SentinelOne Brings Detection and Response to AI Agents

Hey everyone. Welcome back here to Techtron TV. I'm happy to have coming back on our show, Chris Cord.

Chris is the CPO, chief product officer, over at SentinelOne, and let's say welcome him back. Chris, how are you? I'm great.

Thanks for having me, again. My pleasure. I can't help but notice that Eagles football up in the corner there.

Yeah. That's actually, my wife's side's an Eagles fan. So I'm from New York, she's from Philadelphia, so- Uh-huh ...

I have to give a nod every once in a while. You know what? Look, not for nothing, but they've had a better run the last couple years than any of our New York teams have.

That's for sure, yeah. Yeah. But tough year there for them this year.

But we're not here to talk football, Chris. We're here to talk about SentinelOne. I mentioned you're the chief product officer.

You have a long time in the security business, as do I. Give people a sense, Chris, of your journey, and then we'll jump into SentinelOne. Yeah.

So I joined SentinelOne a little over seven months ago, so it was at the end of about March, right around RSA Conference. Prior to that, I was running all product and user experience for Google Cloud security. So basically the main product line was the Google Security Operations, which was the old Chronicle product.

Sure. And then we purchased Mandiant. Most people in the security space are familiar with Mandiant.

Yeah, and we were able to really build out the, and broaden the Google Cloud security portfolio from being really nascent to being something that's now, I think, a force in the industry, especially after the Wiz acquisition. Absolutely. Earlier than that, I've been at RSA Security and Carbon Black, so I've been around the security block for quite some time.

Absolutely. You know what amazes me? I had a lot of friends in the Google security space.

I think we spoke about this the last time off camera. Some of my friends were at Chronicle, other... I'm seeing ex-Google security people all over the place lately.

Yeah. The guy leading Cisco security and- Yeah, Sanyogita ... his whole business.

I love him. Yeah. Yeah.

We were great partners together. Loved working with him. Yeah.

More so- And then Dr. Anton's over there, and then- Yeah ... who else?

I ran into someone else, a friend of mine, Drew. But anyway, it's amazing- Yeah ... the brain trust they had there.

And they do have the Wiz, but there's a lot of ex-Googlers out here doing great things like you are. Let's talk about SentinelOne. I'm sure most of our audience, I'm going to assume, and I hate assuming, but I think most of them know who SentinelOne is, but maybe there's some folks who don't, Chris.

Yeah. How would you explain it to them? Yeah.

SentinelOne's legacy history is, and still, we're a leader in the endpoint detection and response and next generation AV space. So we've, I think, pioneered a lot of the behavioral-based detection on endpoints, and we've broadened that leadership position to really providing a holistic security platform for customers. So we've now branched off into SIEM.

We're able to do identity security and exposure management, and obviously, AI and agentic security, which we'll talk about in a bit. But yeah, we're starting with a legacy and still very much focus our core on being able to protect the compute surface, the runtime surface across endpoints, cloud, and mobile devices. Yep.

We're gonna jump into a lot of this, but I got a quick question for you. Like you, I've been around security, and I've watched how the security silos of today are forming. Is it still cool to say EDR, or no, is that out of...?

Yeah, it is, for sure. Yeah. Okay, just want to make sure I- I think it's more relevant than ever, right?

But yeah, for sure. Yeah, I want to make sure I didn't totally lose touch. I went to see Rush last night, and looking around that crowd, I kind of started feeling my age a bit, but it was a great concert still.

Anyway, so we've got EDR, right? Endpoint detection and response. Everybody is enamored or at least consumed with AI and agentics.

Yeah. Is AI and agentics its own silo, Chris? EDR's gonna have an AI and agentic component to it, right?

Yeah. Identity's gonna have an AI agentic component to it. Does it really need to be its own thing, or does it get built into everything?

Yeah, it's a great question, and it's a multi-billion dollar question. I think you can look at it the way the cloud security market evolved in, there were categories that sort of emerged like CSPM and other things, CNAP, that were very specific to cloud just because of the new operating model. And there might be some things that emerge that are specific to AI.

But if you look at, I think, core areas like how do you understand inventory, how do you understand behavior, how do you do detection and response over agentic actions, our belief is that those things are core part of the EDR remit and journey, right? Because it's hard to just say, "Hey, I'm gonna deploy a specialized tool," especially on compute devices for agent-based behavior. So our point of view is that actually EDRs are the perfect place to be evaluating, understanding, and monitoring agentic behavior, and that's really why we announced agentic detection and response at the OneCon show.

Yep. So that was a great segue. OneCon 26, actually, well, OneCon is the SentinelOne user conference, basically.

Yeah, that's right. Recently held here for 2026, and you guys, basically there were two big announcements, call it headline announcements, if you will. One was agent detection and response.

And we should mention, Singularity is sort of the SentinelOne- Yeah, the platform ... platform. Yeah.

So Singularity agent detection and response, and then we also announced Singularity A-S-O-C, ASOC. Let's start with the ADR piece first. Yeah.

What do we got there? Yeah, like I mentioned, I think, if you look at what's really top of mind for most CISOs and security organizations, it's centered around two main things, two main themes. The first is how do I secure my agentic enterprise?

How do I get a handle and secure this new wave of activity and behavior that's occurring? And then the second piece is how do I enable my defenders to operate at the speed of AI? And so agentic detection and response is really our way of delivering against the first requirement.

And like I said, I think it's very much within the EDR remit to be able to solve this problem. And so what it does is it provides you the ability of understanding agentic inventory, so everything that's running out there from an agentic perspective, and then being able to understand behavior and monitor behavior at depths, and then be able to perform detection and response over that. And so it really gives you a holistic view into how you can understand and secure this new wave of activity that's occurring in your enterprise.

Sure. Absolutely. What's the special sauce for the agent piece of this?

Yeah, so I think there's a few things around agent behavior that is a little bit different than normal behavior, right? So I think we had this stat at OneCon that we showed, but it's clear that agentic activity is dwarfing human activity inside of the enterprise, right? If you think about most humans in an organization now, they're all agent authors, right?

So they all have things like Claude running on their desktop, Gemini Pro, Codex. Each one of those tools allows you to write an agent on demand. Every time you issue a request, you're basically kicking off a wide range of agentic behavior.

And that agentic behavior obviously is very voluminous because agents are going off and trying to do things at really non-human speed, right? And so the interesting part is that behavior has a few properties that make it kind of unique from traditional behavior. The first is something we call delegated intent, which is this idea is a human is asking the agent to do something, and you're giving it permission to perform that task.

And you don't actually know what it's gonna do after that. You're just giving it permission to perform a task. The second is you're giving it long-range access to tools.

And so you say, "Hey, go out and read my email. Go out and touch my Google Drive. " And you're giving it that access, and potentially even broader access to tools.

And that access typically is long-lived. And then the last piece is that you really want to be able to then understand drift in that behavior. So you don't just want to monitor for maliciousness, but you want to monitor that the intent that you had when you originally gave that request is actually what the agent performed and did at the end of the day, because again, a lot of that stuff is invisible to the user.

And so it's really those things that make it unique. Number one, the data is highly voluminous, but number two, you have to be able to monitor in a specialized way to get those properties understood, which is different than traditional EDR behavior. Absolutely.

Where do you think this goes, though, Chris? Yeah, I think we're at the stage in this environment where most people are just looking for baseline visibility. And again, I used the cloud analogy earlier.

I think it's very similar to the way cloud evolved from a security perspective. " Because most CISOs right now, they have no idea what's running in their environment. They're flying blind.

Yep. It's too hard to keep track of, right? So that's the first thing.

Just give visibility. I think once you have visibility, people then try to apply governance rules, policy rules. How do they get control over the right tools, the MCP servers, the agent platforms that are at least within policy inside the organization?

And then I think the last piece when you get to the full operating model is you want detection and response over this behavior, meaning I have to look at it, understand it, see if an agent is doing things that are potentially rogue, or see if an attacker has compromised that agentic behavior, and then be able to detect and then respond on that behavior. Meaning like you may want to kill an agent, you may want to revoke tool access, you may want to just do a response action through your software flow, right? And I think that's what we're getting to that point of.

People are getting the baseline visibility, but we're moving into that more governance and detection and response. And I think that'll be the next wave of how security happens across the agentic framework in the next couple of years. Very cool.

Let's turn to ASOC. Yeah. So ASOC is similar, but on the other side of that coin, which is like how do you enable defenders to use agents to actually help secure their enterprise?

And so if you think about all the headlines that we've seen with a lot of the attacks that are occurring out there, the theme around all of those is speed, right? So speed and persistence. So like when attackers are using AI to perform their attacks, what we're seeing is that the time for that attack to initiate and be successful is shortening the window that you have to be able to properly respond to it.

And so if you have human workflow in the loop, like if you're relying on human bottlenecks, if you have humans reading an alert queue, if you have humans doing response actions, the ability for the defender to keep up with attackers using AI is extremely difficult. And so ASOC is really the way to drive what I like to refer to as efficacy, like being faster and being quicker in the SOC, but also driving efficiency where you can hopefully do that with less cost and maybe potentially less people in the SOC to really up-level the role of the defender inside an organization. I love it.

Chris, I talk to a lot of people about security and AI agentics, and not just security, coding, managing everything, platforms. The biggest thing we hear from people is it's a question of trust, right? Yeah.

Can I trust what my agents are doing? Not only can I trust what my agents are doing, can I trust something like ADR to give me an accurate view of what my agents are doing, right? That's right.

Yeah. We all think we may know what our agents are doing, but how do you build that trust here? Yeah.

I think partially that's why I think the role of an organization like SentinelOne solving this problem is so important, right? Because you already trust us with your most critical workloads and your most critical compute surface inside of your organizations today, right? And that trust can't be taken lightly.

We've seen what happens when people are messing with the operating system and the compute stack, and how dangerous that can be, right? When you actually manipulate things wrong. And so you want to be able to have a trusted organization protecting and managing your compute stack, and you want that to happen for your agent activity as well, right?

So I think that there's a delivery trust and an organizational trust that SentinelOne also already brings to the table. I think the second piece is how much are you staying on top of the new attack surface, right? Because, again, attackers are going to use these techniques in a different way.

And I think SentinelLabs has published some really good research and understanding of how attackers are really operating and leveraging AI tools. And so I think the maturity that we have in actually detecting and responding to some of the world's most notable incidents, I think is also a big part of the trust. And that's why I believe this market will evolve into being part of EDR versus a bunch of startups because they just don't have that legacy to be able to sit inside an operating system and protect the latest attack surface the way an organization like us does.

And they don't have the trust. Yeah. It takes time to build trust.

But Chris, you and I have been around this block. That's the way of security. Today's product is tomorrow's feature anyway, right?

That's right. For sure. There's very few products that rise to become...

Actually, SentinelOne is a great example of a product, right? Yeah. Because it was launched still in the age of antivirus and that kind of stuff.

Right. And then as this whole endpoint detection EDR space blew up, SentinelOne became one of the poster child for it- Yeah ... in a lot of ways.

But that's few and far between. It goes back to the very first question I asked you. Do we need a separate product silo for agentics and AI?

No. So I do think that is the way you're going to see... And look, there are some companies like SentinelOne who can still innovate and develop this stuff internally.

There'll be other companies, and we've seen this. Google is a bit of an example. They're going to go out and buy it.

Yeah, for sure. Right? They'll try to buy the innovation and fold it in.

Available now, or what's the plan on that? Yeah, it's available in early access now, which is our terminology for beta. So we did make it available for beta at the OneCon show.

We've got awesome interest, more than we can even fulfill at the moment, so we're trying to get through all the early access requests that are coming in and make sure we get those up and running. But the expectation is we'll have this launched and ready to go sometime early in Q1, which is- Before RSA. For sure.

We're aiming for February ideally, but obviously we'll see how the beta goes before we fully lock in on a date, but that's the goal. I love it. Excellent stuff.

com is the website, right? Yes, for sure. People could go get information right from there?

You can get information right from there. If you're already a customer, you can actually sign up for the early access program from the SentinelOne website as well. Oh, really?

There's a form there if you're interested. So yeah. And then obviously there are ways to work with your sales organization if you're a customer as well.

I love it. Hey, Chris, man, I appreciate you coming on here, giving us the scoop on this. Keep up the great work.

It's a crazy time right now, right? And we're all kind of feeling our way through this, so it's good to see SentinelOne coming out with some really nice solutions and a whole suite of them. No, I appreciate it, Alan, very much enjoyed being here.

io if you want to see some of the keynotes. If you're interested, we do have all the videos available there, either Tomer's keynote or my product keynote. io.

And that's O-N-E, not the number one. Yes. Spelled out number one, O-N-E- That's right ...

com, right? That's right. io, actually.

io. There we go. Yeah.

All right. Hey, Chris, I appreciate it. Well, if nothing else, I hope to see you at RSA, but maybe we'll talk before then.

Yeah, for sure. That'd be great. All righty.

Chris Gord, CPO, SentinelOne, here on Techstrong TV. We're going to take a break. We'll be back in a moment.