# SentinelOne

> Autonomous endpoint detection and response with one-click rollback, per-endpoint annual pricing.

SentinelOne is an endpoint detection and response platform using on-device machine learning to autonomously detect, contain and roll back malicious activity, priced per endpoint per year with published pricing starting at $179.99 annually. Listing updated 6 September 2026. Checked by MSP Software 6 September 2026.

- Page: https://mspsoftware.net/software/sentinelone
- Vendor: SentinelOne, https://mspsoftware.net/vendors/sentinelone, website https://www.sentinelone.com
- Categories: EDR and XDR (primary), MDR and SOC
- Free version: no.
- Deployment: cloud, on-premises and hybrid. Platforms: Windows, macOS, Linux and web. HQ: United States. Founded: 2013.
- Support: 24/7, help desk, phone and knowledge base. Training: documentation, videos, webinars and live online.

## From the vendor

SentinelOne is an endpoint detection and response platform from SentinelOne for MSPs and enterprises, using on-device machine learning to detect and automatically contain malicious activity without needing to send every decision back to a cloud service first. Its rollback feature restores an endpoint to its pre-attack state, undoing file encryption or other changes, without requiring a full reimage of the machine. It suits MSPs who want strong autonomous detection with minimal manual triage built into the agent itself, and those building a security practice who plan to layer their own analysts or a partner MDR service on top of SentinelOne's raw telemetry rather than relying on the agent alone to handle everything. Pricing is published and starts at $179.99 per endpoint per year for the Complete tier and $229.99 per year for the Commercial tier, with custom quotes for the Enterprise tier (checked September 2026). Pricing applies to deployments of 5 to 100 workstations through authorized third-party partners, and regional pricing or partner markup may vary. SentinelOne integrates with major SIEM and SOAR platforms including Splunk and Microsoft Sentinel, and several third-party MDR providers build their managed services specifically on top of its API. RMM and PSA tools connect through partner-built connectors, so detections can flow into a service desk's normal ticket queue. The platform supports Windows, macOS, and Linux endpoints, with deployment options including cloud, on-premises, and hybrid environments. Support includes 24-hour phone access and a knowledge base with customer portal. Before buying, an MSP should decide whether it wants SentinelOne's own response tooling alone or plans to add a third-party MDR service on top, since pricing and the alerting workflow differ meaningfully between those approaches. SentinelOne is based in the United States.

## Pricing

SentinelOne starts at US$179.99 per endpoint per year, according to the vendor (pricing page: https://www.sentinelone.com/pricing/).

| Plan | Price | Per | Highlights |
| --- | --- | --- | --- |
| Complete | US$179.99 | endpoint per year | Endpoint detection and response, Automated remediation, Rollback capability, Offline protection |
| Commercial | US$229.99 | endpoint per year | All Complete features, Extended detection and response, Threat hunting console, Advanced MDR integration |

## Features

| Feature | Supported | Note |
| --- | --- | --- |
| Behavioural detection | yes | On-device machine learning for behavioral threat detection |
| Automated remediation | yes | Autonomous containment and automated response capabilities |
| Rollback to pre-attack state | yes | Restores endpoints to pre-attack state without full reimage |
| USB and device control | yes | USB and device control capabilities available |
| Application allow-listing | yes | Application allow-listing and control features |
| Offline protection | yes | Protection continues when endpoints are offline |
| Threat hunting console | yes | Threat hunting console in higher tiers |
| Managed MDR add-on | yes | Works with third-party MDR services built on SentinelOne API |
| SIEM and SOAR integration | yes | Integrates with major SIEM and SOAR platforms |
| RMM integration | yes | RMM integration through partner-built connectors |
| macOS support | yes | macOS endpoint support |
| Linux support | yes | Linux endpoint support |
| Works with third-party EDR | yes | Designed to work with third-party MDR providers |

## Integrations

- Elastic Security, https://mspsoftware.net/software/elastic-security

Listed products that integrate with SentinelOne: Apptega, Arctic Wolf, Automox, Barracuda Managed XDR, ConnectWise Managed EDR, CyberStrong, Cynomi, Guardz, LogMeIn Resolve, NinjaOne, NordLayer, SonicSentry MDR, Sophos MDR, SuperOps, UnderDefense MAXI and eSentire MDR.

## Alternatives

- Trend Vision One Endpoint Security: Endpoint protection with EDR, XDR and threat hunting under credit-based licensing. https://mspsoftware.net/software/trend-vision-one. Compare: https://mspsoftware.net/compare/sentinelone-vs-trend-vision-one
- ESET PROTECT: Prevention-focused endpoint detection and response with cloud or on-premises deployment. https://mspsoftware.net/software/eset-protect. Compare: https://mspsoftware.net/compare/eset-protect-vs-sentinelone
- Cortex XDR: Cross-domain XDR for endpoint investigation and response with 24/7 managed detection services. https://mspsoftware.net/software/cortex-xdr. Compare: https://mspsoftware.net/compare/cortex-xdr-vs-sentinelone
- Cynet Unified: Unified endpoint and network security with 24/7 managed response, priced per endpoint per month. https://mspsoftware.net/software/cynet. Compare: https://mspsoftware.net/compare/cynet-vs-sentinelone

## FAQ

### How much does SentinelOne cost?

SentinelOne starts at US$179.99 per endpoint per year, according to the vendor, checked September 2026.

### Does SentinelOne offer a free trial?

There is no free version.

### What does SentinelOne integrate with?

SentinelOne lists integrations with Elastic Security.

### What integrates with SentinelOne?

Apptega, Arctic Wolf, Automox, Barracuda Managed XDR, ConnectWise Managed EDR and CyberStrong list an integration with SentinelOne.

### Is SentinelOne cloud or on-premises?

SentinelOne can be run in the cloud or on-premises. SentinelOne supports a hybrid deployment.

### Who is SentinelOne for?

MSPs report using SentinelOne at sizes of 6-15, 16-50, 51-200 and 200+ technicians.

### Does SentinelOne include a staffed SOC, or just the endpoint agent?

SentinelOne is the endpoint detection and response agent and its autonomous response tooling, not a staffed security operations centre. MSPs who want 24-hour human analyst monitoring typically add a third-party MDR provider that builds its service on SentinelOne's API, which is a separate purchase. SentinelOne's platform is designed to work alongside these partners rather than replace them.

### What does SentinelOne's rollback feature actually do?

SentinelOne's rollback restores an endpoint to its state before an attack, reversing file encryption or other malicious changes, without requiring a full reimage of the machine. It is one of the features that differentiates SentinelOne's autonomous response from EDR products that only detect and alert. MSPs should confirm which SentinelOne tier includes rollback, since it is tied to how much extended response functionality is licensed in the tier selected.

### How is SentinelOne priced across different response tiers?

SentinelOne is priced per endpoint per year with published pricing starting at $179.99 per year for the Complete tier and $229.99 per year for the Commercial tier, with Enterprise pricing available by quote. Higher tiers unlock more extended detection and response functionality rather than covering additional endpoints. An MSP should be clear on which specific capabilities, such as the threat hunting console or advanced MDR integration, are included at the tier being quoted before comparing against a competitor's price.

### Does SentinelOne send alerts into a PSA ticket queue?

SentinelOne connects to RMM and PSA tools through partner-built connectors, so detections can open tickets in a service desk's normal queue rather than only appearing in a separate SentinelOne console. Which specific PSA connectors are available and how directly they are supported can vary by integration partner, so confirm current connector coverage for the exact PSA in use before relying on automated ticket creation.

### What platforms and operating systems does SentinelOne protect?

SentinelOne protects Windows, macOS, and Linux endpoints with its cross-platform agent. The platform deploys in cloud, on-premises, and hybrid environments, giving MSPs flexibility in how they run it across different network architectures. Confirm specific version support for your endpoint operating systems during evaluation or before full deployment.