The Good | FBI Obtains 7000 LockBit Decryption Keys

Past victims of LockBit ransomware received a boon this week from the FBI who revealed they obtained over 7000 decryption keys which can be used to recover encrypted data. This was announced at the 2024 Boston Conference on Cyber Security, where both known and suspected victims of the notorious threat group were invited to come forward to restore their systems.

This new initiative follows in the February takedown of LockBit’s infrastructure via ‘Operation Cronos’ – a collaborative effort between several international law enforcement agencies. Since 2020, LockBit has cost $91 million in losses within the U.S. alone with targets spanning across several critical sectors and industries. In the February operation, authorities were able to seize multiple darknet domains operated by LockBit leading to the disruption of the primary infrastructure that hosted their Ransomware-as-a-Service model.

In March, Mikhail Vasiliev was sentenced for his significant administrative role within LockBit operations and pled guilty to eight charges including cyber extortion, cyber mischief, and weapons-related allegations. Later in April, police unmasked some 200 affiliates of LockBit when they matched a list of pseudonyms used by the ransomware gang to suspected cybercriminals.

Though the gang has experienced major setbacks this year, they have also been able to resume posting old and new stolen data on leak sites, though without the same level of pre-seizure momentum. The U.S. Department of State continues to offer a reward up to $10 million for information leading to the arrest or conviction of several LockBit leaders and affiliates at large.

The Bad | Russian-Linked RaaS Attacks Pathology Provider, Interrupting Critical Services Across Major NHS Hospitals

A ransomware attack on Synnovis, a pathology and diagnostic services provider, caused major disruptions to NHS hospitals across London, U.K. this week. The developing incident is impacting critical services such as blood transfusions as well as operations and procedures relying on pathology services. These services have since been canceled or redirected, though the NHS has stated that emergency care services remain available.

The National Cyber Security Centre (NCSC), which is investigating the attack, reports that the ransomware attack is likely the work of Russian-based cybercriminals known as Qilin. CEO of the NCSC, Ciaran Martin, says, “They’re simply looking for money” despite the British government’s policy against paying ransom demands. Martin describes the attack on Synnovis as “one of the more serious” seen in the U.K.

Qilin ransomware was first observed in July of 2022 and operates as a Ransomware-as-a-Service (RaaS). The group specializes in double extortion, demanding payment for a decryptor and the release of exfiltrated data. Qilin is known to target large enterprises and high-value targets (many in the Commonwealth of Independent States) and has listed over 130 companies on their dark web leak site over the past two years. Notably, Qilin attackers target their victims through phishing and spear phishing campaigns, and often leverage exposed applications and interfaces like remote desktop protocol (RDP). The RaaS outfit also recruits heavily in well known underground forums and dark markets.

The critical healthcare sector continues to be a lucrative target for cyberattackers. Factors such as weak security infrastructures, lack of cyber expertise, third-parties, and aging software systems all contribute to an increasingly high risk of compromise. Working with cybersecurity providers can help healthcare providers keep their patient data safe, manage their regulatory compliance controls, and ensure continuous care for those in need.

The Ugly | Identity-Based Attacks Target Unprotected Snowflake Cloud Storage Accounts

Recent data breaches at Ticketmaster and Santander Bank this week serve as a marked reminder of how important cyber hygiene is in today’s digital landscape. A threat actor known as ‘ShinyHunters’ has reportedly taken responsibility for these breaches, claiming that they stole the data by compromising an employee account at Snowflake, a cloud storage provider. Snowflake has disputed this, clarifying that the source of the breaches was due to poor credential hygiene on targeted accounts.

The initial report from researchers said that the threat actors bypassed authentication processes through a compromised Snowflake employee’s ServiceNow account before generating session tokens to exfiltrate data. These credentials were allegedly stolen in October 2023 when the employee was infected by an infostealer. Later, this report was taken down.

ShinyHunters claim to be selling a trove of stolen data from the recent breaches including: the personal and financial data of 560 million Ticketmaster customers, banking information of 30 million Santander clients and employees, and 3TB of sales history and transactional data from Advance Auto Parts.

The Snowflake debacle is undoubtedly a headache for security teams of companies using it. I chatted with @LindseyOD123 about the situation and what we can infer from Snowflake’s recommendations. Check it out!https://t.co/xi83P5QnTU

— Alex Delamotte (@spiderspiders_) June 4, 2024

Snowflake representatives have since stated that while the threat actor is targeting user accounts that have multi-factor authentication (MFA) disabled, there is no evidence of exploiting misconfigurations or vulnerabilities in the platform infrastructure. Snowflake has released a list of IoCs here and urges customers to enable MFA, limit traffic networks to only trusted locations, and reset all credentials. CISA recommends customers to stay alert for suspicious activity and to take steps to prevent unauthorized access.

Under the cloud shared responsibility model, end-users are also responsible for following certain standard security best practices such as MFA to reduce risk. Despite the murky details and disputes developing alongside these incidents, what’s clear is how crucial basic security hygiene is for modern enterprises using cloud technology.

Last week, PinnacleOne examined the digital “great game” in the Middle East, as the convergence of AI, nuclear energy, and geopolitical competition.

This week, we highlight how China’s strategy for evading semiconductor technology controls is driving an increased insider threat issue for leading western enterprises.

Please subscribe to read future issues — and forward this newsletter to interested colleagues.

Contact us directly with any comments or questions: pinnacleone-info@sentinelone.com.

Insight Focus | Chips and Spies

Chips may be the new oil, but there is no petroleum intellectual property buried under the ground to steal. As nations see their economic and strategic futures increasingly dependent on securing digital supply chains, the semiconductor industry is now the front line for intense economic espionage activity and commercially motivated insider threat.

China’s Strategy for Evading Semiconductor Technology Controls

A CSIS report from last year described “China’s New Strategy for Waging the Microchip Tech War.” The report identified the ZTE crisis in April 2018 as a pivotal moment in China’s changing strategic thinking on semiconductors. The U.S. export controls imposed on the Chinese telecommunications giant served as a wake-up call, prompting China to elevate semiconductors from an economic priority to a national security imperative. This imperative has become only more intense as U.S. and allied technology controls tightened over the last two years, becoming now a de facto semiconductor blockade on China for leading edge technologies.

As Chinese intelligence agencies and national semiconductor champions explicitly target key industries through insider and cyber espionage to bolster its economic and military capabilities, semiconductor firms find themselves in the targeting bullseye.

In response, China has adopted a four-pronged strategy aimed at:

• Limiting its exposure to foreign pressure
• Deterring U.S. and allied actions
• Increasing international dependence on its semiconductor industry
• Harnessing the power of AI for economic and military advantages

This strategic shift has led to a more aggressive approach to acquiring foreign semiconductor technologies, with insider IP theft emerging as a key tactic. The blurred lines between state-sponsored espionage and commercial IP theft complicate the threat landscape – Huawei doesn’t need to be told by the MSS to steal valuable IP from its competitors, though it will take their support if offered.

As the Chip Four strengthen multilateral export control enforcement on China and slow AI chip exports to the middle east (seen as a backdoor for China), China will amp up the use of illicit and covert means to circumvent restrictions. This is exactly what we’ve seen.

Surge of Insider IP Theft Incidents

Against the backdrop of China’s shifting strategy, the semiconductor industry has witnessed a surge in insider IP theft incidents, many involving employees of Chinese descent allegedly stealing confidential data and trade secrets from their employers.

Just last week, an incident was reported at SK hynix where a former Chinese employee was arrested for allegedly stealing over 3,000 pages of confidential data on atomic layer deposition (ALD) equipment used in DRAM manufacturing processes. Hired in 2013, the employee worked in the department responsible for analyzing defects in semiconductor designs and was most recently involved in consultations with business-to-business clients in China. China has not yet been able to develop ALD equipment needed for precise and uniform deposition of advanced chips. The Chinese national returned to Korea in June 2022, and left to join Huawei the same month.

Other similar incidents over the past few years include:

• In March 2024, a former Google engineer named Linwei Ding, a Chinese national, was charged by the U.S. Department of Justice for allegedly stealing hundreds of Google’s classified AI files while secretly working for two Chinese companies, including an Ant Group affiliate called Beijing Rongshu Lianzhi Technology Company.
• In February 2024, an ex-Apple engineer was sentenced to prison for stealing self-driving car technology before attempting to flee to China.
• In June 2023, Haoyang Yu, a former engineer from Lexington, Massachusetts, was sentenced to six months in prison for possessing a stolen semiconductor trade secret from his former employer, Analog Devices, Inc. He was found guilty of using the stolen design to start his own microchip business.
• In February 2023, a court found seven former employees of Samsung guilty of illegally obtaining and transferring semiconductor-related technology to Chinese companies. The information related to semiconductor cleaning equipment and was classed as “national core technologies” protected by South Korean laws.
• In September 2021, a former employee of Applied Materials was convicted of possessing stolen trade secrets related to proprietary LCD chip technology, while two other employees were acquitted. Three other employees were initially charged with conspiracy to steal trade secrets under the allegation they planned to use them to launch a US/China-based competitor but were not convicted.

Developing a Comprehensive Insider Threat Program

As we described in an earlier ExecBrief, technology companies need to recognize and address the threat of malicious insiders. To effectively combat the rising tide of insider IP theft, semiconductor firms must develop and assess a comprehensive set of insider threat scenarios tailored to their unique threat model, technical controls, organizational design, and internal culture. The following example threat scenarios can guide insider trust program assessment.

In particular, firms can follow the following approach to build a robust insider threat program:

1. Define a tailored set of insider threat scenarios:
   • Consider both nation-state actors and lone-wolf/commercial threat actors, identifying plausible targets and objectives specific to the firm’s critical assets and IP.
   • Map out potential attack paths and exploitation methods used by insiders, such as exfiltration via USB/cloud storage, installing remote access tools, or destroying critical data.
   • Develop a comprehensive set of scenarios that reflect the firm’s unique threat model and risk profile.
2. Assess current security controls against these scenarios:
   • Evaluate the effectiveness of existing technical controls, such as data loss prevention, access monitoring, and endpoint security, in detecting and preventing insider actions described in the scenarios.
   • Identify gaps in visibility, detection capabilities, and response procedures.
3. Evaluate organizational design and internal culture:
   • Analyze how the firm’s structure, processes, and culture may enable or mitigate insider threats, assessing factors such as employee screening, segregation of duties, access management, and security awareness.
   • Identify potential weaknesses or inconsistencies that insiders could exploit.
4. Develop a roadmap for improvements:
   • Prioritize areas for enhancing insider threat defenses based on the gaps identified in the assessment phase.
   • Define clear action items across people, process, and technology domains, such as deploying additional monitoring tools, refining incident response playbooks, improving access controls, and providing targeted security training.
   • Set timelines and assign accountability for implementation.
5. Implement program enhancements and conduct ongoing validation:
   • Execute the improvement roadmap in a phased manner, continuously testing and validating security controls against updated insider threat scenarios.
   • Engage third-party experts as needed to assess program maturity and identify further opportunities for improvement.
6. Foster a culture of insider threat awareness:
   • Regularly communicate the importance of insider threat prevention to all employees, encouraging the reporting of suspicious activities through clear and safe channels.
   • Provide role-specific training on identifying and responding to potential insider incidents, and recognize and reward employees who demonstrate strong security practices.

By following these steps and tailoring them to their specific context, semiconductor firms can develop a robust insider threat program that addresses the full spectrum of risks posed by malicious, negligent, or compromised employees. Regular scenario-based testing and iterative improvement will ensure the program remains effective as the threat landscape evolves.

Going Forward

The semiconductor industry stands at a critical juncture, facing an onslaught of state-directed and commercially motivated IP theft that threatens a geostrategic industry. As geopolitical competition intensifies and the boundaries between economic development and national security blur, semiconductor companies must adapt to this new reality and take decisive action to safeguard their invaluable assets and personnel.

Chained detections is a new threat hunting paradigm aligned with the strategy of chaining interesting events to identify behavior patterns and augment threat attribution. Much like SentinelOne’s Storyline technology, which connects events from various sources to create a narrative of an attack, human threat hunters harness these capabilities to comprehensively grasp the potential impact of a threat actor.

This new methodology, unique to SentinelOne’s WatchTower services, incorporates proactive and sophisticated ways of uncovering and responding to complex threats. This blog is the second installment in our series showcasing today’s threat hunting infrastructures and explores how to further leverage Chained Detections to enhance an organization’s security posture through adaptive threat hunting. Read part one of the series here.

Understanding Chained Detections

One of the biggest challenges in threat hunting is the fact it is operating primarily within the sphere of low and medium fidelity results. High fidelity detections can be easily converted into alerts, but others are subject to a mundane and time-consuming review, something only more senior analysts can do well. This can make threat hunting both a time consuming and cost prohibitive exercise for many organizations.

There have been many attempts to tackle this problem, including risk-based alerting, clustering, baselining, allowlisting and denylisting, data normalization, tokenization, and supporting the results with additional data enrichment strategies, but there is one more highly effective method out there. Chained detections execute a sequence of automated tasks triggered by an initial detection with the aim to triage and enrich telemetry data progressively.

This approach helps to uncover and respond to complex threats without going down too many rabbit holes. Incorporating this new adaptive threat hunting methodology increases the effectiveness of any threat hunting program.

Initial Detection Trigger

The process begins with an initial detection, which could be based on various indicators such as anomalous behavior, known attack patterns, or suspicious activity in telemetry data. Due to the nature of the methodology, vague signals can be also utilized to execute the chain. For example, a file with a specific file name dropped anywhere on a system could act as a trigger.

Automated Triage

Once a detection is made, automated triage processes come into play. These processes aim to quickly assess the detection’s severity and relevance. Some basic steps in automated triage would include:

• Contextual Enrichment – Gathering additional data and context around the event, such as user accounts, device information, or network traffic patterns.
• Correlation – Determining if the event is part of a broader attack or a standalone incident by correlating it with events that may have triggered and are stored in a centralized logging backend.
• Prioritization – Assigning a priority level to the event based on its perceived risk and potential impact to the organization before collecting more information.

Chaining Tasks

Depending on the outcome of the initial triage, additional automated tasks are triggered in a chained manner. These tasks are designed to gather more information, validate the detection, and potentially take predefined actions. Examples of chained tasks include:

• Threat Intelligence Lookup – Querying threat intelligence feeds to check if the indicators associated with the event are known threats.
• Isolation and Remediation – Isolating the affected system or network segment to prevent lateral movement by the attacker and initiating remediation actions, such as applying patches or disabling compromised accounts.

Data Collection

Gathering detailed information about the affected system, such as running YARA rules and collecting memory dumps, process lists, or file system snapshots may be necessary.

Decision Points, Human Intervention & Feedback Loops

At each stage of the chained detection process, decision points are established based on the findings. These decision points guide whether to continue with additional tasks, escalate the incident, or conclude the investigation.

While much of this process is automated, there is still a role for human intervention. Security analysts may be brought into the loop when certain thresholds are met or when the automated processes cannot make conclusive determinations.

Chained detections also incorporate a feedback loop for continuous improvement. Information gathered during investigations, including false positives and false negatives, is used to refine and enhance detection and response processes.

The chained detections approach for threat hunting is highly effective for dealing with advanced and evolving threats. It enables organizations to respond rapidly and systematically to security incidents, minimizing the impact and reducing the time to remediation. It also leverages automation to handle repetitive tasks, allowing security analysts to focus on complex investigations and strategic decision-making.

Case Study | Real-World Threat Hunting with SentinelOne’s WatchTower Team

A malicious hacker reaches out to a client, claiming they’ve infiltrated their CCTV system and is asking for compensation. The SentinelOne WatchTower team receives the call to help uncover the culprits behind the extortion attempt, the precise actions taken, the systems involved, and the exact timing of it all. First, the team deploys instrumentation where there has been a cybersecurity blackout, a significant number of systems with no detection and response tools installed. This is a digital detective game and the main goal is to gain insight into every system level and user-based move.

SentinelOne followed the below steps to effectively threat hunt and mitigate the threat:

1. Scanning for initial indicators, the SentinelOne response team identified an initial detection found in the EDR telemetry that malware payloads may potentially be present on an endpoint.
2. Although there were no malicious processes and the files had been deleted, the team was able to locate some low frequency indicators. To build more context, enter metadata collection leveraging YARA rules.
3. This revealed definite artifacts of files that were once on the system, specifically, payloads which may have included remote access tools (RATs) such as njRAT and StRaXxXD – likely downloaded from Telegram.
4. After backtracking the user activities, various RDP brute forcing tools such as NLA.Ckecker and NLBrute were identified as having been downloaded onto other systems.
5. This activity strongly indicated potential Initial Access Broker activity – not just an average attacker, but a sophisticated criminal organization.

Initial Detection on Target Compromised System

Threat Hunting Details:

endpoint.name: xxxserver1

timestamp: <>

tgt.file.path:

C:Users...Downloadsnj-RAT.zip

C:Users...DownloadsTelegram Desktopnj-RAT.zip

tgt.file.sha1: ed4f80…

src.process.user: xxxserver1userA

The same user downloaded ddos.exe (alerted by SentinelOne upon agent installation on a different system):

timestamp: <>

tgt.file.path: C:Users...DownloadsTelegram Desktopddos.exe

tgt.file.sha1: fddece…

src.process.user: xxxserver1userA

Viewing event logs and correlating activity, the SentinelOne WatchTower team identified an active attempt to brute force login after finding numerous failed login attempts on xxxserver1. Upon checking the visible IP in the console, the team found it to be 10.x.x.x with an open RDP port 3389 accessible from the Internet. Subsequently, the team pinpointed the machine that was subjected to Remote Desktop Protocol (RDP) brute forcing and subsequently compromised to launch the attack.

Remote Desktop Protocol (RDP), developed by Microsoft, provides a convenient way to access IT systems remotely and is widely used across client environments. However, it also poses significant risks if not properly configured. Attackers often target exposed RDP clients, attempting brute force attacks on usernames and passwords. If successful, they can gain a foothold in the victim’s network.

Notable items detected by threat hunters:

…DownloadsStRaXxXD.zip 62a861056f35fd8cb754672080b0eeb8faae806d

…Telegram DesktopNLBrute (RDP brute forcing tool)

…Telegram DesktopIN_ip_ranges.txt, ip.txt (possible enumeration)

…Telegram Desktopسنگین بدبویTXT.txt

…Telegram Desktop@Delta_Package pentest network xxx.part3.rar

…Telegram Desktop2.rar

…Telegram Desktopip.txt

…Telegram Desktopindia test.txt

…Telegram Desktopdork for mahdi.txt

…Telegram Desktop@Delta_Package pentest network xxx.part6.rar

…Telegram DesktopLinux 1,2.rar

…Telegram DesktopWork With Dorks [DORKs Generator] By JohnDoe v.2.1.rar

Targeting Domains with Google Dorks

…Telegram Desktopep1.rar

…Telegram Desktop4.rar

…Telegram DesktopNLBrute (2).rar

…Telegram DesktopCracker (1).exe 756280…

…Telegram DesktopNLA.Ckecker.zip dddbd…

…Telegram DesktopSQLi Dumper V10.3.zip f00d9…

…Telegram DesktopNLA.Ckecker (2).zip dddbd…

…Telegram Desktopready.apk b78812…

Summary of Further Analysis

Swift action by the SentinelOne WatchTower team prompted the client to pull the plug on their server after receiving the details of the compromise. After a thorough investigation, the team advocated for the closure of unused RDP ports and security tools for threat detection and prevention be installed on every system. The team also recommended the implementation of multi-factor authentication (MFA) for every system accessible from the Internet as a best practice.

Conclusion

Threat hunting continues to face significant challenges, particularly in navigating the realm of low and medium fidelity results. This dilemma often translates into a cumbersome and time-consuming review process, reserved for seasoned analysts, making threat hunting both costly and impractical for many organizations. Chained detections represent a proactive and sophisticated methodology that revolutionizes threat hunting by streamlining the investigative process, avoiding unnecessary tangents, and focusing resources where they matter most. By incorporating automated triage, external tasks, and establishing decision points, organizations can swiftly uncover and respond to complex threats with precision and agility.

The chained detections approach supports a symbiotic relationship between automation and human intervention, harnessing the power of technology to handle repetitive tasks while empowering security analysts to tackle intricate investigations and strategic decision-making. The integration of a feedback loop ensures continuous improvement, refining detection and response processes based on real-world insights gathered during threat hunts and cyber investigations.

For organizations seeking to fortify their cybersecurity posture and elevate their threat hunting capabilities, embracing the chained detections methodology is not merely an option but a necessity in today’s threat landscape. By leveraging a combination of both automation, intelligence and human expertise, organizations can effectively combat advanced and evolving threats, minimizing the impact of security incidents, and accelerating the path to remediation.

Learn More About SentinelOne’s WatchTower

For enterprises looking for a threat hunting partner to help them implement a robust methodology and stand up to emergent threats, SentinelOne’s WatchTower provides threat hunting experts equipped with the latest threat intelligence powered by artificial intelligence (AI) and machine learning (ML) algorithms.

Today, customers can use WatchTower to achieve real-time and retroactive detections of anomalous activity across their enterprise to proactively address evolving threats and strengthen their security posture. Learn more about what WatchTower can do for your enterprise by requesting a demo.

As a partner-driven organization, SentinelOne recognizes the critical role that partners play in securing our digital world. Partners are instrumental in helping customers understand how to break through the noise and recommending the best solutions to help solve their toughest security challenges, and businesses are increasingly turning to managed security to elevate protection, address cybersecurity talent shortages and better align cost structures. SentinelOne has a robust and powerful partner ecosystem that is a key differentiator for us, spanning MSSPs, incident response providers, and other strategic partners. We have a massive opportunity to expand our business and execute our mission to secure tomorrow.

Two months ago, we brought in Brian Lanigan, a seasoned leader with proven experience building and managing global sales teams that consistently over-achieve, to help us capitalize on this opportunity. He’s wasted no time putting the pieces in place to create a better experience and stronger engagement with partners across our ecosystem that drives our mutual success. We sat down with Brian to talk about his plans.

Welcome Brian Lanigan, SVP of Partner Ecosystem, SentinelOne

Brian joined us from Lacework, where he was the Worldwide Channels and Alliances leader, evolving the predominantly direct model to an 85 percent partner-aligned business. He helped establish Lacework as a top 20 AWS partner and the Cloud Security offering for six of the top eight MDR providers.

Prior to Lacework, Brian served as the head of global strategic alliances at Splunk, where he helped build the partner ecosystem as the business scaled from $200 million to $2.6 billion and led the teams that built:

• The MSP RTM, leading to a $150 million ARR business
• The GSI partner ecosystem, establishing the Accenture-Splunk business group
• The AWS partnership, accelerating Splunk to a top five AWS Partner
• The OEM business, establishing Splunk as the core data collection engine to many leading independent software vendors

What drew you to SentinelOne?

SentinelOne has a clear vision that meets the moment: Secure every surface, every minute of every day. It has the best technology in the industry to make it a reality. That was the first draw. The second was the sheer opportunity for both the company and its partners. The market for AI security services is massive and ripe for disruption. Together with our partners, we can move from securing endpoints and delivering MDR, into full business protection, across all security products leveraging our multi-tenanted data lake and Purple AI technology to manage across silos.

How will you do this?

Superior technology is the foundation of how we help our partners and customers build more resilient enterprises, and we will continue to invest in innovation that enables them to scale and remain ahead of adversaries now and into the future.

We just announced new capabilities within our Singularity Platform designed to democratize advanced cybersecurity operations through AI and automation. At the heart of these capabilities is Purple AI. Beyond a chatbot or virtual assistant, Purple AI is an advanced AI security solution that not only creates complex data queries from natural language, but anticipates what security analysts need to do and recommends next steps. It is the only Sec AI offering that is multi-tenanted and can be used horizontally across multiple sites, and we will leverage it to help our partners accelerate and scale their current services with hyper efficiency.

Cloud security is an important and growing part of our business and that of our partners, and we’re doubling down on investment to expanding our capabilities in this area as well, as evidenced by our recent launch of Singularity Cloud Native Security, which when combined with our AI-powered Cloud Workload Security and Cloud Data Security threat protection products, delivers visibility and mitigation capabilities in a single cloud security platform.

SentinelOne has evolved from an endpoint company to a platform. How is our go-to-market strategy evolving to accommodate this shift?

Point solutions are falling out of favor. Customers are seeking to consolidate not only their security vendors, but also their security consoles and data in order to gain a unified view of the enterprise security landscape.

Enterprises need a specialized security approach centered on all enterprise data to prevent attacks. This is where SentinelOne stands out. Disjointed platforms do not result in better protection. Bigger brands do not mean better security. SentinelOne is a true, unified AI security platform that seamlessly aggregates and connects data from all security products in a single streamlined technology and interface, and we make it easy for our partners to build on top of it to expand their offerings and unlock new opportunities in huge total addressable markets.

How are you aligning your organization to capitalize on these opportunities?

Our partner ecosystem is second-to-none and we are constantly adapting our organization to ensure we are creating a world-class experience for our partners that fuels their success, because at the end of the day, their success is our success. We’re focused on embracing the totality of the SentinelOne ecosystem in a harmonized manner – from value added resellers, distributors, systems integrators and cloud service providers to IR and technical alliance partners, MSSPs and MDRs.

We are investing in the partners that invest with us, focusing on those that have the joint vision to deliver outcomes for our customers. Further, we’re creating a sales culture that recognizes that many different partner types can be influential in a given account, rather than just simply the transacting partner(s). We’re helping our partners build and maintain successful and profitable lines of business centered around SentinelOne and we’re appointing proven leaders with experience in growth at scale to guide our team to its full potential.