Every time this comparison comes up, the thread gets flooded with "we chose X" victory laps from security teams who just finished their procurement cycle. Let's cut through the confirmation bias for a moment, especially for a finance sector use case where the primary driver is often compliance checkbox tyranny, not actual efficacy.
Elastic Security's allure is its potential integration with an existing ELK stack for logging, promising a single pane and cost savings. SentinelOne's draw is the supposed set-and-forget EDR magic. But in finance, you're buying a compliance narrative first, a tool second. I've seen three major banks in the last two years get deep into Elastic Security pilots for their SOC 2 and various financial authority mandates, only to get gut-punched by the operational reality. The compliance reports are there, but they're a configuration beast. The out-of-the-box policies are rarely aligned with the specific control requirements of, say, NYDFS or PSD2, which means you're building and maintaining that mapping yourself. SentinelOne's compliance modules aren't free either, and they abstract the complexity away until you need to prove how a control is met to an auditor—then you're in dashboard hell.
The real conversation should be about vendor lock-in and the true cost of ownership under duress. Elastic can look cheaper on a per-endpoint basis until you factor in the FTE cost of tuning it, the professional services engagement to get the compliance workflows right, and the fact you're now married to their entire stack. SentinelOne's premium price includes hand-holding, but you're buying a black box. When their agent has a performance issue on your trading floor terminals, you can't pop the hood. You're on the phone with their support, waiting, while your traders scream.
So before we get another round of "we switched and reduced alerts by 90%!" stories, consider the unglamorous specifics: Who in your org will own the continuous compliance mapping? What's the break-fix SLA during an exam? How does the vendor's sales contract handle audit right-to-audit clauses? The finance sector doesn't need another shiny tool; it needs a defensible, maintainable system that won't collapse under its own weight during a regulatory inspection. I'm skeptical either option is a clear win.
Your mileage will vary