SentinelOne’s Chris Corde On Why Traditional EDR Is ‘Flying Blind’ On AI Agents

Corde, SentinelOne’s chief product officer, tells CRN that conventional EDR (endpoint detection and response) tools are in many cases not able to keep up with the way agentic technologies are increasingly being used in the workplace.

As workers increasingly rely upon AI tools for performing key tasks, conventional EDR (endpoint detection and response) tools are in many cases not able to keep up—leaving security teams with a blind spot when it comes to monitoring agent behavior, according to SentinelOne Chief Product Officer Chris Corde.

“Because they sit inside these agent platforms, you can’t actually see them with traditional EDRs,” said Corde, an industry veteran who joined cybersecurity vendor SentinelOne in March, during an interview with CRN.

Crucially, it’s not just sophisticated uses of AI agents that can cause such issues, he said, with even routine activities having the potential to trigger actions that security teams must be able to oversee.

Ultimately, “if you’re not monitoring that from a security perspective, you’re flying blind,” Corde said. “I think that’s the real implication [of agentic]. And it’s only getting bigger. The problem is just getting wider as more people adopt these things.”

Addressing this massive AI visibility and control gap is a core focus of SentinelOne’s new Singularity Agentic Detection and Response (ADR) offering, which was unveiled at the vendor’s OneCon 2026 conference last week.

ADR extends the vendor’s existing Singularity capabilities, with the addition of new agentic behavioral monitoring and protections against undesirable activity by AI agents, SentinelOne said.

The offering brings together technology from the company’s acquisition of Prompt Security with its endpoint protection capabilities—offering the ability to connect an initial prompt with the actions that follow, Corde said. That visibility is essential, he said, when it comes to being able to identify both malicious activity and cases where an agent has gone astray from what a user intended.

“You told an agent to do something, it starts to do things that are not necessarily what you had designed or desired,” Corde said.

Alongside ADR, SentinelOne unveiled Singularity ASOC, which brings together AI investigations and autonomous response with security data management and its AI SIEM offering.

Meanwhile, the company debuted a new AI Security Services partner program aimed at providing support for building AI security practices.

All in all, for SentinelOne’s own security-focused agents, “our job is to take the non-determinism out of the system as much as possible,” Corde said. “We want to get to a reliable, predictable outcome.”

Prior to joining SentinelOne, Corde had served as senior director of product management for security at Google since 2021. Earlier roles included spending six years at VMware, including as its vice president for product management in security.

What follows is more of CRN’s interview with Corde.

How does SentinelOne’s approach to agentic detection and response differ from other AI security tools?

The biggest thing is, you need to truly monitor behavior where the agents are running to get depth of visibility into what’s happening. What you’re seeing in the industry is a lot of people are trying to solve an AI security challenge using network gateways. I’ll have a network appliance, and I’ll stick a network appliance at the edge—and I’ll try to monitor how the agent is potentially interacting with an LLM model that might live externally.

That’s candidly not where we’re seeing the majority of the behavior occurring. Because as people are downloading and using Claude on their devices, that’s a full-fledged virtual machine that’s sitting down at the device that effectively has the LLM model embedded right into it.

They’re blind to a whole bunch of behavior. And they’re especially blind to behavior that’s occurring from the agent to the file system. If there’s something that the agent is doing to the operating system or to the file system, they really don’t have the ability to see it nor block it. I think that’s the biggest difference—that we have the power of combining what we’ve done with Prompt with our traditional EDR agent to really get depth of visibility, see the full trace from the beginning of the request, the prompt that went in to every activity that occurred. Then we can apply detection and response logic because we have the embedded behavioral AI engine in our EDR engine to begin with. I think that’s very unique. I think, first of all, only EDR vendors can really do this, or somebody who has a persistent agent. But even within the EDR community, I don’t think others have really gone to this depth of detection and response over agentic behavior.

This is the case because you have both the EDR side, but also the long-running focus on AI and LLMs?

With Prompt, we’ve had a year of advancement here, managing governance, policy, user access for LLMs. That’s basically what they were going for. What we do today is we combine the two agents on the endpoint to really get a comprehensive view into what’s happening, which I think is unique.

What protection does behavioral monitoring provide, beyond visibility into AI agents?

I think the biggest thing is when you get to the detection and response side. A lot of people are able to do visibility because you can do API inspection, you can look for which tools are installed. Visibility is sort of getting commoditized. I would say it’s still almost the biggest need that people have today.

It’s like the early days of the cloud, when everybody was just [thinking], “I just want visibility into what people are doing in Amazon and Google Cloud.” You hear a lot of customer demand, “Just give me visibility to start”—which is good.

Then I think the second piece is that behavioral monitoring—how do I see the actual sets of behavior, which I think is one step beyond the traditional inventory. It’s depth of event behavior. Like I said, you need access at the compute side. But the real win here is when you get to, how do we monitor this behavior for a drift from intent? You told an agent to do something, it starts to do things that are not necessarily what you had designed or desired. If those two things can be monitored, which I think we’ve done with a detection layer, then you’re providing people with the oversight that’s required—not just saying, "Hey, here’s a bunch of visibility. You figure out what you want to do with it."

I think that’s the outcome that people want ultimately. They just want to know that this behavior is intended and protected from maliciousness.

Why isn’t reviewing an agent’s prompts and instructions enough to secure it?

[It’s because] they’re going to behave differently every time. This goes a little bit more for the long-running agents or things that may run on a periodic basis. If you think about the way people handle files today, many ways people look at files and they say those are static indicators. I can scan a file, I can sandbox a file, I can know exactly what a file was intended to do, and it’s never going to change.

People tend to do things like run a file in a sandbox. It gets a check mark [for having a] good reputation—fine. Let it do whatever it wants. People might monitor how users are using that file. But just in terms of the artifact, you can do a static analysis and say it’s good to go. Unless it changes, you know it’s good.

You cannot do a static analysis of an agent. You can look at it, you can analyze its job, you can analyze what it was coded to do, you can analyze what its policy is. Every time it runs, it’s going to do a different set of things, and that’s really the core of non-determinism. That’s by design. LLMs by design take a different path to the answer every time you give it a request.

It doesn’t matter if you’re using an agent or if you’re just going to Anthropic and asking a question. Every single time, it’s generating the answer on demand, with potentially a different path. That’s why everyone’s always like, "Well, why is it giving me a different answer every time?" Well, that’s what it’s built for.

That’s the key of non-determinism. Now, you don’t want it to be wrong. That’s the ultimate goal, is they’re going to get to the right answer. But it might take a different path to get to that answer every time.

Why does an autonomous SOC need more than LLMs, as [CEO] Tomer [Weingarten] said during his keynote?

I think the point of what he was trying to walk through is—if you generalize it—a lot of people are like, “Well, are there only going to be three companies in the world that do everything? Is it just going to be the model providers?” I think the reality is, there’s a lot that has to be customized and built, especially with specialized knowledge of a certain task to make it work really well.

I think that’s what really he was trying to emphasize, not to speak for him, but that you really have to understand where and what is the right model in some cases to apply. You have to understand how do you put the right harness around it to perform a task really well. You may have to explicitly ensure that it has access to the right data to do its job well. You may have to do prompt engineering to help make sure that the prompt is very specific to what you want it to do, so that you get a better outcome.

All these things go into, I’ll call it autonomous building. The idea that when a customer uses an agent coming from Purple, like our own agents that we publish, they don’t want non-determinism. What they want is an answer that they feel confident in every single time. Our job is to take the non-determinism out of the system as much as possible. We want to get to a reliable, predictable outcome. And the way to do that is to put all this training and research around the right tooling to use—to ensure that the agent acts within its boundary, and the harness helps it get its job done in a way that is as accurate as possible.

That’s never perfect. I think he showed a stat that was like 99.7 percent. You want to get as close to 100 percent, but it’s never going to be perfect. But it’s definitely better than human recall for sure.

What does rising AI agent token usage mean for endpoint security?

[AI] is becoming the surface area in the compute stack to have to monitor and protect. Why EDRs were built in the first place is that people started to realize that there’s a tremendous amount of value in having unfiltered event data at scale, at depth, in everything that occurs on a device. Because there’s so much potential attack surface on the device when a human is interacting with stuff that you need to have an unfiltered view—and you need to be able to put detection logic over those unfiltered events.

What you’re seeing now with these agentic behaviors is that it’s exponentially growing faster than these human events. And those things are happening on those same endpoint devices. Because they sit inside these agent platforms, you can’t actually see them with traditional EDRs. It’s almost like you’re trying as hard as you can to look at only a small percentage of the behavior—and a larger percentage of the behavior is sitting over here, which is completely blind to you.

I think that’s the paradigm shift here. That’s what we’re trying to stress. This is the surface area to watch, because there’s still going to be things that happen here when a human goes and browses the internet—but there’s a whole bunch of stuff that they’re doing now every single day when they type requests into Claude, and people do it mindlessly now 20 times a day. That creates this fan out of behavior [where] if you’re not monitoring that from a security perspective, you’re flying blind.

I think that’s the real implication. And it’s only getting bigger. The problem is just getting wider as more people adopt these things.