SentinelOne’s Singularity Platform now integrates Purple AI, a generative AI security agent that operates across endpoints, cloud workloads, and identity credentials. This autonomous threat prevention tool delivers real-time visibility into AI tool usage while enforcing automated controls to prevent prompt injection and sensitive data leakage. The capability extends directly from the August 2025 acquisition of Prompt Security, an Israeli startup valued at an estimated $250 million in cash and stock. That deal closed during SentinelOne’s third fiscal quarter of 2025, bringing specialized runtime security for generative AI tools into the core platform. By securing the rapidly growing use of agentic AI in the workplace, SentinelOne addresses a specific gap where traditional endpoint detection fails to monitor how employees interact with external models. The company also acquired Observo AI in September 2025 to manage streaming telemetry pipelines, ensuring the data infrastructure can handle the volume required for continuous autonomous response. These moves position Purple AI as a central component of the broader strategy to protect against AI-specific threats before they reach production systems.
The competitive pressure from CrowdStrike Falcon forces SentinelOne to maintain aggressive innovation cycles in the enterprise sector. CrowdStrike recently joined the S&P 500 index in June 2024 and reported total revenue of $3.06 billion in 2024, a 36% increase over the prior year. Their Falcon platform uses a single lightweight agent to stream telemetry to a centralized cloud analytics engine, correlating events across the entire customer base through a graph database called Threat Graph. This architecture allows CrowdStrike to detect indicators of attack rather than just static indicators of compromise, a distinction that matters when attackers rely on stolen credentials and built-in system tools. However, the reliability of this centralized model was tested on July 19, 2024, when a faulty configuration update caused approximately 8.5 million computers to crash globally. Delta Air Lines subsequently filed a lawsuit seeking between $500 and $550 million in damages for flight cancellations and lost revenue. In response, CrowdStrike launched the "Falcon Flex" retention program, which accumulated over $3.2 billion in total deal value by late 2025. While CrowdStrike claims a 97% customer renewal rate, the incident exposed the fragility of relying on a single point of failure for global security operations.
SentinelOne counters this risk with its behavioral AI approach, which uses a heuristic model to monitor personal computers, IoT devices, and cloud workloads without the same dependency on a single cloud update mechanism. The company’s FY 2025 annual report shows revenue of $821 million, though it recorded an operating income of negative $329 million and net income of negative $288 million. These financial figures reflect the heavy investment required to maintain a competitive edge against a rival with nearly four times the revenue. SentinelOne’s strategy focuses on autonomous protection that reduces the need for human intervention in routine threat triage. The integration of Purple AI allows the platform to identify and block malicious prompts in real time, preventing data exfiltration through generative AI interfaces. This capability is critical as organizations deploy AI agents that can act autonomously within their networks. The rivalry between these two companies defines the current standard for enterprise cybersecurity, with each pushing the boundaries of what autonomous defense can achieve. Whether the market will favor CrowdStrike’s scale or SentinelOne’s specialized AI focus remains an open question for investors and CISOs alike.
