In short: SentinelOne Singularity is an AI-driven security platform that protects endpoints, servers, cloud workloads and identities from one agent and console. Its agent blocks and remediates threats autonomously, including rolling Windows devices back after ransomware. Packages run from Core to Enterprise, with Purple AI and Wayfinder managed services as options.
How Singularity works
The Singularity agent runs AI models on the device to block known and unknown malware before it executes, and watches behaviour to catch fileless attacks, script abuse and exploits. When it detects malicious activity it can respond by itself: kill processes, quarantine files, disconnect the device from the network while keeping it connected to the console and, on Windows, roll the device back to its state before the attack using operating system snapshots.
Because detection and response happen on the device, protection continues when a laptop is offline. The console, data lake and investigation tools run in SentinelOne's cloud. Agents are available for Windows, macOS and Linux, including virtual desktops, and the same platform extends to cloud workloads and containers.
Singularity packages
SentinelOne sells endpoint protection in tiered packages. Feature differences, without prices:
| Package | What it adds | Typical fit |
|---|---|---|
| Singularity Core | AI-based prevention and autonomous threat response for endpoints | Replacing legacy antivirus |
| Singularity Control | Core plus security suite features such as device control and host firewall control | Organisations wanting stronger device hygiene without EDR |
| Singularity Complete | EDR and XDR for endpoints and cloud workloads, device and firewall control, remote shell, network discovery, an AI Security Assistant and 14 days of data | Teams or MDR providers that investigate and hunt |
| Singularity Commercial | Complete plus identity detection and response, managed threat hunting and 90 days of data | Mid-size organisations wanting identity cover and longer history |
| Singularity Enterprise | Commercial plus an agentic AI SOC analyst for automated triage, full visibility and forensics with deep network data collection, and expert-led onboarding and training | Larger security teams |
Managed detection and response, managed threat hunting (below Commercial) and the agentic AI SOC analyst (below Enterprise) can be added to lower packages. Package contents are revised periodically, so we confirm the current inclusions before quoting. Licensing detail is on softwarelicensing.uk/sentinelone.
Purple AI, identity, cloud and SIEM
Around the endpoint, SentinelOne offers:
- Purple AI: an agentic AI security analyst that answers investigators' questions in plain English without hand-written queries, summarises activity, auto-triages risky alerts and can investigate from alert to verdict with suggested next steps.
- Singularity Identity: identity posture checks and identity threat detection and response for Active Directory and Entra ID, with deception to lure attackers; see ITDR.
- Singularity Cloud: runtime protection for servers, virtual machines, containers and Kubernetes, plus cloud posture tools; see cloud workload protection and CNAPP.
- Singularity AI SIEM and Hyperautomation: ingest first and third-party logs and automate response workflows.
Managed services
SentinelOne's managed services sit under the Wayfinder Threat Detection and Response name: round-the-clock managed detection and response in which SentinelOne's experts monitor and respond across your environment, plus expert-led threat hunting and incident readiness and response services such as forensics and compromise assessments. Many IT providers also run their own MDR on the Singularity platform, so you can choose the vendor's service or a provider's.
Whichever you choose, agree in writing which actions the service may take without asking, how quickly you are told, and how out-of-hours escalation works. Our MDR guide has a full checklist.
Who SentinelOne suits
Singularity suits organisations that want strong automation on the device, mixed Windows, macOS and Linux estates, and teams that like the ability to roll back a ransomware-hit Windows device rather than rebuild it. Its identity and cloud options make it a single-vendor route for growing estates.
It is most often compared with CrowdStrike Falcon and Microsoft Defender for Endpoint; see our comparison. Rollback is a recovery aid, not a replacement for cloud backup: keep independent, immutable backups as well.
How we help
A typical rollout starts with the agent in detect-only mode on a pilot group, so you can see what it would block and add exclusions for line-of-business software before switching to protect mode. Next come device and firewall control policies, then the wider estate in waves, with the previous product removed only once each device reports healthy. Servers and virtual desktops usually get their own policies, and cloud workloads are added through Singularity Cloud.
We size the right package and add-ons, plan migration from your existing agent with protection maintained throughout, configure policies (detect versus protect mode, exclusions, device and firewall control), and set up integrations with identity and ticketing. We can also help you decide between Wayfinder and a provider-run MDR. Pricing is always "ask us for a quote".
Contact us to discuss SentinelOne Singularity.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is SentinelOne Singularity?
SentinelOne Singularity is a security platform that protects endpoints, servers, cloud workloads and identities from one agent and console. Its agent uses on-device AI to prevent, detect and respond to threats autonomously, with EDR, identity, cloud and SIEM options and managed services.
What is the difference between Singularity Control and Complete?
Singularity Control adds device control and host firewall control to core prevention. Singularity Complete adds EDR and XDR across endpoints and cloud workloads, with 14 days of recorded activity to search, which is what a security team or MDR provider needs to investigate incidents.
Can SentinelOne roll back ransomware?
Yes, on Windows. The agent can restore files and settings changed by a detected attack using Windows snapshots. It is a valuable recovery aid but does not replace independent, immutable backups.
What is Purple AI?
Purple AI is SentinelOne's agentic AI security analyst within the Singularity platform. It lets analysts ask questions in natural language instead of writing queries, summarises activity, auto-triages alerts and can run an investigation through to a verdict with suggested next steps. Ask us how it is currently licensed for your package.
Does SentinelOne work offline?
Yes. Detection and response run on the device, so protection continues without a connection. Events sync to the console when the device reconnects.