SentinelOne

SentinelOne Next-generation cybersecurity solutions. SentinelOne has offices in Palo Alto, Tel Aviv, and Tokyo.

SentinelOne was founded in 2013 by an elite team of cybersecurity and defense experts who developed a fundamentally new, groundbreaking approach to endpoint protection. SentinelOne is a pioneer in delivering autonomous security for the endpoint, data center and cloud environments to help organizations secure their assets with speed and simplicity. SentinelOne unifies prevention, detection, respons

e, remediation and forensics in a single platform powered by artificial intelligence. With SentinelOne, organizations can detect malicious behavior across multiple vectors, rapidly eliminate threats with fully-automated integrated response, and to adapt their defenses against the most advanced cyberattacks. The company is recognized by Gartner as a Visionary for Endpoint Protection and has enterprise customers in North America, Europe, and Japan. To learn more, please visit our website at www.sentinelone.com.

From day one, SentinelOne was architected to stop novel, machine-speed threats. We were purpose built to be a Leader in ...
05/27/2026

From day one, SentinelOne was architected to stop novel, machine-speed threats. We were purpose built to be a Leader in the AI era.

For the sixth consecutive year, Gartner has named SentinelOne a Leader in the Gartner® Magic Quadrant™ for Endpoint Protection Platforms.

Autonomous detection. Machine-speed response. Built for this moment.

📖 Read the report: https://s1.ai/GartnerMQ-2026

🚨 This week, cybercrime hit global networks, endpoints, and core OS defenses simultaneously.🚦 The Good: International po...
05/23/2026

🚨 This week, cybercrime hit global networks, endpoints, and core OS defenses simultaneously.

🚦 The Good: International police made 201 cybercrime arrests across the MENA region, Ukraine unmasked an infostealer operator who compromised 28,000 accounts, and authorities seized a criminal VPN used by ransomware groups.

The Bad: Researchers exposed “SHub Reaper,” a deceptive macOS infostealer spoofing Apple, Google, and Microsoft. It bypasses security mitigations to lift credentials and drop persistent backdoors.

The Ugly: Microsoft warned that threat actors are actively exploiting two Windows Defender zero-days in the wild, turning endpoint protection engines against themselves to escalate privileges.

This was the week in cyber.

🔗 Full technical breakdown: https://s1.ai/GBU9-Wk21

Turn blind trust into verified control with Prompt Security for Agentic AI. AI agents use trusted workflows and permissi...
05/21/2026

Turn blind trust into verified control with Prompt Security for Agentic AI.

AI agents use trusted workflows and permissions to bypass traditional security. They act and execute.

They hold credentials. Call APIs. Modify data. Chain actions across business-critical systems, at machine speed, without per-step human approval. Every agent in your environment is a non-human identity reasoning, deciding, and executing on your behalf.

Most security teams can't tell you how many are running right now.
That's the gap. And it's why we built Prompt for Agentic AI Security, SentinelOne's real-time discovery and governance control plane for the agentic layer.
It surfaces every agent and MCP server across your environment (sanctioned or shadow). It maps what each one can reach, what it can do, and what permissions it holds. It scores risk dynamically. It enforces least privilege before unauthorized action chains can fire. And it gives you a full audit trail of every decision an agent made and every system it touched.
Security shouldn’t be the reason your organization can't adopt agents. It should empower you to adopt them with confidence.

Learn more: https://bit.ly/4nO5NIE

05/20/2026

Industry-leading runtime protection, activated in one click in the AWS console.

SentinelOne's Singularity Platform is now available through AWS Security Hub Extended. AI-powered endpoint protection, deployable in minutes from the AWS console customers already use.

Turn on SentinelOne’s endpoint and detection and response (EDR), and cloud workload security with a single click. Deploy it seamlessly across their environment, and manage it alongside their broader AWS security signals all in one place.

Use the AWS budgets and commitments you already have. One contract. One bill. No new procurement cycle. Security procurement simplified. Coverage complete.

As Melissa K. Smith, our SVP of Global Strategic Partnerships, put it, "We're removing friction so teams can get to protection faster."

Available now in all commercial AWS regions → https://s1.ai/AWS-HbExt

We red-teamed a government AI built to refuse everything outside its lane.At first, it blocked everything. Every semanti...
05/18/2026

We red-teamed a government AI built to refuse everything outside its lane.

At first, it blocked everything. Every semantic attack. Every jailbreak. Then we stopped attacking the meaning and started attacking the structure.

We wrapped a phishing payload in JSON and asked for "test data." The system generated working malicious code. We encoded a forbidden instruction in Base64 and asked it to "decode and execute." It did. We chained the two into a compound attack — and the system handed over a near-verbatim copy of its own system prompt.

The lesson isn't that this bot was weak. It wasn't. The lesson is that every guardrail it had was watching for the wrong thing.

Semantic robustness ≠ architectural security.

You can have an unbreakable intent classifier and still have defenseless architecture. Blocking meaning doesn't block structure. And the attackers already know this. The question is whether your guardrails do.

Read the full case study: https://s1.ai/Red-Teaming

A new macOS stealer called Reaper — a SHub variant tracked by SentinelLABS — runs an infection chain where each stage hi...
05/18/2026

A new macOS stealer called Reaper — a SHub variant tracked by SentinelLABS — runs an infection chain where each stage hides behind a different trusted brand:

- The lure: a fake WeChat or Miro installer
- The delivery: a typo-squatted domain, mlcrosoft[.]co[.]com
- The ex*****on: dressed up as an Apple XProtectRemediator security update
- The persistence: a fake Google Software Update directory, beaconing every 60 seconds
Microsoft, Apple, Google — in that order, in one chain. The victim never sees a single unfamiliar name.

The lesson for defenders isn't "watch for Reaper." It's that brand recognition is not a signal of safety — it signals the attack. Unexpected AppleScript activity, outbound traffic after Script Editor runs, LaunchAgents in trusted-vendor namespaces — that's where to look.

Full research from Phil Stokes: https://s1.ai/shub-reaper

In a CI/CD pipeline, the same workflow can ship a release or a breach. It was built to be trusted, and attackers are cou...
05/17/2026

In a CI/CD pipeline, the same workflow can ship a release or a breach. It was built to be trusted, and attackers are counting on that.

In 2025, intruders sat on a self-hosted TeamCity server for over a year, then shipped a backdoor through a benign-looking build job running with full system privileges. No obvious malware. No suspicious binary. That was the attack.

This is "shift-left" when adversaries run it: not poisoning your code, but inheriting your pipeline. Stolen tokens running Ansible playbooks the build system happily executes. Rogue runners registering as trusted participants. Crypto devs phished through fake interviews, handing over SSH keys mid-"assessment."

Signature-based detection was built for a world where malicious looked malicious. CI/CD isn't that world. If your service account is compiling code, accessing secrets, and pushing artifacts, congratulations. You've described both your release process and your incident.

Read Blog #4 in our Annual Threat Report series → https://s1.ai/Pipeline-Blg

🚨 This week, cybercrime hit digital marketplaces, AI infrastructure, and educational platforms simultaneously with darkn...
05/16/2026

🚨 This week, cybercrime hit digital marketplaces, AI infrastructure, and educational platforms simultaneously with darknet administrators arrested, LLM-driven exploitation tactics evolving, and a massive breach of learning management systems triggering government intervention. Here’s what you need to know.

🚦Authorities successfully dismantled a reboot of "Crimenetwork" marketplace and charged a major money launderer linked to "Dream Market," striking two blows against the financial infrastructure of the dark web. Meanwhile, Google’s Mandiant revealed how attackers are now using Large Language Models (LLMs) to automate and accelerate the discovery of software vulnerabilities, signaling a shift in how initial access is gained.

At the same time, the educational sector was rocked as Instructure confirmed hackers exploited a flaw in their Canvas platform to deface student portals and exfiltrate data. The breach’s severity has escalated to federal levels, with the U.S. government now seeking formal testimony to understand the full scope of the impact on academic institutions.

Finally, while a deal was reportedly struck with the "ShinyHunters" group to prevent the public leak of stolen Canvas data, the incident highlights the extreme vulnerability of critical SaaS platforms. Organizations are now racing to secure their perimeters against AI-enhanced threats and legacy vulnerabilities that continue to put user data at risk.

This was the week in cyber.

🔗 Full technical breakdown: https://s1.ai/GBU9-Wk20

This is what a realistic AI-era attack chain looks like. Drawn from 11,000+ anonymized cloud environments in our 2026 re...
05/13/2026

This is what a realistic AI-era attack chain looks like. Drawn from 11,000+ anonymized cloud environments in our 2026 report.

No zero-day. No prompt injection research paper. No novel technique. What we see instead is a misconfigured bucket, one hardcoded key, and a model connected to a CRM.

Today’s attacks are credentials nobody rotated and a model left isolated.

📄 The 2026 AI & Cloud Verified Exploit Paths & Secrets Scanning Report: https://s1.ai/AISecrets
🔗 The Accompanying Blog: https://s1.ai/AISecr-Bl

05/11/2026

$100,000+ on the line. 10,000+ threat hunters. Capture-the-flag.

The winner won't out-type the attack. They'll out-think it—at machine speed, with AI in the loop.

Sentinels League qualifiers are open. Registration is live: https://s1.ai/S1-League

🚨 This week, cybercrime hit governments, enterprises, and cloud infrastructure simultaneously with ransomware facilitato...
05/09/2026

🚨 This week, cybercrime hit governments, enterprises, and cloud infrastructure simultaneously with ransomware facilitators sentenced, DPRK IT worker scheme supporters exposed, and attackers exploiting critical enterprise software vulnerabilities. Here’s what you need to know.

🚦U.S. authorities sentenced a global ransomware negotiator tied to more than $56M in cyberattacks, while two U.S. nationals were convicted for facilitating fraudulent remote IT worker schemes linked to North Korean operations, highlighting how cyber-enabled financial crime and nation-state tradecraft continue to overlap.

At the same time, SentinelLABS uncovered “PCPJack”, a credential theft framework targeting exposed cloud infrastructure and stealing secrets.

Finally, Palo Alto customers learned that attackers are actively exploiting a firewall zero-day under active exploitation, putting enterprise perimeter defenses directly at risk and forcing urgent remediation efforts across affected environments.

This was the week in cyber.

🔗 Full technical breakdown: https://s1.ai/GBU9-Wk19

Address

444 Castro Street, Suite 500
Mountain View, CA
94041

Website

Alerts

Be the first to know and let us send you an email when SentinelOne posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to SentinelOne:

Shortcuts

Share

Category