SentinelOne

SentinelOne was founded in 2013 by Tomer Weingarten and Almog Cohen in Mountain View, California, with the thesis that autonomous, on-device AI could replace the signature-based and human-heavy detection models that defined legacy endpoint security. The core product, the Singularity Platform, unified endpoint, cloud, and identity detection and response into a single AI-native architecture — a positioning that proved prescient as enterprises sought to consolidate point solutions. The company went public on the NYSE (ticker: S) in June 2021.

SentinelOne's 2025 M&A strategy signaled an aggressive platform expansion beyond EDR. In August 2025, the company announced a $250M definitive agreement to acquire Prompt Security, a runtime GenAI and agentic AI protection startup — directly addressing the emerging threat surface of enterprise AI tool usage, prompt injection, and shadow AI. The following month it announced the acquisition of Observo AI, an AI-native telemetry pipeline company, to power its Singularity AI SIEM with real-time data routing and cost reduction. Both deals were expected to close in Q3 FY2026. By the time of OneCon 2025, SentinelOne had also rolled out a comprehensive AI Security portfolio spanning AI discovery, model protection, and agent security — formalizing a dual mission of 'security for AI' and 'AI for security.'

SentinelOne's technical differentiation rests on three pillars. First, its Singularity data lake architecture enables hyperscale storage and real-time query across the entire telemetry surface, which underpins Purple AI — the company's AI security analyst that can conduct autonomous end-to-end threat investigations via natural language. Second, the Purple AI MCP Server (open-source, released Nov 2025) enables any external LLM or AI framework to connect to SentinelOne's live intelligence, making Singularity a composable data substrate for the broader agentic ecosystem. Third, the Prompt Security acquisition added runtime GenAI guardrails — prompt injection prevention, DLP, and shadow AI discovery — that no pure-play EDR vendor can match, positioning SentinelOne as the only public company with coverage from endpoint to AI agent.

SentinelOne occupies the critical middle ground between legacy EDR incumbents (CrowdStrike, Microsoft Defender) and emerging AI security specialists. It has successfully expanded from endpoint to cloud, identity, SIEM, and now GenAI security — matching CrowdStrike's platform breadth while maintaining faster growth rates. The Prompt Security acquisition was a direct competitive shot at Palo Alto Networks' AI Access Security and standalone GenAI DLP players. SentinelOne's open Purple AI MCP Server is a deliberate ecosystem play to become the intelligence fabric for the broader AI security market, not just a vendor. At ~$4.4B market cap (as of early 2026), it trades at a discount to CrowdStrike, which is narrowing as profitability improves and platform diversification accelerates.