SentinelOne Singularity Identity

Name: SentinelOne Singularity Identity
Brand: SentinelOne
Rating: 4.3 (33 reviews)

Leader

The world’s most advanced, autonomous AI-powered cybersecurity platform

Est 2013|Valuation $8.1B|Raised $2B

LinkedIn 411K|Website|Web traffic 559K|FTEs 2,900|HQ Mountain View, CA

MarketsEndpoint Security (EPP/EDR)

Published May 16, 2026

01Common complaints

Consider alternatives or a formal evaluation if any of the following apply:

The organization is heavily invested in Microsoft security licensing and seeks close integration with native Entra/Azure telemetry, in which case Microsoft Defender for Identity may reduce integration complexity and licensing friction.
The primary need is advanced Active Directory recovery and resilience; specialists such as Semperis may provide deeper AD recovery, auditing, and resilience features.
Procurement requires abundant public third-party validation and identity-specific case studies; Singularity Identity has fewer identity-specific public reviews versus endpoint-focused materials.
Support and enablement must be provided directly by the vendor or through a guaranteed premium support channel; community feedback indicates variability when support is routed through distributors or resellers.
Strict budget constraints exist and the required identity capabilities could be acquired more cost-effectively via an identity-only solution or a different licensing model depending on organization needs.

Consider alternatives or a formal evaluation if any of the following apply: 1. The organization is heavily invested in Microsoft security licensing and seeks close integration with native Entra/Azure telemetry, in which case Microsoft Defender for Identity may reduce integration complexity and licensing friction. 2. The primary need is advanced Active Directory recovery and resilience; specialists such as Semperis may provide deeper AD recovery, auditing, and resilience features. 3. Procurement requires abundant public third-party validation and identity-specific case studies; Singularity Identity has fewer identity-specific public reviews versus endpoint-focused materials. 4. Support and enablement must be provided directly by the vendor or through a guaranteed premium support channel; community feedback indicates variability when support is routed through distributors or resellers. 5. Strict budget constraints exist and the required identity capabilities could be acquired more cost-effectively via an identity-only solution or a different licensing model depending on organization needs.

Known/observed limitations from sources

Training content access/credits: Users report difficulty accessing recorded setup/training without paid credits for instructor-led or formal training programs.
Documentation gaps: Community comments mention sparse or outdated documentation in some areas.
False positive events: At least one reported global false positive tied to an external reputation feed and associated operational friction around alerts/notifications and remediation.

- **Training content access/credits:** Users report difficulty accessing recorded setup/training without paid credits for instructor-led or formal training programs. - **Documentation gaps:** Community comments mention sparse or outdated documentation in some areas. - **False positive events:** At least one reported global false positive tied to an external reputation feed and associated operational friction around alerts/notifications and remediation.

Roadmap visibility

Public roadmap details for Singularity Identity were not clearly documented in the sources reviewed. Procurement teams should request roadmap commitments for the following items:

Depth of Entra ID/Azure AD coverage and integration milestones
Coverage for relevant attack techniques and detection transparency
Integration breadth with IAM, PAM, and IdP logs
Improvements in tuning, automation, and operational playbooks

02Why they buy

Unique selling points supported by available evidence

Attivo-derived deception capabilities: product documentation and historical Attivo technology indicate deception, decoy, and lure capabilities intended to misdirect attackers and detect lateral movement.
Platform integration: SentinelOne offers identity capabilities as part of the larger Singularity platform, enabling correlation between endpoint and identity telemetry for investigations.

Where competitors may have clearer advantages

Microsoft Defender for Identity can provide tighter native integration with Windows/AD/Azure telemetry in Microsoft-centric environments.
CrowdStrike is commonly evaluated for its managed service ecosystem and integrated detection and response offerings.
Specialist vendors such as Semperis, CyberArk, and Silverfort may offer deeper capabilities in narrow subdomains of identity security.

03Field reports

Review platform coverage reality

A key limitation in evaluating Singularity Identity is that most public review volume relates to SentinelOne’s endpoint product rather than the identity module. Identity-specific reviews are present but fewer in number.

Gartner Peer Insights — Singularity Identity (mixed)

Gartner Peer Insights lists reviews for the Singularity Identity product. Examples visible in snippets include:

A positive review highlighting AI and behavioral analysis components and additional capabilities
A critical review indicating the ITDR product showed potential but required usability and stability improvements shortly after initial deployments

These review excerpts are vendor-neutral summaries of visible review snippets; full reviews may require platform access.

Gartner Peer Insights lists reviews for the Singularity Identity product. Examples visible in snippets include: - A positive review highlighting AI and behavioral analysis components and additional capabilities - A critical review indicating the ITDR product showed potential but required usability and stability improvements shortly after initial deployments These review excerpts are vendor-neutral summaries of visible review snippets; full reviews may require platform access.

TrustRadius — SentinelOne Singularity (platform/EDR-centric, mixed)

TrustRadius reviews for the SentinelOne Singularity platform commonly cite platform-level pros and cons, including:

Pros reported by reviewers: automatic remediation, one-click rollback, and favorable ransomware detection performance
Cons reported by reviewers: portal learning curve and feature gaps in some areas (for example, data loss prevention and vulnerability scanning depth)

These observations are primarily platform-level and not all are specific to the identity module.

TrustRadius reviews for the SentinelOne Singularity platform commonly cite platform-level pros and cons, including: - Pros reported by reviewers: automatic remediation, one-click rollback, and favorable ransomware detection performance - Cons reported by reviewers: portal learning curve and feature gaps in some areas (for example, data loss prevention and vulnerability scanning depth) These observations are primarily platform-level and not all are specific to the identity module.

Community / Reddit — recurring themes (including negative)

Community discussions (for example, Reddit threads) surface practical issues and endorsements:

Training / enablement barriers: Users report difficulty accessing setup materials and paid training credits for certain offerings
Support complaints: Threads reference dissatisfaction with distributor-based support and escalation processes, and with outdated or incomplete documentation
Operational issues / incidents: Reports include a false positive tied to a reputation feed and related notification/detection workflow friction
Product perception vs competitors: Managed service experiences and feature coverage comparisons are common in MSP and security practitioner discussions

Community discussions (for example, Reddit threads) surface practical issues and endorsements: - **Training / enablement barriers:** Users report difficulty accessing setup materials and paid training credits for certain offerings - **Support complaints:** Threads reference dissatisfaction with distributor-based support and escalation processes, and with outdated or incomplete documentation - **Operational issues / incidents:** Reports include a false positive tied to a reputation feed and related notification/detection workflow friction - **Product perception vs competitors:** Managed service experiences and feature coverage comparisons are common in MSP and security practitioner discussions

Why customers choose it (observed patterns)

Common reasons observed in public reviews and community discussions include:

Consolidation: combining endpoint, identity, and cloud telemetry within a single vendor platform
Endpoint effectiveness: reputation for endpoint remediation and rollback functionality influences identity module adoption
Desire for deception-based identity defenses based on Attivo Networks technology

Why some customers leave / consider alternatives

Common churn drivers observed in community sources and reviews:

Variability in support experience, especially when procurement is routed through distributors
Documentation and training access limitations
Preference for native integration when the customer environment is heavily Microsoft-centric
Perceived feature gaps relative to specialist identity security vendors or broader security platform competitors

Vendor and partner datasheets: metrics need scrutiny

Critical evaluation recommendations:

Treat datasheet metrics as vendor-provided claims unless independently validated
Request evaluation methodology, false-positive rates, and operational overhead estimates
Validate how identity detections map to your AD/Entra architecture, endpoints, and logging infrastructure

Vendor and channel datasheets exist for Singularity Identity, but datasheets typically present vendor-selected metrics. Where metrics such as claims of perfect detection are presented, buyers should request methodology, test datasets, configurations, and scope statements to validate applicability to their environment. Critical evaluation recommendations: - Treat datasheet metrics as vendor-provided claims unless independently validated - Request evaluation methodology, false-positive rates, and operational overhead estimates - Validate how identity detections map to your AD/Entra architecture, endpoints, and logging infrastructure

Publicly accessible independent case studies

Public, independently verified case studies focused solely on the identity module were not prominent in the sources reviewed. SentinelOne publishes multiple endpoint-focused case studies, but identity-specific third-party case studies are less visible. Procurement teams should request customer references that specifically used the identity module in production.

04Best fit

Company sizes

Mid-market to enterprise organizations are the primary fit, particularly when a customer already has SentinelOne endpoint/XDR deployed and seeks to extend to identity telemetry.

Industries

Regulated industries and sectors frequently targeted by ransomware and advanced attacks (finance, healthcare, energy/utilities, manufacturing) where Active Directory remains central.

Roles/personas

Decision makers: CISO, VP Security, Head of SecOps, IAM/Identity lead
Operational users: SOC analysts, incident responders, Active Directory administrators (as remediation and hygiene often require directory administrative actions)

Fit criteria

Appropriate fit when:

The environment includes hybrid Active Directory and Entra ID/Azure AD and requires ITDR capabilities
The organization seeks deception-based defenses to detect and slow lateral movement
The organization already uses SentinelOne for endpoint and values integrated investigations

Deal disqualifiers:

Requirement for extensive, independently validated ITDR proof points and third-party verification
Low tolerance for variability in training or support, especially when procurement goes through distributors
Preference for a pure identity specialist or a vendor with more extensive independent ITDR validation

Appropriate fit when: - The environment includes hybrid Active Directory and Entra ID/Azure AD and requires ITDR capabilities - The organization seeks deception-based defenses to detect and slow lateral movement - The organization already uses SentinelOne for endpoint and values integrated investigations Deal disqualifiers: - Requirement for extensive, independently validated ITDR proof points and third-party verification - Low tolerance for variability in training or support, especially when procurement goes through distributors - Preference for a pure identity specialist or a vendor with more extensive independent ITDR validation

05The pitch

What the product does (objective value proposition)

SentinelOne Singularity Identity is SentinelOne’s identity security / ITDR (Identity Threat Detection & Response) offering. It is positioned to:

Detect identity exposures and misconfigurations (identity security posture management elements)
Detect and disrupt identity attacks (e.g., credential theft/abuse, AD attacks, lateral movement)
Provide deception-based defenses (decoys/lures) derived from Attivo Networks capabilities
Integrate identity telemetry with endpoint telemetry (SentinelOne’s EDR/XDR platform)

The vendor describes the product as providing continuous identity monitoring and visibility across hybrid environments to detect exposures, prevent credential abuse, and reduce identity risk. This is a vendor positioning statement and should be validated in procurement.

SentinelOne Singularity Identity is SentinelOne’s identity security / ITDR (Identity Threat Detection & Response) offering. It is positioned to: - Detect identity exposures and misconfigurations (identity security posture management elements) - Detect and disrupt identity attacks (e.g., credential theft/abuse, AD attacks, lateral movement) - Provide deception-based defenses (decoys/lures) derived from Attivo Networks capabilities - Integrate identity telemetry with endpoint telemetry (SentinelOne’s EDR/XDR platform) The vendor describes the product as providing continuous identity monitoring and visibility across hybrid environments to detect exposures, prevent credential abuse, and reduce identity risk. This is a vendor positioning statement and should be validated in procurement.

Target market and positioning

Target market: Mid-market to large enterprises running hybrid identity (on-premises Active Directory combined with Entra ID/Azure AD) and seeking ITDR capabilities that integrate with endpoint security.
Positioning: The product is offered as part of the Singularity platform, combining endpoint, cloud, and identity telemetry. SentinelOne presents a single agent and console for cross-domain investigations and response.

Positioning claims include vendor statements about a unified endpoint and identity agent and measures to reduce visibility gaps across identity and endpoint layers. These remain vendor claims and should be evaluated against independent evidence.

- **Target market:** Mid-market to large enterprises running hybrid identity (on-premises Active Directory combined with Entra ID/Azure AD) and seeking ITDR capabilities that integrate with endpoint security. - **Positioning:** The product is offered as part of the Singularity platform, combining endpoint, cloud, and identity telemetry. SentinelOne presents a single agent and console for cross-domain investigations and response. Positioning claims include vendor statements about a unified endpoint and identity agent and measures to reduce visibility gaps across identity and endpoint layers. These remain vendor claims and should be evaluated against independent evidence.

Get a comprehensive analysis of SentinelOne Singularity Identity including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →