We utilize SentinelOne Singularity Identity to prevent malware and to monitor for any ongoing malicious activities. Another use case that we've recently adopted is the extraction of vulnerability data. We are beginning to incorporate this data into our vulnerability management program.
Our goal was to transition from using a signature-based antivirus to a next-generation antivirus that relies on behavioral analysis. This was the main motivating factor behind our decision. While we were inclined to make this change, our cyber insurance provider also exerted pressure on us to adopt the NexGen antivirus. They even offered a significant discount on our insurance premiums if we implemented it. This played another important role in our decision-making process. We were specifically seeking a solution that could effectively combat ransomware. Unlike other antivirus and signature-based solutions, which don't effectively tackle ransomware, SentinelOne provides warranty coverage for ransomware incidents, making it an appealing choice. To date, we have been fortunate enough not to have experienced any ransomware attacks. SentinelOne advertises that we won't receive ransomware, and indeed, we haven't received any. Last year, we acquired an automated penetration testing program separate from SentinelOne. This program collaborates with SentinelOne to simulate malicious activities within our environment. Essentially, it tests SentinelOne's capability to detect and prevent ransomware. The results from this tool confirm the effectiveness of SentinelOne.
We're quite satisfied with the layout of the console. I have a security analyst who works under me, and he mentioned that out of all the antiviruses he has ever used, SentinelOne is the most intuitive. I agree with him. It's quite simple to use. However, simplicity can be a bit challenging at times because if it's overly simple, it might lack features that are necessary for complex environments. Yet, I believe it strikes a good balance between simplicity and complexity. It certainly offers flexibility. One helpful feature is the ability to create different groups, assign custom names to these groups, and then place endpoints into these groups and apply distinct policies to them. This functionality works exceptionally well.
Managing the environment from the console is straightforward. However, we do need to periodically deploy updates to the agents. While I personally would prefer this process to be automated and not require manual intervention, the current process is relatively simple. Although it can be a bit time-consuming, it hasn't posed a significant burden. It would be preferable if this manual step could be eliminated. Overall, the management process is user-friendly. A particularly valuable feature is the audit section, which allows us to track all activities. This is especially useful due to the involvement of multiple groups within our IT department, each performing various tasks. Without the audit history, it's challenging to monitor these activities and understand what actions individuals are taking. Therefore, the ability to retrospectively review the audit history is essential.
SentinelOne Singularity Identity functions effectively in safeguarding identities from exploitation. We have not encountered any incidents where it seemed that malware had infiltrated the system and remained undetected. Another aspect that contributes to our validation is the penetration testing tool we acquired, which actively executes exploits on the machines. Often, we do not expect ongoing active attacks within our environment. Consequently, it becomes challenging to accurately assess their operational effectiveness due to the absence of such attacks. This penetration testing tool plays a crucial role in illuminating our tools' capability to withstand robust attacks that we may not currently be experiencing. Through this tool, we simulate these attack scenarios, which provides us with an understanding of how well we can endure an attack on a larger scale. Upon reviewing the penetration testing reports, they consistently indicate that the tool's activities are blocked at various stages. Based on this, I would rate it highly. In all honesty, I don't believe I could ask for more.
SentinelOne Singularity Identity demonstrates a high capability in detecting and preventing threats. The solution effectively identifies and thwarts threats across all areas; we have even tested it in real attack scenarios. Occasionally, there might be false positives, but their occurrence hasn't been significantly problematic. For instance, there was an issue with resumes where the system consistently flagged them as viruses for some reason. This was somewhat frustrating; however, it didn't persist. We raised a support ticket, and they promptly resolved the problem. False positives are common in any antivirus solution, but the rate of false positives with SentinelOne Singularity Identity is quite low, which is good.
The most valuable feature of SentinelOne Singularity Identity is its ability to detect based on behavior rather than just static signatures. It's dynamic.
Our infrastructure team is dissatisfied with SentinelOne Singularity Identity. They would prefer to explore alternative solutions. The primary reason for this discontent is that we frequently encounter performance issues with our servers. These performance issues are quite challenging to trace and address, making it difficult to identify their root cause. Often, the culprit behind these problems is the SentinelOne agent on the server. However, pinpointing and resolving this issue takes a considerable amount of time, adding to the challenge. The team is not particularly satisfied with this situation. Nevertheless, the team eventually manages to identify instances where the solution is overly meticulous, leading to unnecessary scrutiny. To resolve this, they implement exclusions, which alleviates the problem. So, it's not that they lack a solution; rather, the process of reaching a solution through exclusion is laborious, especially considering the known impact on performance.
SentinelOne Singularity Identity promotes in their documentation that their agents operate within defined processing power limits. Despite this claim, we've observed instances where these limits are exceeded. As an area for improvement, we have previously requested a feature that would allow us to set a cap on CPU utilization percentages for servers. This way, we could establish that, based on our configuration, the CPU usage cannot surpass a specified threshold, such as ten or twenty percent. This feature would be highly valuable, along with potential enhancements in their administration console that reduce its impact on servers or endpoints and offer greater transparency in this regard. Although their support is helpful, as they assist us when we suspect issues and can interpret the logs we send them, these logs are often cryptic. It would be preferable if we could manage a significant portion of this analysis independently, without needing their assistance.
I have been using SentinelOne Singularity Identity for almost three years.
SentinelOne Singularity Identity is stable. We have not had any stability issues.
SentinelOne Singularity Identity is highly scalable.
The technical support is responsive. We're grappling with an issue that is somewhat frustrating, but it's not really the fault of the support. It's a very specific problem where a crucial file on the server's machine is being closely examined by the antivirus, causing a slow login process for the users. Consequently, we had to exclude this file, even though it's an executable that SentinelOne doesn't recommend excluding. As a result, we're currently engaged in a somewhat controversial back-and-forth issue. However, they are providing us with feedback and suggestions that we can implement to try and address the issue. They're persistent and are trying various approaches. I find their response time reasonable. Overall, it has been a good experience.
Before SentinelOne Singularity Identity we were using Microsoft Defender but it was not as effective in detecting and preventing malware attacks.
The initial setup is straightforward. In fact, we implemented it in phases. In the first phase, we deployed it only to our servers. In the following year, we expanded it in another phase to include all of our workstations, of which we have a larger number compared to servers. The first phase went really quickly. We even adopted a more aggressive approach, reducing the number of exclusions initially and adding exclusions as we encountered issues.
Subsequently, our cyber insurance provided us with a discount the following year to encourage us to deploy it to all workstations. This compressed our deployment timeline, and despite the time constraints, we succeeded. We managed to extend it to the rest of the workstations within approximately a month from the decision point. I would describe the deployment process as very smooth. There was even a point during the rollout when I was on vacation and slightly concerned about it. However, we encountered no issues.
The implementation was completed in-house with some support from SentinelOne.
SentinelOne seemed to offer more while being priced lower than its competitors. At times, they would distinguish what they refer to as an EDR functionality, providing us with more in-depth information about the activities on the machine. This was one aspect. Comparing this to Cybereason, obtaining this functionality incurred a slightly higher cost. However, SentinelOne included certain elements of this functionality as part of their base package. Although not as extensive as Cybereason, it was still enticing as we didn't have to pay extra for it, unlike Cybereason, which positioned SentinelOne at a more appealing price point. Therefore, our decision to go with SentinelOne was driven by the perception of receiving more features for a better value.
We assessed Microsoft ATP, Cybereason, and CrowdStrike. SentinelOne Singularity Identity had a rollback feature that was absent in Cybereason or ATP. The cost of SentinelOne was also reasonable; they offered a competitive price point better than any of the others. While CrowdStrike is the most popular option, their price compared to SentinelOne was significantly higher, making it feel overpriced.
I would rate SentinelOne Singularity Identity a nine out of ten.
What we don't engage in is threat hunting, as this requires an additional module that we haven't acquired.
Before making the switch, we conducted a penetration test against Defender. Our penetration tester managed to bypass it around 50 percent of the time. However, since implementing SentinelOne, we no longer face this issue. Thus, moving away from Defender was a beneficial decision. We were aware that Defender couldn't effectively handle more advanced attacks. Although it did result in additional costs – as Defender is included with our Microsoft license – the investment was justified. This is especially true considering we have insurance that provides a discount, given that having a next-generation antivirus in place is generally viewed positively by insurance providers. Overall, this move has provided us with greater peace of mind, knowing that we are better protected against the increasingly sophisticated malware landscape. I'm aware that Microsoft offers a more comprehensive package. They have their own version of a behavioral-based antivirus, which we can opt for at a higher cost. However, Defender doesn't provide that functionality. So, when comparing the two, it was quite obvious to us that we needed a more advanced solution.
SentinelOne Singularity Identity is a commendable product. In my opinion, individuals should evaluate it and form their own judgments. Conducting testing with actual simulations, particularly utilizing a penetration testing tool that runs malware simulations against the software, appears to be a prudent approach. This method allows for a well-informed assessment of the solution's efficacy. The challenge with antivirus software often lies in its opaqueness. We lack genuine insights into its actual performance. We tend to rely on marketing claims and trust that the software can effectively thwart necessary attacks. However, such claims are prevalent across the industry. Thus, the most reliable course of action is to ensure our chosen tool provides a sense of security by rigorously testing it with malware attempts and attempting to circumvent its defenses.
