In short: SentinelOne Singularity Endpoint is AI-driven endpoint protection and EDR delivered by one agent. Singularity Control covers prevention, behavioural detection, automated remediation, rollback, device control, firewall control and remote shell. Singularity Complete adds Deep Visibility EDR, Storyline, 14 days of telemetry and Purple AI investigation. Both are licensed per endpoint, monthly or annually.
What Singularity Endpoint is
Singularity Endpoint is SentinelOne's endpoint protection platform (EPP) and endpoint detection and response (EDR), delivered by a single agent for Windows, macOS and Linux and managed from the cloud-based Singularity console.
Protection works in layers on the device itself:
- Static AI examines files before they run, catching known and previously unseen malware without relying on daily signature updates
- Behavioural AI watches what processes do, catching fileless attacks, malicious scripts (PowerShell, WMI and similar), credential theft tools, exploits in documents and browsers, and lateral movement attempts from other machines
- Automated response kills malicious processes, quarantines files, cleans up registry keys and scheduled tasks left behind, and can disconnect a device from the network while it stays connected to the console
- Rollback returns a device to a trusted state from before the attack, which is often the fastest way back from ransomware on supported systems
Because detection runs on the device, protection does not depend on a constant connection, which matters for laptops on the move.
Control and Complete compared
| Capability | Singularity Control | Singularity Complete |
|---|---|---|
| Static and behavioural AI prevention | Yes | Yes |
| Automated remediation and rollback | Yes | Yes |
| Network isolation of infected devices | Yes | Yes |
| Device control (USB and Bluetooth, Windows and macOS) | Yes | Yes |
| Firewall control with location awareness (Windows, macOS, Linux) | Yes | Yes |
| Remote shell | Yes | Yes |
| Rogue device visibility (devices still needing an agent) | Yes | Yes |
| Deep Visibility EDR and threat hunting | No | Yes |
| Storyline attack context | No | Yes |
| Searchable historical EDR telemetry | No | Yes, 14 days as standard |
| Purple AI natural-language queries, summaries and notebooks | No | Yes |
Control suits organisations that want strong, automatic protection and device control but do not plan to investigate or hunt. Complete is the edition to choose if you, or a managed service such as Vigilance MDR, will investigate incidents, search for indicators across the estate or need forensic history. We quote the managed and investigation add-ons on Complete.
Add-ons for Singularity Endpoint
| Add-on | What it adds | Licensed by |
|---|---|---|
| Deep Visibility data retention | Keeps EDR telemetry searchable for 30, 90, 180 or 365 days instead of the standard period | Endpoint |
| Threat Intelligence | Additional threat intelligence for your console; we explain what it adds for your estate when quoting | Endpoint |
| Cloud Funnel | Replicates EDR data to your own SIEM or log platform, Amazon S3 or Google Cloud Storage | Endpoint |
| Purple AI | Agentic investigation and auto-triage on top of the assistant features in Complete | Endpoint |
| Network Discovery | Finds and controls unmanaged devices | Endpoint |
| Vulnerability Management | Agent-based vulnerability assessment | Endpoint |
| RemoteOps | Remote scripts and forensic collection | Endpoint |
Longer retention is worth considering if your insurer, auditors or incident response provider expect you to be able to look back further than a fortnight.
How Singularity Endpoint is licensed
Singularity Control and Singularity Complete are licensed per endpoint. A workstation, a server and a serverless container pod or task each count as one endpoint. Container and Kubernetes hosts use a separate per-host licence, covered on our Cloud Workload Security page.
We can supply licences month to month, so you can add and remove devices as staff join and leave, or on an annual commitment billed monthly. A minimum endpoint commitment can apply. Pricing depends on edition, quantity and term, so ask us for a quote. See per-user vs per-device licensing for how device-based licences compare.
Deployment and requirements
The agent is deployed with the tools you already use: Microsoft Intune or another device management platform, group policy, a remote monitoring tool, or a manual installer for a handful of machines. Policies are set in the Singularity console, so you can start in detect-only mode, check for conflicts with line-of-business software, then switch to automatic protection.
Before go-live we remove the antivirus product being replaced, agree exclusions for specialist software, and decide how aggressive automatic response should be on servers versus laptops.
How we help
- Audit the estate: we list every workstation and server, note the operating systems, and find the machines your current antivirus has quietly stopped reporting from.
- Pick the edition: Control or Complete, device by device if that makes sense, plus retention long enough for your insurer or incident response retainer.
- Pilot, then enforce: we start a pilot group in detect-only mode, tune exclusions for line-of-business software, then switch to automatic protection estate-wide.
- Keep it current: we handle agent upgrades, licence changes as staff join and leave, and renewals on one Forever Systems invoice.
Compare other options in endpoint protection and anti-ransomware.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does SentinelOne Singularity Control include EDR?
No. Control provides prevention, behavioural detection, automated response, rollback, device control, firewall control and remote shell. Deep Visibility EDR, threat hunting, Storyline investigation and Purple AI queries come with Singularity Complete.
How long does Singularity Complete keep EDR data?
SentinelOne lists 14 days of historical EDR data retention as standard with Singularity Complete. Deep Visibility retention add-ons extend this to 30, 90, 180 or 365 days, licensed per endpoint.
Does SentinelOne protect Linux servers?
Yes. The agent supports Windows, macOS and Linux, and servers are licensed per endpoint in the same way as workstations. Container hosts use a separate per-host licence.
Can SentinelOne recover files after ransomware?
SentinelOne can roll an affected endpoint back to a trusted state from before the attack, reversing changes the malware made. Rollback support depends on the operating system, so we confirm it for your devices. It is not a substitute for backup, which you still need.