What I like best about SentinelOne Singularity Endpoint is its agent-level behavioral AI that blocks real-time threats like ransomware or malicious scripts even when machines are offline. It gives us instant local protection without waiting on cloud analysis. The standout feature for L1 workflow is the automated rollback capability. If a threat modifies or encrypts local files, we can restore them to their original state in a single click using VSS shadow copies, saving us from time-consuming endpoint re-imaging. Review collected by and hosted on G2.com.

What I dislike most about SentinelOne Singularity Endpoint is the occasional complexity when dealing with false positives or aggressive behavioral detections. Sometimes legitimate internal scripts or administrative tools get flagged, and writing exclusions requires file path or hash tuning to prevent recurring alerts without weakening security. Additionally, while the storyline is great for endpoints, when we need to correlate those endpoint alerts with wider network or email telemetry, SentinelOne's native multi-layer visibility is limited. We end up having to jump over to other tools like FortiSIEM, Splunk, or CrowdStrike NG SIEM to piece together a broader multi-vector attack chain. Review collected by and hosted on G2.com.

Very intuitive tool, easy to use, with built-in Generative AI that greatly helps in solving cases. Remediation is simple and fast. In terms of resources, it requires little and is quickly deployed through other tools like NinjaOne RRM. The price is reasonable for the advanced capabilities the solution offers, and if you have any questions, the support team responds promptly and appropriately. Review collected by and hosted on G2.com.

Centralized console, easy to use and with many automations that make your day-to-day more efficient. Thanks to the incorporated AI, the tool helps you close cases under the law of least effort and gives you time for other investigations. Review collected by and hosted on G2.com.

I really appreciate being able to deploy and manage endpoint protection in a way that fits smoothly into our existing IT management processes. It’s extremely valuable to have a security platform that supports proactive monitoring and helps cut down on manual intervention, so our team can stay on top of issues without constantly needing to step in. Review collected by and hosted on G2.com.

I’d also like to see continued improvements to reporting, policy management, and integration with RMM platforms to make day-to-day administration more efficient. Simplifying certain workflows and offering more intuitive, at-a-glance visibility across managed environments would be especially beneficial for IT teams and managed service providers. Review collected by and hosted on G2.com.

What I love most about SentinelOne Singularity Endpoint is its ability to detect and block threats in real-time, automated protection against ransomware and malware, and centralized device management. Additionally, it facilitates incident investigation, reduces response times, and enhances device security without requiring constant manual intervention. Review collected by and hosted on G2.com.

What I like least about SentinelOne Singularity Endpoint is that it can sometimes generate false positives and block legitimate applications or processes, affecting user operations. Additionally, some configurations and exclusions can be complex, requiring additional time to investigate alerts and resolve issues. Review collected by and hosted on G2.com.

La principale force de SentinelOne demeure, selon mon expérience, son moteur de détection et sa capacité à réagir rapidement à certains comportements malveillants associés aux rançongiciels. La visibilité offerte par les événements de sécurité et les capacités EDR permettent d'obtenir davantage de contexte lors de l'investigation d'incidents que ce que nous avions avec notre solution précédente.

Au moment de notre acquisition, le coût était également compétitif par rapport à plusieurs solutions comparables du marché, ce qui a contribué à notre décision. J'ai aussi apprécié la richesse fonctionnelle de la plateforme, notamment les capacités d'automatisation, les fonctionnalités EDR et les outils basés sur l'intelligence artificielle qui semblaient prometteurs lors de l'évaluation initiale.

Dans notre environnement d'entreprise, ces éléments ont constitué les principaux avantages du produit. Review collected by and hosted on G2.com.

Après plus d'un an d'utilisation dans notre environnement d'entreprise, plusieurs aspects du produit demeurent problématiques pour notre équipe.

Le premier concerne l'interface d'administration. Malgré plus de 25 ans d'expérience en TI et en cybersécurité, je trouve encore certaines fonctions difficiles à localiser et plusieurs tâches quotidiennes nécessitent davantage de navigation que sur d'autres plateformes que j'ai administrées. Ce constat est partagé par plusieurs membres expérimentés de mon équipe.

Nous observons également un volume important de faux positifs, notamment lors d'opérations légitimes comme certaines mises à jour de pilotes ou d'utilitaires. Le temps requis pour analyser, valider et exclure ces événements réduit une partie des gains opérationnels attendus d'une plateforme EDR moderne.

Notre déploiement couvre plusieurs dizaines d'appareils Windows et la plateforme est administrée quotidiennement par notre équipe TI.

Concernant le support technique, les recommandations reçues ont souvent consisté à créer des exclusions plutôt qu'à approfondir l'analyse de certains faux positifs. Bien que cette approche permette de résoudre rapidement un incident isolé, elle ne répond pas toujours à la cause sous-jacente du problème.

Nous avons également rencontré certaines incompatibilités ou impacts sur les performances lors de l'utilisation conjointe avec d'autres outils présents dans notre environnement.

Enfin, certaines fonctionnalités que je considère désormais standard dans plusieurs solutions concurrentes, notamment le filtrage et la restriction web intégrés, ne sont pas offertes nativement dans SentinelOne. Cette absence nous oblige à maintenir des solutions complémentaires pour répondre à nos besoins de sécurité. Review collected by and hosted on G2.com.

The best part of SentinelOne Singularity Endpoint is Storyline, which automatically correlates process, file, registry, network and login activity into a single attack graph. Instead of piecing together Windows Event Logs by hand, I can follow an event from its origin through every action it triggered, which makes investigation much faster and more reliable. I saw this clearly on 12 November 2025 at FemAid360, where I administer the Windows Server hosting our e-learning platform. SentinelOne raised a Suspicious-level alert linked to activity from a tutor-role account. Rather than reacting to the alert alone, I used Storyline to trace the activity back to its source and see exactly what had executed on the server, which showed a PowerShell script execution. That let me quickly judge that the activity was not legitimate use of the platform, and I disabled the affected account to contain it. Afterward I reviewed and tightened the tutor-role permissions and reset the account credentials, so the same path could not be reused. Review collected by and hosted on G2.com.

The main drawback I experienced at FemAid360 was false-positive detections on a production Windows Server. The agent’s behavioral detection sometimes flagged or blocked legitimate activity, such as routine administrative and platform processes, as malicious. Each of these alerts had to be triaged by walking the process tree in Storyline to confirm the activity was benign, which consumed analyst time and diluted attention from genuine detections. In a small team without a dedicated SOC, this creates a real signal-to-noise problem. Time spent validating false alarms is time not spent on true positives and in the worst case a real threat could be overlooked while the analyst is focused on a benign alert. Reducing this required tuning mitigation policies and reviewing exclusions for legitimate server and admin processes. That worked, but it added operational overhead early in the deployment, and I think the out-of-the-box detection settings could better distinguish routine administrative behavior from malicious behavior on server workloads. Review collected by and hosted on G2.com.

I think this software gives you a clear view of what’s going on across your endpoints. It helps you detect threats or any malicious activity that may be happening, and I really like the ability not only to identify issues but also to support investigating them. The dashboard makes it easy to see what’s happening on your endpoints and dig into investigations all in one place. It’s also a great tool for automatically responding to certain actions when they occur. Review collected by and hosted on G2.com.

I feel like the dashboard takes some time to learn if you’re new to it. There have been a few alerts where I’ve had to dig in further just to figure out whether it’s actually a threat or not. I’d also love to see more reports and additional dashboard views to make it easier to get the full picture. Review collected by and hosted on G2.com.

I like its ability to detect and respond to threats in real time with minimal manual intervention. I also like its automated threat response capabilities, which help reduce the time spent on manual analysis and allow the security teams to focus on other important tasks. Review collected by and hosted on G2.com.

One thing I dislike about SentinelOne Singularity Endpoint is that some features and settings can take time to understand, especially for new users. The dashboard could be a little more intuitive, and sometimes investigating alerts requires going through multiple details. Improving the reporting and making certain configurations simpler would make the overall experience even better. Review collected by and hosted on G2.com.

What's provided the most value for me is the autonomous response. Running a mixed Windows/macOS fleet with a chunk of BYOD devices, I can't babysit every alert, and the on-agent behavioural AI catches and auto-mitigates threats without waiting on a cloud round-trip or an analyst clicking "contain". The Storyline attack visualisation is the feature I lean on daily; instead of stitching together process trees myself, I get the full execution chain mapped out, which turns what used to be a 30-minute triage into a few minutes of confirming and rolling back. AI / Intelligence: The static and behavioural AI models running locally mean detection holds up even when a device is offline, which matters for laptops that aren't always on the VPN. Fewer noisy false positives than the signature-based tooling I've used before. UI / UX: The console is clean, and the Deep Visibility query interface lets me hunt across the fleet quickly. Onboarding new admins doesn't require weeks of ramp-up. Performance: Agent footprint is light — I haven't had the user complaints about system slowdown that plagued our previous endpoint tool, which is a real win when you're deploying to BYOD machines you don't fully control. Integrations: Ranger for network visibility (surfacing unmanaged devices) plus the API and SIEM connectors have fit into our stack without much friction. Adding Ranger meant I stopped needing a separate discovery tool to find rogue endpoints. Support / Onboarding: Deployment was straightforward, and vendor support has been responsive on the escalations that mattered. Pricing / ROI: It is not the cheapest option, but the ROI shows up in reduced analyst hours; the one-click rollback on ransomware alone has justified the spend, and consolidating discovery (Ranger) into the same platform cut a line item elsewhere. Unexpected benefit: The rollback capability doubled as a safety net for my organisation during a legitimate-but-misclassified software push; being able to reverse endpoint changes cleanly saved a reimaging headache. Review collected by and hosted on G2.com.

The biggest pain point is policy and exclusion management at scale. Building exclusions is more manual than it should be; there's no clean way to test an exclusion's blast radius before it goes live, so tuning for a noisy line-of-business app on part of the fleet involves more trial-and-error than I'd like. A "preview affected endpoints" step or a staging mode for policy changes would cut real risk out of the process. Deep Visibility is powerful, but the query experience has a learning curve. The syntax isn't intuitive for newer analysts, and saved-query sharing and templating could be better. When I'm onboarding someone, threat hunting is the piece that takes longest to hand off, which partly defeats the "autonomous" pitch for smaller teams. Reporting is the other weak spot. The canned reports rarely match what I need for regulatory or management audiences, so I still end up exporting to build the view myself. More flexible, customisable reporting, or a proper report builder, would save hours each reporting cycle. On macOS, agent updates and OS-version compatibility have occasionally lagged behind Windows, which matters on a mixed fleet where I can't always hold back an OS update on a BYOD device. Tighter macOS parity would help. Console performance can also drag when pulling large time-range queries across the full fleet, and the alert volume before tuning is high enough that early days feel noisier than expected. Review collected by and hosted on G2.com.

What I liked most was being able to check what happened when SentinelOne detected or blocked something on my machine. As a QA engineer, I was often testing different applications and running scripts, so occasionally an alert would come up because of something I was working on. It was helpful to be able to look into it and understand what caused it. I also found the interface fairly easy to use once I got familiar with it. Review collected by and hosted on G2.com.

The main downside for me was that some alerts were not very easy to understand at first. Since I’m not a security specialist, sometimes I had to spend extra time figuring out why something had been detected and whether it was actually a problem or just related to the testing I was doing. Review collected by and hosted on G2.com.