SentinelOne detects and reverses attacks on the endpoint itself, without waiting for a signature or a cloud lookup. It is the platform behind Arrosoft’s MDR service, and it is one of the few endpoint products that puts money behind its ransomware claim. Both of those are worth understanding before you buy either.

What SentinelOne does

SentinelOne judges software on what it does rather than on whether anyone has seen it before, and it makes that judgment on the machine itself rather than waiting on a cloud lookup. That matters for endpoints that are offline, on poor links, or at sites with no local security staff.

Detection without signatures

Static and behavioral AI models run on the agent itself. A process that starts encrypting files, injecting into other processes or tampering with shadow copies is judged on that behavior, which is why the platform catches techniques it has not seen before rather than only variants of malware it has.

Autonomous response

When the agent decides something is malicious it can act without waiting for an analyst: kill the process, quarantine the file, and isolate the machine from the network while leaving the management connection open. How far that goes before a human is involved is set by policy, and in a managed deployment it is agreed with you.

One-click rollback

The capability that separates SentinelOne from most EDR products. The agent tracks what an attack changed and can return the machine to its state before it, so a ransomware incident on a workstation becomes a rollback rather than a rebuild. It is also what the ransomware warranty is written around.

Identity protection

The same agent extends to credential attacks — credential theft, privilege escalation and lateral movement — across Active Directory and cloud identity providers including Entra ID, Okta, Ping and Duo. Identity is where most serious intrusions actually progress, and it is the surface endpoint tools traditionally miss.

Cloud workloads

Cloud workload protection runs on the same platform and feeds the same data, so a detection on a server and a detection on a laptop are investigated in one place rather than two.

Investigation and retention

Purple AI lets an analyst ask questions across connected data in plain language rather than writing queries, and Singularity AI SIEM retains log data long enough for compliance reporting and for investigations that begin months after the event.

Which of these you get depends on the package. The core detection, response and rollback capabilities are in every tier; identity, cloud and SIEM are separate modules.

The ransomware warranty: what it actually covers

This is the section buyers come to this page for, and the one every reseller page gets wrong by quoting the headline and stopping. The numbers below are from SentinelOne’s published warranty terms.

What it pays. Up to USD 1,000 per affected endpoint, capped at USD 1,000,000 across any twelve-month subscription period. It covers actual damages from the attack and it is the sole remedy.

What it covers. Windows agents only, and only files on those endpoints. Identity and macOS agents are excluded.

What you have to have in place. The warranty is conditional on configuration, and the conditions are specific:

• Protection mode set to protect for both malicious and suspicious threats
• Detection engines enabled, with Application Control for containers the only exception
• Cloud connectivity, Anti-Tamper, Snapshots and Scan New Agents all on
• A current or immediately prior GA Windows agent, on a supported Windows version, standard rather than legacy
• The machine free of malware before the agent was installed, with the operating system and applications patched
• A supported console version, with two-factor authentication enforced for every user
• No recommended exclusions deployed, no pending actions such as reboots outstanding
• Binary Vault enabled where available, and VSS enabled with at least 10% disk allocation on every disk

What you have to do when it happens. Blacklist the ransomware within one hour of discovery. If it was detected but not blocked, remediate and roll back within one hour. Notify SentinelOne within 24 hours. Then produce evidence of compliant configuration, a written demand, and support for the ransom amount.

What is excluded. Breaches caused mainly by running the platform outside its documentation, by negligence or misconduct, or by another product interfering with it. Malware you or a third party introduce deliberately, including testing, is not ransomware under the agreement.

Why the warranty is an argument for a managed service

Read the conditions again and the pattern is obvious. Every one of them is an operational commitment: a configuration that has to stay correct for months, and a one-hour response obligation that has to be met at whatever hour the attack lands.

An unmanaged deployment satisfies these on the day it is installed and drifts afterwards. Arrosoft’s Managed Detection and Response service exists to hold them: the configuration is maintained, the agents are patched, and critical detections are escalated by phone rather than left in an inbox. The obligations in SentinelOne’s terms remain yours. The managed service is how they get met in practice.

Who it suits

• Organizations that want detection and endpoint rollback in one agent, alongside backup rather than instead of it
• Teams with no 24-hour security coverage of their own, who need the platform and the people together
• Regulated operators such as utilities, where controls have to be demonstrable to an auditor and log data kept long enough for an investigation that starts months later

What Arrosoft adds

Deployment and policy design, migration off your current antivirus, agent patching, alert triage, and containment when something real happens. From the first day the agents are live: one endpoint agent instead of two, out-of-hours alerts going to our analysts rather than sitting in your team’s queue until morning, and a ransomware hit on a Windows workstation that ends in a rollback rather than a rebuild. Licensing can go either way: take the SentinelOne licenses from us with the service, or bring licenses you already own and we will work with those.

What we license

Arrosoft licenses two SentinelOne versions, Singularity Complete and Singularity Control, and the following add-on modules:

• Singularity Network Discovery
• Singularity Vulnerability Management
• Singularity Identity Posture Management
• Singularity Identity for IdPs
• Cloud and Kubernetes agent (Complete)
• Purple AI
• Cloud Funnel
• Extended data retention — 30, 90, 180 or 365 days

How we triage and classify what we find, and how we contact you at each severity level, are set out on the Managed Detection and Response page. The response targets that apply to you are set out in your service agreement.

Frequently asked questions

Does the warranty replace cyber insurance? No. It is capped at USD 1,000 per endpoint and USD 1,000,000 a year, it pays actual damages as the sole remedy, and it covers Windows endpoints only. Treat it as a statement of confidence in the product, not as cover.

Does it cover our Macs? No. Windows agents only.

What happens if our configuration drifts? The warranty is conditional on it. That is the argument for having someone maintain it.

Can we run SentinelOne alongside our existing antivirus? Our position is that it replaces it. Two endpoint agents compete for the same hooks and tend to interfere with each other, and the warranty makes that concrete: breaches caused mainly by another product interfering with SentinelOne are excluded from cover. Migrating off your current agent is part of our deployment.

How quickly do we have to react if we are hit? The warranty’s response steps require the ransomware to be blacklisted within one hour of discovery, remediation and rollback within one hour if it was detected but not blocked, and notification to SentinelOne within 24 hours. Those obligations stay with you under SentinelOne’s terms. Under our managed service we carry them out in practice, inside that one-hour window.