SentinelOne Singularity Endpoint Reviews & Product Details

SentinelOne covers all of our endpoints. SentinelOne Singularity Endpoint provides excellent endpoint visibility, detection, and response capabilities through a modern and intuitive interface. The platform is lightweight, has minimal impact on endpoint performance, and offers strong behavioral AI-driven threat detection that helps identify both known and unknown threats. Integration with SIEM and security tools is straightforward, making investigation and response workflows more efficient. The automated remediation and rollback capabilities significantly reduce analyst effort and improve incident response times. Review collected by and hosted on G2.com.

While the platform is powerful, some advanced features have a learning curve for new analysts. Certain investigations may require deeper knowledge of the console and query capabilities. Pricing can also be higher than some competing solutions, although the overall security value and operational savings justify the investment. Review collected by and hosted on G2.com.

What I like best about SentinelOne Singularity Endpoint is its agent-level behavioral AI that blocks real-time threats like ransomware or malicious scripts even when machines are offline. It gives us instant local protection without waiting on cloud analysis. The standout feature for L1 workflow is the automated rollback capability. If a threat modifies or encrypts local files, we can restore them to their original state in a single click using VSS shadow copies, saving us from time-consuming endpoint re-imaging. Review collected by and hosted on G2.com.

What I dislike most about SentinelOne Singularity Endpoint is the occasional complexity when dealing with false positives or aggressive behavioral detections. Sometimes legitimate internal scripts or administrative tools get flagged, and writing exclusions requires file path or hash tuning to prevent recurring alerts without weakening security. Additionally, while the storyline is great for endpoints, when we need to correlate those endpoint alerts with wider network or email telemetry, SentinelOne's native multi-layer visibility is limited. We end up having to jump over to other tools like FortiSIEM, Splunk, or CrowdStrike NG SIEM to piece together a broader multi-vector attack chain. Review collected by and hosted on G2.com.

Very intuitive tool, easy to use, with built-in Generative AI that greatly helps in resolving cases. Remediation is simple and quick. It requires few resources and is quickly deployed through other tools like NinjaOne RRM. The price is reasonable for the advanced capabilities the solution offers, and if you have any doubts, the support team responds promptly and appropriately. Review collected by and hosted on G2.com.

Centralized console, easy to use, with many automations that make your day-to-day more efficient. Thanks to the incorporated AI, the tool helps you close cases with minimal effort, giving you time for other investigations. Review collected by and hosted on G2.com.

I really appreciate being able to deploy and manage endpoint protection in a way that fits smoothly into our existing IT management processes. It’s extremely valuable to have a security platform that supports proactive monitoring and helps cut down on manual intervention, so our team can stay on top of issues without constantly needing to step in. Review collected by and hosted on G2.com.

I’d also like to see continued improvements to reporting, policy management, and integration with RMM platforms to make day-to-day administration more efficient. Simplifying certain workflows and offering more intuitive, at-a-glance visibility across managed environments would be especially beneficial for IT teams and managed service providers. Review collected by and hosted on G2.com.

What I love most about SentinelOne Singularity Endpoint is its ability to detect and block threats in real-time, automated protection against ransomware and malware, and centralized device management. Additionally, it facilitates incident investigation, reduces response times, and enhances device security without requiring constant manual intervention. Review collected by and hosted on G2.com.

What I like least about SentinelOne Singularity Endpoint is that it can sometimes generate false positives and block legitimate applications or processes, affecting user operations. Additionally, some configurations and exclusions can be complex, requiring additional time to investigate alerts and resolve issues. Review collected by and hosted on G2.com.

The main strength of SentinelOne remains, in my experience, its detection engine and its ability to quickly respond to certain malicious behaviors associated with ransomware. The visibility offered by security events and EDR capabilities provides more context during incident investigations than we had with our previous solution.

At the time of our acquisition, the cost was also competitive compared to several comparable market solutions, which contributed to our decision. I also appreciated the platform's rich functionality, including automation capabilities, EDR features, and AI-based tools that seemed promising during the initial evaluation.

In our corporate environment, these elements have been the main advantages of the product. Review collected by and hosted on G2.com.

After more than a year of use in our corporate environment, several aspects of the product remain problematic for our team.

The first concerns the administration interface. Despite more than 25 years of experience in IT and cybersecurity, I still find some functions difficult to locate, and several daily tasks require more navigation than on other platforms I have managed. This observation is shared by several experienced members of my team.

We also observe a significant volume of false positives, especially during legitimate operations like certain driver or utility updates. The time required to analyze, validate, and exclude these events reduces some of the operational gains expected from a modern EDR platform.

Our deployment covers several dozen Windows devices, and the platform is administered daily by our IT team.

Regarding technical support, the recommendations received have often consisted of creating exclusions rather than delving deeper into the analysis of certain false positives. While this approach allows for quickly resolving an isolated incident, it does not always address the underlying cause of the problem.

We have also encountered some incompatibilities or performance impacts when used in conjunction with other tools present in our environment.

Finally, some features that I now consider standard in several competing solutions, such as integrated web filtering and restriction, are not natively offered in SentinelOne. This absence forces us to maintain complementary solutions to meet our security needs. Review collected by and hosted on G2.com.

The best part of SentinelOne Singularity Endpoint is Storyline, which automatically correlates process, file, registry, network and login activity into a single attack graph. Instead of piecing together Windows Event Logs by hand, I can follow an event from its origin through every action it triggered, which makes investigation much faster and more reliable. I saw this clearly on 12 November 2025 at FemAid360, where I administer the Windows Server hosting our e-learning platform. SentinelOne raised a Suspicious-level alert linked to activity from a tutor-role account. Rather than reacting to the alert alone, I used Storyline to trace the activity back to its source and see exactly what had executed on the server, which showed a PowerShell script execution. That let me quickly judge that the activity was not legitimate use of the platform, and I disabled the affected account to contain it. Afterward I reviewed and tightened the tutor-role permissions and reset the account credentials, so the same path could not be reused. Review collected by and hosted on G2.com.

The main drawback I experienced at FemAid360 was false-positive detections on a production Windows Server. The agent’s behavioral detection sometimes flagged or blocked legitimate activity, such as routine administrative and platform processes, as malicious. Each of these alerts had to be triaged by walking the process tree in Storyline to confirm the activity was benign, which consumed analyst time and diluted attention from genuine detections. In a small team without a dedicated SOC, this creates a real signal-to-noise problem. Time spent validating false alarms is time not spent on true positives and in the worst case a real threat could be overlooked while the analyst is focused on a benign alert. Reducing this required tuning mitigation policies and reviewing exclusions for legitimate server and admin processes. That worked, but it added operational overhead early in the deployment, and I think the out-of-the-box detection settings could better distinguish routine administrative behavior from malicious behavior on server workloads. Review collected by and hosted on G2.com.

I think this software gives you a clear view of what’s going on across your endpoints. It helps you detect threats or any malicious activity that may be happening, and I really like the ability not only to identify issues but also to support investigating them. The dashboard makes it easy to see what’s happening on your endpoints and dig into investigations all in one place. It’s also a great tool for automatically responding to certain actions when they occur. Review collected by and hosted on G2.com.

I feel like the dashboard takes some time to learn if you’re new to it. There have been a few alerts where I’ve had to dig in further just to figure out whether it’s actually a threat or not. I’d also love to see more reports and additional dashboard views to make it easier to get the full picture. Review collected by and hosted on G2.com.

I like its ability to detect and respond to threats in real time with minimal manual intervention. I also like its automated threat response capabilities, which help reduce the time spent on manual analysis and allow the security teams to focus on other important tasks. Review collected by and hosted on G2.com.

One thing I dislike about SentinelOne Singularity Endpoint is that some features and settings can take time to understand, especially for new users. The dashboard could be a little more intuitive, and sometimes investigating alerts requires going through multiple details. Improving the reporting and making certain configurations simpler would make the overall experience even better. Review collected by and hosted on G2.com.

What's provided the most value for me is the autonomous response. Running a mixed Windows/macOS fleet with a chunk of BYOD devices, I can't babysit every alert, and the on-agent behavioural AI catches and auto-mitigates threats without waiting on a cloud round-trip or an analyst clicking "contain". The Storyline attack visualisation is the feature I lean on daily; instead of stitching together process trees myself, I get the full execution chain mapped out, which turns what used to be a 30-minute triage into a few minutes of confirming and rolling back. AI / Intelligence: The static and behavioural AI models running locally mean detection holds up even when a device is offline, which matters for laptops that aren't always on the VPN. Fewer noisy false positives than the signature-based tooling I've used before. UI / UX: The console is clean, and the Deep Visibility query interface lets me hunt across the fleet quickly. Onboarding new admins doesn't require weeks of ramp-up. Performance: Agent footprint is light — I haven't had the user complaints about system slowdown that plagued our previous endpoint tool, which is a real win when you're deploying to BYOD machines you don't fully control. Integrations: Ranger for network visibility (surfacing unmanaged devices) plus the API and SIEM connectors have fit into our stack without much friction. Adding Ranger meant I stopped needing a separate discovery tool to find rogue endpoints. Support / Onboarding: Deployment was straightforward, and vendor support has been responsive on the escalations that mattered. Pricing / ROI: It is not the cheapest option, but the ROI shows up in reduced analyst hours; the one-click rollback on ransomware alone has justified the spend, and consolidating discovery (Ranger) into the same platform cut a line item elsewhere. Unexpected benefit: The rollback capability doubled as a safety net for my organisation during a legitimate-but-misclassified software push; being able to reverse endpoint changes cleanly saved a reimaging headache. Review collected by and hosted on G2.com.

The biggest pain point is policy and exclusion management at scale. Building exclusions is more manual than it should be; there's no clean way to test an exclusion's blast radius before it goes live, so tuning for a noisy line-of-business app on part of the fleet involves more trial-and-error than I'd like. A "preview affected endpoints" step or a staging mode for policy changes would cut real risk out of the process. Deep Visibility is powerful, but the query experience has a learning curve. The syntax isn't intuitive for newer analysts, and saved-query sharing and templating could be better. When I'm onboarding someone, threat hunting is the piece that takes longest to hand off, which partly defeats the "autonomous" pitch for smaller teams. Reporting is the other weak spot. The canned reports rarely match what I need for regulatory or management audiences, so I still end up exporting to build the view myself. More flexible, customisable reporting, or a proper report builder, would save hours each reporting cycle. On macOS, agent updates and OS-version compatibility have occasionally lagged behind Windows, which matters on a mixed fleet where I can't always hold back an OS update on a BYOD device. Tighter macOS parity would help. Console performance can also drag when pulling large time-range queries across the full fleet, and the alert volume before tuning is high enough that early days feel noisier than expected. Review collected by and hosted on G2.com.