In short: SentinelOne Vigilance is SentinelOne's managed detection and response (MDR) service, now marketed as Wayfinder MDR. SentinelOne analysts monitor, triage and respond to threats 24/7 across endpoints and cloud and, on the Elite tier, identity and supported third-party sources, acting within your response policy. It is a per-endpoint add-on.
What Vigilance MDR is
Endpoint detection and response produces alerts, and someone has to look at them, day and night. SentinelOne's managed detection and response (MDR) service puts SentinelOne's own security analysts on your Singularity console 24 hours a day, 365 days a year: they investigate what the technology flags and take action when a threat is confirmed.
SentinelOne used to sell this service as Vigilance, and that is still the name of the per-endpoint licence we order. Today SentinelOne markets it as Wayfinder MDR, part of its Wayfinder threat detection and response portfolio alongside Wayfinder Threat Hunting and Incident Readiness and Response. SentinelOne says its analysts use Google Threat Intelligence and Purple AI to enrich and speed up investigations.
What the service covers
| MDR Essentials | MDR Elite | |
|---|---|---|
| 24/7/365 monitoring and triage | Yes | Yes |
| Managed response and mitigation | Yes | Yes |
| Core detection coverage | Endpoint and cloud | Endpoint, cloud, identity and supported third-party integrations |
| Continuous IOC and behavioural threat hunts | Yes | Yes |
| Periodic emerging-threat and hypothesis-based hunts | Yes | Yes |
When analysts confirm a threat, they contain it according to the response policy you set: killing malicious processes, isolating endpoints and rolling back unauthorised changes. You receive the incident context and recommended next steps, and for serious incidents SentinelOne's digital forensics and incident response specialists are available. We confirm which service level your quote covers.
How Vigilance is licensed
Vigilance is an add-on licensed per endpoint, on top of your SentinelOne edition. Analysts work from the EDR telemetry and investigation data in Singularity Complete, so we quote it for devices on Complete rather than Control.
We can supply it month to month or on an annual commitment billed monthly, and a minimum endpoint commitment can apply. Pricing depends on endpoint numbers, service level and term, so ask us for a quote. You can find general guidance in our software licensing guide.
What you still need to do
MDR takes the round-the-clock watching off your hands, but it works best when responsibilities are clear:
- Agree the response policy: what analysts may do automatically and what needs a call to you first
- Keep contacts up to date so the right person hears about an incident, in and out of hours
- Act on recommendations such as patching, resetting credentials or changing configuration
- Keep the agent everywhere: devices without SentinelOne are not covered
We help with all four and handle the follow-up work on your behalf if you want us to.
Who it suits
- organisations without their own 24/7 security operations centre
- IT teams that cannot watch alerts in the evenings, at weekends and over holidays
- businesses whose cyber insurer asks for 24/7 monitoring or MDR
Compare other MDR options in EDR, XDR and MDR.
How we help
- Write the response policy with you: what SentinelOne's analysts may do on their own, and what needs a call to your team first.
- Set up escalation: named contacts for working hours, evenings and holidays, so incidents reach someone who can act.
- Close coverage gaps: we check every device has the agent and is on Singularity Complete before the service starts.
- Follow through: we act as your day-to-day contact for remediation work, reporting and licence changes on one invoice.
Compare other MDR options in EDR, XDR and MDR.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is SentinelOne Vigilance the same as Wayfinder MDR?
Vigilance was SentinelOne's earlier name for its MDR service and is still the name of the licence we order. SentinelOne now markets the service as Wayfinder MDR, with MDR Essentials and MDR Elite levels.
Does Vigilance MDR need Singularity Complete?
We quote it on Singularity Complete, because analysts rely on the EDR telemetry and investigation data that Complete provides. We confirm prerequisites for your estate when quoting.
Will SentinelOne analysts isolate my devices?
Only within the response policy you agree. Actions can include killing processes, isolating endpoints and rolling back changes. You can require contact before high-impact actions.
How is Vigilance MDR priced?
Vigilance is a per-endpoint add-on, available month to month or on an annual commitment. A minimum commitment can apply. Ask us for a quote.