SentinelOne Singularity Endpoint Reviews & Product Details

Very intuitive tool, easy to use, with built-in Generative AI that greatly helps in solving cases. Remediation is simple and fast. In terms of resources, it requires little and is quickly deployed through other tools like NinjaOne RRM. The price is reasonable for the advanced capabilities the solution offers, and if you have any questions, the support team responds promptly and appropriately. Review collected by and hosted on G2.com.

Centralized console, easy to use and with many automations that make your day-to-day more efficient. Thanks to the incorporated AI, the tool helps you close cases under the law of least effort and gives you time for other investigations. Review collected by and hosted on G2.com.

I really appreciate being able to deploy and manage endpoint protection in a way that fits smoothly into our existing IT management processes. It’s extremely valuable to have a security platform that supports proactive monitoring and helps cut down on manual intervention, so our team can stay on top of issues without constantly needing to step in. Review collected by and hosted on G2.com.

I’d also like to see continued improvements to reporting, policy management, and integration with RMM platforms to make day-to-day administration more efficient. Simplifying certain workflows and offering more intuitive, at-a-glance visibility across managed environments would be especially beneficial for IT teams and managed service providers. Review collected by and hosted on G2.com.

What I love most about SentinelOne Singularity Endpoint is its ability to detect and block threats in real-time, automated protection against ransomware and malware, and centralized device management. Additionally, it facilitates incident investigation, reduces response times, and enhances device security without requiring constant manual intervention. Review collected by and hosted on G2.com.

What I like least about SentinelOne Singularity Endpoint is that it can sometimes generate false positives and block legitimate applications or processes, affecting user operations. Additionally, some configurations and exclusions can be complex, requiring additional time to investigate alerts and resolve issues. Review collected by and hosted on G2.com.

La principale force de SentinelOne demeure, selon mon expérience, son moteur de détection et sa capacité à réagir rapidement à certains comportements malveillants associés aux rançongiciels. La visibilité offerte par les événements de sécurité et les capacités EDR permettent d'obtenir davantage de contexte lors de l'investigation d'incidents que ce que nous avions avec notre solution précédente.

Au moment de notre acquisition, le coût était également compétitif par rapport à plusieurs solutions comparables du marché, ce qui a contribué à notre décision. J'ai aussi apprécié la richesse fonctionnelle de la plateforme, notamment les capacités d'automatisation, les fonctionnalités EDR et les outils basés sur l'intelligence artificielle qui semblaient prometteurs lors de l'évaluation initiale.

Dans notre environnement d'entreprise, ces éléments ont constitué les principaux avantages du produit. Review collected by and hosted on G2.com.

Après plus d'un an d'utilisation dans notre environnement d'entreprise, plusieurs aspects du produit demeurent problématiques pour notre équipe.

Le premier concerne l'interface d'administration. Malgré plus de 25 ans d'expérience en TI et en cybersécurité, je trouve encore certaines fonctions difficiles à localiser et plusieurs tâches quotidiennes nécessitent davantage de navigation que sur d'autres plateformes que j'ai administrées. Ce constat est partagé par plusieurs membres expérimentés de mon équipe.

Nous observons également un volume important de faux positifs, notamment lors d'opérations légitimes comme certaines mises à jour de pilotes ou d'utilitaires. Le temps requis pour analyser, valider et exclure ces événements réduit une partie des gains opérationnels attendus d'une plateforme EDR moderne.

Notre déploiement couvre plusieurs dizaines d'appareils Windows et la plateforme est administrée quotidiennement par notre équipe TI.

Concernant le support technique, les recommandations reçues ont souvent consisté à créer des exclusions plutôt qu'à approfondir l'analyse de certains faux positifs. Bien que cette approche permette de résoudre rapidement un incident isolé, elle ne répond pas toujours à la cause sous-jacente du problème.

Nous avons également rencontré certaines incompatibilités ou impacts sur les performances lors de l'utilisation conjointe avec d'autres outils présents dans notre environnement.

Enfin, certaines fonctionnalités que je considère désormais standard dans plusieurs solutions concurrentes, notamment le filtrage et la restriction web intégrés, ne sont pas offertes nativement dans SentinelOne. Cette absence nous oblige à maintenir des solutions complémentaires pour répondre à nos besoins de sécurité. Review collected by and hosted on G2.com.

What's provided the most value for me is the autonomous response. Running a mixed Windows/macOS fleet with a chunk of BYOD devices, I can't babysit every alert, and the on-agent behavioural AI catches and auto-mitigates threats without waiting on a cloud round-trip or an analyst clicking "contain". The Storyline attack visualisation is the feature I lean on daily; instead of stitching together process trees myself, I get the full execution chain mapped out, which turns what used to be a 30-minute triage into a few minutes of confirming and rolling back. AI / Intelligence: The static and behavioural AI models running locally mean detection holds up even when a device is offline, which matters for laptops that aren't always on the VPN. Fewer noisy false positives than the signature-based tooling I've used before. UI / UX: The console is clean, and the Deep Visibility query interface lets me hunt across the fleet quickly. Onboarding new admins doesn't require weeks of ramp-up. Performance: Agent footprint is light — I haven't had the user complaints about system slowdown that plagued our previous endpoint tool, which is a real win when you're deploying to BYOD machines you don't fully control. Integrations: Ranger for network visibility (surfacing unmanaged devices) plus the API and SIEM connectors have fit into our stack without much friction. Adding Ranger meant I stopped needing a separate discovery tool to find rogue endpoints. Support / Onboarding: Deployment was straightforward, and vendor support has been responsive on the escalations that mattered. Pricing / ROI: It is not the cheapest option, but the ROI shows up in reduced analyst hours; the one-click rollback on ransomware alone has justified the spend, and consolidating discovery (Ranger) into the same platform cut a line item elsewhere. Unexpected benefit: The rollback capability doubled as a safety net for my organisation during a legitimate-but-misclassified software push; being able to reverse endpoint changes cleanly saved a reimaging headache. Review collected by and hosted on G2.com.

The biggest pain point is policy and exclusion management at scale. Building exclusions is more manual than it should be; there's no clean way to test an exclusion's blast radius before it goes live, so tuning for a noisy line-of-business app on part of the fleet involves more trial-and-error than I'd like. A "preview affected endpoints" step or a staging mode for policy changes would cut real risk out of the process. Deep Visibility is powerful, but the query experience has a learning curve. The syntax isn't intuitive for newer analysts, and saved-query sharing and templating could be better. When I'm onboarding someone, threat hunting is the piece that takes longest to hand off, which partly defeats the "autonomous" pitch for smaller teams. Reporting is the other weak spot. The canned reports rarely match what I need for regulatory or management audiences, so I still end up exporting to build the view myself. More flexible, customisable reporting, or a proper report builder, would save hours each reporting cycle. On macOS, agent updates and OS-version compatibility have occasionally lagged behind Windows, which matters on a mixed fleet where I can't always hold back an OS update on a BYOD device. Tighter macOS parity would help. Console performance can also drag when pulling large time-range queries across the full fleet, and the alert volume before tuning is high enough that early days feel noisier than expected. Review collected by and hosted on G2.com.

What I liked most was being able to check what happened when SentinelOne detected or blocked something on my machine. As a QA engineer, I was often testing different applications and running scripts, so occasionally an alert would come up because of something I was working on. It was helpful to be able to look into it and understand what caused it. I also found the interface fairly easy to use once I got familiar with it. Review collected by and hosted on G2.com.

The main downside for me was that some alerts were not very easy to understand at first. Since I’m not a security specialist, sometimes I had to spend extra time figuring out why something had been detected and whether it was actually a problem or just related to the testing I was doing. Review collected by and hosted on G2.com.

What I like most about SentinelOne Singularity Endpoint is the combination of strong endpoint protection and automation. It does not just flag suspicious activity and leave the analyst to figure everything out. It can investigate behavior, connect related activity, and respond quickly.

I also like the visibility it provides during investigations. Being able to understand the sequence of processes and events around an alert makes it much easier to determine what actually happened.

For me, the biggest advantage is that it reduces repetitive work for security teams while still giving analysts the control and visibility they need when a deeper investigation is required. Review collected by and hosted on G2.com.

The main thing I would improve is the overall user experience. SentinelOne is very powerful, but some parts of the console can feel more complicated than they need to be, especially when you are trying to quickly investigate an incident or find a specific piece of information.

I would also like more flexibility around dashboards and reporting. The data is there, but turning it into exactly the view you want can sometimes take more effort than expected.

Overall, I think the product is technically strong, but the interface and day-to-day workflows could be made more intuitive. Review collected by and hosted on G2.com.

I like the 1-click ransomware rollback because it restores compromised, encrypted files in minutes without a full device re-image, cutting recovery time and downtime. I also value the local AI processing, which provides autonomous, uninterrupted protection with zero latency—even when devices are disconnected from the network—and protects against fileless and zero-day threats. Initial setup is straightforward, with a lightweight, single-agent installation through MDM tools and immediate protection out of the box. Review collected by and hosted on G2.com.

I get frequent false positives on benign custom scripts and internal software, so I have to keep managing exclusions. The management console has a steep learning curve, and agent upgrades across complex, mixed-OS fleets can occasionally cause friction. I also have to start in Detect-Only mode to baseline normal behavior and tune exclusions. AI-guided exclusion suggestions, better sandbox pre-testing for custom internal tools, and creating an exclusion in one click from alert details would make this easier. Review collected by and hosted on G2.com.

I like how smoothly SentinelOne Singularity Endpoint handles complex threat detection without bogging down everyday operations. Storyline connects related process events into a clear timeline, saving me hours of forensic guesswork and helping me see an event’s root cause and progression. Its behavioral AI analyzes processes in real time and catches novel or fileless threats without constant manual updates or slowing down system resources. I also value being able to isolate a compromised machine and roll back files to a clean state with one click, which makes incidents quicker and less stressful to fix. It cuts down on manual triage and friction, integrates smoothly with the broader security stack, and the initial agent deployment was straightforward and efficient. Review collected by and hosted on G2.com.

I had to spend time tuning policies, custom rules, and exclusions at the start, and I saw some early false positives, especially in development or heavy testing environments. During deep behavioral scans or intensive remediation, it can also use more system resources than I expected on older endpoints or heavily loaded servers. The dashboard works well for high-level overviews, but customizable compliance and forensic reports can feel rigid and require extra manual formatting. Review collected by and hosted on G2.com.

I like SentinelOne Singularity Endpoint’s real-time threat detection and automated protection. It helps protect my devices from cyber threats, detect suspicious activity, and prevent malware and ransomware attacks. I like that it improves security while reducing manual work, and that the user-friendly interface helps me organize responses to cyber threats quickly and reduce security risks. I also appreciate the centralized management and detailed security reports, which make it easier for me to monitor devices, investigate threats, and manage endpoint security efficiently. The initial setup was easy and relatively straightforward, although configuring it and integrating existing security tools took some extra time. Review collected by and hosted on G2.com.

I think the interface could be more intuitive, and false positives could be reduced. The setup and configuration process could be simpler for new users, with clearer setup guides and more tutorials. I’d also like more customization options. Some configuration and integration with existing security tools took additional time. Review collected by and hosted on G2.com.