Category: How does SentinelOne Endpoint Security work? / Is SentinelOne cloud-based or on-premises?
SentinelOne is primarily SaaS based. We offer our customers a choice between managing the service as a cloud hosted on Amazon AWS or as an on-premise virtual appliance. However, SentinelOne agent prevention, detection, and response logic is performed locally on the agent, meaning our agents and detection capability are not cloud-reliant.
Unlike other vendors, the agent does not have to upload data to the cloud to look for indicators of attack (IoA), nor does it need to send code to a cloud sandbox for dynamic analysis.
Other vendors’ cloud-centric approaches introduce a large time gap between infection, cloud detection and response time, at which point an infection may have spread or attackers may have already achieved their objectives.