To Our Partners and Customers

The following intelligence brief was sent to all SentinelOne partners and customers today:

Executive Summary

Recent U.S. and Israeli strikes against Iranian targets, followed by Iranian attacks on multiple regional locations, present a highly dynamic geopolitical situation with credible cyber threat implications. Iran has historically incorporated cyber operations into periods of regional escalation.

Given the rapid escalation of geopolitical tensions, we assess that Iranian state-aligned cyber activity is likely to intensify in the near-term based on a long track record of leveraging cyber operations for asymmetric retaliation, coercive signaling, and strategic messaging. Prior campaigns, including destructive wiper malware, infrastructure disruption, and influence operations masquerading as ‘hacktivism’, demonstrate both capability and intent to operate in the cyber domain alongside kinetic action.

This report outlines Iran’s historical cyber posture, relevant tactics and tradecraft, and our forward-looking assessment of potential cyber responses in the days and weeks following the airstrikes.

We assess with high confidence that organizations in Israel, the United States, and allied nations are likely to face direct or indirect targeting – particularly within government, critical infrastructure, defense, financial services, academic, and media sectors.

We recommend that all clients, especially those operating in, or supporting, U.S. and Israeli infrastructure, review their security posture and preparedness accordingly.

This assessment is current as of February 28, 2026 and reflects a rapidly evolving threat environment.

Iran’s Cyber Operations to Date

Iran presents a mature, well-resourced cyberthreat based on more than fifteen years of experience across a wide range of malicious cyber events.

Iran uses a diverse set of cyber tools to further state objectives, particularly preservation of the Iranian regime, including:

• Espionage and credential theft via APT34, APT39, APT42, and MuddyWater, targeting a wide range of military, civilian, telecommunications, and academic institutions, particularly against regional targets (Israel, Middle East) and the United States
• Disruptive and destructive campaigns, including the use of wiper malware
• Targeted spearphishing and social engineering campaigns, supporting strategic intelligence collection across multiple industries
• Fake hacktivist personas for plausible deniability and psychological impact (e.g., DarkBit, Cyber Av3ngers)
• Coordinated disinformation and influence ops across Telegram, X, and compromised news outlets
• Internet blackouts within Iran to control public opinion and narrative, while similarly countering the effect of foreign influence operations
• Proxy ransomware and criminal fronts blurring lines between state and financially motivated actors

Iranian cyber actors previously aligned their operations with kinetic campaigns, often acting as a force multiplier for regional allies like Hamas or as a standalone tool of retaliation. The TTPs employed by Iranian hacktivists increasingly mirror those used by state-sponsored APTs, raising critical questions about capability sharing and formal command-and-control relationships within this environment.

Expected Iranian Cyber Response to Current Events

1 – Precision Espionage Operations

Expect escalated targeting of Israeli defense, government, and intelligence networks using spearphishing, credential harvesting, and deployment of custom malware. Historically, groups such as APT34 (OilRig) and APT42 (TA453) leveraged legitimate access to move laterally and exfiltrate strategic intelligence. Additionally, U.S. military and government organizations will likely be targeted in similar campaigns.

Anticipated Targets:

• U.S. military and government organizations
• Israeli defense entities and affiliated research organizations
• U.S. and Israeli diplomatic infrastructure
• Defense contractors and supply chain partners
• Strategic allies and locations in theater

2 – Disruptive & Destructive Tactics

Iran has a well-documented history of using destructive malware and DDoS attacks to disrupt the critical infrastructure of its adversaries. We assess a high likelihood of similar tactics being deployed against U.S. and Israeli sectors, particularly utilities and public-facing systems.

Key techniques include:

• Deployment of wipers via fake hacktivist personas or directly-attributed APT clusters
• Exploitation of unpatched or poorly secured public-facing web services for defacement and initial access
• Use of scheduled tasks and LOLBins to execute custom wiper malware with stealth and persistence

Anticipated Targets:

• Transportation, Communication, Energy and Water utilities in U.S. and Israel
• Telecom, alerting systems, and national broadcast infrastructure
• Financial platforms and digital banking services

3 – Coordinated Influence & Disinformation Campaigns

Iranian-aligned actors are likely to amplify disinformation campaigns to shape public perception, particularly around civilian impact, military failure, and geopolitical instability. These efforts often run concurrently with real-world escalations and aim to degrade public trust in institutions.

Anticipated Themes:

• Allegations of Israeli war crimes
• U.S. and Israeli military losses
• Fabricated claims of successful Iranian cyber retaliation
• Disinformation on U.S.–Israel political division
• Leaks of manipulated or stolen documents misattributed to Israeli insiders
• Lack of support from the U.S. populace for ongoing strikes against Iran

4 – Probing Attacks on U.S. & Israeli Infrastructure

Iran has demonstrated readiness to expand attacks to Western infrastructure during periods of high tension. Recent examples include the exploitation of Unitronics PLCs at U.S. water treatment plants (late 2023), highlighting a shift toward ICS/OT targets. Such actions serve retaliatory and signaling purposes and are often designed to be low-impact yet high-visibility to maximize psychological effect.

Anticipated Targets:

• U.S. defense industrial base, especially contractors supporting military action
• Israeli military and key government organizations
• Critical infrastructure (water, energy, transportation) in the U.S. and Israel
• Regional partners (e.g., Jordan, UAE, Egypt, Saudi Arabia) aligned with U.S. and Israeli interests
• Media and academic institutions reporting on the conflict

SentinelOne Detection & Monitoring Posture

SentinelOne research and detection teams have closely followed Iranian cyber actors for many years. We provide multiple layers of protection and are closely monitoring emerging threat intelligence to maximize coverage.

We extensively cover techniques known to be used by Iranian threat groups including:

• PowerShell and script abuse
• Proxy tools
• Credential theft
• Keylogger components
• Wipers
• Browser credential theft
• DLL sideloading
• Tunneling tools (ngrok/Cloudflared)
• Scheduled task persistence
• Remote access tool abuse
• Active Directory reconnaissance
• Destructive boot tampering

These protections are not Iran-specific but known to be effective in detecting their operations.

We are monitoring the situation closely and can ship new detections quickly through Platform Rules updates or Live Security Updates.

Recommendations

1. Increase Vigilance Against Phishing and Credential Abuse

• Prioritize MFA enforcement and internal phishing detection
• Monitor for abuse of VPN, email, and collaboration platforms
• Monitor for suspicious activity involving legitimate user accounts and applications

2. Harden Critical Infrastructure and OT Environments

• Patch and segment exposed ICS components, especially common HMI/PLC vendors
• Scan all Internet-facing infrastructure, and patch any vulnerable Internet-facing services
• Consider removing or restricting network access to any non-critical Internet-facing services, especially if they are not protected by MFA
• Review DDoS mitigation playbooks and response procedures

3. Monitor for Influence Operations and Fake Leaks

• Establish rapid communication response protocols for disinformation relevant to your organization
• Be prepared for threat actors using “hacktivist” branding and Telegram/Telegram-style platforms for communication
• Consider there are likely masquerade efforts and this requires a detailed assessment to determine true origin

4. Review and Test Incident Response Plans

• Ensure IR and SOC teams maintain heightened alert status
• Simulate data-wipe and ransomware scenarios
• Simulate corporate social media hijacking scenarios and prepare for account pausing/access resets

5. Establish Clear Points of Contact

• Ensure internal organization has direct POCs for support for security incidents
• Communicate posture expectations and escalation paths internally

6. Monitor for activity associated with Iranian state-aligned threat actors

SentinelOne is proactively hunting for IOCs and TTPs associated with these groups. These threat hunts are being performed for all Wayfinder Threat Hunting customers. Any related hunt findings will be visible in the Wayfinder Threat Hunting dashboard.

Closing Note

This report is intended to support informed decision-making and proactive defensive measures amid a dynamic and escalating geopolitical conflict.

The cyber threat landscape associated with Iranian state-aligned actors is adaptive, and we assess that both targeting priorities and tactics may shift rapidly in response to real world developments, political statements, or perceived provocations.

We advise clients to treat this as a time-sensitive assessment and to revisit posture, incident response, and monitoring processes regularly.

For immediate questions or escalations, please contact your Client Success Lead or reach our Support teams directly at: https://www.sentinelone.com/global-services/get-support-now/

Appendix

Customers should consider activating Platform Detection Library rules to improve coverage. The following rules are known to be effective against Iranian cyber operations:

MuddyWater

• Possible MuddyWater DLL Drop Consistent with Audio Driver Sideloading

Credential Dumping

• Suspicious Task Creation for Credential Harvesting
• Python-Based Network Exploitation Tool
• Potential LSASS Dumping Tools
• Credential Dumping via Shadow Copy
• Interactive NTDS Harvesting via VSS
• Cached Domain Credential Dumping

Tunneling & Remote Access

• Ngrok Domain Contacted
• Cloudflared Persistent Tunnel Establishment Detected
• Anomalous Process Initiating Cloudflare Tunnel Traffic

Collection & Exfiltration

• Keylogging Script via PowerShell
• Chromium Browser Info Stealer via Remote Debugging
• Browser Credential and Cookie Data Access Attempt

PowerShell/Script Abuse

• PowerShell Script Execution via Time Based Integer IPv4
• Suspicious Usage of .NET Reflection via PowerShell
• Encoded Powershell Launching Command Line Download

Defense Evasion, Impact, Discovery

• Potential DLL Sideloading in PerfLogs Directory
• Disk Data Wipe Attempt via Dd Utility
• Boot Configuration Tampering via BCDEdit
• BloodHound Active Directory Reconnaissance File Creation

AI coding assistants are no longer just autocompleting lines of code, they are quietly making decisions for you. Tools like Claude Code are able to read projects, plan multi-step changes, install dependencies, and modify files with minimal human oversight. To make this possible, these assistants rely on plugin marketplaces, where third-party developers can enable ‘skills’ that teach the agent how to manage infrastructure, testing, and dependencies. Though powerful, the model requires a high degree of trust, thus bringing with it a new set of risks.

At a first glance, third-party marketplace plugins are harmless productivity boosters. Connect a marketplace and enable a plugin so your coding assistant becomes smarter about your stack. However, beneath the convenience is a security blind spot: These same skills often run with extremely high privilege and very little transparency on how they make decisions or where the code and dependencies are coming from. The code issue isn’t prompt manipulation or social engineering – it’s compromised automation.

A full technical blog post by SentinelOne’s own Prompt Security team breaks down how a single benign-looking plugin from an unofficial marketplace exposes a dependency management skill. When the developer asks the agent to install a common Python library, that skill quietly redirects the install to an attacker-controlled source, ensuring a trojanized version of the library is pulled into the project. While nothing looks wrong – the library imports cleanly, the example code runs without error – malicious code is now embedded into the environment, capable of exfiltrating secrets, monitoring traffic, or lying dormant until it is triggered at a later time.

What makes this especially concerning is persistence. Marketplace plugins are not one-off interactions. Once enabled, their skills remain available across sessions and will continue to shape how the agent behaves in the future. Rather than a ‘bad prompt’, this effect is more like compromising your package manager itself.

As AI-driven development workflows accelerate, plugin marketplaces and third-party skills are now part of the software supply chain whether teams realize it or not. If your coding assistant can fetch and execute code on your behalf, every plugin installed joins your trust boundary.

Read the full blog post here for a detailed walkthrough of the attack mechanics and learn why dependency skills are such a powerful, but under-modeled, risk.

Third-Party Trademark Disclaimer:

All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third-party.

A prolific cybercriminal group that calls itself “Scattered LAPSUS$ Hunters” has dominated headlines this year by regularly stealing data from and publicly mass extorting dozens of major corporations. But the tables seem to have turned somewhat for “Rey,” the moniker chosen by the technical operator and public face of the hacker group: Earlier this week, Rey confirmed his real life identity and agreed to an interview after KrebsOnSecurity tracked him down and contacted his father.

Scattered LAPSUS$ Hunters (SLSH) is thought to be an amalgamation of three hacking groups — Scattered Spider, LAPSUS$ and ShinyHunters. Members of these gangs hail from many of the same chat channels on the Com, a mostly English-language cybercriminal community that operates across an ocean of Telegram and Discord servers.

In May 2025, SLSH members launched a social engineering campaign that used voice phishing to trick targets into connecting a malicious app to their organization’s Salesforce portal. The group later launched a data leak portal that threatened to publish the internal data of three dozen companies that allegedly had Salesforce data stolen, including Toyota, FedEx, Disney/Hulu, and UPS.

The new extortion website tied to ShinyHunters, which threatens to publish stolen data unless Salesforce or individual victim companies agree to pay a ransom.

Last week, the SLSH Telegram channel featured an offer to recruit and reward “insiders,” employees at large companies who agree to share internal access to their employer’s network for a share of whatever ransom payment is ultimately paid by the victim company.

SLSH has solicited insider access previously, but their latest call for disgruntled employees started making the rounds on social media at the same time news broke that the cybersecurity firm Crowdstrike had fired an employee for allegedly sharing screenshots of internal systems with the hacker group (Crowdstrike said their systems were never compromised and that it has turned the matter over to law enforcement agencies).

The Telegram server for the Scattered LAPSUS$ Hunters has been attempting to recruit insiders at large companies.

Members of SLSH have traditionally used other ransomware gangs’ encryptors in attacks, including malware from ransomware affiliate programs like ALPHV/BlackCat, Qilin, RansomHub, and DragonForce. But last week, SLSH announced on its Telegram channel the release of their own ransomware-as-a-service operation called ShinySp1d3r.

The individual responsible for releasing the ShinySp1d3r ransomware offering is a core SLSH member who goes by the handle “Rey” and who is currently one of just three administrators of the SLSH Telegram channel. Previously, Rey was an administrator of the data leak website for Hellcat, a ransomware group that surfaced in late 2024 and was involved in attacks on companies including Schneider Electric, Telefonica, and Orange Romania.

A recent, slightly redacted screenshot of the Scattered LAPSUS$ Hunters Telegram channel description, showing Rey as one of three administrators.

Also in 2024, Rey would take over as administrator of the most recent incarnation of BreachForums, an English-language cybercrime forum whose domain names have been seized on multiple occasions by the FBI and/or by international authorities. In April 2025, Rey posted on Twitter/X about another FBI seizure of BreachForums.

On October 5, 2025, the FBI announced it had once again seized the domains associated with BreachForums, which it described as a major criminal marketplace used by ShinyHunters and others to traffic in stolen data and facilitate extortion.

“This takedown removes access to a key hub used by these actors to monetize intrusions, recruit collaborators, and target victims across multiple sectors,” the FBI said.

Incredibly, Rey would make a series of critical operational security mistakes last year that provided multiple avenues to ascertain and confirm his real-life identity and location. Read on to learn how it all unraveled for Rey.

WHO IS REY?

According to the cyber intelligence firm Intel 471, Rey was an active user on various BreachForums reincarnations over the past two years, authoring more than 200 posts between February 2024 and July 2025. Intel 471 says Rey previously used the handle “Hikki-Chan” on BreachForums, where their first post shared data allegedly stolen from the U.S. Centers for Disease Control and Prevention (CDC).

In that February 2024 post about the CDC, Hikki-Chan says they could be reached at the Telegram username @wristmug. In May 2024, @wristmug posted in a Telegram group chat called “Pantifan” a copy of an extortion email they said they received that included their email address and password.

The message that @wristmug cut and pasted appears to have been part of an automated email scam that claims it was sent by a hacker who has compromised your computer and used your webcam to record a video of you while you were watching porn. These missives threaten to release the video to all your contacts unless you pay a Bitcoin ransom, and they typically reference a real password the recipient has used previously.

“Noooooo,” the @wristmug account wrote in mock horror after posting a screenshot of the scam message. “I must be done guys.”

A message posted to Telegram by Rey/@wristmug.

In posting their screenshot, @wristmug redacted the username portion of the email address referenced in the body of the scam message. However, they did not redact their previously-used password, and they left the domain portion of their email address (@proton.me) visible in the screenshot.

O5TDEV

Searching on @wristmug’s rather unique 15-character password in the breach tracking service Spycloud finds it is known to have been used by just one email address: cybero5tdev@proton.me. According to Spycloud, those credentials were exposed at least twice in early 2024 when this user’s device was infected with an infostealer trojan that siphoned all of its stored usernames, passwords and authentication cookies (a finding that was initially revealed in March 2025 by the cyber intelligence firm KELA).

Intel 471 shows the email address cybero5tdev@proton.me belonged to a BreachForums member who went by the username o5tdev. Searching on this nickname in Google brings up at least two website defacement archives showing that a user named o5tdev was previously involved in defacing sites with pro-Palestinian messages. The screenshot below, for example, shows that 05tdev was part of a group called Cyb3r Drag0nz Team.

Rey/o5tdev’s defacement pages. Image: archive.org.

A 2023 report from SentinelOne described Cyb3r Drag0nz Team as a hacktivist group with a history of launching DDoS attacks and cyber defacements as well as engaging in data leak activity.

“Cyb3r Drag0nz Team claims to have leaked data on over a million of Israeli citizens spread across multiple leaks,” SentinelOne reported. “To date, the group has released multiple .RAR archives of purported personal information on citizens across Israel.”

The cyber intelligence firm Flashpoint finds the Telegram user @05tdev was active in 2023 and early 2024, posting in Arabic on anti-Israel channels like “Ghost of Palestine” [full disclosure: Flashpoint is currently an advertiser on this blog].

‘I’M A GINTY’

Flashpoint shows that Rey’s Telegram account (ID7047194296) was particularly active in a cybercrime-focused channel called Jacuzzi, where this user shared several personal details, including that their father was an airline pilot. Rey claimed in 2024 to be 15 years old, and to have family connections to Ireland.

Specifically, Rey mentioned in several Telegram chats that he had Irish heritage, even posting a graphic that shows the prevalence of the surname “Ginty.”

Rey, on Telegram claiming to have association to the surname “Ginty.” Image: Flashpoint.

Spycloud indexed hundreds of credentials stolen from cybero5dev@proton.me, and those details indicate that Rey’s computer is a shared Microsoft Windows device located in Amman, Jordan. The credential data stolen from Rey in early 2024 show there are multiple users of the infected PC, but that all shared the same last name of Khader and an address in Amman, Jordan.

The “autofill” data lifted from Rey’s family PC contains an entry for a 46-year-old Zaid Khader that says his mother’s maiden name was Ginty. The infostealer data also shows Zaid Khader frequently accessed internal websites for employees of Royal Jordanian Airlines.

MEET SAIF

The infostealer data makes clear that Rey’s full name is Saif Al-Din Khader. Having no luck contacting Saif directly, KrebsOnSecurity sent an email to his father Zaid. The message invited the father to respond via email, phone or Signal, explaining that his son appeared to be deeply enmeshed in a serious cybercrime conspiracy.

Less than two hours later, I received a Signal message from Saif, who said his dad suspected the email was a scam and had forwarded it to him.

“I saw your email, unfortunately I don’t think my dad would respond to this because they think its some ‘scam email,'” said Saif, who told me he turns 16 years old next month. “So I decided to talk to you directly.”

Saif explained that he’d already heard from European law enforcement officials, and had been trying to extricate himself from SLSH. When asked why then he was involved in releasing SLSH’s new ShinySp1d3r ransomware-as-a-service offering, Saif said he couldn’t just suddenly quit the group.

“Well I cant just dip like that, I’m trying to clean up everything I’m associated with and move on,” he said.

The former Hellcat ransomware site. Image: Kelacyber.com

He also shared that ShinySp1d3r is just a rehash of Hellcat ransomware, except modified with AI tools. “I gave the source code of Hellcat ransomware out basically.”

Saif claims he reached out on his own recently to the Telegram account for Operation Endgame, the codename for an ongoing law enforcement operation targeting cybercrime services, vendors and their customers.

“I’m already cooperating with law enforcement,” Saif said. “In fact, I have been talking to them since at least June. I have told them nearly everything. I haven’t really done anything like breaching into a corp or extortion related since September.”

Saif suggested that a story about him right now could endanger any further cooperation he may be able to provide. He also said he wasn’t sure if the U.S. or European authorities had been in contact with the Jordanian government about his involvement with the hacking group.

“A story would bring so much unwanted heat and would make things very difficult if I’m going to cooperate,” Saif said. “I’m unsure whats going to happen they said they’re in contact with multiple countries regarding my request but its been like an entire week and I got no updates from them.”

Saif shared a screenshot that indicated he’d contacted Europol authorities late last month. But he couldn’t name any law enforcement officials he said were responding to his inquiries, and KrebsOnSecurity was unable to verify his claims.

“I don’t really care I just want to move on from all this stuff even if its going to be prison time or whatever they gonna say,” Saif said.

This is an era defined by relentless pressure on cybersecurity professionals. As environments and attack surfaces have expanded, endpoint, cloud, identity, and now AI signals continue to pile up faster than teams can interpret them. Meanwhile, rapidly evolving TTPs, fueled by ransomware-as-a-service (RaaS) and other off-the-shelf tooling have enabled motivated threat actors to move with the sophistication and speed of the most advanced nation state adversaries.

With defenders stretched thin, actors are using these advanced techniques to hide behind operational noise. And, while handling alert fatigue isn’t enough, even mature teams can struggle to confront advanced persistent threats, especially those that specialize in evasion and long-term access.

Addressing these new realities requires reimagining defenses – new strategies to unify signals, eliminate the noise, augment human capacity, and truly prepare for incidents long before they happen. This requires more than just better tools. It requires a full shift in how detection and response is delivered.

That shift is SentinelOne’s Wayfinder Threat Detection and Response (Wayfinder TDR), now generally available (GA).

Our Ethos | Defense Through AI, Intelligence & Human Experts

Wayfinder TDR is built on a foundational belief: True cyber resilience emerges from the fusion of AI, intelligence, and world-class human expertise – not from any single component in isolation.

Modern adversaries evolve too quickly, hide too effectively, and move too fluidly for traditional service models to keep up. Automated systems can miss subtle behaviors and human teams alone cannot keep pace with the scale of telemetry, meaning generic threat feeds are no longer the right solution. True defense requires three pillars working in concert.

Intelligence provides the early warning – timely, curated, contextual insight into an attacker’s behavior and tactics. SentinelOne integrates Google Threat Intelligence (GTI), one of the most powerful and comprehensive intelligence sources in the world, directly into every part of Wayfinder. It delivers a level of global threat visibility previously available only to a small set of elite organizations. This data is combined with our SentinelOne intelligence for an unparalleled set of threat content previously unseen in cybersecurity.

AI then transforms that intelligence and raw telemetry into actionable outcomes. SentinelOne’s industry-leading Purple AI engine automates triage, accelerates investigation, enriches findings with context, and closes the gap between detection and action. AI allows Wayfinder experts to cut through overwhelming volumes of data and surface what actually matters to the operation.

Finally, human expertise applies the experience and ingenuity to understand and act on what’s uncovered. Across 16 countries, SentinelOne’s team of threat hunters, analysts, incident responders, and strategic advisors bring decades of hands-on experience with the world’s most sophisticated adversaries. This combined knowledge closes gaps that machines alone cannot see, validating ambiguous signals and guiding customers through moments of uncertainty with clarity and confidence.

Wayfinder deepens this philosophy by combining elite human expertise with agentic, AI-powered threat hunting and investigations. This multi-layered human and AI model brings a level of defense that neither humans nor machines can achieve alone. We believe that the future of AI security is one that elevates – rather than replaces – human defenders, arming them with the speed of automation and the insights of global intelligence.

Our Portfolio | Tailored Protection & Elite Expertise

Wayfinder Threat Detection & Response is a unified portfolio designed to meet organizations where they are. From automated hunting and 24/7/365 MDR to high-touch advisory services during crises, each Wayfinder offering can either stand alone, or bring a comprehensive and adaptive defense program together.

These services deliver end-to-end coverage across preparation, detection, investigation, response, and recovery, ensuring customers are supported through every phase of the threat lifecycle.

Wayfinder Threat Hunting

Threat hunting is the foundation of the portfolio, delivering always-on, fully automated hunts powered by GT, SentinelOne’s threat intelligence, and enriched by SentinelOne experts. It continuously scans customer environments for emerging attacker infrastructure, high-confidence indicators of compromise, and evolving techniques.

Wayfinder Threat Hunting is unique in that it requires no manual tuning, no scheduled queries, and no analyst scripting. Intelligence updates stream directly into the system and are matched against customer telemetry with contextual attribution – threat actor, campaign, and MITRE mapping all included. Findings immediately feed into MDR workflows for rapid investigation and response.

This eliminates blind spots that attackers rely on and brings dynamic, intelligence-led coverage to every organization, regardless of staffing or maturity level.

Wayfinder MDR Essentials

MDR Essentials delivers enterprise-grade, always-on XDR coverage across endpoints, cloud environments, identity providers, and supported partner services. It provides continuous monitoring, triage, investigation, and response, powered by SentinelOne analysts, AI-driven inference, and threat hunting insights. Using curated intelligence from both SentinelOne’s AI-driven alerting and triage and Google Threat Intelligence, get rapid insight and protection at scale.

MDR Essentials is built for organizations that want strong, immediate defense without operational complexity. Onboarding and activation are simple and swift while coverage is unified through the Singularity Platform. Customers benefit from 24/7 protection, rapid containment, and detailed guidance without needing to expand internal teams.

With MDR Essentials, organizations finally get the confidence that cyber experts are watching every signal, every hour, across every critical surface.

Wayfinder MDR Elite

Wayfinder MDR Elite extends the Essentials experience with a premium, high-touch operating model for organizations that are looking for deeper partnership, strategic alignment, and more proactive readiness and response. Every MDR Elite customer receives a dedicated Threat Advisor, an expert who becomes embedded in their security program, and offers hands-on guidance, operational reviews, and tailored risk management recommendations.

Elite also provides bundled access to SentinelOne’s DFIR specialists, enabling advanced investigations, malware analysis, and targeted forensics. As well, Elite customers receive a built-in Incident Readiness & Response (IRR) retainer, ensuring they have pre-approved hours available for compromise assessments, breach simulations, preparedness workshops, and expert counsel during major incidents.

For teams that want not just coverage but clarity, Elite becomes a trusted extension of their leadership and decision-making process.

Wayfinder Incident Readiness & Response

Wayfinder IRR creates a foundation of preparedness that many organizations simply do not have today. With a renewable pool of hours, customers can proactively strengthen their posture or engage experts during high-pressure moments.

The key to this offering is flexibility. Use those hours to get immediate, 24/7/365 access to elite DFIR specialists that respond effectively and compliantly to critical incidents. Or use hours for breach readiness exercises and compromise assessments to uncover hidden risks and improve your security posture and readiness.

Wayfinder IRR experts act as a trusted partner who can guide organizations through high-pressure moments before, during, and after a breach to build confidence, clarity, and resilience. Expert-led exercises, simulations, and advisory services will transform theoretical security plans into reliable, tested incident response capabilities. And when incidents do occur, our team will not only contain, investigate, and stop the breach in its tracks, but will reconstruct attacker activity to understand the “how” and “what” of an incident, identifying compromised accounts, exfiltrated data, and affected systems.

Wayfinder Emergency Response

For organizations experiencing an active breach without a retainer in place, Wayfinder Emergency Response provides urgent access to a 40-hour block of DFIR expertise. It enables rapid containment, adversary eviction, hands-on investigation, and guidance during critical situations.

Our experts’ deep platform expertise speeds investigations and delivers critical evaluations such as rapid Root Cause Analysis, malware reverse engineering, IOC analysis, and more. With Wayfinder Emergency Response, achieve complete incident control with rapid threat containment, root cause analysis, and privileged, counsel-driven investigative support with defensible reporting. This ensures that all organizations have an expert-led lifeline supported by AI-driven analysis and Google-enhanced intelligence during the most critical moments.

Our Vision | Redefining Managed Services for the AI Era

For years, organizations have been forced to choose between generic intelligence feeds, siloed MDR services, and incomplete incident response retainers. These make for complex in-house responsibilities since point solutions only offer bolt-ons rather than cohesive strategies. AI was under utilized. Human expertise was expensive, inconsistent, or inaccessible. We set out to eliminate the fragmentation that leaves so many organizations exposed.

SentinelOne’s Wayfinder TDR services break that cycle by unifying agentic AI, elite human operators, and unmatched threat intelligence insights into a single, adaptive defense fabric. The result? A portfolio that not only responds to threats but proactively seeks them out, contextualizes them, and then empowers organizations to act with precision and speed.

It stands alone in merging together the deep integration of GTI, operational automation driven by AI, and the global scale of human expertise. Instead of stitching together disparate solutions, Wayfinder is purpose-built to streamline telemetry, intelligence, and human insight into a coherent defense program.

This shift matters as modern adversaries are no longer linear nor predictable – they’re fluid. They adapt rapidly. And, they exploit operational complexity. To reduce that complexity, Wayfinder closes detection gaps and reduces the noise while ensuring that experts are available before, during, and after any incident.

This is a fundamental redefinition of what managed security can achieve when human ingenuity and agentic AI move in sync. Aligning intelligence, technology, and human judgment in a single adaptive defense, Wayfinder raises the bar for what true managed security must deliver.

Conclusion | Proactive & Scalable Defense Starts Now

The future of cybersecurity belongs to organizations that can see farther ahead, move faster, and act with confidence. Attackers are only becoming more automated and opportunistic, meaning SOCs need more than tools – they need a combination of the right intelligence translated by trusted experts and partnership when incidents arise.

As announced at OneCon 2025, Wayfinder joins human expertise, agentic AI, and Google Threat Intelligence to deliver a multi-layered human + AI defense model that helps customers fill in their skill gaps, elevate teams, and strengthen their posture immediately.

Wayfinder TDR is the next evolution of SentinelOne’s services portfolio, combining threat hunting, managed detection, and incident response into a force multiplier to empower organizations in regaining control and reducing daily risk.

Shift the advantage back to the defending side with Wayfinder – watch an overview here and book a demo to get started.

Every major technology revolution begins the same way: Promise, panic, and potential.

The internet gave us connection. Cloud gave us scale. AI is giving us cognition – systems that can reason, decide, and act.

Firewalls helped the internet era. Workload protection helped the cloud era. And, in the AI era, you have AI Security.

This is a new field and frontier that requires mastering two disciplines at once.

• Security for AI – Governing and protecting the usage of AI itself. Models, data, agents, and the users and developers who rely on them. In many cases, this is also done by AI.
• AI for Security – Applying agentic AI and machine learning to solve today’s biggest cybersecurity challenge: Staying ahead of AI-powered attacks by detecting, investigating, and responding at machine speed.

Most importantly, in this era, the architecture and infrastructure needed to truly benefit from AI will be the determining factor to successfully secure it. Quality of data, inclusivity of data, cardinality, and latency will be critical, as will be the tools and technologies facilitating those.

At OneCon 2025, we are laying out a practical path to secure this new world. The opportunities AI creates, the risks it introduces. The strategy and product innovation you can put to work today to accelerate and de-risk your AI journey.

AI: Business Accelerant & New Attack Surface

The need for these dual disciplines is driven by the rapid increase in AI usage itself – both by good and bad forces.

AI is accelerating everything. It is transforming how businesses operate, how employees work, and how attackers adapt. Across every single industry, AI is becoming embedded into processes, tools and workflows in every team. Marketing teams use it to generate content. Developers use it to write code. Legal, HR and finance all use it to summarize and automate tasks. AI is now woven into the very fabric of how organizations think and operate.

While holding incredible potential benefits, this transformation is also introducing massive new security risks. Traditional security controls are blind to the data that employees are entering into 3rd-party AI models. Security teams lack visibility into the growing ecosystem of AI tools and assistants spreading across every single enterprise. AI-based browsers that integrate chat or summarization features create new pathways for data exposure. And the rise of Model Context Protocol (MCP) servers that connect agents to agents introduces an entirely new layer of risk that most organizations are not equipped to monitor or govern today.

Meanwhile, adversaries are evolving just as quickly. They are using AI to increase efficiency, precision, and their reach. Non-native English speakers can now craft a convincing, localized spearphishing campaign in minutes. LLMs are being used to write polymorphic malware that mutates faster than traditional defenses can react. Attackers are automating their reconnaissance, identifying vulnerabilities through natural language interfaces, and even embedding AI models directly inside malware to adapt in real time.

The result is a security gap that spans both sides of the equation – on one side, AI as a catalyst for real business innovation and, on the other, AI as an enabler of attack and massive risk exposure.

Building Security in the Age of AI: Three Critical Principles

Protecting this new world requires visibility, intelligent automation, and governance that can move at the same speed as AI itself. In solving for that, we believe in a simple yet critical guiding philosophy to delivering effective AI Security – three critical principles that inform everything that we build and anchor any platform-level defense.

1. Intelligence Over Rules – Security must think, not react. Static signatures and brittle logic can’t match the velocity of modern threats. True protection emerges when AI continuously learns, reasons, and adapts — detecting intent, not just pattern.
2. Autonomy with Accountability – Machines should act at machine speed, but always within human-defined guardrails and system supervision. The future of defense is autonomous, but never ungoverned where AI decisions remain explainable, traceable, and aligned with human values.
3. Unity of Data, Context, and Action – Effective AI security fuses signals from endpoints, identities, and clouds into one coherent understanding. Insight without context is noise; action without context is chaos. The synthesis of both creates real-time, end-to-end resilience.

These principles map directly to the questions customers ask us every day.

How do I better defend my organization?

How do I outpace threats?

How do I get the most from my people and partners?

SentinelOne’s AI Advantage

When it comes to making AI Security real today, SentinelOne is in a unique position. We have been AI-native since day one. Automation has been foundational from the start, not a bolt-on. And, we’ve been using agentic approaches and workflows in live security environments before it became the buzzword du jour.

At launch, we were among the first to apply machine learning to malware detection and prevention. That broke the decades-old pattern of pushing static signatures to endpoints many times a day. Instead of distributing new rules after every outbreak, we trained lightweight predictive models that identified malicious behavior on their own. That meant detecting never-before-seen threats in real time at massive scale.

That innovation reshaped endpoint security and set the foundation for what followed. The same principles of data-driven models, autonomous decision making, and behavioral analytics evolved into the Singularity Platform and now power Purple AI, our agentic system that changes how analysts detect, investigate, and respond. Together, they extend protection and intelligence across endpoint, identity, cloud, and AI. It is an entire platform built on and enhanced by AI. This is how we keep our customers safe: By delivering real time security that is predictive and adaptive, at planet scale.

This year we took the next step with two focused acquisitions:

• Prompt Security – A portfolio built to secure AI use cases and protect how employees, developers, and applications leverage generative and agentic AI. This is a critical component of protecting AI as an attack surface itself.
• Observo AI – An AI-ready streaming data pipeline that intelligently filters, normalizes, and ingests petabytes of telemetry across the enterprise with sub-second latency and strong cost efficiency. Combined with Singularity AI SIEM, this provides both pre-ingestion analytics and flexible pull/stream data collection, ensuring complete visibility, real-time detections and autonomous response across the entire security environment.

These advancements extend Singularity into a unified AI Security architecture that gives defenders a complete, autonomous view across traditional and emerging surfaces – from premise to cloud.

Delivering on the AI Security Vision Today

Today at OneCon, we’re not just giving customers a roadmap and strategy, we’re giving them new tools and innovation to start securing their AI-enterprise today, including:

• New solutions from Prompt Security to secure AI apps, tools, developers and agents – Real-time visibility and policy enforcement across thousands of AI tools. Shadow AI discovery, data loss prevention for prompts and outputs, safe coding with secret redaction and vulnerable code blocking, and protection for internal AI applications.
• Purple AI innovations – Integrated agentic auto-investigations with dynamic runbooks. Next best actions on alerts. One-click custom detection rule creation that turns investigation outcomes into durable detections. Integration with Singularity Hyperautomation for approved response.
• Purple AI MCP Server – A secure bridge between Singularity’s live intelligence and your AI ecosystem. Build your own agents grounded in your security context. Use OpenAI, Anthropic, Gemini, or internal models. Innovate securely at scale. The MCP Server is open source and available on GitHub today.
• Observo AI pipelines and integration with Singularity AI-SIEM – Vendor-agnostic data engine for any source to any destination. When paired with Singularity AI SIEM, Observo supercharges detection and response with high-fidelity, cost-efficient streaming telemetry.
• Wayfinder Threat Detection and Response with Google Threat Intelligence – Global insight combined with automation and human expertise. GTI visibility feeds directly into SentinelOne services. Intelligence becomes action through Purple and our analysts. Faster, more precise response as a matter of process, not hope.
• Platform upgrades:
  • Native scalability to million+ active agents in a single deployment. Faster policy updates with minute command SLA.
  • Agent efficiency improvements across operating systems. Lower CPU and memory usage, fewer support cases, better user experience.
  • AI SIEM query engine overhaul that supports very high cardinality and keeps up to seven years of security data hot. Natural language search in Purple AI operates on the same high performance data. No cold storage delays.
  • Live Security Updates upgrades that dramatically reduce response times, and improve accuracy and efficacy.  And more customer controls for safe rollout.
  • Thousands of new detections continually delivered, from the AI-SIEM to the endpoint agent. We’re wherever the adversary moves, delivering real-time protection across dozens of surfaces and data sources. With AI infused into every layer of our operations, we’re moving faster, scaling further, and stopping even unknown threats with greater precision than ever before.
  • New Infrastructure as Code (IaC) deployment processes, better observability across the platform, and proactive communications on incidents via a public status page have all been added to bolster resilience, reliability and transparency.
  • Active monitoring mode and proactive alerting extends resilience outside the SaaS operation into the Endpoint agent, providing near real-time health metrics of the agents themselves – now transparently available for the customer visibility in the agent management control plane.

The Path Forward in AI Security: Advancing Humanity, Protecting the Human

AI security is more than just defending systems, it’s about defending the fabric of trust that lets humans thrive in a digital world. As intelligence becomes ambient and autonomous, security must evolve from a reactive layer into an enabling force for human progress.

• Empowering Human Potential – By offloading complexity and noise to intelligent machines, AI security frees humans to focus on creativity, empathy, and purpose. Protection becomes invisible, a silent force amplifying human capability rather than constraining it.
• Preserving Digital Integrity – As data becomes identity, securing truth is a moral imperative. AI security safeguards the authenticity of information, ensuring societies can rely on what they see, share, and believe. As our lives move fully into digital spaces, the boundary between human and machine expression blurs. Every action carries traces of who we are. In this new reality, AI Security’s role is to safeguard that trust: To ensure that what we see, share, and decide upon is authentic. It means protecting the fidelity of data, the truth of identities, and the integrity of digital interactions against manipulation. It is the contract to our reality.
• Building Ethical Autonomy – The next era demands systems that defend not only themselves, but the people they serve. Ethical AI security means designing intelligence that understands context, respects privacy, and acts in humanity’s best interest even when no one is watching.

Ultimately, the path forward fuses human and artificial intelligence into a shared defense, machines protecting people, and people guiding machines, so that technology remains our most trusted ally, not our greatest risk.

Defenders deserve a technology that protects every surface, that can see everything, turns data into advantage, and puts human governance at the center. So, let’s get started.

AI for Security. Security for AI. Autonomous protection, always evolving, in production, today, all in pursuit of a safer, brighter future.

Today, on the main stage at OneCon 2025, SentinelOne is taking the wraps off its vision, roadmap, and new portfolio for securing an AI-powered world. From securing AI tools, applications, and agents to transforming and automating security operations, SentinelOne’s AI Security strategy and new innovations will help customers accelerate and de-risk their AI advantage.

Introducing a new portfolio for securing AI, new AI-ready data pipelines, the expansion of Purple AI, SentinelOne’s category-best agentic security analyst, the debut of new AI-powered threat detection and response managed services, and more, the new innovations revealed at OneCon 2025 will focus on how our customers and partners can both secure AI systems and achieve autonomous security today.

Securing AI: New Prompt Security Offerings

At OneCon 2025, SentinelOne is putting customers in control of AI in their organization by introducing a new suite focused on securing known and shadow GenAI use, coding, data leakage, agents and more.

• Prompt Security for Employees – Delivers real-time visibility and control over employee GenAI usage. Supporting more than 15,000 AI sites, it detects and eliminates shadow AI risks and prevents sensitive data exposure.

• Prompt Security for AI Code Assistants – Secures the use of GenAI coding tools by instantly redacting secrets, PII, and IP from code to prevent data leaks. Its real-time Vulnerable Code Scanner blocks insecure or malicious AI-generated outputs before production, helping developers code faster and safer while maintaining organizational control and compliance.

• Prompt Security for AI Applications – Protects custom-built AI solutions, from chatbots to complex automations, against emerging threats like denial-of-wallet and remote code execution (RCE).

• Prompt Security for Agentic AI (Beta) – Provides real-time visibility, risk assessment, and governance for autonomous AI agents built on the Model Context Protocol (MCP) – the first comprehensive solution to secure, monitor, and control agentic AI operations at machine speed.

New AI-Ready Data Pipeline: Integrating Observo AI & Singularity AI SIEM

Following the recent acquisition of Observo AI, SentinelOne is introducing the first integration into its Singularity Platform, giving customers a new AI-native data platform to reimagine how they collect, enrich, and act on data across their entire security ecosystem and power their agentic security operations.

Observo AI’s Integration with Singularity AI SIEM, unites intelligent AI-native streaming data control with agentic AI-powered analytics and orchestration, optimizing data pipelines for enhanced threat detection and autonomous response across all security data. Observo AI efficiently ingests and normalizes petabytes of data from any source, then prioritizes and routes what matters most into Singularity AI SIEM. This unique, transformative combination creates the only SIEM on the market to provide both pre-ingestion analytics and flexible pull/stream data collection.

Expanding Purple AI & New Model Context Protocol Innovations

SentinelOne will also showcase the latest advancements in Purple AI’s agentic triaging, investigations, and workflows, bringing together human-level reasoning with orchestration and automated response. Building on Purple’s agentic roadmap, the capabilities are focused on cutting detection, investigation, and response from hours to minutes for analysts.

• In-line Agentic Auto-investigations with Dynamic Reasoning (Preview) – End-to-end one-click agentic investigations spanning discovery, alert assessment, hypothesis validation, impact analysis, recommended response, and proactive custom rule creation. Purple AI shifts the paradigm from human work assisted by AI to AI work approved by humans, with every step and conclusion clearly documented in a single investigation canvas for human approval.

• Automated and agentic investigations and response through Purple AI’s integration with Singularity Hyperautomation for Agentic Investigations & Response Actions (Preview) – Purple AI seamlessly integrates with Singularity Hyperautomation to execute pre-approved customer workflows to both conduct its agentic investigations, validating hypotheses via actions such as contacting human defenders via Slack, and to agentically surface pre-approved recommended actions to execute.

• Agentic Custom Detection Rule Creation (Preview) – In the investigation pane, analysts can receive agentically recommended custom detection rules that can be created with a single click, enabling security teams to immediately identify and stop similar attacks before they spread.

• Purple AI Model Context Protocol (MCP) Server (Generally Available) – Provides secure, seamless integration between the Singularity Platform and any AI framework or large language model. Acting as a universal translator and intelligence hub, it empowers developers and partners to build custom agentic AI experiences powered by the full context and analytics of SentinelOne’s platform. The open-source Purple AI MCP Server is available today on GitHub.

Managed Services for the AI Era: Wayfinder Threat Detection & Response

Wayfinder combines elite human expertise with agentic AI to deliver next-generation managed services. Built on SentinelOne’s telemetry and Google Threat Intelligence, Wayfinder provides AI-powered threat hunting, MDR, and incident response, enabling faster detection, smarter response, and adaptive defense – empowering teams to focus on high-value priorities.

Managing Attack Paths: Mapping Risks & Securing Cloud Data

As cloud-native AI services gain adoption, SentinelOne is advancing unified exposure management with an upcoming release of Cloud Attack Paths and Data Security Posture Management (DSPM) in Singularity Cloud Security. Together, these capabilities deliver an intelligent cloud defense – mapping how interconnected exposures create exploitable pathways to sensitive data. By revealing critical exposures, Singularity Cloud Security empowers threat analysts to see what attackers see, anticipate lateral movement, and eliminate risks wherever they originate and before they can take shape. With AI-powered protections, deflect threats in real time and stop attacks in their tracks

Contextualizing the Identity Surface: Singularity Identity

The next evolution of Singularity Identity is here: a comprehensive solution that unifies all of SentinelOne’s identity security capabilities into one cohesive and contextual security experience. Delivering real-time detection and response, continuous posture assessments, and proactive risk management across hybrid environments, our solution uncovers threats faster while providing security teams with full visibility and protection across their environment. Our full identity profile now features policy-based conditional access – now in beta and purpose-built for dynamic, zero-trust environments.

Conclusion

OneCon25 showcases the next chapter in cybersecurity. With many innovations showcased this year, SentinelOne is delivering AI-native solutions that transform detection, response, and protection across endpoints, cloud, and enterprise systems. By combining automation, intelligence, and human expertise, organizations can act faster, secure smarter, and embrace AI-driven innovation without compromise, making the vision of autonomous, adaptive security a reality today.

Forward Looking Statements

This blog post includes forward-looking statements including, but not limited to, statements concerning our current and future products and services. Forward-looking statements are subject to risks and uncertainties that could cause actual performance or results to differ materially from those expressed in or suggested by the forward-looking statements. These and other risk factors are described in the “Risk Factors” section of our most recent Annual Report on Form 10-K, subsequent Quarterly Reports on Form 10-Q, and other filings made with the U.S. Securities and Exchange Commission (SEC), which are available free of charge on the SEC’s website at www.sec.gov.

You are cautioned not to place undue reliance on these forward-looking statements. Any future products, functionality and services may be abandoned or delayed, and as such, you should make decisions to purchase products and services based on features that are currently available. Any forward-looking statements made in this document are based on our beliefs and assumptions that we believe to be reasonable as of the date hereof. Except to the extent required by law, we undertake no obligation to update these forward-looking statements to reflect new information or future events.

The Sentinels League is the official, week-by-week standings for the Threat Hunting World Championship – the first-of-its-kind tournament where the world’s top defenders go head-to-head across four surfaces: AI, Cloud, SIEM, and Endpoint. Thousands of blue teamers from more than 100 countries are tackling real-world attack scenarios to earn points, climb the tables, and secure their path to Las Vegas.

Bookmark this blog post to check your position, track the movement each week, and jump into the next qualifier if you’re not on the board yet.

More Than a Game | How the Sentinels League Work

Qualifiers run throughout the month of September across the four league tracks with players who finish in the top 50 in each league advancing to the Regional Finals on October 22 for the Americas, Europe, and Asia Pacific & Japan. From there, regional champions progress to the Grand Final at OneCon in Las Vegas from November 4 to 6, where the World Champion is crowned.

This is more than a game. It’s a global showdown that blends entertainment, education, and elite competition. Defenders everywhere will up-level their skills and battle for:

• $100,000 in prizes
• A championship trophy
• The prestige of being crowned World Champion
• Charitable donations made in partnership with the S Foundation on behalf of each finalist

Only one player will take home the title, but everyone gains the experience of battling in real-world scenarios that sharpen the skills cyber defenders use daily.

A Global Leaderboard in Action | Follow the League Tables Live

These games are grounded in real incidents and operational trade-offs. Players earn points for flags captured and accuracy under time limits. This means pace and precision both matter. The tables below display each player’s alias, alongside points, and the prize they would receive should they finish in that same position.

Qualifying Stages

Compete online from anywhere, or in-person at select events this month. Earn Threat Hunting Hero badges, prizes, and points that advance you up the league tables. Throughout September, players may enter once per qualifier and compete across all four tracks.

• AI Qualifier Games: Take on scenarios featuring AI attackers and AI-powered threat hunting tools.
• Cloud Qualifier Games: Track and neutralize threats across cloud-based attack surfaces.
• SIEM Qualifier Games: Assert your dominance in real-time SIEM hunting and remediation challenges.
• Endpoint Qualifier Games: Hunt down and remediate endpoint vulnerabilities in scenarios pulled straight from real-world incidents.

Regional Finals | October 22

The top 200 players from each region (Americas, Europe, Asia Pacific & Japan) will face off live in an action-packed online event. Only three regional champions will advance.

Grand Final | November 4–6 | OneCon, Las Vegas

Three finalists will earn an all-expenses-paid trip to OneCon 2025 in Las Vegas to compete live on stage for the World Championship title, the trophy, and the $100K prize pool.

Leagues Menu Quick Jump

• AI League
• Cloud League
• SIEM League
• Endpoint League

AI Leagues

Live table for the AI League Qualifiers are as follows. Top 50 on October 2 qualify for the Regional Finals.

AI APJ League

AI EMEA League

AI AMERICAS League

Back to the Menu Quick Jump

Cloud Leagues

Live table for the Cloud League Qualifiers are as follows. Top 50 on October 2 qualify for the Regional Finals.

Cloud APJ League

Cloud EMEA League

Cloud AMERICAS League

Back to the Menu Quick Jump

SIEM Leagues

Live table for the SIEM League Qualifiers are as follows. Top 50 on October 2 qualify for the Regional Finals.

SIEM APJ League

SIEM AMERICAS League

SIEM EMEA League

Back to the Menu Quick Jump

Endpoint Leagues

Live table for the Endpoint League Qualifiers are as follows. Top 50 on October 2 qualify for the Regional Finals.

Endpoint APJ League

Endpoint AMERICAS League

Endpoint EMEA League

Back to the Menu Quick Jump

A Global Competition, Built for the Community

This championship is proud to unite thousands of cybersecurity defenders in a showcase of skill, innovation, and strategy. We invite you to share this blog for live updates, engage with us on social media, help grow the buzz across our community, and watch as the stage for threat hunting glory gets bigger. Also, it’s not too late to make a run at Regionals. Enter the next qualifier and save your spot in the Sentinels League today!

Participation is open worldwide. Prize eligibility is subject to Terms & Conditions and some countries are not eligible to receive monetary rewards. See the full rules for details.