SentinelOne managed services are the human-delivered offerings that SentinelOne sells on top of the Singularity Platform: managed detection and response (MDR), threat hunting, incident response, technical account management and support. The Singularity Platform Terms define SentinelOne Services as Singularity Support, Technical Account Management (TAM), SentinelOne’s Vigilance Service, Incident Response service, or other services.[2] Services other than support are governed by the SentinelOne Services Addendum.[1] Incident response is governed by the Incident Response Retainer Addendum,[5] and support by the Support Terms.[6] Two warranties attach payment obligations to specific SKUs. The Ransomware Warranty attaches to the Control and Complete packages,[4] and the Breach Response Warranty attaches to the MDR SKUs.[3]
Editions
SentinelOne markets its services as Wayfinder Threat Detection & Response (TDR), a framework that combines managed detection and response, threat hunting and incident readiness.[9] The warranty text names the MDR SKUs currently or previously sold.
| Offering | Content (vendor description) | Notes |
|---|---|---|
| Wayfinder MDR Essentials | 24/7/365 protection with integrated threat hunting, real-time dashboards and digital onboarding[7] | Breach Response Warranty SKU[3] |
| Wayfinder MDR Elite | Essentials plus dedicated Threat Advisors, bundled IRR exercises, on-demand DFIR and strategic guidance[7] | Breach Response Warranty SKU[3] |
| Vigilance MDR; Singularity MDR | Earlier MDR SKU names still listed in the warranty[3] | Vigilance also named as a SentinelOne Service[2] |
| Wayfinder Threat Hunting | Intelligence-led hunting by SentinelOne analysts[9] | Managed Threat Hunting is included in Commercial and Enterprise and an add-on to Complete[10] |
| Incident Readiness & Response (IRR) | Incident response bought as IR Hours[5] | See Incident response retainer below |
| Singularity Support (Standard, Premium) | Support for the Singularity Platform[6] | Coterminous with the platform subscription |
In the package comparison, Managed Detection and Response is shown as an add-on for Singularity Commercial and Enterprise.[10] No MDR prices are published.
Metrics
| Term | Catalog row | Where it applies | What SentinelOne says |
|---|---|---|---|
| Covered Endpoint | Covered Endpoint | MDR SKUs, Breach Response Warranty | Physical or virtual devices with the SentinelOne Agent on a supported OS. The subscribed unit count sets the warranty cap.[3] |
| IR Hour | IR Hour | Incident response retainer | The number of hours for IR Services indicated in the Purchase Order.[5] |
| Endpoint | Endpoint | Ransomware Warranty; package-level threat hunting | Warranty paid per affected Endpoint.[4] |
The Breach Response Warranty counts MDR subscriptions “discreetly” (sic, meaning discretely) across Wayfinder MDR Essentials, Wayfinder MDR Elite, Vigilance MDR and Singularity MDR.[3] The MDR service is therefore itself sold per endpoint. In practice this makes the MDR quantity a second endpoint count, which should be reconciled against the platform quantity.
Counting / floors
Services require the platform (effective 2026-05-14). SentinelOne Services are available only if the customer subscribes both to the Singularity Platform and to the service under a Purchase Order.[1] The Services Addendum terminates automatically when the MSA expires or terminates.[1] Catalog proof: SentinelOne Services require a Singularity Platform subscription.
No automatic renewal of services (effective 2026-05-14). Service terms are as stated in the Purchase Order. SentinelOne Services do not renew automatically, and the customer must contact SentinelOne or its Partner to renew before the term expires.[1] Platform subscriptions, by contrast, renew automatically under the MSA unless notice is given 30 days before the end of the term.[11] A lapse in MDR can therefore leave the platform running without the service, and any Breach Response Warranty then falls away with it. Catalog proof: SentinelOne Services do not renew automatically.
File Fetch consent. Services that use the File Fetch feature, including Vigilance and WatchTower Pro, carry the customer’s express authorization for SentinelOne to download full files from Customer Endpoints to the management console.[1]
Incident response retainer
IR Services are bought as IR Hours stated in a Purchase Order. They are priced by IR Services Level, and more hours can be bought at the rate for the customer’s level.[5] Purchased hours may also be used for targeted threat hunting and guided post-incident improvements.[5] Each Activation Request uses a minimum of four IR Hours. SentinelOne targets an Initial Response within 8 hours and Initial Findings within 24 hours of the Activation Request.[5] The addendum runs for 12 months from purchase and renews for further 12-month periods for the same IR Hours unless either party gives 30 days’ notice. Hours must be used within the term in which they were bought, and unused hours expire.[5] Fees are non-refundable. Each party’s total liability under the addendum is capped at $40,000, apart from the obligation to pay for IR Hours.[5] Catalog proof: Unused IR Hours expire at the end of the term; Each IR activation consumes at least four IR Hours.
Support
Singularity Support is the support service for the platform governed by the Support Terms.[11] It is coterminous with the Subscription Term in the Purchase Order and cannot be cancelled during that term.[6] The published response times (support levels last updated May 2025) are:[6]
| Priority | Standard | Premium |
|---|---|---|
| 1 - Urgent | 4 hours | 1 hour |
| 2 - High | 12 hours | 3 hours |
| 3 - Normal | 24 hours | 6 hours |
| 4 - Low | 72 hours | 12 hours |
SentinelOne may update support tiers, Support Levels and the Uptime Commitment, and the Documentation holds the current version.[6] Catalog proof: Support is coterminous and not cancellable.
Programs
Ransomware Warranty
The Ransomware Warranty (effective 2026-05-14) applies to customers or MSSPs that subscribe to the Control or Complete SKU, when the warranty is stated in a Quote or Purchase Order.[4] It pays actual damages up to $1,000 per affected Endpoint and up to $1,000,000 for every consecutive 12 months of subscription. It covers only Endpoints with the Windows Agent installed and configured as required, and excludes Identity and macOS agents.[4] The conditions are detailed and must be met at the time of infection. They include Protection Mode set to Protect, all detection engines on, anti-tamper and snapshots on, the latest or the preceding GA Windows agent, and two-factor authentication on the console.[4] Customers subscribed to Vigilance Response are exempt from the manual post-infection steps.[4] Catalog proof: Ransomware Warranty pays up to $1,000 per Endpoint for Control or Complete SKUs.
Breach Response Warranty
The Breach Response Warranty (effective 2026-09-11) applies to the Wayfinder MDR Essentials, Wayfinder MDR Elite, Vigilance MDR and Singularity MDR SKUs.[3] It reimburses Covered Expenses, meaning pre-approved forensic, legal and recovery costs, up to a cap set by the subscribed Covered Endpoint count at the time of the breach.[3]
| MDR subscription quantity | Cap on Warranty |
|---|---|
| Up to 4,999 | $100,000 |
| 5,000 - 10,000 | $500,000 |
| 10,001 and above | $1,000,000 |
A breach must be reported within 48 hours of discovery, and a written demand made within 90 days. Service rates above $250 an hour are not reimbursed.[3] SentinelOne’s MDR page describes the warranty as up to $1M covering Windows, Linux, macOS and cloud workloads.[8] The tier table shows that the $1M figure applies only above 10,000 Covered Endpoints. Catalog proof: Breach Response Warranty cap set by MDR subscription quantity.
Virtualization & partitioning
The Breach Response Warranty’s Covered Endpoints include physical or virtual devices running the agent on a supported operating system.[3] No other virtualization rule is published for services.
Out of scope
This page does not cover MDR, threat hunting, TAM or IR Services Level prices, which are not published, or the MSSP Agreement under which service providers resell SentinelOne. Professional services under statements of work are governed by their own documents.