How to Buy SentinelOne for Your Business
SentinelOne is the endpoint protection we deploy on every client computer and server, and it is one of the products small businesses most often ask us how to buy, because the answer is not obvious. SentinelOne sells mainly through partners and managed providers, its website is written for large enterprises, and the tier names do not explain themselves. This article covers what the product is, how the tiers differ, what buying it through a managed provider includes, why we pair it with Huntress, what to decide before ordering and how deployment works.
What SentinelOne is
SentinelOne’s Singularity platform is endpoint protection, detection and response in one agent. Traditional antivirus compared files against a list of known malware; SentinelOne watches what programs do, on the device, without needing a connection to the cloud to decide. When a process starts behaving like ransomware, dumping credentials or misusing built-in Windows tools, the agent stops it, can disconnect the computer from the network, and on Windows can roll the affected files back to their state before the attack. It records the whole sequence, called a Storyline, so an incident can be understood afterwards. It runs on Windows, macOS and Linux, on computers and servers, and it replaces the antivirus rather than sitting alongside it. Our article on firewalls, antivirus and EDR explains where it fits among the other layers.
The tiers
| Tier | What it adds | Who it suits |
|---|---|---|
| Singularity Core | The endpoint protection and response engine: behavioural detection, automated remediation and rollback | The minimum; rarely the right choice for a business that will have a response team behind it |
| Singularity Control | Core plus device control (USB and Bluetooth), host firewall management and rogue-device discovery | Businesses that need to block USB storage or manage the Windows firewall centrally |
| Singularity Complete | Control plus full telemetry retention, deep visibility and threat hunting, which is what a 24/7 response team works from | Almost everyone; it is what we deploy by default |
| Add-ons | Vigilance (SentinelOne’s own managed detection), Singularity Mobile, cloud workload and identity modules | Enterprises; small businesses usually get managed detection from a partner such as Huntress instead |
How buying through a managed provider works
SentinelOne’s direct sales are built for large organisations, with minimum seat counts and a console you run yourself. A managed provider holds a partner licence, adds devices one at a time and runs the console for you. Through us, SentinelOne is priced per computer and per server per month as part of the managed cybersecurity service, and the price includes deployment, policy tuning, exclusions for your line-of-business software, alert handling and the reporting insurers ask for. We do not quote it as a bare licence, because a bare licence with nobody watching it is most of the cost and little of the value. Our SentinelOne page has the details, and if you already have a quote from elsewhere, send it; we would like the chance to beat it.
Why we pair it with Huntress
SentinelOne is excellent at stopping an attack on the device. What it cannot do is decide, at 3 a.m., whether the thing it flagged is an attack or your accounting software behaving oddly, or notice that someone in another country just logged into a mailbox with a stolen password, which involves no device at all. Huntress adds a 24/7 security operations team that reviews what SentinelOne reports, hunts for persistence that slipped past it, and watches Microsoft 365 identities for the sign-in patterns that precede business email compromise. The two together, per computer and server, are the endpoint half of the stack described in our endpoint security guide; the Huntress page covers the managed response side.
What to decide before you order
- Every device, or just some? Every computer and server, including the Macs and the one in the warehouse. Partial coverage leaves the way in.
- Tier. Complete, unless there is a specific reason for Control.
- Servers. Licensed per server; list them, including virtual machines and any hosted ones.
- Managed detection. Huntress, SentinelOne’s Vigilance, or a plan to watch the console yourselves, which is not a plan.
- What comes off. The existing antivirus is removed during deployment; know what it is and whether its subscription can be cancelled.
- Exclusions. Accounting, practice-management and industry software sometimes needs exclusions; have the vendors’ lists ready.
- Insurance. If a cyber-insurance application prompted the purchase, the readiness check shows the other questions on it, several of which SentinelOne alone does not answer.
How deployment works
Deployment is quiet. The agent is pushed through our management tools or Intune to every machine, the old antivirus is removed in the same step, and policies start in a detect mode for a few days so that any exclusions can be added before enforcement is turned on. Rollback is tested on a spare machine. Servers are done outside business hours. A business of 50 devices is fully protected within a week, with no reboots demanded of people mid-morning. From then on the agents update themselves, alerts go to the response team, and a monthly report shows what was blocked. Compared with the alternatives, including the one we are most often asked about, CrowdStrike, the difference for a small business is less the agent than the arrangement around it.
Free tools from OAC Technology
- Managed services pricing calculator: a monthly figure for managed IT, in about a minute
- Cyber insurance readiness check: fourteen questions insurers ask, scored in a minute
- Phishing quiz: ten realistic emails, one at a time, with the tells explained
Common questions
Can a small business buy SentinelOne directly?
SentinelOne sells mostly through partners and managed service providers, and its direct sales are aimed at larger organisations with minimum seat counts. For a business with 5 to 200 devices, buying through a managed provider is the normal route, and it comes with deployment and monitoring rather than a console you have to learn.
Which tier do we need?
Complete for almost everyone. Core is the endpoint protection engine; Control adds firewall and USB device control; Complete adds the full visibility and threat-hunting data that a managed response team works from. The price difference is small compared with what the extra visibility is worth during an incident.
Does SentinelOne replace our antivirus?
Yes. It is antivirus, endpoint detection and response in one agent. Run only one endpoint protection product per machine; the old one is removed during deployment.
Does it work on Macs, servers and phones?
Windows, macOS and Linux computers and servers all run the same agent, and servers are licensed per server. Mobile devices use a separate product, Singularity Mobile, which most small businesses replace with device management and app protection instead.
What does it cost?
It is priced per computer and per server per month under a managed plan, and we quote it with the rest of the security stack rather than as a line on its own. If you have a quote from elsewhere, send it; we would like the chance to beat it.
Do we still need Huntress if we have SentinelOne?
We think so. SentinelOne stops attacks on the device; Huntress adds people watching around the clock, identity monitoring for Microsoft 365 and a second opinion on what SentinelOne flags. For a business without a security team, the combination is what turns alerts into protection.
Talk to us
If you want SentinelOne on your computers and servers, or have a quote from elsewhere you would like us to beat, tell us how many devices you have and we will send a price the same day. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
