The reason why I choose SentinelOne right now is that I can fork timelines. I can create serialization or my own fingerprints for the use cases. Or I can actually look for unknown unknowns. Where in CylanceOPTICS, I don't have that functionality, but what you can do in Cylance is, like, you can create artifacts.

Cylance also lets you classify different severities of AV detections, while SentinelOne uses signatures. So, they work slightly differently. In my opinion, Cylance might be lighter, but both are competitors with similar functionality, just a different approach. That's about it.

The solution is mostly for EDR stuff, basically, to protect a company if it got hit by ransomware. That was one of the biggest worries. That was the main use it, was to monitor and protect at this point.

We use CylanceOPTICS for malicious URLs and malicious processes. 

Malicious processes that we're attempting to be notified about, and similar things.

Typically, we use machine learning features that we developed over the last half a dozen years to build this product, and therefore we're not a signature-based solution. If there are some anomalies that are taking place, generally we can raise an alarm and beyond just raising an alarm, we can provide some other kind of mitigation. We can maybe block communications or sandbox communications or send an alert as another aspect of control or protection.

We use it to detect and quarantine malware before it executes in the environment.

The primary use would mainly be for intelligent intrusion detection and response. Our biggest customers are two pharmacies and a bank, so it would be applied in the financial and healthcare industries.  

We are an IT company and this is one of the solutions that we implement for our customers. I am a pre-sales solution architect in charge of cybersecurity.