PROTECTION AND TECHNOLOGIES / ENTERPRISE ENVIRONMENTS

SentinelOne

Endpoint prevention, detection and response for enterprise environments. SentinelOne supplies the product; APPSEC helps define scope, assists with deployment and provides support according to the proposal.

Arrange a demonstration What the service includes

SENTINELONE RESPONSE EXAMPLE

Connect the events. Contain further spread.

Suspicious device Connected events Other devices Isolation restricts propagation Document Script Network attempt

Suspicious device
Connected events
Other devices

The response targets the compromised computer.

SentinelOne can connect the context and isolate a device. Response scope depends on licensing and configuration.

Who it is for: Enterprise IT and security teams managing protection, policies and response across the organisation.
Inputs: Device numbers and types, operating systems, existing protection and operational capacity.
Deliverables: A licensing and deployment proposal; support and additional services as contracted.

SentinelOne Singularity platform: laptop with a security dashboard

SentinelOne / event context

From process to understood event

The diagram shows how a security event is handled. It does not promise automatic prevention of every threat.

01 / Process

Start with observable activity

A process, its parent and its actions provide the starting point for event assessment.

02 / Detection

Connect rules and context

Detection is a signal to assess. A label alone does not establish incident scope.

03 / Isolation

Contain risk within authorised limits

Endpoint isolation can limit spread when available, approved and appropriate.

04 / Context

Connect events for further decisions

Timelines, identities and related processes inform next steps and verify response outcomes.

Behavioural detection beyond known signatures

SentinelOne Singularity is an endpoint protection platform that can cover other areas depending on the selected solution. At the endpoint, it combines prevention, suspicious behaviour detection, event context and response capabilities.

Available features depend on the licence package, operating system, configuration and deployment. The proposal therefore distinguishes included features, optional capabilities and responsibilities that remain with your team.

Prevention and behavioural detection of suspicious activity.
Event and process context to support investigation.
Incident response according to configured permissions and policies.
Central management and visibility of the protected environment.

Technology is only part of the defence

Installing an agent does not determine who will assess an alert, approve an intervention or manage recovery. Before deployment, we therefore review operational responsibilities and escalation paths together.

Endpoint protection does not replace backups, multi-factor authentication, updates, secure configuration or incident procedures. Proper deployment complements them.

APPSEC

Needs assessment, scoping, deployment assistance and support within the proposal's scope.

Vendor

The product, licensing model, documentation and product escalation under the vendor's terms.

Customer

Access to the environment, approval of policies, technical cooperation and decisions that cannot be delegated to a supplier.

From environment assessment to sustainable operations

Understand the environment

Devices, operating systems, current antivirus, critical applications and IT capacity.

Demonstration and pilot

We verify suitability and configuration on a selected group of devices against agreed criteria.

Deployment

A phased migration, policies, permissions, escalation rules and handover to your administrators.

Support

Channels, scope and responsibilities are clearly defined in the contract. We do not automatically promise round-the-clock availability.

Methodological and product sources

SentinelOne Singularity Platform — official vendor website

SENTINELONE

Singularity platform modules

Each module addresses a different part of an attack and has its own licensing terms. Discover what it does, how it works in practice, who it is for and what to check before buying.

Singularity Endpoint Prevention, detection and response on computers and servers Singularity Cloud Security Protection for cloud workloads, containers and cloud configuration Singularity Identity Protection for Active Directory, Entra ID and credentials Singularity Network Discovery Visibility into unmanaged devices on your network Singularity Mobile Protection for iOS, Android and ChromeOS phones and tablets Singularity AI SIEM Central collection, correlation and investigation of security data Purple AI An AI assistant for threat hunting and alert investigation Prompt Security Protect AI tools, applications and agents Wayfinder MDR Managed detection and response delivered by SentinelOne

LicensingPackages, modules and licence planning

COVERAGE

Areas covered by each module

Levels are qualitative: 3 primary role, 2 additional protection, 1 context, 0 no direct role. Actual coverage depends on licensing, platform and deployment.

Areas covered by each module
Module	Endpoints	Servers and cloud	Identities	Network	Data and logs	AI usage
Singularity Endpoint	Endpoints: primary role	Servers and cloud: additional protection	Identities: context	Network: context	Data and logs: context	AI usage: no direct role
Singularity Cloud Security	Endpoints: no direct role	Servers and cloud: primary role	Identities: context	Network: no direct role	Data and logs: context	AI usage: no direct role
Singularity Identity	Endpoints: additional protection	Servers and cloud: context	Identities: primary role	Network: context	Data and logs: no direct role	AI usage: no direct role
Singularity Network Discovery	Endpoints: additional protection	Servers and cloud: context	Identities: no direct role	Network: primary role	Data and logs: no direct role	AI usage: no direct role
Singularity Mobile	Endpoints: primary role	Servers and cloud: no direct role	Identities: context	Network: context	Data and logs: no direct role	AI usage: no direct role
Singularity AI SIEM	Endpoints: context	Servers and cloud: context	Identities: context	Network: additional protection	Data and logs: primary role	AI usage: no direct role
Purple AI	Endpoints: context	Servers and cloud: context	Identities: context	Network: context	Data and logs: primary role	AI usage: no direct role
Prompt Security	Endpoints: no direct role	Servers and cloud: no direct role	Identities: no direct role	Network: no direct role	Data and logs: context	AI usage: primary role
Wayfinder MDR	Endpoints: additional protection	Servers and cloud: additional protection	Identities: additional protection	Network: context	Data and logs: context	AI usage: no direct role

Frequently asked questions

Before we start work.

Is continuous monitoring included?

Not automatically. The product, APPSEC support and any managed service are separate proposal items. Availability and responsibilities are always stated in the contract.

How do we migrate from our current antivirus?

We first assess compatibility and risks. A pilot and phased migration verify policies and operations before protection is extended to more devices.

What do you need to prepare a quote?

Primarily the numbers and types of endpoints and servers, operating systems, required scope, licence duration and the expected level of deployment assistance and support.

INITIAL CONVERSATION, NO OBLIGATION

Not sure where to start? Tell us what you are facing.

You do not need to know whether you need a test, a technology or a consultation. We will suggest a suitable next step based on your situation.

Request a proposal