In short: SentinelOne Cloud Workload Security (CWS) is runtime protection for servers, virtual machines, containers and Kubernetes across AWS, Azure, Google Cloud, private and hybrid clouds. It uses a lightweight eBPF-based agent on Linux. It comes in Control and Complete versions, licensed per server, VM or serverless task, or per container host.
What Cloud Workload Security is
Singularity Cloud Workload Security is SentinelOne's cloud workload protection platform (CWPP). It protects workloads while they run: servers, virtual machines, containers and Kubernetes clusters, in AWS, Azure, Google Cloud, private clouds and hybrid estates, all from one console.
It looks for the attacks that hit servers in practice: ransomware, cryptomining, fileless attacks, container drift (a running container changing from its image), exploits against exposed services and lateral movement between workloads. Where it detects a threat it can contain it automatically rather than waiting for someone to approve an action.
On Linux, SentinelOne uses a lightweight eBPF-based agent, which avoids loading its own kernel module, reducing the risk of kernel conflicts after operating system updates. Windows servers and Kubernetes are supported natively.
What is included
| Control | Complete | |
|---|---|---|
| Runtime AI threat detection | Yes | Yes |
| Automated containment and response | Yes | Yes |
| Linux, Windows and Kubernetes coverage | Yes | Yes |
| Workload telemetry for investigation and hunting | No | Yes |
| Storyline context linking cloud threats to the wider attack | No | Yes |
| Natural-language investigation with Purple AI | No | Yes |
Choose Complete if anyone, in-house or a managed service, will investigate cloud incidents or needs searchable history. Control suits simpler server estates where automatic protection is the main goal.
Cloud Workload Security is the runtime part of SentinelOne's Singularity Cloud Security range. Posture and attack-path analysis come from a separate product, Cloud Native Security; tell us if you need that and we will advise. For the concepts, see cloud security posture management.
How Cloud Workload Security is licensed
There are two ways workloads are counted:
| Licence | What it covers |
|---|---|
| Per endpoint (workstation, server, pod or task) | Each server or VM, and each serverless container pod or task, counts as one endpoint, on the same licence as Singularity Endpoint |
| Per container host | Each node running containers or Kubernetes workloads |
Both are available in Control and Complete versions, month to month or on an annual commitment billed monthly; a minimum commitment can apply. Cloud estates change size often, so we check your node counts and autoscaling ranges before quoting. Ask us for a quote.
Requirements and deployment
On virtual machines the agent is installed like any server agent, through your configuration management, golden images or a deployment script. On Kubernetes it is deployed to the cluster so that each node and its containers are covered. We check supported kernel and distribution versions for your images before rollout, agree which response actions should be automatic on production servers, and connect alerts into the same console your endpoint team already uses.
Who it suits
- organisations running line-of-business servers in Azure or AWS that want the same protection as their laptops
- development teams running containers or Kubernetes who need runtime detection without slowing releases
- businesses with a mix of on-premises and cloud servers that want one console for everything
If you are not sure where your cloud risks are, a cloud security assessment is a good starting point.
How we help
- Map the workloads: we list your cloud accounts, VMs and clusters, including autoscaling ranges, so the licence count matches what actually runs.
- Check compatibility: we confirm your Linux distributions, kernels and Kubernetes versions against SentinelOne's supported list before anything is deployed.
- Roll out safely: agents go onto non-production first, then production, with automatic response settings agreed for servers that cannot simply be isolated.
- Track growth: as your cloud estate grows or shrinks we adjust the licence count on your Forever Systems account.
We can also add Vigilance MDR so cloud alerts are watched around the clock.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does SentinelOne protect Kubernetes?
Yes. Cloud Workload Security protects Kubernetes clusters and containers at runtime, as well as servers and virtual machines. Container hosts are licensed per host.
Is Cloud Workload Security licensed per server or per container?
Servers, VMs and serverless pods or tasks are each counted as one endpoint. Nodes running containers or Kubernetes use a per container host licence.
Which clouds does SentinelOne Cloud Workload Security support?
SentinelOne lists AWS, Azure, Google Cloud, private cloud and hybrid environments, managed from a single console.
Will the agent affect my Linux kernel?
SentinelOne's Linux workload agent is eBPF-based, which SentinelOne says reduces kernel dependency risk. We still check your distributions and kernel versions before rollout.