What I like most about SentinelOne Singularity Endpoint is the combination of strong endpoint protection and automation. It does not just flag suspicious activity and leave the analyst to figure everything out. It can investigate behavior, connect related activity, and respond quickly.

I also like the visibility it provides during investigations. Being able to understand the sequence of processes and events around an alert makes it much easier to determine what actually happened.

For me, the biggest advantage is that it reduces repetitive work for security teams while still giving analysts the control and visibility they need when a deeper investigation is required. Review collected by and hosted on G2.com.

The main thing I would improve is the overall user experience. SentinelOne is very powerful, but some parts of the console can feel more complicated than they need to be, especially when you are trying to quickly investigate an incident or find a specific piece of information.

I would also like more flexibility around dashboards and reporting. The data is there, but turning it into exactly the view you want can sometimes take more effort than expected.

Overall, I think the product is technically strong, but the interface and day-to-day workflows could be made more intuitive. Review collected by and hosted on G2.com.

I like the 1-click ransomware rollback because it restores compromised, encrypted files in minutes without a full device re-image, cutting recovery time and downtime. I also value the local AI processing, which provides autonomous, uninterrupted protection with zero latency—even when devices are disconnected from the network—and protects against fileless and zero-day threats. Initial setup is straightforward, with a lightweight, single-agent installation through MDM tools and immediate protection out of the box. Review collected by and hosted on G2.com.

I get frequent false positives on benign custom scripts and internal software, so I have to keep managing exclusions. The management console has a steep learning curve, and agent upgrades across complex, mixed-OS fleets can occasionally cause friction. I also have to start in Detect-Only mode to baseline normal behavior and tune exclusions. AI-guided exclusion suggestions, better sandbox pre-testing for custom internal tools, and creating an exclusion in one click from alert details would make this easier. Review collected by and hosted on G2.com.

I like how smoothly SentinelOne Singularity Endpoint handles complex threat detection without bogging down everyday operations. Storyline connects related process events into a clear timeline, saving me hours of forensic guesswork and helping me see an event’s root cause and progression. Its behavioral AI analyzes processes in real time and catches novel or fileless threats without constant manual updates or slowing down system resources. I also value being able to isolate a compromised machine and roll back files to a clean state with one click, which makes incidents quicker and less stressful to fix. It cuts down on manual triage and friction, integrates smoothly with the broader security stack, and the initial agent deployment was straightforward and efficient. Review collected by and hosted on G2.com.

I had to spend time tuning policies, custom rules, and exclusions at the start, and I saw some early false positives, especially in development or heavy testing environments. During deep behavioral scans or intensive remediation, it can also use more system resources than I expected on older endpoints or heavily loaded servers. The dashboard works well for high-level overviews, but customizable compliance and forensic reports can feel rigid and require extra manual formatting. Review collected by and hosted on G2.com.

I like SentinelOne Singularity Endpoint’s real-time threat detection and automated protection. It helps protect my devices from cyber threats, detect suspicious activity, and prevent malware and ransomware attacks. I like that it improves security while reducing manual work, and that the user-friendly interface helps me organize responses to cyber threats quickly and reduce security risks. I also appreciate the centralized management and detailed security reports, which make it easier for me to monitor devices, investigate threats, and manage endpoint security efficiently. The initial setup was easy and relatively straightforward, although configuring it and integrating existing security tools took some extra time. Review collected by and hosted on G2.com.

I think the interface could be more intuitive, and false positives could be reduced. The setup and configuration process could be simpler for new users, with clearer setup guides and more tutorials. I’d also like more customization options. Some configuration and integration with existing security tools took additional time. Review collected by and hosted on G2.com.

I really appreciate the strong real-time threat detection capabilities, which provide peace of mind. The AI-driven automation is incredibly efficient at blocking threats autonomously. Additionally, the platform is very easy to manage across all endpoints, making security operations much smoother. Review collected by and hosted on G2.com.

Sometimes the initial setup and fine-tuning of policies can feel a bit complex and time-consuming. Also, during deep system scans, there can be a noticeable impact on system resources, which may slightly slow down older machines. Review collected by and hosted on G2.com.

AI-driven threat detection that effectively identifies ransomware, malware, fileless attacks, and suspicious behaviors in real time.

Autonomous response capabilities, including device isolation, remediation, and rollback for ransomware recovery, which significantly reduce manual effort.

User-friendly management console with centralized visibility across endpoints, making investigations and policy management straightforward.

Lightweight agent performance compared to many traditional endpoint tools, with minimal impact on end-user systems.

Strong visibility and forensic insights, helping security teams investigate incidents faster and improve overall security posture. Review collected by and hosted on G2.com.

SentinelOne Singularity Endpoint can be complex to learn initially, with a UI that isn’t always intuitive. It may require significant tuning to reduce false positives and optimize performance, and some users report occasional system slowdowns or legitimate processes being blocked. While powerful, it demands skilled management to get the best results Review collected by and hosted on G2.com.

What I find most helpful about SentinelOne Singularity Endpoint is its AI-driven endpoint protection, which leverages machine learning and behavioral analysis to detect and respond to threats in real time. It provides excellent visibility across endpoints, making it easy to investigate incidents and understand what's happening throughout the environment.

The user experience is easy to navigate and intuitive, and onboarding new endpoints is seamless. It also integrates well with other security tools to enable a centralized monitoring and streamlined workflow for IR. All of these ensure high performance. Review collected by and hosted on G2.com.

One downside I’ve noticed is the occasional false positives. They create a lot of noise in the environment, which ends up wasting time. Even when the same alert has been manually mitigated and flagged, it still repeats. Review collected by and hosted on G2.com.

The GUI is easy to use, and the tools are efficient. I also like the flexibility to customize policies, including allowing or blocking specific file types and other categories. Another plus is that permissions can be divided easily based on hierarchy. Review collected by and hosted on G2.com.

Sometimes support is delayed, and for P1 issues we sometimes need help ASAP. If an AI agent, chat agent, or KB article could at least help in the meantime, that would make a difference. Even a single email with clear communication on how much time it will take, along with an ETA, would be helpful. Review collected by and hosted on G2.com.

The automated remediation and 1-click ransomware rollback are unmatched. Having the agent kill malicious processes, isolate the endpoint, and revert encrypted files on its own—even when offline—eliminates hours of manual incident triage and machine reimaging. Storyline also stitches attack events together clearly, making root-cause analysis fast and painless. Review collected by and hosted on G2.com.

Initial onboarding requires disciplined policy tuning, as benign administrative scripts and developer utilities can trigger false positives until exclusions are properly configured. Agent version upgrades across large fleets also require careful scheduling to avoid unexpected reboot prompts. Review collected by and hosted on G2.com.

What I like best about SentinelOne Singularity Endpoint is its behavioral threat detection and automated response. It detects suspicious activity quickly, isolates infected endpoints when needed, and provides a clear investigation timeline that makes it easier to understand and respond to security incidents. The management console is also easy to navigate, which simplifies day to day security operations. Review collected by and hosted on G2.com.

I think the sentinelone singularity endpoint platform is a great security solution, however fine tuning policies and creating exclusions for trusted applications can take some time, especially for larger environment. This can be improved on. Review collected by and hosted on G2.com.