Endpoint protection compared

The rollback difference

The capability we’d point to first is rollback. When SentinelOne mitigates a threat it can return the machine to its pre-attack state — encrypted files come back. Most products, including CrowdStrike’s and Microsoft’s, remove the malware but don’t restore what it did. That is the difference between losing an afternoon and losing a week.

Two conditions worth stating plainly, because they are usually left out: rollback is Windows only — it is built on Volume Shadow Copy Service, so macOS and Linux agents remediate but cannot restore files this way — and it depends on snapshots being enabled with enough disk space for shadow storage. We turn snapshots on for the sites we provision. It is still not a substitute for backups: it covers the protected endpoint, not a network drive or a machine with no agent on it.

About Defender’s recent vulnerabilities

Microsoft Defender has had a rough stretch. During 2026 two vulnerabilities were confirmed exploited in the wild: CVE-2026-41091, a local privilege escalation in the Malware Protection Engine that could hand an attacker SYSTEM, and CVE-2026-45498, which could be used to stop Defender working at all. Separately a zero-day dubbed “RoguePlanet” (CVE-2026-50656) allowed SYSTEM-level access through a race condition, and a follow-up called “ShieldBreak” (CVE-2026-69414) was published as a bypass of that patch.

Now the part most vendor comparison pages leave out. This is not evidence that Defender is uniquely bad. Every endpoint agent runs with kernel or SYSTEM privileges, which makes all of them high-value targets, and every major vendor — SentinelOne included — has had serious vulnerabilities disclosed. Any vendor claiming a spotless record is either not looking or not telling you.

What actually deserves evaluating is not whether a product has CVEs, but how fast the vendor patches, whether the agent resists tampering, and whether you would find out if it were disabled. That last point is a genuine argument for a central console: a consumer product silently switched off is invisible to you, whereas a managed console shows an unhealthy or missing agent. We would rather make that argument than pretend our software is bug-free.

When you should buy someone else

• Microsoft Defender (free) — one or two personal machines, no employees, decent backups. Don’t pay us.
• Microsoft 365 Business Premium — if you already pay for M365 and need email security, device management and EDR together, the bundle is hard to beat. At $22 per user it costs more per head than we do, but it replaces several products at once.
• Norton, McAfee or Bitdefender — you want one subscription covering a family’s laptops and phones, plus a VPN and password manager, with no console to learn. That is a genuinely different product and we don’t compete with it.
• CrowdStrike or a managed provider — you need 24/7 monitoring, incident response, or a compliance attestation naming a SOC. We don’t offer those.

When we’re the right answer

You run a handful of machines for a real business, you’re technical enough to read an alert and act on it, and you’ve been quoted something absurd for a fleet your size. That is the gap we were built for: enterprise-grade detection and rollback at $7.00–$10.00 per endpoint per month, one endpoint minimum, no call with a salesperson.