SentinelOne Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Sentinelone

1. 1

   Request SentinelOne's current SOC 2 Type II report and bridge letter — check their trust page at trust.sentinelone.com (many reports are available there with a vendor NDA) or contact their security team directly at security@sentinelone.com. Confirm the audit period covers the last 12 months and that the bridge letter is dated within 6 months.

   SOC 2 Overview (AICPA)How to Find Vendor Trust Pages
2. 2

   Request ISO 27001 certificate documentation directly from SentinelOne's compliance team — ask for the certificate number, issuing body, and expiry date so you can independently verify via the IAF CertSearch registry at iafcertsearch.org.

   ISO 27001 Standard
3. 3

   Document the Chris Krebs executive order event in your vendor risk register with a note on its status: this was a U.S. government security clearance action affecting an individual employee, not a regulatory enforcement action against the company. Assess whether your organization has federal contracting dependencies on SentinelOne that could be affected by any ongoing federal relationship constraints.

   NIST Supply Chain Risk (SP 800-161)
4. 4

   Raise the HTTP security header gap (missing CSP and X-Frame-Options on sentinelone.com) in your next vendor security review. Ask SentinelOne to confirm whether a remediation plan is in place and request their internal application security scanning results for the Singularity Platform console.

5. 5

   Request clarification on AI data usage: ask SentinelOne's legal or security team to confirm in writing whether customer data is used to train AI/ML models (including Purple AI or similar features), what third-party AI providers are used in the platform, and whether enterprise customers can opt out. Reference their privacy notice at https://www.sentinelone.com/legal/privacy-notice/ as the starting point.

6. 6

   Verify TLS certificate renewal automation is active for sentinelone.com before May 1, 2026 — ask your SentinelOne account team to confirm the automated renewal mechanism and that it was tested within the last 90 days.

   SSL Labs Test
7. 7

   For the FedRAMP-authorized Singularity Platform, confirm your specific deployment is covered under the authorized boundary by reviewing the authorization package at https://marketplace.fedramp.gov/products/FR1919071020 and requesting the System Security Plan (SSP) or a customer responsibility matrix from your SentinelOne federal account team.

   FedRAMP Marketplace

• Web archive history was unavailable during this assessment, limiting the ability to establish a full longitudinal view of the domain's online presence prior to current data sources.
• Certificate Transparency log data (Certificate Transparency service) was partially unavailable; subdomain enumeration via CT logs could not be completed, and certificate data was derived from a direct TLS handshake only.
• ISO 27001 certification could not be independently verified through the IAF CertSearch public registry during this assessment period — the claim appears on the vendor's trust page but should be treated as vendor-attested pending manual verification.
• PCI DSS listing status could not be confirmed via the public Visa/Mastercard service provider registries — the PCI DSS claim is vendor-attested via trust.sentinelone.com.
• HITRUST certification status could not be confirmed; the HITRUST certified entity directory was not renderable during this assessment and no independent evidence of HITRUST certification was found.
• AI data usage policy was located but contains no explicit statements regarding customer data training practices or third-party AI provider usage, limiting the ability to fully assess AI-related data handling risk.
• The subprocessor list retrieved (Qualys, SSL/TLS analysis service) represents only the vendor's published page at the time of assessment and may not reflect the full scope of subprocessors used in the Singularity Platform environment.