SentinelOne Vigilance MDR, now Wayfinder MDR

What Vigilance MDR is

SentinelOne's Singularity platform detects and can automatically stop a great deal on its own. But some activity needs a human judgement: is this administrator running a legitimate script, or is it an intruder using their account? Vigilance MDR was SentinelOne's answer: its own security analysts watching your Singularity console, investigating what the technology flags and acting when a threat is confirmed.

SentinelOne now markets the service as Wayfinder MDR. It is one of three services in Wayfinder Threat Detection and Response (Wayfinder TDR):

• Managed Detection and Response (MDR): 24/7 expert monitoring, investigation and response across endpoints, cloud and identity
• Threat Hunting: proactive, intelligence-led hunting by SentinelOne analysts, with behavioural and emerging-threat hunts checked against your telemetry
• Incident Readiness and Response: breach readiness assessments, compromise assessments and digital forensics and incident response when it matters

SentinelOne says every Wayfinder service is delivered inside the Singularity platform, so there is no separate console. People still search for "SentinelOne Vigilance", and older contracts and renewal notices may use the Vigilance name, so we use both on this page.

What SentinelOne's analysts do

The service follows a simple loop, run around the clock by SentinelOne's team:

1. Monitor: analysts watch detections from the Singularity agents on your endpoints, cloud workloads and identity sources.
2. Triage: they investigate each alert, using the platform's Storyline telemetry and Purple AI to establish what happened and whether it is malicious.
3. Respond: when a threat is confirmed, they contain it within your response policy, for example by killing malicious processes, isolating an endpoint or rolling back unauthorised changes.
4. Report: you receive the incident context and recommended next steps, such as resetting a credential or patching a system.

Response happens within the policy you set. You decide which actions analysts can take straight away and which need a conversation with your team first, for example isolating a production server. That policy is the most important thing to get right before the service starts, and it is where we help most.

Wayfinder MDR service levels

SentinelOne offers the service at more than one level. Based on SentinelOne's current material, the differences look like this:

Which level and which Singularity package your quote covers is confirmed at quote. If you want hunting without full MDR, SentinelOne also sells Wayfinder Threat Hunting on its own; our threat hunting guide explains where that fits.

How it sits on Singularity

Analysts can only investigate what the platform records, so the service relies on Singularity's EDR telemetry. The endpoint packages we supply are:

SentinelOne lists its MDR service as an add-on to its larger Singularity Commercial and Enterprise packages, which build on Complete's EDR data. We confirm the right combination for your estate, and the packaging, at quote. For more on the platform, see SentinelOne Singularity on our Cloud Security site; licensing detail is on our SentinelOne Vigilance MDR licensing page.

Running Singularity yourself vs Vigilance MDR

You do not have to buy MDR to get value from SentinelOne. The realistic options are:

Singularity responds automatically to a lot on its own, including killing processes and rolling a device back, so the question is less "will it stop malware?" and more "who will notice and act when an attacker uses legitimate tools?". Our guide to EDR for small business works through that decision, and EDR vs XDR vs MDR on our Cloud Security site compares the approaches.

What you still need to do

MDR takes the round-the-clock watching off your hands, but it is a partnership, not a hand-off. Before go-live, agree:

• The response policy: what SentinelOne's analysts may do on their own, and what needs your approval
• Escalation contacts for working hours, evenings and holidays, kept up to date as people change roles
• Coverage: every device needs the agent and a package that supports the service; unprotected machines are blind spots
• Follow-up: who acts on recommendations such as patching, resetting credentials or changing configuration

MDR does not replace good basics. Patching, removing local admin rights with endpoint privilege management and multi-factor authentication all reduce how often analysts need to act.

Who Vigilance MDR suits

The service fits organisations that want SentinelOne's protection with experts behind it:

• organisations without their own 24/7 security operations centre
• IT teams that cannot watch alerts in the evenings, at weekends or over holidays
• businesses whose cyber insurer, customers or board ask about round-the-clock monitoring and response
• existing SentinelOne users who are drowning in alerts or not looking at them

If you are still choosing a platform, compare it with other vendor-run services on our endpoint security vendors page, including WatchGuard MDR and Bitdefender MDR. For managed services in general, see managed detection and response.

How Forever Systems helps

We can help you choose between running Singularity yourself and adding SentinelOne's MDR, write the response policy with you, set up escalation contacts, check every device is covered before the service starts, and help with follow-up work and licence changes afterwards. SentinelOne's analysts run the service; we make sure it is set up to work for you.

Contact us to talk about SentinelOne Vigilance MDR for your organisation.