In short
Yes, SentinelOne is an antivirus. Singularity Endpoint combines next-generation antivirus and EDR in one agent for Windows, macOS and Linux, using Static AI, Behavioural AI, automated response and rollback, and it keeps protecting devices offline. Forever Systems supplies the Singularity Control and Complete packages per endpoint, monthly or on an annual commitment.
Get a quote for SentinelOne antivirus
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Is SentinelOne an antivirus?
Yes. SentinelOne's Singularity Endpoint is a next-generation antivirus and an EDR product delivered by a single agent, and it is designed to replace your existing antivirus rather than sit beside it. SentinelOne's entry packages focus on prevention and automated response; higher packages add detection and response, investigation and managed services on the same agent.
So the honest answer to "is SentinelOne an antivirus or EDR?" is that it is both, and which capabilities you get depends on the package. Our EPP vs EDR guide explains the two layers in more detail.
How SentinelOne's next-generation antivirus works
SentinelOne makes its protection decisions on the device itself, in layers:
- Static AI: examines files before they run, catching known and previously unseen malware without depending on daily signature updates.
- Behavioural AI: watches what processes do in real time, catching fileless attacks, script misuse, malicious macros, memory exploits and living-off-the-land techniques.
- Automated response: kills malicious processes, quarantines files and reverses unauthorised changes, and can cut a device off from the network.
- Rollback: returns a device to a trusted state from before an attack without reimaging, which can be a quick way back from ransomware on supported systems.
- Offline protection: because detection runs on the agent, laptops stay protected without a constant connection.
Rollback is not a replacement for backup, and support depends on the operating system; we confirm it for your devices. For how these techniques compare with signature-based antivirus, see next-generation antivirus.
SentinelOne packages, from antivirus to EDR
SentinelOne sells its endpoint protection as five packages that build on each other, compared side by side on its pricing page:
| Package | What it adds |
|---|---|
| Singularity Core | SentinelOne's entry NGAV and EPP package: on-agent Static AI and Behavioural AI, automated remediation and one-click rollback |
| Singularity Control | Core plus device control (USB and Bluetooth on Windows and macOS), firewall control, remote shell, rogue device discovery and cloud workload protection |
| Singularity Complete | Control plus EDR and threat hunting, 14 days of searchable telemetry and SentinelOne's AI security assistant (Purple AI) |
| Singularity Commercial | Complete plus identity threat detection and response, 90-day data retention and managed threat hunting |
| Singularity Enterprise | Commercial plus an agentic AI SOC analyst, network discovery, forensic data collection, and guided onboarding and training |
We usually supply Singularity Control or Singularity Complete. If the decision is between those two, our Singularity Control vs Complete page compares them line by line. If you have been offered Core, Commercial or Enterprise, send the quote over and we will match the components.
Not sure which package fits? Ask us
Tell us what you need and we will recommend the right package for your organisation, with a quote.
SentinelOne for small business
SentinelOne is not only for large organisations. What matters for a small business is whether the package fits how you will run it:
- Who looks at the console? Control is largely automatic: it blocks, remediates and rolls back without anyone having to investigate. Complete makes sense if you, an IT provider or a managed service will investigate incidents.
- Mixed devices: one agent and one console cover Windows, macOS and Linux, including servers.
- Laptops on the move: on-device decisions mean protection carries on away from the office.
- Commitment: we can supply SentinelOne month to month or on an annual commitment billed monthly; a minimum endpoint commitment can apply, and we confirm it for your numbers.
Our antivirus for small business guide sets out the full list of criteria, and antivirus for Macs covers mixed estates.
Platforms and servers
The SentinelOne agent runs on Windows, macOS and Linux, and a server counts as one endpoint in the same way as a laptop. From Singularity Control upwards, SentinelOne's pricing page includes cloud workload protection; we confirm how container hosts are counted when we quote. See server antivirus and Linux antivirus for the general considerations, and mobile antivirus for business for phones and tablets, which need a different approach.
Is SentinelOne antivirus the right fit for you?
We will check it against your systems and requirements and recommend the right option.
SentinelOne and Microsoft Defender
SentinelOne is a complete antivirus, so it normally takes over the antivirus role on each device rather than running as a second scanner. We agree how Microsoft Defender Antivirus is configured as part of the rollout, including on Windows Server, where Defender does not change mode on its own. If you are deciding whether the built-in protection would do, see is Windows Defender enough for a business?
To compare SentinelOne with CrowdStrike and Microsoft directly, our sister site sets out CrowdStrike vs SentinelOne vs Defender for Endpoint.
Deploying SentinelOne
Switching to SentinelOne is mostly about planning the changeover well:
- List every device, including servers and machines your current antivirus has stopped reporting from.
- Deploy the agent with the tools you already use, such as Microsoft Intune, group policy, an RMM platform or a manual installer for a few machines.
- Start in detect-only mode on a pilot group, so you can see what SentinelOne would block before it blocks it.
- Agree exclusions for specialist and line-of-business software, and decide how aggressive automatic response should be on servers compared with laptops.
- Remove the old antivirus and switch to automatic protection across the estate once the pilot is clean.
Most rollouts are paced by testing line-of-business software rather than by the agent itself, so we agree the plan and timing with you at quote.
How SentinelOne is licensed and priced
SentinelOne packages are licensed per endpoint: each workstation, laptop or server running the agent. Through Forever Systems you can choose month to month billing or an annual commitment billed monthly. Add-ons such as longer data retention, network discovery and vulnerability management are confirmed at quote.
We do not publish prices, because cost depends on the package, add-ons, quantity and term. Ask us for a quote. Our licensing site explains SentinelOne pricing and licence types, and monthly vs annual licences explains the trade-off between terms.
How we help
We can audit your devices, recommend Control or Complete (device by device if that makes sense), pilot the agent in detect-only mode, tune exclusions for line-of-business software and then switch to automatic protection estate-wide. Licence changes and renewals sit on one Forever Systems account. If you need detection and response beyond the antivirus layer, our EDR, XDR and MDR guidance on endpointsecurity.uk covers the options, and our sister site explains SentinelOne Singularity as a platform.
Contact us for a quote or to ask about a trial.
More on SentinelOne
How Forever Systems helps with endpoint protection
We are an independent UK IT and cyber security provider. We supply business antivirus and endpoint protection from several vendors, so we can recommend what fits your devices, your team and your budget rather than pushing one product.
- Review what you have: we look at your current antivirus, your Microsoft licences and the devices you need to cover before suggesting anything new
- Compare the options: next-generation antivirus, EDR and managed services from vendors including CrowdStrike, SentinelOne, ThreatDown, Bitdefender, Trend Micro, Sophos, Check Point, WatchGuard and Acronis
- Licensing and quotes: the right edition and licence count for your Windows, Mac, Linux, server and mobile devices, with pricing confirmed at quote
- Deployment and migration: we can help roll out agents, set policies and remove the old product cleanly
- Support after go-live: help with policy tuning, alerts and renewals, with the scope agreed at quote
We can also help with the rest of your security, from endpoint security and EDR to Cyber Essentials and security awareness training.
Frequently asked questions
Is SentinelOne an antivirus?
Yes. SentinelOne Singularity Endpoint is a next-generation antivirus that uses Static AI and Behavioural AI on the device, with automated response and rollback. It replaces a traditional antivirus product on Windows, macOS and Linux.
Is SentinelOne NGAV or EDR?
Both, depending on the package. Singularity Core and Control focus on prevention, automated remediation and rollback; Singularity Complete adds EDR, threat hunting and 14 days of searchable telemetry on the same agent.
Is SentinelOne suitable for a small business?
It can be. Singularity Control is largely automatic, so it suits small IT teams that will not investigate incidents themselves. We can supply it monthly, though a minimum endpoint commitment can apply.
Does SentinelOne work without an internet connection?
Yes. SentinelOne's detection runs on the agent itself, so devices stay protected when they are offline or away from the office.
Can SentinelOne undo ransomware?
SentinelOne can roll an affected device back to a trusted state from before the attack. Support depends on the operating system, and it does not replace backup, which you still need.
How is SentinelOne licensed?
Per endpoint, meaning each workstation or server. Through Forever Systems it is available month to month or on an annual commitment billed monthly. Ask us for a quote.
Still have a question about SentinelOne antivirus?
Ask us and a member of our team will reply by email.
More endpoint protection guides
CrowdStrikeIs CrowdStrike an antivirus? Falcon Prevent next-gen antivirus, the bundles we supply and how it is licensed.
ThreatDown (Malwarebytes)Malwarebytes endpoint protection, now ThreatDown: next-gen antivirus for Windows, macOS and Linux, servers and add-ons.EPP vs EDRThe difference between endpoint protection (EPP) and EDR, which products bundle both, and when EPP alone is reasonable.Vendors comparedThe endpoint protection vendors we supply compared on platforms, licence unit, EDR upgrade path and managed options.