SentinelOne launches agentic detection and response for enterprise AI security
SentinelOne has launched Singularity Agentic Detection and Response (ADR), a security offering designed to discover AI agents, govern their access and detect or stop malicious and unintended activity at runtime. Announced at the company’s OneCon 2026 customer conference on October 29, the offering is available in early access.
Built on the Singularity Platform, ADR extends SentinelOne’s endpoint, cloud workload and identity security capabilities to AI agents operating across enterprise environments. It combines agent discovery and policy enforcement with behavioural detection and response, aiming to address risks from both malicious activity and authorised agents acting outside their intended tasks.
The offering provides an inventory of AI agents, tools, connectors and Model Context Protocol (MCP) servers, along with their permissions and associated users. It also supports agents built on platforms including Salesforce Agentforce, Microsoft Copilot Studio, OpenAI ChatGPT workspace agents and Anthropic Claude managed agents.
Its features include monitoring agent activity through event traces, linking AI actions to subsequent system processes, and detecting deviations between an agent’s assigned task and its behaviour. Security teams can set controls on which agents run and what resources they can access, block threats such as prompt injection and credential exfiltration before actions execute, and contain an individual agent without stopping the wider workflow.
SentinelOne said ADR builds on its Prompt AI Agent Security capabilities, introduced in March, and integrates agent activity into the Singularity Platform’s existing investigation and response workflows. The company said security teams can investigate agent actions and automate responses within customer-defined boundaries.
“Securing AI agents goes beyond just stopping threat actors with malicious intent. As we’ve seen all too frequently, an equal if not more prominent risk comes from unintended behavior of sanctioned agents,” said Chris Corde, Chief Product Officer at SentinelOne.
The launch comes as enterprises deploy AI agents that can access credentials, use connected tools and execute multi-step tasks with limited human intervention. SentinelOne is positioning ADR as a way to extend runtime security controls to these agents as organisations expand their use of AI.