EDR that constantly updates without intervention. Scans attached drives, and computers when files are downloaded with automatically. Onboarding walks you step by step to get setup and using the portal quickly and efficiently. Support is always available. Threats are stopped automatically and restored back to normal if set to protection mode vs just detection mode.

threat hunting has a lot of information to digest. If computers have small harddrives sometimes the agent is disabled because it cannot update the database file needed.

Prior to sentinel we were getting hit with crypto variants many times per week and it was starting to become a real issue for IT, and a big drain on the user base. We haven't had a single occurrence since installing sentinel.

Only complaint I have, and this is minor, there is a lot of agent releases. It can be a bit difficult to stay on top of them.

A struggle our organization has around security products is that they sometimes create more work than they eliminate. SentinelOne is a product that functions on it's own without constant administration and intervention once you've gone through the initial setup and created automation processes around keeping it deployed.

The only issue's we've encountered with SentinelOne have revolved around getting our users to understand how it works. SentinelOne acts without warning sometimes to kill or quarantine processes, and if users create changes in our environment without prior communication it can create the need to whitelist retroactively which causes downtime.