuable?
The most valuable feature is the easy-to-understand user interface, which allows even non-technical users to comprehend and resolve issues. Additionally, the solution provides highly useful recommendations.
What needs improvement?
To enhance the notification system's efficiency, resolved issues should be promptly removed from the portal. Currently, these issues take two to three hours to be removed, creating unnecessary clutter and potentially delaying the identification of new issues.
For how long have I used the solution?
I have been using SentinelOne Singularity Cloud Security for almost two years.
What do I think about the stability of the solution?
I would rate the stability of SentinelOne Singularity Cloud Security nine out of ten.
What do I think about the scalability of the solution?
I would rate the scalability of SentinelOne Singularity Cloud Security ten out of ten.
How are customer service and support?
Customer service and support are excellent. They respond promptly, and the technical support is knowledgeable and helpful with any issues we face.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
How was the initial setup?
The initial setup took approximately one week due to the testing phase. It went smoothly with the team's collaboration.
What about the implementation team?
I was present with my team during the deployment process, but I did not personally deploy it.
What other advice do I have?
I would rate SentinelOne Singularity Cloud Security ten out of ten.
Our organization has multiple departments, but only five individuals have access to Singularity Cloud Security.
Singularity Cloud Security's maintenance is handled by SentinelOne.
From a security standpoint, SentinelOne Singularity Cloud Security is excellent, and I highly recommend it.
Enabled our security posture to become much better
What is our primary use case?
I use SentinelOne for the traffic flow in my customer's account.
How has it helped my organization?
Singularity Cloud Security gives us alerts, and it is helpful for us to get these alerts. We get to know about any issues through these alerts. We can resolve the issues accordingly.
It helps resolve issues more quickly. I do not have to analyze them on my own. We get to know the issues, and we also have documentation and recommendations about how to resolve them. That is very helpful for me.
We were able to realize its benefits pretty quickly because I already had its knowledge. I had studied a little bit and researched it. After implementation, my work got faster by almost 60% to 70%. The client was happy with that.
Singularity Cloud Security has reduced the number of risks. After resolving an issue on one of the servers, I can implement the fix on other servers before getting alerts about those. There is about 70% to 80% reduction.
It has been beneficial for all team members because we are all working in shifts and we are not able to communicate with each other much. The documentation has helped a lot.
Our security posture is much better. I do not have the numbers, but we see fewer notifications about security and threats. We follow the guidelines and best practices.
What is most valuable?
The security that it provides is valuable. It has a user-friendly dashboard that I can access without any difficulty.
Security notifications or alerts are also very useful. The alert mechanism helps in identifying issues.
It is very easy to use. I would rate it a nine out of ten for usability.
What needs improvement?
Sometimes, I am not able to see the flow when there is an issue. When anyone complains and I have to troubleshoot it, I find it difficult to search.
The documentation that I use for the initial setup can be more detailed or written in a more user-friendly language to avoid troubles.
For how long have I used the solution?
I have six months of experience using it.
What do I think about the stability of the solution?
It is stable. I would rate it a nine out of ten for stability.
What do I think about the scalability of the solution?
It is scalable. I would rate it a nine out of ten for scalability. Our clients are large organizations.
In our AWS Cloud, we have multiple accounts. We have almost 400 users. The AppSec team is a different team that is responsible for its installation. We are its users.
How are customer service and support?
I use vendor support. I would rate them a nine out of ten.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
I did not use any different solution before.
How was the initial setup?
Initially, it took a lot of time because I had to first learn it and then implement it. First time, there can be some challenges. It took some time to understand because it was my first setup. Once I understood the process, it became easier with subsequent setups.
What about the implementation team?
We implemented this solution after reviewing the documentation. Our AppSec team deployed it.
What other advice do I have?
I would recommend this solution. I find it very user-friendly, and the documentation is also good enough to give solutions, which is very important. In addition to notifications, we also get solutions.
I would rate Singularity Cloud Security a nine out of ten.
Which deployment model are you using for this solution?
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Provides a centralized view of all workloads, enabling us to identify misconfigurations
What is our primary use case?
Working in a highly regulated space with stringent security requirements for money movement necessitates robust security measures. SentinelOne Cloud Security effectively secures our workloads, providing peace of mind and significantly reducing stress by addressing both security and regulatory needs.
How has it helped my organization?
The primary challenge we faced was achieving comprehensive visibility and observability across our extensive cloud environment, which comprises over 50 AWS accounts. It was difficult to determine the specific account and business entity associated with each workload. SentinelOne provided a centralized view of all workloads, enabling us to identify misconfigurations, pinpoint their location, and assess their potential impact. This clarity allowed us to prioritize responses based on the criticality of the affected account, such as production or highly regulated environments, thereby optimizing our response time.
To reduce noise and improve security monitoring, we implemented two key strategies. First, we leveraged the SentinelOne platform to identify internet-exposed assets and prioritize them for enhanced monitoring. SentinelOne's cloud-based capabilities significantly reduced false positives and helped establish a baseline for normal network activity. Second, we integrated the Infrastructure as Code module to automatically detect any deviations from the baseline or new misconfigurations. This proactive approach enabled us to efficiently address vulnerabilities and maintain a secure environment. After an initial cleanup, ongoing maintenance became much easier due to the continuous monitoring and automated alerts provided by SentinelOne and the IAC module.
Cloud security has helped reduce false positives by prioritizing vulnerabilities based on two factors: the criticality of the exposed asset and the environment it operates within. This prioritization metric helps eliminate false positives and allows teams to focus on fixing actual security issues.
Cloud security has improved incident response, primarily by enhancing observability. This allows for immediate identification of an IP address's host account and connected resources, which speeds up response time. Understanding the potential damage is also crucial, and this is achieved by knowing all resources accessible to the compromised asset. This comprehensive approach, combining identification and impact assessment, significantly strengthens security response capabilities.
SentinelOne Cloud Security reduces response times by providing context for assets, such as location, access details, and component interactions. This allows for quick identification of the responsible team and facilitates efficient damage assessment and remediation. Automated responses, like automatically fixing public S3 buckets, can be implemented, although caution is needed as some public access may be intentional.
SentinelOne Cloud Security has significantly improved team collaboration by simplifying the process of identifying the owner of a vulnerable or problematic component. Previously, this was a time-consuming task, but now the platform allows for quick identification of the responsible business entity and developer, enabling direct contact with the appropriate DevOps personnel. This streamlined process accelerates both detection and response times, ultimately enhancing overall security.
SentinelOne has released Purple AI, a tool with immense potential. It can analyze sentences and identify specific IP addresses or vulnerable machines, significantly aiding threat detection. This capability allows for rapid computation and complex query execution, delivering crucial answers in minutes and enhancing data analysis for security purposes.
What is most valuable?
Cloud Security has provided a single view to observe all workloads, prioritization for handling cloud assets, and reduced noise by distinguishing false positives effectively.
What needs improvement?
Once all components, including the cloud piece and container runtime piece, integrate further and incorporate an AI layer for better comprehension, it will greatly enhance the utility of Singularity Cloud Security.
For how long have I used the solution?
I have been using SentinelOne's cloud piece for about three to four months.
How are customer service and support?
SentinelOne has provided excellent support, enabling us to implement a robust solution customized to effectively meet our security and compliance needs.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
Prior to implementing SentinelOne, we faced excessive false positives and an overwhelming number of findings, hindering prioritization. However, SentinelOne Cloud's offensive engine provides reassurance by automatically checking exposed assets for new threats, such as zero-day attacks, ensuring immediate awareness of any issues.
SentinelOne allows for customized prioritization, enabling changes based on specific accounts and the addition of further actions to misconfiguration adjustments. The graphing ability of SentinelOne CNAPP facilitates comprehensive chaining for in-depth analysis. The demos on misconfigurations and the prioritization matrix were particularly informative.
What's my experience with pricing, setup cost, and licensing?
SentinelOne provided competitive pricing compared to other vendors, and we are satisfied with the deal.
Which other solutions did I evaluate?
When evaluating CNAPP vendors, several key considerations emerged. First, it was essential to assess the regulatory frameworks and ensure compliance. Second, the issue of false positives needed to be addressed to maintain efficiency. Finally, the prioritization capabilities, particularly the use of graphs to identify critical assets, were crucial factors in the selection process.
What other advice do I have?
I would rate SentinelOne Cloud Security a nine out of ten. They are bringing all the pieces together, and once the Purple AI can interact with all the different components and correlate across them, I think that's where its real power will come from.
SentinelOne CNAPP was extremely helpful and chosen for three primary reasons: their responsive and efficient team facilitated a rapid deployment; the technology itself proved to be very robust and effective; and the platform's configurability allowed for seamless integration with our specific business needs.
For those evaluating SentinelOne CNAPP, it is advised to engage with their team for potential configuration changes. The tool offers comprehensive insights, providing productive usage from day one for penetration testers and security engineers.
Custom correlation searches enhance threat detection efficiency
What is our primary use case?
As a senior IT security director, I oversee the governance and guidance of security deployments, including the development and implementation of use cases. My primary guiding principle, which is shared by my team, is to prioritize visibility. This translates into our use of SentinelOne Singularity Cloud Security to gain comprehensive visibility across our hybrid infrastructure including cloud, on-premises, and end-user workstations. Ultimately, visibility is the main driver of our security strategy.
How has it helped my organization?
Singularity Cloud Security significantly reduced our organization's threat detection time by providing immediate data visibility. This allows our team to analyze telemetry in real-time, query it, and identify anomalies or potential threats using the Singularity platform. We can create rules that automatically trigger alerts based on this real-time data, enabling immediate response. This instant threat detection and response capability is a major improvement over our previous reliance on multiple tools with delayed data flows. Singularity Cloud Security eliminates those delays, saving valuable time in incident response scenarios.
MTTR and MTTD are critical metrics for incident response processes. They measure the time it takes to fully address an incident, from initial detection to complete remediation. Minimizing these times is crucial to limit damage, as attackers can quickly exploit vulnerabilities and compromise additional systems. Rapid detection and response are essential to disrupt attackers and prevent further progression within the attack chain.
Singularity Cloud helps reduce false positives by allowing engineers direct access to data. This access enables querying, validation, and the creation of correlation searches for improved data analysis. Instead of a black box approach, Singularity provides full visibility into the code and syntax used, increasing confidence in the results. Ultimately, Singularity offers greater control over correlation searches, detection rules, and response scenarios due to the enhanced engagement and control it provides.
Singularity's ability to create custom correlation searches significantly reduces noise by avoiding reliance on generic, pre-built searches that often lead to false positives in diverse organizational environments. This targeted approach results in a high positive rate and efficacy, allowing for focused detection and response. By designing and running custom searches, Singularity minimizes the need to sift through irrelevant alerts, unlike systems using default rules that inundate analysts with noise. This translates to a very low noise-to-efficacy ratio, enabling efficient and accurate incident response.
Singularity Cloud offers valuable data and capabilities extending beyond security, benefiting various business units. For example, it helped troubleshoot a newly introduced service with limited telemetry. My team created custom correlation searches to track specific event types, confirming the software's functionality. This success garnered positive feedback throughout the company, reaching even the CIO and CSR, as it enabled the business to showcase the software's effectiveness in a way that was previously impossible.
SentinelOne improves our regulatory compliance by fulfilling the endpoint detection and response requirements of various frameworks. Many federal regulations require businesses to meet specific security standards, including those related to endpoint, identity, and cloud security. SentinelOne enables us to meet these requirements and assure potential partners that we have a robust security posture. This strengthens our partnerships and streamlines procurement processes, demonstrating how SentinelOne contributes to our compliance efforts.
SentinelOne's evidence-based reporting, particularly the CNS reports, fosters trust due to the transparency of the data source and the ability to understand the underlying mechanisms. Knowing the search criteria, data types, and information gathering process, especially when customized for detection engineering, creates confidence in the product and the relationship with SentinelOne. This transparency and customization allow users to delve into the mechanics of the reporting, understand its functionality, and ultimately trust the evidence provided.
AI is a crucial consideration for security strategies. While some view AI as a potential replacement for human analysts, others see it as a powerful tool to enhance their capabilities. The latter approach emphasizes AI's ability to accelerate incident response, improve threat detection, and provide valuable insights to analysts. This perspective suggests that AI should be used to augment human expertise, enabling analysts to make faster and more informed decisions, particularly in prioritizing threats and developing a sixth sense for identifying malicious activity. By integrating AI as an enabler, organizations can empower their security teams to become more efficient and effective, ultimately strengthening their overall security posture.
What is most valuable?
Singularity Cloud's ability to create custom correlation searches and reduce noise is highly valuable. It allows us to focus on specific detections with high efficacy, avoiding the noise typical with default rules, thus enhancing our incident response efficiency. Additionally, the engineer engagement enables us to have full visibility into the code and design effective correlation searches and detection rules.
What needs improvement?
While the future roadmap presented by SentinelOne appears promising, I hope the envisioned advancements are realistically achievable and that the gap between current offerings and long-term goals is not too significant. If SentinelOne can deliver on its vision, it will be truly impressive, and we will continue to support its efforts.
For how long have I used the solution?
I have been using SentinelOne Singularity Cloud Security for four years.
What do I think about the stability of the solution?
Singularity Cloud has been stable over the course of our usage.
What do I think about the scalability of the solution?
We have not faced issues with scalability and find the solution flexible enough to accommodate our dynamic environments.
How are customer service and support?
SentinelOne has consistently provided excellent support. While there were some initial challenges when we first partnered with them four years ago, these were resolved over time with continued effort and communication. As with any relationship, investment leads to strong, positive outcomes, and we have maintained a great working relationship with SentinelOne ever since.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
Prior to SentinelOne, we did not use an EDR vendor. Four years ago, ransomware became increasingly prevalent, transitioning from a niche topic in IT news to a major concern covered by prominent media outlets like CNN and the Wall Street Journal. This heightened awareness led to increased pressure from company leadership, demanding strategies to mitigate the risk of ransomware attacks. Consequently, we sought an EDR solution to bolster our security posture. SentinelOne was selected over two competitors due to its superior detection capabilities, customization options, and competitive pricing, all critical factors considering our budgetary constraints. In retrospect, I believe we made the correct decision.
How was the initial setup?
The initial setup was straightforward and well-supported by SentinelOne.
What about the implementation team?
We implemented the solution with the help of SentinelOne's support and engineering team.
What was our ROI?
By significantly reducing incident response time and false positives, the ROI has been evident in terms of optimizing our security operations and minimizing risks.
What's my experience with pricing, setup cost, and licensing?
The licensing is easy to understand and implement, with some flexibility to accommodate dynamic environments. The combination of pricing and the ability to customize detection rules was a key factor in selecting SentinelOne.
Which other solutions did I evaluate?
We evaluated two other competitors before choosing SentinelOne based on detection capabilities, customization opportunities, and competitive pricing.
What other advice do I have?
I would rate SentinelOne Singularity Cloud Security nine out of ten.
Currently, our cloud workload protection system is deployed for visibility only, without blocking capabilities or enforced policies. While we are not yet utilizing its full protection potential, this proactive approach allows our development, IT, and quality teams to gradually transition to containerized workloads over the next few years. SentinelOne's cloud workload protection tools provide the necessary functionality to secure our environment as teams adopt modern serverless methodologies. Although full implementation is an ongoing effort, having these tools in place ensures we can confidently secure our evolving infrastructure.
We've thoroughly enjoyed our four-year partnership with SentinelOne. Their account management and readily available engineering support have been exemplary, setting a high standard for customer service. While escalations can sometimes experience delays, their responsiveness has been the best we've encountered. The entire organization, from account managers and engineers to the managed detection response service, operates cohesively.
Cloud security is challenging, especially in multi-cloud environments, but as we use a single cloud provider, we leverage native security tools for detection and visibility. While we initially considered cloud-native protection unnecessary, we realized the limitations of relying solely on our provider's knowledge and visibility. Their data is inherently limited by their own experience. SentinelOne, with its global customer base across various cloud providers, offers broader threat intelligence. Learning from attacks across all cloud platforms, like Amazon, Azure, and Google, is crucial for a comprehensive security posture. By partnering with SentinelOne, we gain access to this wider threat landscape and benefit from a learned security environment.
Our organization relies on Azure services. A key advantage of SentinelOne is its ability to serve customers across various data centers, including those hosted by Azure and Amazon.
I recommend colleagues and professionals in information security give SentinelOne a try, as they will quickly see the benefits, especially if not working with modern cloud-based solutions. SentinelOne's capabilities in visibility and detection make it a valuable addition to any security strategy.
SentinelOne's openness to customer feedback is impressive. I've served on other customer advisory boards, even for competitors, but SentinelOne stands out. They actively involve customers in shaping their products, including the user interface, detection rules, and Singularity AI Cloud components. This customer-centric approach fosters a mutually beneficial relationship where customer feedback directly enhances the security solutions. I encourage all SentinelOne customers to explore opportunities like beta testing, advisory boards, or UX feedback programs. The company's success translates to improved security for organizations like mine, and the close collaboration builds a strong, valuable partnership. Seeing our feedback implemented in their products is truly remarkable.
Enhanced threat management with real-time protection and evidence-based reporting
What is our primary use case?
Singularity Cloud Security helps my organization achieve its goals by providing protection and cloud security posture management for our AWS organization. It offers detailed visibility into any misconfigurations, threats, or other items that come through from the AWS services, and enables my engineers to easily find and get information on how to triage those items.
How has it helped my organization?
SentinelOne has enabled us to identify and address misconfigurations more efficiently by streamlining the research and remediation process.
Singularity Cloud Security has significantly improved our risk management by providing clear visualization of threats, validating their severity, and prioritizing them. This allows us to efficiently allocate resources, strengthen our security posture, and minimize risk.
Cloud security has significantly reduced irrelevant alerts by effectively analyzing potential threats and determining their validity, a capability unmatched by any other product we've used.
Singularity Cloud Security has significantly reduced false positives by filtering out thousands of alerts triggered by offensive security tests and application configuration validation, resulting in a more manageable number of alerts requiring attention.
Singularity Cloud Security has improved incident response by integrating directly with our notification and task management services. This allows us to receive immediate notifications of critical misconfigurations or vulnerabilities and automatically generate service tickets for remediation.
Singularity Cloud Security utilizes push-based notifications to instantly detect misconfigurations and provide immediate alerts through integrated services, significantly reducing the mean time to detection compared to traditional polling-based methods.
Singularity Cloud Security has reduced our mean time to respond because its direct integration with our notification services allows for immediate attention to issues.
SentinelOne has improved our organization's regulatory compliance by providing insights into misconfigurations and issues before they impact our production environment. This proactive approach ensures consistent compliance with both regulatory standards and client expectations.
Cloud Native Security's evidence-based reporting allows for issue prioritization by determining their impact, enabling efficient time allocation to resolve the most critical problems first.
Cloud Workload Security's real-time threat protection safeguards our workloads, providing visibility into anomalies and threats, and automatically remediating them at a speed unattainable through manual intervention. This automation frees my team from time-consuming investigations and remediation, allowing them to focus on other critical tasks while ensuring our services remain actively protected.
The introduction of Purple AI by SentinelOne enhances our cybersecurity strategy by empowering engineers to proactively address security issues. This distributed approach allows engineers to triage, identify, and resolve problems within their own teams, reducing reliance on the SecOps team for all security tasks. By shifting responsibility leftward to the engineers directly accountable for specific components, we foster a more efficient and responsive security posture.
What is most valuable?
Cloud Native Security's evidence-based reporting allows us to prioritize issues by understanding their impact, helping us resolve the most important problems first. AWS real-time threat protection protects our workloads and provides visibility into anomalies or threats, automatically remediating them at speeds beyond our manual capabilities.
What needs improvement?
SentinelOne Singularity Cloud Security could be improved with easier integrations to the Singularity Data Lake, particularly for various vendors. Additionally, the platform would benefit from an enhanced ability to provide a deeper, holistic view of the entire application deployment cycle, extending beyond effective run times.
For how long have I used the solution?
I have been using SentinelOne Singularity Cloud Security for three months.
How are customer service and support?
The most important aspect of the evaluation process was the support and responsiveness of the SentinelOne team, because great products alone cannot meet all needs. Ultimately, having a reliable team ready and willing to assist with any issues is essential.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
We had an existing CNAP solution for about three years. While functional, it generated a lot of false positives and required extensive manual review. Additionally, it lacked useful integration with our other vendors and partners, and overall, felt somewhat outdated.
What's my experience with pricing, setup cost, and licensing?
SentinelOne offers excellent pricing and licensing options. I was able to consolidate two security vendors into one by switching to SentinelOne, and I now pay less than I did for either of them.
As a cloud-native application operating exclusively within AWS, we procured SentinelOne through the AWS Marketplace. This partnership, facilitated through an EDP purchasing agreement, streamlines our procurement process, consolidates purchase records, and provides a discount on our AWS spending.
Which other solutions did I evaluate?
We did a proof of value with SentinelOne, reviewing and validating all the products we are currently using to determine their viability compared to our current vendors and ultimately make the decision to move forward with SentinelOne as our new product vendor.
Prior to evaluating SentinelOne as a CNAP vendor, we faced significant challenges with our existing vendors, primarily large organizations that were slow to update their products and meet our needs. However, our partnership with SentinelOne has been markedly different. Their leadership team demonstrates a strong commitment to customer success, fostering a culture of direct collaboration and continuous innovation, which aligns perfectly with our requirements for a partner.
What other advice do I have?
I would rate SentinelOne Singularity Cloud Security nine out of ten.
The partnership between SentinelOne and AWS, particularly the Singularity Cloud integrations, provides streamlined access to actionable information from AWS.
I would tell anybody considering Singularity Cloud Security to absolutely proceed. SentinelOne has been phenomenal to work with, and I am looking forward to a continued partnership as they innovate and integrate AI, consistently rolling out new features.