Buying detection means buying three separate things at once: software that judges behavior on the machine, a layer reading the whole estate alongside it, and a person whose job is deciding what happens next. Every line here carries all three, which is what separates a running service from a shrink wrapped box.
Holding a file up against a list of things already known to be bad stopped being adequate years ago. The SentinelOne agent judges what a running process is doing: which programs it started, which documents it touched, which addresses it dialled, and whether the overall pattern looks like encryption, harvesting, or a slow crawl across a network. Those judgements carry on with the cable pulled out, which counts for something at thirty thousand feet and inside the cupboard where a forgotten box hums away.
Fluency then sets that account of events next to everything else: who signed in from where, what the mail platform saw, what crossed the wire, and whatever your other tools have been writing down. Surrounded by all of that, an alert can be settled inside a minute. Standing on its own it becomes a research project, and research projects get postponed until Monday.
The first tier spots it, triages it and tells you what to do. The second widens the net, so a strange login on one continent and a peculiar process running on another stop looking like two separate curiosities. The third grows hands: isolation and rollback fire by themselves, before anybody has finished reading the write up.
Nodes are billed on lines of their own, and there is a reason for it. Nodes are not laptops, the agent has a different job on them, and rolling nodes into an endpoint tally would quietly produce a dishonest invoice. Count the nodes and ignore the pods.
Every rate below arrives live from billing. Anything you pick up drops into the inventory panel and sits there quietly.
Behavior watching on the endpoint, backed by a desk with people sitting at it. Those people work the alerts, so what lands with you is a recommendation rather than a graph to decode.
| Engine | SentinelOne, correlated through Fluency |
|---|---|
| Boxes | Windows, macOS and Linux |
| What we do | Alerting, guidance and hands on help with cleanup |
| No network | Judgement continues while the link is down |
| Desk crew | Fortify 24x7 engineers, whatever hour it is |
| Counted by | Protected endpoint, each month |
Everything the first tier does, with identity, mail and network signal read next to the endpoint rather than sitting in three other browser tabs waiting for somebody to notice.
| Engine | SentinelOne, with Fluency reading wider |
|---|---|
| Feeds in | Endpoints, logins, mailboxes, network |
| What we do | Alerting, guidance and hands on help with cleanup |
| Kept for | Extended, for looking back at older activity |
| Best for | Teams whose whole working day runs through Microsoft or Google |
| Counted by | Protected endpoint, each month |
The wide tier, given hands. Any machine crossing the threshold is pulled off the network and rewound before an engineer has finished reading the write up.
| Engine | SentinelOne, response left on automatic |
|---|---|
| Cut off | The machine drops off the network |
| Undo | Reverses file changes the agent convicts, where supported |
| Checked by | Reviewed by an engineer once the action has run |
| Best for | Finance workstations, build hosts and signing machines |
| Counted by | Protected endpoint, each month |
Container workloads get the same treatment. Nodes are the unit here, which keeps the invoice speaking the same language as your cluster.
| Engine | SentinelOne for Kubernetes |
|---|---|
| Eyes on | How workloads behave once running on a node |
| What we do | Alerting, guidance and hands on help with cleanup |
| Desk crew | Fortify 24x7 engineers, whatever hour it is |
| Counted by | Kubernetes node, each month |
Node coverage with the correlation layer turned on, so what happens in the cluster is read alongside sign in and endpoint activity instead of off on a screen of its own.
| Engine | SentinelOne on nodes, correlated by Fluency |
|---|---|
| Feeds in | Node runtime, logins, endpoints, network |
| What we do | Alerting, guidance and hands on help with cleanup |
| Kept for | Extended, for looking back at older activity |
| Counted by | Kubernetes node, each month |
The node line with automatic response bolted on, for clusters carrying something that cannot be left misbehaving until Monday opens.
| Engine | SentinelOne on nodes, response left on automatic |
|---|---|
| Cut off | The offending workload gets stopped |
| Checked by | Reviewed by an engineer once the action has run |
| Best for | Production clusters carrying customer workloads |
| Counted by | Kubernetes node, each month |
Detection makes an excellent control and a terrible guarantee. Here is the split, written out so you can work out what else you need to buy or write down.
Heads up: card statements show FORTIFY 24X7 - Cyb3rs3cur1ty is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.