IoT vulnerabilities and the AI defense race

Mirai botnet persistence

Mirai botnet operators exploit a zero-day vulnerability in end-of-life GeoVision video surveillance devices and leave 17,000 systems vulnerable to command injection. This malware variant targets outdated hardware that no longer receives security updates. Recent activity involving the Mirai botnet also included a hijacking of 900,000 Deutsche Telekom routers to facilitate large DDoS campaigns. These breaches stem from poor security hygiene, such as failing to patch devices or manage credentials. Because the Mirai botnet uses open source code, malicious actors easily repurpose existing scripts to target new vulnerabilities across a wide variety of different, highly diverse, and complex internet of things architectures. Mirai also targeted 13,000 IoT devices in a massive DDoS attack that caused significant web disruption. Security researchers also noted that Mirai variants exploit the OMIGOD flaw in Azure Linux virtual machines and a remote code execution vulnerability in Wazuh servers. With an average timeframe for applying patches clocking in at seven years, devices remain the softest targets on the network. Mirai often hides as a legitimate web server and then closes the ports of the vulnerabilities it exploited to stop other botnets from taking over the system. Approximately 9,100 of the vulnerable GeoVision devices reside in the United States, with significant numbers in Germany, Canada, Taiwan, Japan, Spain, and France. Does the persistence of these legacy vulnerabilities mean that automated scanning will always stay ahead of patch cycles?

SentinelOne AI-driven detection

SentinelOne addresses the expanding attack surface through the Singularity platform and recent strategic acquisitions. The company acquired Prompt Security to manage AI usage control and address shadow AI risks. It specifically targets prompt injections and the careless use of AI. The Observo AI acquisition provides a data pipelining solution that reduces data by 80% at the edge before it reaches a data lake. SentinelOne also acquired Scalyr to power its Singularity XDR platform and launched DataSet, an enterprise live-data platform. This next generation non-schema-based architecture removes the customer dependence upon creating index-based architectures. SentinelOne’s AI-based agent sits on the endpoint itself, which provides local intelligence without requiring constant cloud connectivity. This architecture helps businesses that require sovereign data on isolated or self-hosted systems. You should look at how these local capabilities solve threats in real time when cloud access fails. The platform combines prevention, detection, and response to defeat threats at machine speed. Purple AI acts as an agentic analyst that transforms natural English language into complex security queries to accelerate threat hunting and incident investigations. SentinelOne reported 277 million dollars in total revenue for the first quarter of fiscal year 2027, representing 21% growth.

The enterprise rivalry

Microsoft Defender XDR relies solely on SaaS and runs only in Azure, whereas SentinelOne Singularity provides hybrid deployment options. Organizations requiring specific data residency often choose SentinelOne because Microsoft fixes residency to Azure regions. Microsoft provides pricing value for enterprises already paying for M365 E5 licenses, which includes deep integration with Entra ID and Exchange. However, Microsoft coverage fails against non-Windows endpoints and Linux servers. SentinelOne leads in detection accuracy and response speed.

SentinelOne is a leader in the 2026 Gartner Magic Quadrant for Endpoint Protection Platforms for the sixth consecutive year. The Singularity platform provides unified visibility across endpoint, identity, cloud, and AI. While Microsoft integrates deeply with the Microsoft estate, it lacks the flexible deployment models found in Singularity. SentinelOne provides autonomous containment without waiting for analyst intervention. SentinelOne also provides one-click rollback to reverse ransomware file encryption on the endpoint. Microsoft Defender XDR provides AI-assisted investigation via Security Copilot without a separate purchase. SentinelOne’s coverage includes better protection for Linux servers than Microsoft’s current offerings. Microsoft provides high value for organizations already utilizing the Microsoft ecosystem.