CrowdStrike, Fidelis, SentinelOne and Xcitium

About Fidelis

Fidelis sells a range of solutions that includes XDR, NDR, EDR and CNAPP, offered for proactive cyber defense. Fidelis Elevate is an XDR platform. Fidelis Elevate correlates threats across network, endpoint and cloud. Fidelis Elevate automates detection and response workflows.^[1][3][4]

Fidelis Network is an NDR platform with network traffic analysis and network behaviour anomaly detection across all ports and protocols. Fidelis Network retains metadata for up to 360 days to support investigations and compliance. Fidelis Network lets users decrypt traffic for deeper analysis to detect malware.^[3][4]

Fidelis Endpoint provides EDR protection on-premises and in the cloud. Fidelis Endpoint covers Windows, macOS and Linux.^[3][4]

Fidelis Deception delivers alerts and events from decoys, AD credentials, poisoned data and suspicious traffic. Fidelis Deception monitors IoT and cloud resources as deceptive objects. Fidelis Deception is deception technology that uses decoys and lures. Fidelis Active Directory Intercept combines an AD-aware NDR platform, integrated Active Directory deception technology and foundational AD log and event monitoring. Fidelis Active Directory Intercept monitors for suspicious changes and privilege escalation attempts. Fidelis Active Directory Intercept is designed specifically for Active Directory and layers detection, deception and automated defense against identity-based attacks.^[1][3][4]

Fidelis Halo provides continuous asset discovery and vulnerability assessment across clouds. Fidelis Halo supports customers in their data centers and in globally connected regions for AWS, Azure and GCP. Fidelis Halo is a platform for protection and compliance across cloud, hybrid and on-premises workloads.^[3][4][5]

The Fidelis customer success team covers operations support, customer care, education, training and professional services. Fidelis support includes developers, integration experts, security practitioners, technical account managers and tiers 1, 2, and 3 support. Fidelis provides TAM support for program and project management of Fidelis products. Fidelis professional services include product installation and deployment services, training, tuning and rule-writing. Fidelis Security offers courses to support the Fidelis Security suite of products.^[2][6]

Fidelis Security has been audited against the Service Organization Control (SOC) reporting framework for SOC 2, Type 2. Fidelis Security states PCI DSS 3.2 compliance for the handling of credit card holder information. The Fidelis Halo service does not store, process, or transmit any cardholder data. Fidelis Security tests all code for security vulnerabilities before release and regularly scans networks and systems for vulnerabilities.^[1][3][5]

About SentinelOne

SentinelOne sells an AI-native platform with unified protection across endpoint, identity, AI, and cloud. SentinelOne describes its platform as powered by Autonomous Security Intelligence. SentinelOne states that attackers now use AI to generate code, move at machine speed, and exploit gaps. SentinelOne aims to stop attacks across AI tools, endpoints, identity, and cloud. SentinelOne offers solutions tailored to the regulatory, operational, and threat realities of specific sectors.^[1][3]

SentinelOne's endpoint security platform combines endpoint protection (EPP), endpoint detection and response (EDR), and automated remediation in a single unified agent. SentinelOne combines EPP and EDR in a single platform, enabling prevention, detection, investigation, and response without separate tools or agents. SentinelOne uses behavioral AI to identify malicious activity based on how processes behave, not just what they look like. SentinelOne applies automated hardening to close gaps without manual intervention. SentinelOne's AI-powered EDR addresses ransomware, zero-day exploits, supply chain attacks, and fileless malware. SentinelOne provides autonomous, AI-powered protection across every workstation, every cloud workload, and every mobile device. SentinelOne deploys in SaaS, on-premises, hybrid, and air-gapped environments. SentinelOne's endpoint security integrates endpoint, identity, cloud, and third-party telemetry.^[3][4]

SentinelOne contains identity threats from one console. SentinelOne detects credential theft, privilege escalation, and lateral movement as they happen. SentinelOne's identity protection addresses exposure across Active Directory and cloud identity providers including Entra ID, Okta, Ping, SecureAuth, and Duo. SentinelOne uses deception technology and conditional access policies to contain adversaries before impact.^[4]

SentinelOne provides on-device mobile threat defense for iOS, Android, and ChromeOS users against phishing, malware, and risky apps. SentinelOne's mobile threat defense requires no MDM and works without connectivity. SentinelOne blocks network attacks such as man-in-the-middle, rogue Wi-Fi, and malicious profiles before they reach data.^[4]

Purple AI and agentic workflows handle triage, correlation, and routine response. Purple AI investigates what analysts cannot reach in time. SentinelOne provides AI-native protection to detect, contain, and respond to threats in real time.^[3][4]

Wayfinder IRR provides on-demand breach readiness, expert-led compromise assessments, and incident response. DFIR specialists conduct forensic analysis, identify root cause, and collect full-scope evidence, then contain the threat, evict the adversary, and guide teams through remediation. Breach Readiness exercises test plans and people against real-world threat scenarios. SentinelOne's exercises include tabletops, purple teams, war rooms, CTF challenges, and workshops. SentinelOne offers five assessment types: General, M&A, Post-Breach, Insider Threat, and Targeted. SentinelOne's incident response has a 4-hour SLA for initial expert response and a 24-hour SLA for preliminary findings. One retainer secures a renewable pool of expert hours used across readiness, assessments, and response. SentinelOne's response work covers end-to-end investigations, threat eviction, root cause analysis, IOC analysis, and malware reverse engineering. The response phase delivers executive reporting, compliance documentation, and actionable recommendations.^[1][5]

Wayfinder Emergency Response delivers on-demand access with no commitment required. SentinelOne offers an immediate 40-hour on-demand DFIR block that requires no retainer. SentinelOne hunts for hidden, existing threats and undiagnosed malicious activity in the environment. Hidden threats are identified and neutralized by analysts and Google Threat Intelligence.^[4][5]

SentinelLabs, the research arm of SentinelOne, hosted LABScon 2024, a 3-day conference.^{[1][3][4][5][6]}

About Xcitium

Xcitium sells a zero trust cybersecurity platform that protects endpoints, networks and cloud workloads from zero-day threats by isolating unknown files until they are analyzed and given a verdict. Xcitium says it exists to ensure that people can embrace technology fully, without the shadow of insecurity hanging over them.

Xcitium describes its approach as zero trust auto-containment. Xcitium isolates unknowns at run-time until they are analyzed and given a verdict of good or bad. Unknowns are allowed to execute in virtual resources, where they cannot do any damage. Xcitium says its approach allows executables to run in virtualized containers where they cannot do any damage.

Xcitium contrasts this with traditional detection-based security. Xcitium says traditional security models only recognize and prevent known malware, leaving organizations vulnerable to unknown threats. Xcitium says there is always a lag when new malware is introduced before a solution can be created. Xcitium says the zero-day threat lag leaves systems unprotected during that window.

Xcitium offers US and EU versions of the Xcitium Enterprise Platform, and US and EU versions of a New Xcitium MSP Platform. Xcitium says its Zero Trust Auto Containment protects endpoints, networks and cloud workloads from zero-day threats and lets customers run their business without fear of malware or ransomware.^[1]

On the endpoint side, Xcitium offers ZeroDwell Containment, EPP and Next-Gen EDR to give full context of an attack and how hackers are attempting to breach a network. Xcitium monitors endpoint device activities and policy violations and provides threat hunting and SOC services with 24/7 threat management. Xcitium offers Managed SOC services for MSPs and MSSPs. Xcitium also offers outsourced zero trust managed security with options for protecting endpoints, clouds and networks.^[1][5]

Xcitium Complete XDR uses a 24x7x365 team of SOC analysts to conduct in-depth investigations. Xcitium's XDR platform lets its respondents automate the forensic collection process, block activity in real-time, isolate endpoints from the network and execute custom commands. Xcitium's cybersecurity experts continuously hunt through generated logs looking for anomalous and suspicious activity across a customer's organization. Xcitium baselines a customer's environment for known good behavior and alerts on deviations outside those recorded patterns. Xcitium's incident response team conducts in-depth forensic investigations and provides a detailed timeline of attack activity derived from digital forensics. Xcitium says its Verdict Cloud integration checks process execution through hash submission.^[6]

For cloud workloads, Xcitium's Cloud Native Application Protection Platform (CNAPP) provides automated zero trust cloud security for cloud-based applications and cloud workloads, including infrastructure DevOps from code to runtime.^[5]

Xcitium names customers on its case studies. Gem State Paper & Supply is a family-owned janitorial paper and supply distribution company with over 75 employees serving customers in the Northwest region of the United States. The Grand Bend Area Community Health Centre is a non-profit healthcare organization located in Southwestern Ontario.^[1][5][6]