Control secures your endpoints. Complete adds deeper investigation. Vigilance brings a human team into the response. Choose the combination that fits your business.
AI prevention, automated response, and endpoint policy.
Control capabilities plus deeper searchable endpoint activity.
24/7 analyst monitoring and response alongside your base plan.
Select a level to explore its capabilities.
Three clear options. Choose the capabilities and response coverage your business needs.
Modern prevention and automated response for your business devices.
Go deeper with endpoint detection, threat hunting, and investigation tools.
Add a team of security analysts to help monitor, investigate, and respond.
Vigilance is an add on, not standalone endpoint protection. Its price is additional to your base plan. Five endpoint minimum. Choose your endpoint quantity in Stripe. Taxes, eligibility, terms, and the final amount are confirmed at checkout. View terms.
Control gives you autonomous protection plus endpoint security controls. Choose it when your main priority is preventing threats and managing device and firewall policy.
A policy is only useful when it can be applied consistently. Control combines the endpoint agent’s prevention and response capabilities with central administration, USB and Bluetooth controls on supported devices, native firewall management, and visibility into unprotected hosts.
A small business or IT provider that needs modern endpoint protection and practical controls, while handling alert review and incident decisions internally.
Evaluate suspicious files and behavior to help detect malware, scripts, exploits, and ransomware activity.
Stop malicious activity, quarantine files, and apply supported remediation actions according to your policy.
Manage peripheral access and host firewall rules to reduce unnecessary exposure.
Use rogue endpoint discovery and application inventory to spot protection gaps and better understand your devices.
Complete includes Control’s capabilities and adds a deeper investigation layer. The upgrade is about understanding endpoint activity across the environment, not just blocking a malicious file.
When a suspicious event raises more questions, Deep Visibility helps analysts search retained telemetry, investigate related activity, and look for indicators across endpoints. Storyline context helps connect actions into a more understandable incident sequence.
An organization or IT team that wants stronger forensic context, repeatable investigations, and the ability to actively hunt for suspicious activity.
Search endpoint activity to investigate suspicious files, processes, and other supported telemetry.
Look back through retained events to establish context and identify related activity.
Search for indicators and suspicious behaviors across your environment instead of waiting only for a new alert.
Use connected event information to understand how an incident unfolded and where to investigate next.
Vigilance is an additional managed service. Control and Complete provide the endpoint tools; Vigilance adds analysts who help operate the detection and response process.
A busy business may not have someone available to evaluate a security alert at night or on a weekend. Vigilance adds around the clock monitoring, investigation, and response support to an eligible endpoint plan, with escalation and actions governed by the service setup.
A business that wants people supporting its security response, particularly when internal staff cannot provide continuous alert coverage.
Security analysts review detections instead of leaving every alert for your staff to interpret.
Help distinguish routine activity from a threat requiring action and establish useful incident context.
Support threat handling and authorized containment actions within the managed service scope.
Provide documented incident information and coordinate with the contacts designated during onboarding.
Expand a capability for its meaning. Compare the tools and the people behind each option.
| Capability | Control | Complete | Vigilance add on |
|---|---|---|---|
AI powered malware preventionHelp detect malicious files and suspicious behavior. | Included | Included | Uses your base plan |
Behavioral detectionLook for malicious activity, including attacks that do not rely on a conventional executable file. | Included | Included | Uses your base plan |
Automated threat responsePolicy driven actions to stop or quarantine threats and support remediation. | Included | Included | Analysts support response |
Network isolationDisconnect an affected endpoint from other network activity while keeping the management connection where supported. | Included | Included | Response support |
Remediation and rollbackRecovery actions depend on platform, configuration, and incident; Windows rollback is not a backup replacement. | Platform dependent | Platform dependent | Uses your base plan |
USB and Bluetooth controlManage peripheral access on supported Windows and macOS devices. | Included | Included | Uses your base plan |
Native firewall controlApply and manage supported endpoint operating system firewall policies. | Included | Included | Uses your base plan |
Rogue endpoint discoveryIdentify network hosts that may not have the SentinelOne agent; this is different from the broader Ranger module. | Included | Included | Uses your base plan |
Application inventorySee installed applications to support endpoint visibility. | Included | Included | Uses your base plan |
Deep Visibility searchesSearch detailed endpoint activity across your environment to investigate suspicious behavior. | Not included | Included | Based on base plan |
Historical telemetry huntingSearch retained activity to answer questions beyond an individual alert. | Not included | Included | Based on base plan |
24/7 human monitoringAnalysts review detections as part of a managed service. | Add Vigilance | Add Vigilance | Included |
Managed investigation and responseAdd human triage, investigation, and response within the agreed service scope. | Add Vigilance | Add Vigilance | Included |
Vigilance adds a service to your licensed endpoint capabilities. It does not turn Control into Complete. Ranger, Purple AI, WatchTower, and RemoteOps are separate capabilities or offerings; ask ECC to confirm availability and licensing. Platform compatibility, permissions, retention, and licensing affect available features.
Autonomous endpoint prevention, incident context, and response capabilities in a centrally managed platform.
SentinelOne uses static and behavioral AI to evaluate files and activity on business devices. It can identify malicious behavior, take policy driven action, and give administrators context about an incident. That matters when an attack uses scripts, exploits, or suspicious behavior rather than a familiar malware file.
Control adds practical endpoint controls to that protection. Complete extends the investigation toolkit with Deep Visibility, historical searches, and threat hunting capabilities. Vigilance adds a managed service to an eligible base plan, helping cover the human work of reviewing and responding to detections.
File analysis and behavioral detection work together to help stop malware, ransomware, and other suspicious activity on supported endpoints.
Incident context connects related activity. Complete adds deeper searchable telemetry so your team can investigate beyond a single detection.
Automated and administrator driven actions can help contain a threat. Add Vigilance when you also need analysts supporting the response.
Endpoint protection, threat hunting, and managed response solve different needs. We can help you compare the options before you purchase.
Talk through your optionsCompare the level of protection and management your business needs.
Purchase using ECC’s existing Stripe payment links.
We’ll coordinate account setup and the next steps for deployment.
Control focuses on prevention and automated response. Complete adds advanced endpoint detection and investigation capabilities, including Deep Visibility and threat hunting.
No. Vigilance is the optional managed detection and response add on. Automated endpoint protection and human monitoring are different capabilities.
No. Recovery features depend on the operating system, configuration, and incident. Maintain a separate backup and recovery strategy.
Yes. Contact us with your device count and requirements so we can discuss the right fit and licensing eligibility.
Yes. Prevention and automated response are part of the base endpoint capabilities. Complete adds deeper investigation and hunting features. Adding Vigilance brings human analysts into the monitoring and response process.
It lets you search retained endpoint activity to investigate suspicious behavior and find related indicators across devices. It is useful when you need to answer questions about what happened before, during, and after a detection.
No. Vigilance adds managed monitoring and response to an eligible base plan. Your underlying software tier still determines the investigation tools and telemetry available.
At ECC’s displayed monthly rates, Control plus Vigilance is $9.98 per endpoint and Complete plus Vigilance is $15.98 per endpoint, before tax. The five endpoint minimum applies. Base and add on purchases use separate checkout links.
Do not assume that a capability advertised elsewhere in the SentinelOne platform is included in these plans. Ask ECC to confirm licensing and availability for any additional module you need.
On device protection can continue without an active cloud connection. Central visibility, reporting, and remote actions depend on connectivity and the agent’s configuration.
Tell us what you’re working through. We’ll help you find the right next step.
Review the installation guidance for your devices before deployment.
