SentinelOne expands security operations automation with governed AI

SentinelOne has today announced governed, closed-loop response across the Singularity Platform, delivering trustworthy automation for security operations. Purple AI and Singularity Hyperautomation now autonomously investigate alerts, reach verdicts, and execute responses.

Security teams set the boundaries first, deciding where AI acts on its own and where it stops for human sign-off. The Autonomous SOC now runs from alert to action, at the speed and scale of AI, with the confidence and control of human defenders.

SOC teams have tried to embrace automation for years to deal with an overwhelming volume of alerts and data. Response automation was first attempted through SOAR playbooks, though those playbooks are fixed decision trees that break the moment reality diverges from the script. What stayed missing was judgment at the point of action. Purple AI supplies it, choosing the next step from what the investigation actually found rather than from a branch encoded months earlier. The loop closes.

The foundation is already carrying a production load. Purple AI Agentic Investigation has been running in customer environments since June, and now handles more than 8,500 critical autonomous investigations every day. More than a third of the eligible customer base has it running. Across that base, Purple AI investigates nearly three times as many alerts as analysts reach by hand. Alerts that would have aged in a queue get investigated, and analysts spend their hours on the decisions that need judgment.

“Security teams need AI they can trust to act within boundaries they set,” said Chris Corde, Chief Product Officer, SentinelOne. “With this release, teams decide exactly where Purple AI is permitted to execute autonomously, and where it pauses for a human. That governance is what makes autonomous response viable in a live SOC. Human response time stretches on nights and weekends – attack timelines do not. In a single recent weekend, Purple AI investigated more than 5,000 critical alerts across our customer base, each in minutes. Nothing waited for Monday.”

What decides whether a SOC can adopt autonomous response based on agentic reasoning is whether a human can see the action, trace it, and take it back. Every AI-driven action in the Singularity Platform is traceable, auditable, and overrideable by the team that authorized it.

Not every workflow needs to run unattended. The discipline is relevant control, staying in the decisions that carry real consequence and letting the rest run. Governance is the precondition, not the paperwork.

These capabilities are built into core components of the Singularity Platform. SOC teams get AI reasoning and automated execution inside the workflows, tools, and approval chains they already run. There is no integration work and no additional tooling required.

Building on Purple AI Agentic Investigation, the new capabilities use Singularity Hyperautomation workflows to:

• Trigger a Purple AI Agentic Investigation from any point in a workflow, not only the initial alert.
• Pull the full investigation report, with verdict and evidence, directly into automation logic.
• Apply customizable LLM Actions to reason over the findings and call the right next step.
• Call validated response snippets, reusable action blocks teams build once and use repeatedly.

The Hyperautomation workflow capabilities are expected to be generally available later this quarter.