Beware, all XDR vendors (and their products) are not created equal. 

• Customer focus: Ask about the solution roadmap – for both R&D and support. The last thing you need is a vendor who will abandon you and leave your security posture in question.

• Legacy to the core: Is the solution’s antivirus (AV) technology still rooted in the context of ‘legacy’ AV and the use of signatures? If so, beware. This approach has been proven highly ineffective and has been behind the industry push to NGAV and related AI methodology. It’s worth noting that according to Forrester’s Total Economic Impact report, customers report a 97% satisfaction rate, and see an average of 353% ROI when they switch from legacy AV providers.

• Poor prevention: Poor prevention (pre-execution) of new and unknown threats (including ransomware). These binaries must execute to have their behavior evaluated. However, due to their use of signatures, most modern threats fall into this realm.

• Simplified deployment: How easy is the product to deploy as a complete solution? Performing a ‘quick’ deployment of some of the solutions in the market, with all required components, is simply not feasible or scalable.

• Performance/footprint: Ask about the focus on performance and footprint/impact on the endpoint. Some product offerings are notoriously bloated and resource intensive.

• Unified EDR from the outset: Is the product a unified platform that can address all phases of the threat lifecycle? (Does it align with Gartner’s definition: ‘A cohesive security operations system that unifies all licensed components’?)

• Forensics/hunting: Keeping in mind that hunting and IR are known weak points in certain products, how do these capabilities stack up across your shortlisted solutions? 

• SentinelOne is the only vendor to deliver 100% visibility with zero missed detections across all tested operating systems. Visibility is the foundation of best-in-class EDR, and big data expertise is vital to unlocking visibility. Singularity delivered a comprehensive view of the entire enterprise, detecting every attack autonomously at machine speed.

• SentinelOne delivered the most high-quality analytic detections to provide automated and instant context. SOC teams are overwhelmed with alerts and data, making it impossible to respond fast enough to the critical alerts that matter. Singularity provides automated, real-time correlation and context so analysts can focus on signals instead of noise.

• SentinelOne experienced zero delayed detections. Adversaries operating at high speed must be countered with machine speed automation that’s not subject to human-powered latency. Singularity delivers contextualised detections as they occur, in real-time and makes it easy for any analyst to interpret results.

• SentinelOne required zero configuration changes, making EDR effortless. Constantly adjusting and tuning a product means the battle is lost before it starts. Technology-powered solutions should work at enterprise-scale right out-of-the box. Singularity deploys in seconds and instantly works at full capacity.

• SentinelOne produced one alert per targeted device. Even the most skilled analysts struggle to manually connect the dots when defending against advanced attacks. Consolidating hundreds of data points across a 48-hour advanced campaign, SentinelOne Storyline correlated the attack into a single alert per targeted machine. Singularity automatically transforms complex and messy data into a clear, precise story.

• 100% Protection: (9 of 9 MITRE ATT&CK tests)

• 100% Detection: (19 of 19 attack steps)

• 100% Real-time (0 Delays)

• 99% Visibility: (108 of 109 attack sub-steps)

• 99% – Highest Analytic Coverage: (108 of 109 detections)