SentinelOne Singularity Cloud Security Reviews

We are a security-based company. We use PingSafe to put our data planes on it. We have a cloud setup, and we have integrated PingSafe into our environment. It checks for any audit or security-related issues.

By implementing PingSafe, we wanted a centralized solution. We have many AWS accounts to manage, so we wanted a single dashboard with analytics. We wanted to be able to view and monitor everything at once. We also wanted to customize the rules on which we wanted the alerts to be set up. PingSafe was a better option for our use case.

We have multiple rules set up on PingSafe for things that we want to monitor. We have set up something for restricted access for SSH, and then we have access to the EC2 instances. If any of the rules are broken or if there is a bad actor, we get notified quickly. It also helps with the audit and keeping the infrastructure clean.

PingSafe includes proof of exploitability in its evidence-based reporting. This is quite important for us because we are a security-based company. We want to tag each and every alert correctly. We also need to provide RCA to the customers. PingSafe forms a very good basic layer for things that are happening in the infrastructure. The reports that it gives are also nice. It gives us information about the impact and other things. It helps us.

Its setup is good. It also depends on how finely you want to set it up. It depends on the rules you set, the thresholds you set, and how quickly you act on things. We did not want PingSafe to act on things, so we went for a basic setup without any auto-remediation. We act on the issues. It provides us with a basic layer of security.

Previously, we used to find issues from the AWS console and the AWS logs, but because we had multiple AWS accounts, finding out the issues was a bit of a pain point for us. We had to go inside 30 to 40 AWS accounts to find out the capabilities. We had to write our own automation scripts to find the full logs. We wanted a solution that gave us a centralized place to put all the issues that we were facing based on security concerns. With PingSafe, we found a centralized solution. It was easy for us to get the data of 30 to 40 clusters in a single dashboard. It was pretty nice to have that. The UI seems a bit confusing initially, but once you start using it, it becomes more intuitive.

There is a team that is working on setting it up on ISE. So far, with just a vanilla setup, it is doing its job, and we are happy with it.

There are a few false positives, but we want them to be there. We do not want to miss out on something. We want everything to be monitored. It does not matter to us if it is a false positive. At the end of the day, the cost that we would pay by ignoring a true positive thinking it is a false positive would be much higher than going through false positives and marking them as false positives.

For every module and everything that we do on our AWS clusters, we evaluate the risk individually, and then PingSafe forms an extra layer of security on top of the personal checks that we do. It is like a shield for us. It helps us a lot.

PingSafe has reduced the mean time to detect issues by a lot. Earlier, it was a very manual process to detect errors. There was not a single place where we could look into all the alerts. They were all scattered. PingSafe unified that. With PingSafe, once the alert is detected, we can just look into it directly. We can go into a specific cluster, resolve the issues, and mark it as resolved. There is a 45% to 50% reduction in the mean time to detect.

Our mean time to remediate remains the same because we have manual remediation. There is no change in that. The main issue for us was to be able to detect issues, and PingSafe solved that for us, but because remediation is taken care of by us manually, the mean time to remediate remains the same.

PingSafe is continuously monitored by the customer success engineering team and the security team. These people contact the infrastructure team. The application team is not involved because we mostly monitor the infrastructure side. That is the AWS side. It helps us with better collaboration. When the time zones change, we do not have to give a lot of context or change information across different time zones to different people. They can go into the console, see the issue, and continue to work on it.

Earlier, if there was a security issue, it had to be handed over to people in different time zones. Because we are a global company, we have on-calls and other things. Earlier, it used to be a big process. We had to write down the whole documentation of what happened, where we were seeing the issue, and whether it was resolved or not. We had to provide the complete information on that single issue. Things are simpler now because people can just log into it and see what is in the pending state and which security vulnerabilities we are still facing. A person in a different time zone can just log into the PingSafe console and start remediating the issue.

The multi-cloud support is valuable. They are expanding to different clouds. It is not restricted to only AWS. It allows us to have different clouds on one platform. The integration is quite easy. It took around 15 minutes for the whole stack to set up. It was very easy to set up. That was one of the best things.

The custom rules are also valuable. We can set up our own thresholds on the rules. We can have a granular setup for the rules. We can also scan for specific ports and specific AWS modules. The granularity of rules is good. 

In terms of ease of use, initially, it is a bit confusing to navigate around, but once you get used to it, it becomes easier. Initially, I had problems finding a few things and creating the policies. It was a bit difficult for me, but after going through the documentation, it got easier.

I was checking the IaC checks that they have, and they can add something for auto-remediating IaC. They can integrate something that will help auto-remediate on IaC and make needed changes to the code. They can also integrate something like CoPilot.

Other than that, I do not have any input. They have covered quite a bit. They are doing a good job. The features are good for what we are using it for right now.

I have been using PingSafe for 3 to 4 months.

Its stability is good. We do not have a high volume. It is doing well for the scale that we have. I would rate it a 9 out of 10 for stability.

Its scalability is good. I would rate it an 8 out of 10 for scalability. It meets our requirements. PingSafe does the very basic job of collecting the CloudWatch logs, keeping them in a centralized place, and looking for errors. We have scaled it across all of our AWS accounts, and it is doing well. I do not see any issues coming in the future as well.

PingSafe is being used by our infrastructure team. There are 15 to 20 people who keep a check.

Their support was good. I would rate them an 8 out of 10.

Positive

We did not have anything like PingSafe before.

The initial setup was straightforward. It only took about 15 minutes.

We initially had issues handling the setup. We were doing it slightly wrong. We ran it multiple times which messed up the setup. We got PingSafe folks on the call. PingSafe people assisted us with it, and it was very quick once they were on the call.

We are on the cloud. We have different AWS clusters, and we have onboarded AWS clusters to it. There is a single dashboard for us. We have not integrated it with anything else. PingSafe is a separate system running, and we have not integrated it with anything. Being a security company, we are directly adding third-party solutions to our stack. 

PingSafe does not require any maintenance from our side. It was a one-time installation, and since then, we have not had any issues with it.

Based on the things that we have tested, it does a pretty good job of alerting and reporting. If you have a highly scaled environment with 50 to 60 AWS clusters and you are looking for a tool that simplifies getting security logs, PingSafe is the perfect solution. It does the job. I would recommend PingSafe to others.

PingSafe has an auto-remediation feature, but we are not using that because we have to give a lot of access to PingSafe for that. We are not willing to do so. That is why we do not use the auto-remediation offered by PingSafe. We just get the alerts, and then we act on them. We also do not use agentless vulnerability scanning, IaC scanning, and PingSafe's Offensive Security Engine.

Overall, I would rate PingSafe an 8 out of 10.

We are a channel partner of SentinelOne in Brazil. We have a distributor that we use to sell SentinelOne. We are very happy and very proud to represent SentinelOne here.

SentinelOne Singularity Complete helps consolidate security solutions. There is a hot discussion about the future of the Security Operations Center. Security Operations Centers generally use SIEM and SOAR, but SentinelOne Singularity XDR can also help there because you can see what is happening not only on the endpoints but also in the network. In other words, you can replace the NDR solution. We also see it going all the way to include all the clouds. This ecosystem is very important to us. In the near future, we see it being used for all the problems related to detection and response in cybersecurity.

Our customers use the Ranger functionality. There are two Ranger versions. There is Ranger AD, and there is Ranger Pro. SentinelOne Singularity platform has its own security ecosystem. You do not have the need to buy other solutions. For example, we sell a ZTNA solution. If you have ZTNA, you do not need to buy a PAM solution. You do not need to buy a NAC solution. The ZTNA technology has replaced all the other solutions. It is the same thing with Singularity. If you buy the ecosystem of Singularity, you do not need to buy several different technologies.

Ranger can do all the hardware inventory. It can point out the versions of the operating systems and then you can apply patching to update the versions of the operating systems. You can use Ranger in different ways. For a security professional, it is a very powerful tool.

It sends you alerts and warnings about possible incidents, but you do not get too many false positives. It is precise. You get real information about an incident.

It is very important to have good hygiene of your endpoints and your network. The uptime of the endpoints and networks is very important. SentinelOne Singularity Complete provides a good uptime. Incident identification is very important and having fewer false positives is also important. The SOC staff knows that if SentinelOne Singularity points out an incident, they have to pay attention to the threat. It is a very good checker.

SentinelOne Singularity Complete reduces the organization's risk.

ITDR or Ranger AD is an important feature for me.

It integrates very well. We sell different products from different vendors. We know that the SentinelOne Singularity platform can be integrated with several different solutions from different vendors. We sell products of a Spanish company, and they support the integration of logs produced by SentinelOne into their platform. We see the capacity to integrate SentinelOne with the solutions of other vendors. It is very important because you can get not only a more integrated ecosystem but also a more powerful ecosystem.

All EDRs are made of different modules. There is a firewall module, an IPS module, and an application module. The application module focuses on the different codes and libraries that can be run on the machines. It is very important for Singularity EDR to detect what type of codes and what type of libraries can run in the machine. If they can implement a white list or a black list of codes or libraries that can be used in the machine, it would be very helpful. They can focus more on the application module.

It is a short duration because we started to be a channel partner of SentinelOne two months ago, but we are very focused on SentinelOne.

Their technical support for me is good. I am not involved in the deployment of the solution, but I have not heard any kind of complaint about the support. 

Positive

We are currently using McAfee in our company, but we are going to move to SentinelOne.

I am a very experienced security professional. I have got the CISSP certification and other specific certifications. I see too many different products. I have good experience with Trend Micro, but I find SentinelOne Singularity more comprehensive.

We are trying to replace the solutions from other vendors. Customers are trying to use more powerful tools such as CrowdStrike or SentinelOne. We do not believe that Microsoft has a very good solution. There are a lot of people who speak about problems with Microsoft Defender and other components of the Microsoft ecosystem. The technical side is not the only factor. Price too is important, but we are trying to replace it. We have some good prospects to replace EDRs or other malware detection tools with SentinelOne Singularity.

I am a security architect. I am not involved in the deployment of the solution. Some other guys in the technical area are involved in the deployment, but from what I hear, there is no problem. You have to do some configurations.

The deployment duration depends on the customer. If you have an SMB customer, it takes less time than to deploy it for a big customer.

We have a team of technicians who are specialized in different kinds of companies. They are specialized in the cloud and other things. We have about 10 people. They take care of the deployment and configuration of the solution. We can also count on the specialist from the distributor for support and vendor support.

You get good support. You get a good product and you are going to be protected. The technology can be integrated with different tools. This is important. We do not live alone in this world. There are other vendors, so the capability to integrate is very important. Singularity Complete is going in the right way.

The price depends on the extension of the solution that you want to buy. If you want to buy just EDR, the price is less. XDR is a little bit more expensive. There are going to be different add-ons for Singularity. This is important for customers because they can add some new features. They do not need to change the product. They can simply add a new feature.

My company is a reseller of SentinelOne. It is one of the top solutions as per Gartner's Magic Quadrants. I am always interested in everything that comes from SentinelOne. I have watched the recent webinars about the latest launch of SentinelOne. There is going to be Purple AI. They have a new console, and we are waiting for it.

What we see here is that companies or customers want more features. The gap between EDR and XDR is too large. XDR includes cloud workloads of the systems and network and not only the endpoints. SentinelOne EDR is a very good solution. You do not need to monitor the Windows operating system. SentinelOne can do this for you. For example, the registry of Windows is the most important part of the operating system. SentinelOne EDR can see what happens in the registry. It can warn about any modification in the registry.

The Singularity ecosystem is very powerful. SentinelOne is very focused on expanding the reach of Singularity and making it a more comprehensive solution. SentinelOne is doing a very good job to get there. We believe that there will be a consolidation of the market, and SentinelOne will survive this consolidation because SentinelOne Singularity is a very powerful and very good solution.

I would rate SentinelOne Singularity Complete a nine out of ten. We have a very good relationship with SentinelOne.

We use the solution for security posture management. It's a safeguard for our cloud. It helps flag misconfiguration or any kind of vulnerability. There are also remediation capabilities, although we're only subscribed to alerts.

It's a safeguard tool for our cloud. When I'm using my cloud I need to make sure whatever I'm doing is secure. So we needed a gatekeeper or something acting as a gatekeeper, to keep an eye out since people can sometimes make mistakes. If there is any kind of event error, it helps us get alerted.

It's a real-time monitoring tool that runs 24/7.

I like the security capabilities. The availability and stability are very good. 

It is very easy to use, and the graphical user interface is nice. It's great that they provide information regarding issues on the front end. The evidence-based reporting is good. There is some heavy investment there. The user interface and ease of use for security operations are very helpful. Everything is easily available, and that's very impressive. 

It works within a certain set of rules. It has enough information to cover 100% of the services we are using. For most of my expectations, the product has covered my needs. They are also adding new features and functionality.

We use the infrastructure as code scanning, which is good. There's very good security scanning. We can scan non-production environments and get a report. We get notifications of issues immediately. Before moving to production, we always look at reports to check for issues. 

We're almost 99% compliant based on the compliance regulations we follow. It's helpful to have good compliance scanning. 

We've been dealing with fewer false positives. It's improved over time. It's too early to say, percentage-wise, how many fewer we're seeing; however, it is noticeable. 

It's lowered our risk posture. We have been satisfied so far. It covers what we need to be covered.

The mean time to remediate has been lowered by about 20% to 30%.

We now have very good collaboration between our cloud security, application developers, and AppSec teams. There's better communication in terms of response. We haven't calculated if it's saved us any engineering time, however. 

They could improve their mean time to detect. It's good, however, it could be lowered further. Detection should be in near real-time. We need these alerts fast as security is our greatest concern.

They could improve reporting and offer better, faster notifications. 

I've used the solution for almost 2 years.

I'd rate the stability 8 out of 10.

We have 10 to 15 people using the solution. 

I'd rate the ability to scale 8 out of 10.

We've had our support directly reach out to theirs. Sometimes they address items slowly; sometimes they are faster. The support response time could be improved. 

Positive

We did use something prior to PingSafe. We had a few things on-premises and on our private cloud. We liked the pricing and feature offering of PingSafe and decided to implement it. 

The initial setup was pretty straightforward. We had to do some integration and it was simple. The deployment itself hardly took an hour. It's integrated with our AWS and that was pretty seamless. 

I don't worry about maintenance. I don't take care of that aspect. However, PingSafe works in the background, maintaining and upgrading the system directly. 

We had a few people from PingSafe involved in the implementation. 

I'm a customer and end-user.

It's a 100% available solution. It covers most of our cloud security requirements and has a nice interface. Support could be faster, though. When we're dealing with security, we don't want lots of time between responses. 

I'd rate the solution 7 out of 10.

We use the solution for monitoring the security of our infrastructure. It helps us identify all the vulnerabilities.

We had code and infrastructure, and we just weren't sure of all the vulnerabilities within them. This knowledge has helped protect us from security loopholes. 

It's integrated with all of our cloud services on our accounts. It automatically fetches all the resources, scans through the code, and reports back on our vulnerabilities. It helps with all of our overall security standards as per the industry, and it can give us a rating. If I go to the compliance section, it gives me an idea of how I'm performing with respect to compliance metrics.

There's real-time threat detection. It can show threats and find issues based on their severity and helps us with real-time monitoring.

It's fairly easy to use. I'd rate the ease of use 7 out of 10. There is a learning curve around the initial issues. However, we can look at issue descriptions and what to do. It gives us a lot of details about an issue, so that helps. 

Evidence-based reporting helps prioritize and solve our cloud security issues.

PingSafe includes proof of exploitability in evidence-based reporting. It's really important. If we did have any proof, it would be harder to pinpoint false positives. I like that it gives proof.

The code scanning is helpful. Whenever somebody commits a recent code, it helps identify that immediately and check vulnerabilities. 

It has positively affected our exposure. Before we implemented it, we were having lots of issues, and now, with PingSafe, we're up to 87% compliance with respect to all security metrics. It's been a gradual process, however, we're getting better and better. 

We've been able to reduce mean time to detect. It's gotten a bit faster. If you have a solution like this, you can take a more proactive approach. When a vulnerability happens, you can act immediately. Our mean time to detect has improved by about 80%.

It's also helped us with our mean time to remediate. It shows recommended actions and helps tell us what could possibly remediate the issue. 

The product has positively affected collaboration among our cloud security, application developers, and AppSec teams. PingSafe, however, is more centered around our infrastructure security and doesn't impact developer productivity much.

The compliance monitoring capabilities are helpful. We're a venture product, so we need to be compliant with everything. When we get a report, we can see what we need to do for compliance, and it helps us identify issues and mitigate them effectively to increase compliance. 

There is a bit of a learning curve for new users. The ease of use could be better.

We've had an issue where we muted a false positive, however, when we made some changes to a cloud configuration, it popped up again. So it hasn't really reduced false positives; you just need to manually ignore them. 

I've used the solution for one year. 

The solution has been stable throughout. 

We have three to four users that are actively using PingSafe. They are admins and engineers. 

So far, we haven't had any scalability issues. 

They have great technical support.

Positive

We didn't use a different solution previously.

The initial deployment was pretty quick. When you integrate any of your cloud service providers, it doesn't take long. We had it implemented in a few days. One of our reps can just work with the team to get it ready.

It's not integrated with any other security tools, however, it is integrated within our infrastructure. 

No maintenance is required.

I don't have any visibility on the pricing of PingSafe. 

We have not evaluated other solutions. 

I'd recommend the solution to other users. Overall, I'd rate the product 8 out of 10. 

We have onboarded multiple accounts from our organization. We have onboarded Azure accounts, and we have also onboarded GCP accounts. 

We are using the vulnerability management feature, and we are also using the offensive security feature. We are planning to use IaC in a couple of months.

We are a services company. We are working for multiple clients from the banking sector or the finance sector. They have to follow the rules and regulations of their country. Each country has multiple compliance requirements, and PingSafe helps with the compliance standards that need to be followed. We get reports on the basis of that. We get to know our compliance level. It helps organizations to achieve a high level of compliance.

Its reporting is very good. We do not have to go to the portal and see things again and again. All the required reports go to the respective teams. We have created multiple reports on the basis of applications and cloud accounts. The reports directly go to the application team or the cloud team. They are working on the security posture.

Offensive security is my favorite feature. It gives a lot of things with evidence. It also provides the severity levels, such as critical, high, and medium.

PingSafe has reduced false alerts. We are using PingSafe every day, and we are able to see every configuration. If we find anything different, we work with PingSafe's support team. We create a support ticket as a bug or as a false positive. We are able to close an issue on the basis of priority.

PingSafe is protecting our overall infrastructure. It protects our configuration, network, and IM configuration-related things. We trust PingSafe. We are getting good results, and we hope to keep getting good results in the future as well.

PingSafe has reduced the mean time to detect. If needed, we can also run a scan, and the results are reflected in the PingSafe portal.

PingSafe has reduced our mean time to remediate. It also has auto-remediation capability, but we are not using that. As of now, we are following the information given for closing an alert. This information makes it quite easy. It is very helpful. We do not have to search on the web to find a way to fix the issue. The description it provides is good enough.

PingSafe has affected the collaboration among our cloud security, application developers, and app sec teams. All the teams are on the same platform. They are able to communicate with each other.  

The offensive security feature is valuable because it publicly detects the offensive and vulnerable things present in our domain or applications. It checks any applications with public access. Some of the applications give public access to certain files or are present over a particular domain. It detects and lets us know with evidence. That is quite good. It is protecting our infrastructure quite well.

Its UI is quite easy. The recommendation part is also quite easy to understand. Users can read the description, and they get to know which action to perform. It is quite easy to use it and onboard things. I would rate it a 9 out of 10 for the ease of use.

For vulnerabilities, they are showing CVE ID. The naming convention should be better so that it indicates the container where a vulnerability is present. Currently, they are only showing CVE ID, but the same CVE ID might be present in multiple containers. We would like to have the container name so that we can easily fix the issue. This is a feature request that we have. We are trying to get that done as soon as possible.

We have been using PingSafe for the last year. We are implementing it for customers. We are also trying to be a partner of PingSafe or SentinelOne.

It is stable. I would rate it a 10 out of 10 for stability. We have not faced any downtime. The platform is working well.

Its scalability is very good. We can onboard multiple accounts, Kubernetes clusters, or ECS services on a single platform.

I have contacted them. We also have a Customer Success Manager whom we can contact via email. Whenever required, we raise a support ticket with them. We get a call from them, and it gets resolved every time.

We also have biweekly calls with the PingSafe team. We discuss any issue that we have with them. They let us know about the things they can do. They provide us with updates. This is how we are working with the SentinelOne team or the PingSafe team.

Positive

PingSafe is a SaaS solution. It is easy to deploy it for a customer. If we have all the permissions on the infrastructure, we can onboard any cloud within an hour. However, in an organization, some approvals might be required. In such a case, it can take a week.

It does not require any maintenance. Whatever they are doing is quite good, and the application is working fine. They let us know about their maintenance plans via email. We get to know that downtime is at a specific time. So far, we have not had any issues. It has been pretty good.

We have not used PingSafe's agentless vulnerability scanning. We are trying to onboard all the features and enable them in our tenant. Currently, there are a few features that we have not enabled because we have onboarded some of the accounts as a single account. We are trying to onboard all the accounts at the org level, but we are facing some issues. We are communicating with the SentinelOne team. We are trying to get it done as soon as possible.

We have done a PoC of IaC for some of the projects. In a couple of months, we will start with this feature. It is quite a good feature because we get to the issues in our code before deploying it. It is very good for developers and the Infra team. They do not have to worry after the deployment of the application.

Overall, I would rate PingSafe a 10 out of 10. It is helpful. It is easy to use and easy to understand. It makes it easy to explain things to the customers.