SentinelOne is an endpoint detection and response platform using on-device machine learning to autonomously detect, contain and roll back malicious activity, priced per endpoint per year with published pricing starting at $179.99 annually.
Listing updated . Checked by MSP Software .
SentinelOne is an endpoint detection and response platform from SentinelOne for MSPs and enterprises, using on-device machine learning to detect and automatically contain malicious activity without needing to send every decision back to a cloud service first. Its rollback feature restores an endpoint to its pre-attack state, undoing file encryption or other changes, without requiring a full reimage of the machine. It suits MSPs who want strong autonomous detection with minimal manual triage built into the agent itself, and those building a security practice who plan to layer their own analysts or a partner MDR service on top of SentinelOne's raw telemetry rather than relying on the agent alone to handle everything.
Pricing is published and starts at $179.99 per endpoint per year for the Complete tier and $229.99 per year for the Commercial tier, with custom quotes for the Enterprise tier (checked September 2026). Pricing applies to deployments of 5 to 100 workstations through authorized third-party partners, and regional pricing or partner markup may vary. SentinelOne integrates with major SIEM and SOAR platforms including Splunk and Microsoft Sentinel, and several third-party MDR providers build their managed services specifically on top of its API. RMM and PSA tools connect through partner-built connectors, so detections can flow into a service desk's normal ticket queue. The platform supports Windows, macOS, and Linux endpoints, with deployment options including cloud, on-premises, and hybrid environments. Support includes 24-hour phone access and a knowledge base with customer portal. Before buying, an MSP should decide whether it wants SentinelOne's own response tooling alone or plans to add a third-party MDR service on top, since pricing and the alerting workflow differ meaningfully between those approaches. SentinelOne is based in the United States.
Trend Vision One Endpoint Security Endpoint protection with EDR, XDR and threat hunting under credit-based licensing. No reviews yet vs Trend Vision One Endpoint Security
ESET PROTECT Prevention-focused endpoint detection and response with cloud or on-premises deployment. No reviews yet vs ESET PROTECT
Cortex XDR Cross-domain XDR for endpoint investigation and response with 24/7 managed detection services. No reviews yet vs Cortex XDR
Cynet Unified Unified endpoint and network security with 24/7 managed response, priced per endpoint per month. No reviews yet vs Cynet Unified| Feature | Supported | Note |
|---|---|---|
| Behavioural detection | yes | On-device machine learning for behavioral threat detection |
| Automated remediation | yes | Autonomous containment and automated response capabilities |
| Rollback to pre-attack state | yes | Restores endpoints to pre-attack state without full reimage |
| USB and device control | yes | USB and device control capabilities available |
| Application allow-listing | yes | Application allow-listing and control features |
| Offline protection | yes | Protection continues when endpoints are offline |
| Threat hunting console | yes | Threat hunting console in higher tiers |
| Managed MDR add-on | yes | Works with third-party MDR services built on SentinelOne API |
| SIEM and SOAR integration | yes | Integrates with major SIEM and SOAR platforms |
| RMM integration | yes | RMM integration through partner-built connectors |
| macOS support | yes | macOS endpoint support |
| Linux support | yes | Linux endpoint support |
| Feature | Supported | Note |
|---|---|---|
| 24-hour human-staffed SOC | unknown | |
| Managed threat response and isolation | unknown | |
| Own endpoint telemetry agent | unknown | |
| Identity threat detection | unknown | |
| Network monitoring | unknown | |
| Microsoft 365 monitoring | unknown | |
| Monthly threat reporting | unknown | |
| PSA integration for ticketing | unknown | |
| Multi-tenant console | unknown | |
| Works with third-party EDR | yes | Designed to work with third-party MDR providers |
| Dedicated incident response | unknown |
SentinelOne is the endpoint detection and response agent and its autonomous response tooling, not a staffed security operations centre. MSPs who want 24-hour human analyst monitoring typically add a third-party MDR provider that builds its service on SentinelOne's API, which is a separate purchase. SentinelOne's platform is designed to work alongside these partners rather than replace them.
SentinelOne's rollback restores an endpoint to its state before an attack, reversing file encryption or other malicious changes, without requiring a full reimage of the machine. It is one of the features that differentiates SentinelOne's autonomous response from EDR products that only detect and alert. MSPs should confirm which SentinelOne tier includes rollback, since it is tied to how much extended response functionality is licensed in the tier selected.
SentinelOne is priced per endpoint per year with published pricing starting at $179.99 per year for the Complete tier and $229.99 per year for the Commercial tier, with Enterprise pricing available by quote. Higher tiers unlock more extended detection and response functionality rather than covering additional endpoints. An MSP should be clear on which specific capabilities, such as the threat hunting console or advanced MDR integration, are included at the tier being quoted before comparing against a competitor's price.
SentinelOne connects to RMM and PSA tools through partner-built connectors, so detections can open tickets in a service desk's normal queue rather than only appearing in a separate SentinelOne console. Which specific PSA connectors are available and how directly they are supported can vary by integration partner, so confirm current connector coverage for the exact PSA in use before relying on automated ticket creation.
SentinelOne protects Windows, macOS, and Linux endpoints with its cross-platform agent. The platform deploys in cloud, on-premises, and hybrid environments, giving MSPs flexibility in how they run it across different network architectures. Confirm specific version support for your endpoint operating systems during evaluation or before full deployment.
Reviews are moderated. How reviews work.
Share what it is like to use this product day to day. Your experience helps other MSPs choose with confidence.
Write the first review
