SentinelOne CEO Tomer Weingarten On Autonomous SOC AI: ‘We’re Well Ahead’

With the debut of the new Singularity ASOC (autonomous Security Operations Center) platform, no other vendor of SentinelOne’s size is ‘able to give you a complete, closed loop [system for] agentic investigation with one click of a button,’ Weingarten tells CRN.

SentinelOne’s progress in bringing autonomous, AI-powered security operations to thousands of customers is giving the company a major “technology edge” over competitors—and is proving the real-world growth opportunities available to partners, SentinelOne Co-Founder and CEO Tomer Weingarten told CRN.

When it comes to autonomous SOC (Security Operations Center) technology, “I think we’re well ahead,” Weingarten said during an interview Wednesday, following the debut of the vendor’s Singularity ASOC offering.

[Related: SentinelOne’s AI Security Surge Driving ‘Separation’ From The Pack: Partners]

“I haven’t seen any other vendor—definitely not at our scale, definitely not production-grade—that’s able to give you a complete, closed loop [system for] agentic investigation with one click of a button,” he said. “Here, it’s something that you just turn on.”

Weingarten spoke with CRN during SentinelOne’s OneCon 2026 conference in Las Vegas, which saw the company point to major momentum for its AI-driven security operations capabilities along with the unveiling of Singularity ASOC. The platform—powered by SentinelOne’s Purple Security Superintelligence—brings together AI investigations and autonomous response with security data management and AI SIEM, the company said.

A major milestone has been moving agentic investigations into real-world environments “at scale,” Weingarten said—with more than 5,000 customers enabling the capabilities to “run a full forensic investigation and give a verdict to their analyst.”

That has led investigation times to drop from roughly 50 minutes to about five minutes, which is “incredibly significant,” he said.

“I think we have gotten to the point that we have built a system that can do investigations and detection better than what every human team can do,” Weingarten said.

Ultimately, for MSSPs and other partners, the highly autonomous systems are “going to radicalize everything they do,” he said.

Partners can now easily get started with “running all these investigations [and] security operations, in a complete autonomous manner,” Weingarten said. “So that can be a 5X opportunity, just in terms of the other services that [they can] cover. Then in terms of outcome, in terms of providing services on top of it, the sky’s the limit for them.”

What follows is more of CRN’s interview with Weingarten.

How would you describe how much progress SentinelOne has made in the past year, when it comes to achieving autonomous security operations?

The biggest thing for us was deploying this at mass scale, in production. It was a first time for us to roll out a new capability at the complete estate scale. We allowed customers to turn this on with one button through their consoles. And we’ve seen an amazing uptick.

We saw 5,000-plus customers enabling the feature and letting our agentic investigations automatically and autonomously go after each and every alert they have—and run a full forensic investigation and give a verdict to their analyst. That shrunk the median time that people take to investigate these alerts from 50 minutes to about five minutes on average. That is incredibly significant.

So I think we have gotten to the point that we have built a system that can do investigations and detection better than what every human team can do. We actually built it with a couple of our large customers. And we also ensured that the system is accurate.

That was the other big deal for us—to say, OK, we can do it fast, we can do it in scale. These are two big things. But can it also mirror the accuracy rate of, let’s say, a tier-four highly skilled analyst? We ran it for close to a couple of months with a couple of these customers. And we just saw staggering alignment between what the system had recommended as a verdict, versus what their human analyst team has investigated as well. So it gave us a lot of confidence that we can deploy it.

We deployed it gradually. Through the first couple of weeks of deployment, we investigated close to 100,000 alerts. And that accuracy rate maintained. So it gave us a lot of confidence to do a full rollout. And now it’s running in production.

We’re learning a ton. Every time you put [in] one of these systems and they’re starting to work at that scale, it just gets better. You find all these quirks, you find all these edge cases. And you can continue and hone in—and create something that I think will radically change [at least] how our customers are doing security.

But I would say, even at large, we’re having more and more conversations today where you can deploy the system even if you’re not our customer. And I think that’s another big change that’s coming for us. We’re going to be opening the platform to not only necessitate a customer to ingest all data in it—but even if you don’t, you can still connect alerts to the system and have the system interrogate, ad hoc, at the source.

So this entire notion that you have to move all your data, or those long-haul migrations—that goes away. If you can just deploy this and start running investigations at the same level of accuracy, imagine how much you can accelerate the work of the security professional across the board.

Now, take it to the channel ecosystem. Take it to the MSSPs. That’s going to radicalize everything they do. We’re now working on rolling that out to that part of the ecosystem. That means that they can do more for their customers. They can onboard more customers. They can free up their time to do more important work. And they can create even more business for themselves.

[With] a lot of what we’re starting to put into the platform, we’re also providing a way where [partners’] end customers can just opt-in to use it, and it’s fulfilled by the channel. So in essence, it’s also a pipeline generation mechanism for them that is completely new. To me, it really shows what a more agentic-first world can look like, also in the lens of what’s the role of the channel provider, the reseller, the distributor and the service provider.

I think we’re answering all of those with this model in keeping the channel provider and the channel partner in the loop. There is no direct interface between us and the customer financially at all. It all funnels through those same routes.

So again, it’s just a great, free way to get more business and expose more SentinelOne capabilities. And then you can manage it for the customer, you can deploy it for the customer, you can support the customer—but you keep the control, which we think is really important.

You mentioned the accuracy—could you talk a little bit more about what you did to get the accuracy up, and how this is such a milestone?

There’s a couple of key things that we learned through the process of building this. A, if you think that you can take just a general LLM, as good as can be, and fine-tune it for security— which really means that you’re giving it some more security knowledge—and you expect that to achieve the accuracy and the speed that you need, that’s going to prove futile.

It’s just not the right tool for every part of the funnel that you go through, [from] the inception of an event and all the way to the result of the investigation. There are so many different stages in that. And in all of them, an LLM won’t be proficient enough, or fast enough, or accurate enough, no matter how much you fine-tune it. These things are still non-deterministic.

So I think for us, [the key is] breaking down that entire funnel, and basically treating it as one system that can have multiple models for multiple challenges—some of them completely traditional, deterministic machine learning.

I think by the way, LLMs generally accelerate coding, and they accelerate your ability to develop more and more deterministic machine learning. So it’s a great way to leverage LLMs, but not [through] putting them inside of the loop itself because they introduce a lot of uncertainty.

So we’re building these models that are very curated for the part of the funnel that they need to solve. And I think that just shrinks your noise level significantly. So you kind of know what the result is going to be when you’re using classic machine learning, and that gives you already a much more distilled gamut for accuracy.

So when you put an LLM in the mix—when you require broad-based reasoning—you’re not doing it on the entire ocean of events. You’re doing it on something that’s already filtered and labeled, and almost like giving clues to the LLM on what it should look at and what it should do next.

But even for the LLMs that we’re using—and I think we’ve removed them from a lot of the critical junctures here—when there are escalations in the process that require more broad-based reasoning, [we can] take more than a decade of security telemetry that is highly curated. We’ve got so much data that shows what “good” looks like and what “bad” looks like. And when you leverage that and you train an LLM with that, I think that’s where you start to see just better recall.

And even more specifically, when you allow the system to build enough memory across the entire enterprise operation, that’s also where we’ve seen a very significant leap in accuracy and proficiency.

Not all of it is coming from [the idea that] reasoning has become so much better and there’s this magical model here. No—it’s a combination of better curated signal, better memory, yes, some security fine-tuning. But all in all, it’s using the right tool for the right juncture. And all of them together, I think, get us to the point that we’re at today.

And like I said on stage, I think that’s just the first step. And we’re already seeing how we can accelerate this even further. If we can truly reach these decisions in millisecond speed, that transforms cybersecurity. Because obviously, up until now, we’ve all been blocked in running investigations [because they] can take hours. Maybe now it’s minutes, which is great to see. It’s still slower than how fast an attack can move.

If you can change that equation, then that starts to become really, really meaningful for this wild, wild west that we’re seeing, even today, with mass exploitation [of] vulnerabilities.

So, for instance, you had mentioned during your keynote that in addition to LLMs you’re also using decision models, security-tuned models etc. So all these different models working together is what you’re doing?

Absolutely. From the minute an event is born—all the way to when you reach a verdict, and then all the way to taking an action—we deploy different technologies. Some of it is just classic systems, our own harnesses that orchestrate this entire thing. And some of it is just infusing the right models at the right time.

I think the one other very interesting thing that we’ve been doing now for more than a year is called FORGE. The equivalent [of FORGE] would be something like [AlphaFold, which applies AI to protein-structure prediction]. It’s basically an algorithm that can self-evolve new detections. It’s basically seeing a signal, but seeing that there is no relevant detection, and then inferring a new detection that can catch that new form of an attack—without a human researcher needing to come in and say, “OK, this is how you should be able to catch these types of attacks.” The algorithm does it by itself.

Then we have a team that vets it and decides what goes into the platform. As I mentioned, we don’t feel like these intrinsic mechanisms need to be, or should be, completely autonomous. That can create a lot of volatility in the system.

But these types of algorithms just make the overarching system much more proficient, and that’s kind of the story here. It’s really more about the cohesiveness of the system rather than a magical AI doing something.

Do you think having this system that’s able to do what you’re describing here, puts you ahead of many other vendors in the market? What do you think this does for SentinelOne?

I think we’re well ahead. I think that our distribution is maybe not [as] well ahead. But [we have] a technology edge. I haven’t seen any other vendor—definitely not at our scale, definitely not production-grade—that’s able to give you a complete, closed loop [system for] agentic investigation with one click of a button, without [taking steps such as] customizing agents and deploying workflows.

Here, it’s something that you just turn on. And I think that’s also a huge advantage—because we’re serving so many different parts of the market. It’s not only that you can deploy something that’s super advanced, but maybe needs a lot of hand-holding because you’re selling it only to the enterprise. No, we have one platform. And we sell all the way from a 100-seat SMB and all the way to a Fortune 10 with 1 million endpoints. Same technology, same platform, same code base.

So I do think that is a huge advantage, especially when you look at the long tail of the market here—which is, largely for endpoint protection and definitely for security operations, it’s still in the first innings. Even for endpoint protection, we’re still talking about 50 percent of the market still in the hands of incumbents.

So a lot of it is just driving more conversation around runtime. And it’s incumbent upon us to continue and leverage that technological advantage that we have toward more distribution, easier distribution.

And some of the stuff that we’re doing natively on the platform is allowing all of our partners to just, in an easier fashion, sell more or help their customers consume more—without going through lots of hoops and deployments. It’s already there, and [you just] click a button and it’s working. It removes a ton of the complexity you see with some of the other platforms.

One of your announcements today was about partners and enabling them around getting more of the AI security up to speed on that and selling it more broadly. Would you say you’re continuing to think about partners as you’re putting out these new innovations?

Yes, 100 percent. You and I have talked throughout so many years now, and I think I’ve always made the same point. We’re a technology company. Do we have services? Yes, absolutely. But at the same time, I sincerely believe that our place is to provide the technology for our global scale of partners to deliver it.

That has always been our focus. That’s what we’re going to continue to focus on. And that’s why we’ve been very successful with the channel ecosystem.

I think we’re now onboarding more deeply some partners in—so really helping them standardize completely on our platform. And that allows them to consolidate all their operations into one provider and create a ton of efficiencies for them.

If you’re able—as a partner that manages millions and millions of devices—to enjoy agentic investigations [and] to conduct your own services, that’s a huge game-changer for them. I think that’s some of the appetite that we’re seeing from those many security providers. And that’s why we’re doubling down on some of our biggest ones.

LevelBlue, obviously, is one of the biggest MSP providers, if not the biggest MSP provider in the world globally. It’s great to see them standardizing on our platform.

We’re incredibly dominant in the entire MSP market, especially in the U.S. I think part of it’s just the ease of use, the multi-tenancy, the capabilities we’ve had for years to allow them to do everything they need to do in the easiest way possible.

Making things more autonomous for them—where they can trust the outcomes because they’re accurate—would be a huge priority for most MSSPs, I would imagine?

Totally. The other reality is that in some parts of the market, you don’t necessarily always get also the same level of expertise. Deploying autonomous investigations actually raises the bar, I think, in some areas of the market—where otherwise you might not have enough staff. You might be bombarded with too many AI-assisted attacks.

Now you can deliver, honestly, military-grade technology for every partner out there and for every part of the market.

In this environment and market, where do you see SentinelOne sitting? Do you feel you’re more nimble than many of the other bigger players, but you’re still able to play in the enterprise?

Yes—it’s both a blessing and a curse, I would say. We’re still one of the fastest-growing companies on the public market. Our competitors are large companies, and I think they have bigger distribution.

But we’ve been growing our distribution steadily, and I think our technology is what gets us to win every single time. The talent we have is remarkable. It’s not me who’s building these products. It’s a group of incredibly talented people that come up with these solutions and just create products that work. I think that is a compounding advantage that we have.

I think we live and breathe AI. That’s where we started and where our platform has originally showed the advantage, to begin with. So now we feel like it’s a very natural extension to what we do.

I think the focus and the understanding that you will be able to secure AI really on the runtime perspective—that maps back to the endpoint and workload opportunity [where] we’ve been working for years now. Just having one platform that’s modern, that we never stopped innovating on, just leaves you out of this sticky mud of a legacy solution or a platform that has come from 70 acquisitions.

There’s very different integration overhead and operational overhead when you have your own codebase, and you have a very talented team that can do a lot, that runs with innovation, that is built in-house for the most part.

Even when we acquire companies, we keep them pretty much intact, and we continue to drive innovation within those companies. Prompt Security is an amazing example. We acquired them. They had amazing technology. We didn’t want to harm that in any way. And now you’re seeing us launch agentic detection and response with that same team, under that same name.

That is giving more strength to these teams and what they can do and what they’re delivering. But now it’s happening in tandem and it’s happening alongside the SentinelOne team. And we learn too. We make these acquisitions, and we feel like we can do a lot together.

Was it a deliberate decision to make the most out of these acquisitions that we’ve already had, rather than just perpetually acquiring more and more companies?

I think that every acquisition is a little bit different to me. I don’t think we ever look at acquisition as this treadmill that we run on, like some of our peers, I would say—where they just acquire en masse.

It really is more unique. And we look at each and every one of these assets—and we think, OK, is this something that is tactical, strategic, long term, short term? We kind of make our choices between the different assets.

There’s so many other companies today out there. There is an abundance of startups that you can potentially look at. If you see something interesting, you probably have 70 different alternatives for the same capability.

For us, coming back to what I said about our DNA in technology, we favor technology. We look at a highly talented team that has built deep technology—which is hard to find, by the way.

And when we find those teams, through the diligence process and through the acquisition process, we get more familiar with them. We get more familiar with how they work, their state of mind. And when you find people that have really great alignment with the way that we operate anyway, then you start building [that] the future could look like this.

Then you just have this vision on how you see their progression within the platform, and how you make them stronger, and how they make you stronger. Those are the best acquisitions.

When you have these two things happen, then you get it right—and you don’t get it right every single time. But I think that with Prompt, it’s obviously one of these times that we got something really, really right. It’s an incredible team. It’s a great product. The demand for it is through the roof.

Now with ADR, it’s such a natural extension both to EDR and to what the Prompt AI security platform was doing that it just screams, “good fit, great demand.” We’re largely seeing customers really excited by it.

For MSSPs especially, but also for any of your partners—what do you think that this transformation around truly autonomous security outcomes that are actually accurate—means for them?

For partners, they must already recognize that there’s a huge opportunity in front of them. I think the opportunity is twofold. Now that you have more autonomous capabilities, and you can delegate a bit of the security work into these agentic systems, the next stage for them is really starting to cover more surfaces for customers.

I think that’s the big opportunity. Doing security work on one surface is great. Doing security work on multiple surfaces, cross-surface—is A, a better outcome for the customer, and B, better business for the partner.

So to me, what this enables them [to do] is to now take security into many other facets of the enterprise and stitch it all together. Endpoint, identity, cloud—switching out of, “Hey, I’m going to sell a SIEM,” to, “I’m going to just do security operations for you.” You don’t need to think “product.” You need to think “outcome.”

And if you think about it, if they do that successfully—via one single platform that can orchestrate all these multiple parts of the enterprise—they themselves become mini-platform providers. Because they are the ones that are driving the platform for customers. So to me, that’s just a huge opportunity that they have.

There’s more to build in the platform to achieve that entire overarching vision. But even today—and definitely in the next couple of quarters—they’re going to have enough capabilities from SentinelOne to be able to go into every environment, whether they’re there already or not, click connect, get all the rest of the [systems] connected into a central platform, and start running all these investigations [and] security operations, in a complete autonomous manner.

So that can be a 5X opportunity, just in terms of the other services that [they can] cover. Then in terms of outcome, in terms of providing services on top of it, the sky’s the limit for them.