We're moving off a legacy AV and our MSP is pushing SentinelOne hard. I need to know if it's the right fit or if they're just reselling what gets them the best margin.
Context: 50 users, mix of in-store POS machines, office desktops, and laptops. Retail environment means:
* Employees with minimal tech literacy on the floor.
* Heavy use of specific, often outdated, legacy inventory software.
* No dedicated internal IT security person.
My primary evaluation criteria aren't about marketing buzzwords. I need:
* Actual admin burden reduction. If the console is a nightmare, we can't handle it.
* Transparent, predictable pricing. No gotchas with device counts or features.
* Low false positive rate on our line-of-business apps. A block that stops a sale is a major incident.
* Evidence it stops modern ransomware without needing constant babysitting.
I've seen the demos. The EDR/XDR story is compelling, but I'm skeptical we'd use it. Our MSP would "manage" it for us.
Questions for those with hands-on experience, especially in SMB/retail:
1. How is the false positive management? Can you create exclusions easily, and do they stick?
2. What's the real-world impact on older, quirky software? Did you have to whitelist entire directories?
3. How does the pricing actually work? Is it per endpoint, and what's included in the base tier vs. add-ons?
4. If you're using an MSP to manage it, what level of access/visibility do you actually retain? Can you see alerts and actions taken, or are you blind?
I have zero interest in "it's great" without specifics. Tell me about the problems you solved, and more importantly, the problems it created. Benchmarks and data trump vendor slides every time.
Show me the query.
I'm the operations manager at a 55-employee specialty goods retailer, and we migrated from Webroot to SentinelOne a year ago across our stores and HQ.
**Target audience fit:** It's built for managed service. The MSP portal gives our provider full visibility, and we get a simplified view. It's an SMB product that scales up.
**Real pricing:** We pay $6.20 per endpoint per month on a 3-year term. That's the all-in Vigilance (MDR) tier. Watch for minimum device counts - our MSP had a 25-seat floor.
**Admin burden:** For us, it's nearly zero. The policy setup was done by our MSP. Day-to-day, we only see alerts they escalate. The console is clean, but I wouldn't call it simple; we lean on them.
**False positive management:** This was our biggest worry. Creating exclusions for our old inventory system was straightforward at the policy level, and they've held. We had two blocks in the first week, none since.
I'd recommend SentinelOne in your exact scenario, where an MSP handles it and you have legacy apps. If you were managing it yourself with no security staff, I'd lean toward something with a simpler dashboard.
Trust the trial period.
Thanks for sharing the real numbers, that's helpful. Your point about the console being clean but not simple is spot on. I've seen a few teams get overconfident after the initial MSP setup and tweak policies without proper change control, which can introduce gaps.
If you're leaning on your MSP for day-to-day, make sure your contract clearly defines their response SLAs for those escalated alerts, not just deployment. That's where the real admin burden can resurface if they're slow.
SentinelOne is solid, but your MSP is likely pushing it for the margin. They all do.
You need to answer this first: is your MSP competent at managing the policy, not just installing it? A default S1 policy on your old inventory software will cause blocks. Exclusions are easy, but they need to be correct and documented. If your MSP just clicks "allow" on everything to avoid tickets, you have no security.
For your criteria:
* Admin burden is low only if the MSP does it right. Otherwise, you're managing constant false positive tickets.
* Pricing is predictable if you get the final quote in writing, including minimum seats and any offboarding fees.
* Evidence it stops ransomware is there, but only if the EDR is monitored. If your MSP isn't providing 24/7 MDR, you're just buying a fancy AV.
Consider running a proof of concept on a few POS machines first. Let it audit for a week before enabling full protection.
Least privilege is not a suggestion.