2021 was a year in which everything escalated. The pandemic triggered more separation, more isolation, and a general unease in our ability to discern the good from the bad. In cybersecurity, we saw a sharp increase in the number of threat actors riding the wave of the ransomware economy, more governments using cyber space to influence nation state politics, and definitely more software vulnerabilities. The combined effect of these has made breaches easier and security harder.

So where will 2022 lead us? Our predictions last year weren’t far off the mark, so as we look forward to another year in the trenches of cybersecurity, we gather some of SentinelOne’s best researchers and thought leaders once again to read the tea leaves of the central motifs they see coming to bear in 2022.

We Haven’t Reached ‘Peak Ransomware’ Yet

Ransomware operators have, throughout the last year, continued to display their absolute lack of compunction. Numerous high-profile attacks in 2021 demonstrated that these actors will seize any opportunity to profit. In 2022, expect the availability of highly-critical vulnerabilities such as log4j, which have exposed countless environments while greatly enhancing attackers’ toolsets, to be making the headlines more than once.

This past year also saw the wider and accelerated adoption of malware written in Rust and Go programming languages. One of the main benefits of this practice is, naturally, cross-platform compatibility. A few recent examples of this include BlackCat/AlphaVM ransomware, RansomEXX ransomware and ElectroRAT. We are trending towards a majority of these threats being multiplatform out of the gate. As we progress into 2022, expect to see a greater number of new, cross-platform malware families emerge.

Targeting of healthcare entities (hospitals, medical research facilities, private clinics) will continue to be a critical issue. While on the surface many threat operators claim to avoid attacking medical-centric targets, the reality is far less altruistic. We continue to see ransomware infecting these environments, at times costing lives. In 2022, expect to see no let up in aggressive, unscrupulous ransomware operations targeting organizations regardless of the impact on public safety.

We will also continue to see the identity of these operations blur, with various groups continuing to hide in the open while attempting to circumvent any new penalties or sanctions through frequent re-branding of their operations. Jim Walter, Senior Threat Researcher, SentinelLabs

You Can’t Spend Or Arrest Your Way Out Of Cybersecurity

We’ve seen the number of ransomware attacks rise steadily, despite enterprises spending millions. Although the US government assembling the ransomware task force was done out of good intention, it’s demonstrated that arresting the cybercriminals responsible, such as the alleged member of the REvil ransomware gang, is not going to be enough.

Recently, the U.S. State Department offered a reward of up to $10 million “for information leading to the identification or location of any individual(s) who hold(s) a key leadership position in the DarkSide ransomware variant transnational organized crime group.” While not officially linked to the Russian Federation, DarkSide was able to operate inside Russia with the apparent implicit approval of the government. The use of State Department funds underscores the desire to keep the military option in reserve while using diplomatic and other means to identify and bring to justice transnational organized crime actors.

Continued ransomware activity throughout 2022 will prove that we can’t spend or arrest our way out of cyberattacks. Instead, we must change our way of thinking. The problem isn’t the problem, it’s the way we think about the problem. And that’s not what matters. It’s how our adversaries think about the problem that really counts.

We need to think critically about the problems we are trying to solve to beat cybercriminals at their own game. Playing inside the lines isn’t going to cut it – it’s time to think outside of the box and fight machine with machine.  Morgan Wright, Chief Security Advisor, SentinelOne

Software Dependencies Are Your Weakest Link

From the end of last year with SolarWinds to the end of this year with Log4j2, the alarm bells have been ringing loud and clear: software dependencies are a massive blindspot and a major vector for supply chain attacks.

The likelihood of widely-used software components being secure out-of-the-box is low at best. Even with the best of intentions, the mindset of those that create and share useful modules, plug-ins, packages and other utility code is rarely security-focused. On top of that, the ability of an enterprise to be able to test and evaluate every piece of software that enters their network is limited for most, including the federal government.

2022 represents both an opportunity and a threat: we can tackle the problem with technology and visibility across our entire cyber estate, or we can continue as we’ve been going along, waiting for the next well-crafted nation-state attack like Sunburst or the next “universal vulnerability” like Log4j2. Overworked SOC teams and admins may vote with their feet. Migo Kedem, VP of Growth and Founder of SentinelLabs, SentinelOne

APTs Getting Down to Business

Working in the trenches of cybersecurity research, it’s easy to get carried away with flashy and innovative operations. It’s easy to forget that ‘APT’ is a euphemism for a strata of intelligence collection operators well entrenched in the national apparatus of the majority of countries worldwide. After all, some of the more notable APTs have been around for nearly a quarter of a century.

Instead of romanticizing them as rogue outfits of wily hackers, many of these nation-state adversaries are entrenched in bureaucracies, they have objectives to meet, and–contrary to popular researcher belief–their primary goal isn’t to impress us.

This past year, nation-state adversaries learned a tried-and-true formula that being unimpressive and downright mundane (at least in the early stages of their operations) inevitably increases their return-on-investment. In other words, if your infection vector is an email ($0) with some JavaScript loaders for Cobalt Strike or Metasploit ($0), allowing you to validate victims, lookout for security solutions, begin basic collection, and deploy second-stage tools where they won’t be burned, then whatever persistence and collection you accomplish represents a booming ROI.

Moreover, it’s easier to blend into the noise of ‘business-as-usual’ when you’re just another APT doing intellectual property theft with no zero-day exploits, custom tooling, or notable antics. How many threat hunters will get out of bed to make it their business to track those folks when there are flashy high-end actors out there to blog about?

I’m afraid that 2022 will further slide us into the more mundane aspects of cyberespionage – as a pervasive but low-grade, constant but unremarkable onslaught of collection efforts from all sides that we’ve essentially grown used to. Juan Andres Guerrero-Saade, Principal Threat Researcher, SentinelLabs

Private Espionage Businesses Will Continue To Flourish

Private espionage businesses will encounter many setbacks due to their increased attention over the last year, but that will neither deter nor prevent the growth of such a lucrative and in-demand trade. We can expect researchers to uncover new and less-reported businesses selling surveillance-for-hire technology and resources around the globe with little regard for real-world impact.

While some well-known companies such as Russia’s Positive Technologies, Singapore’s Computer Security Initiative Consultancy, Israel’s Candiru, and perhaps most famously, the NSO Group, have experienced crippling government sanctions or negative media coverage during 2021, we can expect these and others to rebrand, split, or generally evolve with the opportunity of profits in mind. This type of business will not go away in 2022. Tom Hegel, Senior Threat Researcher, SentinelLabs

Securing the Intricacies of Enterprise Cloud Dependency

Enterprises will need to adopt cloud native security faster and respond to these threats from the front lines as customer data privacy on cloud-native servers will be put to the test. The on-going cloud-credential stealing feast will continue, and we will see cloud-native ransomware implemented by abusing weak permissions and stolen Azure and AWS API credentials.

On-Premise Active Directory will continue to fade away, while Azure Active Directory is pushed towards major adoption. As companies like Okta and JumpCloud get further buy-in, they’ll start facing increased interest from every stripe of hacker looking to gain access to large swaths of victims at once.

From the defenders perspective, API Security solutions will become a necessity. XDR adoption will grow via MSSPs forcing threat hunters to adopt more automations. These will provide coverage for the new data sources and will enable defenders to face the new battle-terms. Rafel Ivgi, Principal Security Technologist, SentinelLabs

More Targeted Attacks On Enterprise Macs (and Other Apple Devices Near You)

Unsurprisingly, and as we predicted last year, there has been a glut of macOS and iOS vulnerabilities disclosed in 2021 due to the increased scrutiny of Apple’s platforms by both security researchers and threat actors. Stealing the show during 2021 was NSO’s Pegasus zero-click iMessage exploit, in which a zero-day vulnerability (CVE-2021-30860) in Apple’s Core Graphics framework was used to construct an entire emulated computer architecture.

Meanwhile, although Macs have never been at the heart of most companies’ network or server infrastructures, the Mac has become a firm-favorite among developers and C-Suite level executives – an enticing combination for threat actors interested in high-value targets.

At the same time, iOS and macOS security is woefully misunderstood by Apple users, including in the enterprise. While Mac users at least have the ability to install 3rd-party EDR products for detection and protection against malware, few choose to do so, persuaded by a strong “Macs are safe by design” marketing message from Apple. Lulled into believing that the Mac’s legacy AV scanner XProtect and the regularly-bypassed Gatekeeper and Notarization technologies are somehow enough, users leave themselves and their organizations vulnerable to attacks. The fact is, the Mac’s built-in defenses are far from adequate, as even Apple admitted earlier this year.

Recent history has shown that threat actors with the most resources – nation-states – are willing to spend those resources on targeting dissidents, journalists and political opponents. Whether it’s buying NSO spyware like Pegasus or creating Mac-specific backdoors like macOS.Macma, governments (or their proxies) have been the main driver of targeted attacks against Apple’s platforms so far. However, where nation-states go, criminals soon follow.

These three factors – increased attention on Apple device vulnerabilities, wider use of Macs in the enterprise, and the false sense of security that Macs are safe and don’t need 3rd-party protection – will lead to more high-value, targeted attacks against Apple device users in 2022.  Phil Stokes, macOS Threat Researcher, SentinelLabs

Conclusion

While this year saw the U.S. government making some valiant efforts to try and tackle the long-standing challenges of cybersecurity, it is enterprises that are the first and last line of defense, needing to stay focused on growth and commercial expansion while not risking it all by getting breached and losing trust and material funds.

Whatever challenges 2022 brings, we all need to ensure that we are taking care of the basics: strong preventative measures, clear Incident Response and Disaster Recovery planning, and let’s not forget to take care of our people on the front line! From all of us at SentinelOne, we wish you a happy and secure New Year!

If you would like to learn how SentinelOne can protect your organization, contact us or request a free demo.

It’s been a busy year for the SentinelLabs research team, with 45 posts published throughout 2021 on crimeware, APT actors, software vulnerabilities, and macOS malware, not to mention releasing a few community tools for reverse engineering and threat hunting.

Ransomware and APT actors have dominated much of our year, along with some spectacular vulnerabilities that have impacted enterprises worldwide. We’ve seen novel attacks targeting macOS and threat actors setting their sights on Docker containers and cloud workloads.

As ever, you can find all our research and threat intelligence posts over at SentinelLabs, but for a quick recap on some of the main highlights, take a scroll through our 2021 timeline below.

January

In early January, we broke news of macOS.OSAMiner, a long-running cryptominer campaign targeting macOS users. What made this particular campaign so effective at staying undetected for at least five years was its use of run-only AppleScripts. SentinelLabs’ research showed how researchers can reverse these opaque executables and revealed previously hidden IoCs.

February

Zeoticus ransomware was causing trouble prior to 2021 but had received little attention from researchers. Unusually, Zeoticus executes fully even if the device is air-gapped or fails to have internet connectivity. SentinelLabs detailed how this Windows-specific malware had evolved, and described its execution and persistence methods.

In February, SentinelLabs also revealed a privilege escalation vulnerability in Microsoft’s flagship security product, Windows Defender. The bug, CVE-2021-24092, had remained unreported for 12 years and likely affected around a billion devices.

March

More macOS malware came to light in March in the form of SentinelLabs’ discovery of XcodeSpy, a targeted attack on iOS software developers using Apple’s Xcode IDE. A malicious Xcode project was found to be installing a customized backdoor with the ability to record the victim’s microphone, camera and keyboard.

April

While Windows vulnerabilities are a fairly common occurrence, SentinelLabs’ report of a new NTLM relay attack was, surprisingly, classed as a “Won’t Fix” by Microsoft in April. The vulnerability affects every Windows system and could allow attackers to escalate privileges from user to domain admin.

On the crimeware front, this month SentinelLabs also published an update on Avaddon RaaS and detailed APT activity relating to Zebrocy.

May

As we kicked into the summer months, adversary activity also started to ramp up beginning with Agrius, a new threat actor SentinelLabs observed operating against targets in Israel. Agrius actors dropped a novel wiper named ‘Apostle’, which later evolved into a fully functional ransomware.

Also in May, SentinelLabs researchers disclosed CVE-2021-21551, a single CVE to track multiple BIOS driver privilege escalation flaws impacting hundreds of millions of Dell computers.

June

Building off earlier research around APT actor Nobelium (aka APT29, The Dukes), SentinelLabs discovered that the same threat actor (tracked by SentinelLabs as ‘NobleBaron’) was engaged in supply-chain attack activity via a poisoned update installer for electronic keys used by the Ukrainian government.

Also this month, SentinelLabs presented evidence that an attack on Russia’s FSB that had been widely-attributed to Western “Five Eyes” agencies was far more likely to have been of Chinese origin, probably from threat actor TA428.

July

Cyberwar took an unusual turn in July when Iran’s train system was paralyzed by an attack from a mysterious wiper. The attackers taunted the Iranian government as hacked displays instructed passengers to direct their complaints to the phone number of the Iranian Supreme Leader Khamenei’s office. SentinelLabs researchers were able to reconstruct the majority of the attack chain and sketch the outline of a new adversary.

This month also saw the Labs team disclose CVE-2021-3438 – a high severity flaw in HP, Samsung, and Xerox printer drivers – and offer an in-depth analysis of Conti ransomware.

August

ShadowPad is a privately sold modular malware platform and used in infamous campaigns such as CCleaner, NetSaran and the ASUS supply-chain attacks. SentinelLabs researchers produced a ground-breaking report on the origin, use and ecosystem of ShadowPad.

One of the busiest months of the year for our researchers, August also saw us dislose a massive macOS adware campaign undetected by Apple, a ransomware campaign targeting healthcare providers, and HotCobalt – a denial-of-service vulnerability affecting Cobalt Strike.

September

In another in-depth investigation into cyberespionage and APT activity, SentinelLabs broke the story of a Turkish-nexus threat actor that targeted journalists to place malware and incriminating documents on their devices immediately prior to their arrest.

We also reported on new variants of both Apostle ransomware and the Zloader banking trojan, as well as disclosing CVE-2021-3437.

October

Both Karma ransomware and Spook ransomware were new players in 2021’s ransomware ecosystem. Karma has targeted numerous enterprises across different industries this year. SentinelLabs explored the links between Karma and other well known malware families such as NEMTY and JSWorm.

Meanwhile, SentinelLab’s investigation into Spook ransomware found that the operator published details of all victims regardless of whether they paid or not.

November

APTs targeting macOS are a far rarer sight than on Windows, but this November saw news break of a targeted attack against pro-democracy activists in Hong Kong with a novel macOS malware dubbed “Macma”. SentinelLabs dove in and revealed further IoCs not previously reported to aid defenders and threat hunters.

SentinelLabs also disclosed multiple separate vulnerabilities this month: CVE-2021-43267 – a remote Linux kernel heap overflow – and the related VirtualBox vulnerabilities CVE-2021-2145, CVE-2021-2310, and CVE-2021-2442.

December

Unsurprisingly, we rounded out the year with yet another novel ransomware threat. While most actors in this space have adopted the double-extortion method – demand a ransom for encrypted files, then threaten to leak the data if the victim doesn’t pay up – the operators behind Rook were particularly candid about their motivations, stating “We desperately need a lot of money”. SentinelLabs researchers offered the first technical write up of Rook, covering both high-level features and its ties to Babuk ransomware.

We also discovered and disclosed multiple vulnerabilities in AWS and other major cloud services that implement USB over Ethernet.

Conclusion

2021 was some year for everyone involved in fighting cybercrime and defending enterprises. From APTs and bugs to malware and ransomware, we’ve all had plenty to do to keep up with the unfolding cybersecurity threats this year. SentinelLabs continues in its commitment to keep you up to date with the latest research and threat intelligence.

We’ll be back shortly after the New Year. In the meantime, we wish everyone a happy and secure New Year and 2022. Be sure to keep your organization, endpoints, network and cloud infrastructure safe with SentinelOne’s award-winning Singularity platform, and keep your security team up-to-date with SentinelLabs’ original and timely research.

The Good

We have a few nifty victories for law enforcement this week. First off, an individual that heralds from Massachusetts, Flavio Candido da Silva, recently pled guilty to aggravated identity theft and conspiracy to commit wire fraud in a Boston federal court. Da Silva is alleged to be part of a larger team responsible for the theft of identities and the manufacture and distribution of falsified documents. The case relates to charges laid back in May when nineteen individuals were charged with conspiracy to open fraudulent driver accounts at multiple rideshare and delivery companies.

In some cases, identifying information used to feed fake accounts was obtained directly from victims through social engineering. The actors would gain access to victims’ identification documents by posting as an alcohol delivery service or deliberately causing minor vehicle accidents. The fraudulent accounts were used to further spoof income documents for these newly-created fake workers. There is potentially a lengthy jail term tied to this one, which hopefully will serve as a deterrent to those thinking of engaging in cybercrime.

The week would not be complete without mention of Log4j. There have been some important updates around this threat from the wider community, including CISA’s Mitigating Log4Shell and Other Log4j-Related Vulnerabilities, which was updated on December 22nd. Their advisory serves as a launching point for various other Joint Cybersecurity and JCDC advisories. As always, the latest bleeding edge updates will be posted on the SentinelOne blog.

The Bad

On top of the extra workload IT admins have been dealing with thanks to the ongoing log4j2 vulnerability, this week’s bad news is particularly unwelcome as it involves another “patch the thing we already patched” scenario from Microsoft. This week’s new fire hazard comes courtesy of two Active Directory domain controller bugs. The bugs were addressed last month, but it turns out they can still be exploited by attackers and allow the take over of Windows Domain Controllers.

The two flaws, which have a severity rating of 7.5, are tracked as CVE-2021-42278 and CVE-20210-42287. The new advisory comes in the wake of a publicly available exploit being published back on December 12th.

SAM Name impersonation (CVE-2021-42278) allows attackers to tamper with the SAM-Account-Name attribute used to log users into a system in the AD domain. Meanwhile, KDC Bamboozling (CVE-20210-42287) allows a potential attacker to impersonate a domain controller directly. According to Microsoft:

OK folks, you know the drill. Patch the patch, and ensure you have reliable endpoint protection in place.

The Ugly

As if things aren’t bad enough on the ransomware scene, it gets even uglier when actors find new ways to bypass or disable certain security tools. In that context, we shine a light on AvosLocker, which emerged in June 2021 as a new RaaS (Ransomware as a Service) operator.

In an effort to improve the success rate of encryption, AvosLocker decided to do what any good IT admin would do when encountering a problem on a device: boot it in Safe Mode!

According to researchers, in some cases AvosLocker was forcing victim machines to reboot in Safe Mode with networking, and installing the remote management tool AnyDesk. This allows the attackers to control the target machines remotely while security tools that don’t run in Safe Mode are inactive.

The attackers were also seen running a tool called PDQ Deploy to push customized batch scripts out to target devices to assist in disabling a number of endpoint security solutions before rebooting into Safe Mode. Once booted, the victim machines run the ransomware payload and files are encrypted.

Endpoint security tools affected by the technique, the researchers say, include:

• Windows Defender
• Carbon Black
• Bitdefender
• Trend Micro
• Kaspersky
• Symantec
• Cylance

AvosLocker does not succeed on devices protected by SentinelOne.

This serves as a good reminder that all these ransomware actors are constantly at work, even when not being highlighted in the news. For additional information on ransomware and potential solutions, start here.

The primary objective in information security is to reduce the risk exposed through cyber threats towards an organization. To achieve that, security leaders aim to make informed decisions that allow their organization to best protect, detect, respond, and recover from cyber threats. Therefore, when looking into reducing risk, security leaders often choose to reduce significant dependencies in their enterprise architecture and procedures towards a particular vendor or capability.

That strategy makes good sense, but what about when you are considering security software? Some believe that OS vendor-supplied security software must be “safer” or less risky than that of 3rd party vendors. After all, this line of thinking goes, who knows the OS better than those who developed it?

Yet choosing security software sold by your operating system vendor increases your dependency on a single vendor, and in some of the most security-critical areas, too. In this post, we’ll review the pros and cons of relying on your OS vendor for security software, and we’ll take a look at what 3rd party vendors offer that an OS vendor cannot.

Security and Operating Systems | Expertise Matters

It goes without saying that the developer of any software knows that software best – they are after all, the owners of the source code – but we are where we are in cybersecurity in no small part because developers frequently fail to understand the security implications of their own products.

Responsible software companies implement bug bounty programs to invite external security specialists to audit their software, and this is no less true of OS vendors like Microsoft, Google, Apple and Red Hat Linux as it is of developers of browsers, and indeed, security software vendors, too. The more complex a piece of software, the more likely there are to be vulnerabilities, a fact borne out by recent CVE statistics in Microsoft Windows, for example.

• In 2020, Microsoft confirmed 1,220 new vulnerabilities impacting their products, a 60% increase on the previous year.
• 807 of 1,220 vulnerabilities were associated with Windows 10, with 107 of those related to code execution, 105 to overflows, 99 to gaining information, and 74 to gain privileges.
• In 2021, 836 new vulnerabilities have been confirmed so far, 455 of which impact Windows 10 and 107 allow malicious code execution.

Operating system software is, and always will be, riddled with security vulnerabilities. Across Microsoft products, it is the Windows operating system where most security bugs are being found. Additionally, Microsoft has the highest rate of zero days compared to any other operating system vendor. Even more alarming is that most of these vulnerabilities relate to elevation of privilege or remote code execution: high risk vulnerabilities that threat actors can and do use to compromise organizations.

When a vendor is dealing with such an overwhelming amount of CVEs affecting so many different product lines, increasing your dependency on more products from that vendor requires a moment’s thought.

How much time and effort can the OS vendor extend to ensuring vulnerabilities in their security software offering are found and dealt with in a timely manner? A 3rd party vendor with a much smaller portfolio and expertise in security itself may be much-better placed to provide a reliable and effective security solution than an OS vendor with other priorities.

Moreover, with such a huge code base containing potentially vulnerable code, code dependencies in OS vendor products can present attackers with unexpected opportunities. For example, in 2021 SentinelLabs discovered a simple privilege escalation bug in Windows Defender that had been in the code since 2009.

As we have seen, just because an OS vendor knows their own product better than anyone else, it doesn’t follow that they are best placed to understand or even deal with the security implications of that software. And the bigger and more complex the software, the more true that is going to be.

When you add all this together, it raises a troubling thought: is the vendor that is likely the source of the most vulnerabilities in your environment really the vendor you want to select for cybersecurity?

Nonetheless, perhaps there is another good argument for preferring security software from an OS vendor rather than a dedicated security solutions specialist: If one were looking for a turnkey solution, perhaps the OS vendor’s own security offering should be less hassle than installing a security solution from a third party vendor?

There are a number of issues to consider here; installation, licensing, cost, ease-of-use, integration, and, ultimately, the effectiveness of the protection.

E5 Licensing Complexities | What’s Not Included In The Box

Among the major OS vendors, Microsoft is unique in having chosen to develop and sell a product to protect its own operating system software. Arguably, there is a conflict of interest in a software company looking to build revenue by marketing a security product to protect its other products, and potential customers might wonder whether the engineering effort expended there would have been better spent on directly securing those products.

Even if organizations choose to pay the premium and procure Microsoft 365 E5 Security, Enterprise Mobility and Security E5, or Windows E5 licenses, they often discover after the fact that they end up requiring additional 3rd-party products to cover the gaps of Microsoft’s security portfolio:

• When it comes to Extended Detection Response (XDR) solutions, the general consensus in the industry is that a solution must be able to perform 3rd-party data ingestion to perform cross-workload data analytics and response actions. Microsoft 365 Defender lacks the ability for 3rd-party data ingestion, so organizations are left with a technology that can only process its own dataset and therefore only protect the limited scope of Microsoft solutions.
• Microsoft’s Endpoint Platform Protection (EPP) and Endpoint Detection Response (EDR) offering is called Microsoft Defender for Endpoint. The solution continues to lack in several critical areas including detection quality, automatic remediation of cyber threats on non-Windows 10 endpoints, and 1-click recovery from cyber threats.

Many customers evaluating Microsoft alongside SentinelOne consistently say that the “With E5 you have everything you need” claim of Microsoft turned out to be inaccurate. Once they began their evaluations, the gaps became significant, and over time compounded by the fact that Microsoft tends to introduce additional niche products.

For example, Microsoft recently made the decision not to support Kubernetes clusters and containers with Microsoft Defender for Endpoint; instead, they announced Microsoft Defender for Containers, yet another product which is not included in E5 and which again requires additional licenses, procurement, and deployment.

Beyond that, the procurement process can quickly become very complex as all the different products are spread across dozens of different licensing models in Microsoft Azure, Microsoft Windows, and Microsoft 365.

Some of these licensing models are per endpoint, others per user, and still others are pay-as-you-go. This plethora of offerings can make it extremely difficult to predict the actual cost of the platform for a business with multiple, complex needs.

In contrast, a solution like the Singularity platform has a very simple, straightforward licensing model where customers can choose between:

• Singularity Core – On-device, NGAV with autonomous behavioral AI that does not rely on the cloud to detect, prevent and remediate file-based and fileless attacks, including ransomware.
• Singularity Control – Singularity Core with additional endpoint control capabilities like firewall, device control, and more.
• Singularity Complete – Singularity Control with additional Endpoint Detection Response (EDR), Cloud Workload Security, and Network Security capabilities.

All three options are licensed in a subscription model per agent/month, with no hidden costs.

Ease of Use and Integration

It’s a natural and expected consequence of using software from one vendor that, where they have other offerings, they will try to encourage take up of their other products. But one of the most important things for an enterprise when choosing security software is how it can reduce risk, decrease dependencies, and easily integrate with the rest of the security stack.

With Singularity XDR, organizations are able to gain unified visibility across their technology ecosystem, and benefit from unparalleled data analytics with centralized cross-workload response actions.

With this approach, SentinelOne customers have the flexibility they need in order to choose a best-of-breed strategy while being able to centralize into a unified security platform.

In contrast, Microsoft’s methodology pushes organizations into a closed ecosystem, which means increasing the dependency to a single vendor that can quickly become a single point of failure.

The Ultimate Test: Who Protects Best?

Every vendor will tell you they are better than the competition, and it’s vital for security leaders to look at independent 3rd-party evaluation like when comparing security products.

The most recent MITRE Engenuity ATT&CK Evaluation is a good place to start.

Despite the fact that the simulation took place predominantly on Windows, Microsoft’s own security product still had 23 missed detections. During the test, they paused the evaluation 35 times to perform configuration changes, including for their detection logics: a luxury an organization does not have in the real-world during a cyber-attack.

In comparison, SentinelOne had zero misses, zero configuration changes, and 100% visibility.

Taking Advantage of a Best-of-Breed Approach

Security leaders aware of the pitfalls we’ve mentioned above are choosing a best-of-breed approach and bringing in security-first vendors to partner with for their security requirements.

With Singularity, SentinelOne provides a best-in-class Extended Detection Response (XDR) platform that extends protection from the endpoint to beyond with visibility, proven protection, and unparalleled response:

• One security console: Built for centralized & intuitive operations. Whether SOC analysts are chasing bad actors or security administrators need to configure device control policies, all can be achieved in one console.
• Best-in-class EPP + EDR for modern threats: Every endpoint is equipped to prevent and detect with robust static & behavioral AI, even when offline.
• Consistency: SentinelOne provides you consistency in terms of what features are available and ensures feature parity across Windows, macOS, and Linux.
• Time-saving automation: Automatic attack reconstruction with Storyline technology, autonomous & 1-click remediation and patented rollback, dedicated in-house experts for MDR, DFIR, and threat hunting

Conclusion

Cybersecurity is all about managing risk as effectively as possible. There is no organization in the world that is immune to cyber threats. Over the years, security leaders have been required to make a choice between best-of-suite or best-of-breed approaches for their technology stack.

With the increasing complexity of cyber threats, the continuous increase of cyberattacks, and the increased dependency on operating system vendors, organizations are looking to partner with security-first companies that can provide a holistic approach to security.

If you would like to learn more about how SentinelOne can reduce cyber risk across your entire organization – Windows, Linux, macOS, IoT, mobile and cloud workloads – contact us or request a free demo.