S1, perhaps with the benefit of a last-mover advantage (having being founded roughly 14 months after CRWD and growing much slower), decided to take a different product and architectural approach. The drawback, however, is that the agent can’t confirm a threat or stop and remediate a threat autonomously and immediately, and hence EDR is very dependent on manpower in the cloud. The main benefit is that it consumes very little device resources. The brain of EDR is in the cloud, which means the agent on the endpoint can be very lightweight, as it only needs to send telemetry to the cloud. This concept gave birth to the era of EDR (Endpoint Detection & Response), pioneered by CRWD and Carbon Black. However, when AWS emerged, it was realised that the scale of the cloud could provide the compute and storage to conduct threat analysis on a huge scale, while also using a bunch of SecOps folks to remotely protect and control endpoints from the cloud. All these device-focused approaches fell under the EPP (Endpoint Protection Platform) umbrella, and to be fair, they provided adequate patches for the ineffective signature-based AVs.

Some vendors attempted to improve protection on the endpoints with different methods and approaches, such as using sandboxes, heuristics, anomalous behaviour detections, and device vulnerability management. Thus, updating the signature-based databases in a timely manner was simply not possible. At the dawn of the mobile era when the iPhone was released in 2007, there was an explosion of data, which was also accompanied by surges in new (and hence unknown) types of malwares. The efficacy of this method was dependent on the updates to the signature database. Initially, endpoint security was entirely focused on signature-based AV (antivirus) software, that would check inbound file hashes against a database of known malicious file hashes, aka signatures. The endpoint security market has undergone a number of evolutions since the early 1990s. Really, S1's cloud security competition will be the likes of PANW and Lacework more than it will be CRWD. Though, it is cloud security where we think S1 will convincingly outcompete CRWD thanks to technological factors. ITDR is considered an important future defense to thwart credential-based attacks, and fills in an important gap between EDR, IAM, IGA, and PAM. S1's move into ITDR (identity Threat Detection & Response) is a smart move. However, S1’s gear shift into aggressive GTM coupled with a cleaner slate and sophisticated architectural design, ought to keep pushing the company forward to grab increasingly more market share and close the gap with the market leader CrowdStrike. Indeed, this did sacrifice the GTM momentum, allowing CRWD to rapidly grow and dominate the endpoint EDR market.

Spending more time on PMF (Product Market Fit) in the company’s early days, has led to S1 having superior product fundamentals and architectural design. Key competitors: CrowdStrike, Palo Alto Networks, Microsoft, NGAV names like Cybereason and Tanium, and legacy AV incumbents like SymantecĭCF Valuation: in the Updates - SentinelOne 3Q23 report published in December, we arrived at a value of c. Market: Started in endpoint security and has since expanded into identity and cloud security

We explain why the differences in technology give S1 a significant upper hand when it comes to cloud security.Ĭompany status: Public > $15/share (ticker: S > note we will refer to it in the report as S1)įounders: Tomer Weingarten CEO, Ehud Shamir, Almog Cohen.

CRWD is a formidable foe in endpoint but will unlikely sustain itself as a strong rival to S1 in cloud security.We compare CRWD and S1 within the endpoint space across a number of categories, providing a detailed summary of their differences.CRWD's endpoint security moat will continue to be solid, but S1's competitive advantages will close the gap in the years to come.

Sentinelone competitors