SentinelOne that catches what your antivirus misses, and stops it on the machine.
Behavioural detection on every endpoint, tuned to the software your business runs rather than left on its defaults. Take the licences on their own, have us roll them out across the estate, or have our engineers watching the console for you. Priced per endpoint against the term you choose.
A licence takes an afternoon. The policy takes longer.
Installed and left alone, the agent runs on its defaults. Nobody has told it that your line-of-business software is supposed to behave the way it does, so it either raises more alerts than anyone has time to read, or somebody turns it down until it raises almost none.
We build the policy around what actually runs on your estate, and write down every exclusion with the application it covers, who approved it and when it is next reviewed. When somebody asks in six months why a folder is skipped, the answer is on file rather than in a colleague's memory.
The package you buy decides what is switched on.
Licensing is per endpoint, and the tier sets which parts of the platform are turned on. Most businesses land on Complete or Commercial. Enterprise sits above them.
Core
Endpoint protection with behavioural AI, role-based access and multi-tenant management. The baseline the others build on.
Control
Everything in Core, with firewall and device control added, so you decide what connects to a machine and what is allowed to run on it.
Complete
Adds extended detection and response, Storyline correlation and ActiveEDR, and endpoint data retained from fourteen days, so there is history to look back through.
Commercial
Adds ninety-day retention, identity threat detection and managed threat hunting. Managed detection and response can be added to it.
What the agent does on the machine.
The agent handles all of this on the endpoint itself, without anybody needing to be watching.
Threats caught by what they do, not what they look like
The agent watches how software behaves on the machine rather than checking it against a list of known threats. That is what catches something written last week that no list has seen yet.
Stopped before anyone notices
When it sees something malicious the agent kills the process and quarantines the file on its own, without waiting for someone to be at a keyboard. The person using the machine usually never knows.
One machine held apart while you look
The agent can cut a machine off from everything except the SentinelOne console, so it cannot reach anything else while somebody looks at it. It is put back on the network from the same console once it is clean.
Encrypted files put back without a restore
Where ransomware has encrypted files on a Windows machine, the agent restores them from shadow copy. It is usually faster than going to backup, though it does not replace one.
The whole attack in one chain, not a hundred alerts
Storyline correlates related events into a single story, so an alert arrives as an account of what happened rather than a line in a log. Deep Visibility sits behind it for searching endpoint activity yourself.
Defender stays where it is
SentinelOne runs alongside Microsoft Defender rather than replacing it. We set the exclusions both ways so neither slows the machine down chasing the other.
Ways to buy it.
Each is priced on its own, and the licences do not require any of the others.
We supply them and register them in your name, renewed on your date. You deploy them and run them on your own terms, and you are free to take them elsewhere later.
Get a price→We roll the agent out across the estate, build the policy around the software you run, and hand it over with the exclusions and the settings written down.
Get a price→Our engineers watch the console, work through what it finds and act on it, so nobody in your business has to be awake for an alert at three in the morning.
Get a price→For a deployment you already have. We go through what is set, what has been excluded and why, and write up what we would change and in what order.
Book the review→Before you get in touch.
Per endpoint, and it moves with the package and the term. We quote on your numbers and agree it in writing before anything starts.
You can. The tenant is registered in your name and the renewal date is yours. Plenty of people buy the licences and take nothing else.
Often not. Defender does plenty once it is set up properly, and most of what we see has been left on its defaults. We would sooner sort that out than sell you a second agent.
How many endpoints, how far back you need to look, and whether you want threat hunting. We size it on those three, and say when the tier above is not worth it.
Endpoint numbers, the operating systems they run, and whether anything is deployed already. That is usually enough for a price.
Look closer, page by page.
Four short reads: licensing and setup, managed detection, replacing what you have, and incident support.
Supply, rollout and the policy set against the software you actually run.
See licensing and setup→Migration from Defender, Sophos, ESET or Trend, with no gap in cover.
See the migration→
SentinelOne is the platform. Factor1 is the team watching it, every hour of the year.
Endpoint security is one piece. We look after the whole.
Under one agreement, the estate is watched, maintained and documented as a single thing, by the team behind this page.
…and everything between.
Tell us what you are running today.
The first call is with the engineer who would do the work. Bring your endpoint numbers, the operating systems in use and anything already deployed, and you will leave with a written quote and a view on which package fits.
Product features, package contents, module availability and retention periods are set by SentinelOne and are subject to change. Some capabilities are limited by region, operating system, platform or licence tier, and not every module is available in every package or territory. What is included is confirmed in writing on your quote.
SentinelOne, Singularity, Storyline, ActiveEDR and Ranger are trademarks of SentinelOne, Inc.
