PPurple AI

Purple AI is SentinelOne’s agentic security analyst. When a threat crosses a threshold you set, it opens an investigation without anyone clicking, pulls evidence from endpoint, identity, cloud and third-party data, builds an attack timeline and returns a verdict with its reasoning attached. Buyers are taking it: SentinelOne said Purple AI was attached to 40% of the licenses it sold in the quarter ended October 31, 2025. It suits security teams that already run, or plan to run, the SentinelOne Singularity Platform.

Platform fit and metering are the main things to plan for. Purple AI is part of Singularity rather than a product you bolt onto another vendor’s stack, and agentic investigations draw on Singularity Credits. The base Singularity Complete package starts at $179.99 per endpoint per year, while the Enterprise tier that lists the Agentic AI SOC Analyst is quoted. This review is based on SentinelOne’s published product pages, pricing and announcements as of October 2026; we have not tested it hands-on.

Disclosed Traction From a Public Security Company

SentinelOne is a public company, so Purple AI has more disclosed traction than most AI SOC products. Each item below was checked on the linked page.

The attach rate is the number to weigh. Four in ten new licenses including Purple AI means it has moved past the pilot stage at many SentinelOne customers, and those buyers chose to pay for it. It does not tell you how well it works in your environment, but it does suggest the product is mature enough to be bought at scale.

The customer and IDC figures are useful but come through SentinelOne. The YKK Americas estimate of 40% to 50% investigation time saved is one customer’s experience, and the IDC snapshot was published on SentinelOne’s own page. Ask for references in your industry and run the free Agentic Investigation trial against your real alert volume.

Purple AI Reasoning Over OCSF-Normalized Telemetry

Purple AI sits on top of the Singularity Platform and its data. It reasons over OCSF-normalized telemetry from SentinelOne’s endpoint, identity and cloud products, plus third-party security sources connected to the platform. SentinelOne positions it as the reasoning layer of the whole platform.

The Investigation Flow

1. Trigger. A detection crosses a threshold the customer defines, and a zero-click investigation starts automatically. Auto-Triage also ranks high-risk activity so the riskiest items get attention first.
2. Evidence gathering. Purple AI collects evidence, correlates telemetry across endpoint, identity, cloud and third-party data and builds an attack timeline. The data stays inside the platform.
3. Verdict. It renders a verdict with a Verdict Justification and a complete, auditable evidence chain, drawing on Similarity Analysis across SentinelOne’s community and a Community Verdict model trained on investigations by its Wayfinder managed services team.
4. Response. Depending on how the customer configures it, the verdict either triggers a policy-driven automated response through Singularity Hyperautomation or gives analysts recommended actions.
5. Record. Investigation Notebooks document the work automatically, and every automated action is logged for compliance.

Working With Analysts

Analysts can ask questions in plain language and get answers without writing a query, request AI summaries and follow-up questions, and use guided investigations that help junior staff learn the job. SentinelOne frames the human role as keeping visibility and control rather than doing every step.

Models and Data

Purple AI uses a multi-model approach that combines Anthropic’s Claude, OpenAI’s GPT and SentinelOne’s proprietary Ultraviolet models. Foundation models are swappable, customer data is isolated and SentinelOne says it is not used to train models.

Setup and Controls

For existing Singularity customers, SentinelOne says Agentic Investigation needs no deployment, integration or tuning; an admin turns it on in the console in one click. Activation is role-based and reversible, and consumption guardrails cap how much work the agent does. New customers get onboarding with deployment support, training, 24/7 support and a customer success manager. An MCP Server lets teams connect their own AI agents to Purple AI.

Thresholds and Unapproved Responses Stay With Analysts

People set the thresholds, approve which responses may run automatically and handle cases the policy reserves for analysts. Response beyond pre-approved policies stays with your team, and someone has to own the credit budget.

Published Base Packages, a Quoted Tier and Singularity Credits

SentinelOne publishes prices for its base packages and quotes the tier that includes the agentic SOC analyst. Agentic investigations are metered in Singularity Credits, a unified currency for AI work on the platform.

Prices are in US dollars and exclude taxes. SentinelOne sells through authorized partners, and the partner’s pricing applies if it differs from the published list.

What 100 Endpoints Cost on Complete and Commercial

A 100-endpoint company on Complete. At $179.99 per endpoint, the platform costs $17,999 a year before any credits. Moving to Commercial for identity protection and 90-day retention raises that to $22,999. The free Agentic Investigation trial lets this company see how many credits its alert volume uses before committing.

A mid-size SOC wanting the full agentic analyst. The Agentic AI SOC Analyst is listed under Enterprise, which is quoted. Ask the partner for the platform price and a credit estimate based on your monthly detection count, and get both in writing.

A large enterprise with heavy alert volume. Here the credit line matters most, because every zero-click investigation consumes credits. Use the consumption guardrails, set thresholds so low-value alerts do not trigger full investigations, and review usage monthly in the first quarter.

Hidden and variable costs. Expect variable credit spend, possible upgrades to longer data retention, and partner margins. If you plan to feed third-party data into the platform, ask whether ingestion into SentinelOne’s data products is priced separately.

Purple AI Compared With CrowdStrike Charlotte AI, Microsoft Security Copilot and Cortex AgentiX

Most AI SOC analysts from the big security vendors work best inside their own platforms, so the choice usually follows the platform you already run.

Charlotte AI is the closest match: both are agentic analysts built into an endpoint platform. Microsoft Security Copilot makes more sense for companies whose security runs on Defender and Sentinel. Cortex AgentiX is less an analyst than a platform for building and governing many agents, with a far larger integration catalog. If you are not tied to any of these platforms, independent AI SOC tools such as Dropzone AI sit on top of existing tools instead. See all options on our cybersecurity agents page.

SentinelOne Shops and Lean SOCs Buried in Alerts

• Existing SentinelOne customers: activation is one click with no new integration, and the data is already in the platform.
• Lean SOC teams with too many alerts: zero-click investigations and Auto-Triage take first-pass work off analysts.
• Teams training junior analysts: guided investigations, plain-language hunting and Investigation Notebooks show how cases are worked.
• Public sector and regulated buyers: FedRAMP High support and a no-training data policy ease approvals; see our enterprise agents page.
• Companies consolidating security tools: buyers already moving endpoint, identity, cloud and SIEM work to Singularity get the most from one reasoning layer.

Falcon and Defender Customers

• Teams committed to another EDR: Purple AI is part of SentinelOne’s platform, so Falcon or Defender shops should look at their vendor’s agent or an independent tool.
• Buyers who need a fixed, published price: the agentic analyst is quoted and investigations are metered.
• Very small businesses without a security owner: someone still has to set thresholds, approve response policies and watch credit use.
• Organizations wanting to build many custom agents: a build-and-govern platform such as Cortex AgentiX or Torq Socrates is a better fit.

Platform Commitment, Credits and Response Policies

• Platform commitment: Purple AI’s value depends on Singularity holding your telemetry, which makes switching vendors harder later.
• Metered investigations: credits are consumed per piece of AI work, so a spike in alerts can mean a spike in cost; configure the guardrails.
• Automatic response policies: automated containment is only as good as your policies; start with recommendations and widen automation once you trust the verdicts.
• Vendor-sourced results: the 40% to 50% time saving and 55% faster remediation figures come from a customer quote and an IDC snapshot published by SentinelOne.
• Partner pricing: purchases go through authorized partners whose prices can differ from the list.

Agentic Investigation Opens to All Customers in June 2026

On June 17, 2026, SentinelOne opened Purple AI Agentic Investigation to all customers, adding zero-click investigations, a complimentary trial and pay-as-you-go Singularity Credits. Chief Product Officer Chris Corde said investigation capacity had become the main limit on modern SOCs.

On December 8, 2025, CRN reported that Purple AI had a 40% attach rate on licenses sold in SentinelOne’s fiscal third quarter, that revenue rose 23% to $258.9 million, and that the company had acquired Observo AI and Prompt Security.

The Obvious First AI SOC Agent for SentinelOne Users

For SentinelOne customers, yes, it is the obvious first AI SOC agent to try. Purple AI scores 8.5/10 on our scale. It completes real investigations on its own, explains each verdict with an evidence chain, and can act within policies you approve. Turning it on costs nothing during the trial, and the 40% attach rate shows plenty of buyers have decided it is worth paying for.

The score reflects pricing and platform fit. The agentic analyst sits in a quoted tier, investigations are metered in credits, and the product is built for Singularity customers. Public user reviews are still too few to judge. Run the trial on a month of real alerts, measure credit use against analyst hours saved, and expand automatic response only after the verdicts prove reliable.

What SOC Analysts Want to Know About Purple AI

Is Purple AI Included in SentinelOne Singularity Complete?

Singularity Complete lists an AI Security Assistant, while the Agentic AI SOC Analyst for automated triage is listed under the quoted Enterprise tier. Agentic Investigation runs on Singularity Credits after a complimentary trial. Confirm what your package includes with your SentinelOne partner.

What Are Singularity Credits?

Singularity Credits are SentinelOne’s unified currency for AI-powered work on the platform. Zero-click investigations draw on them. Customers can buy credits through partners, direct billing or eCommerce once the free trial ends.

Which AI Models Does Purple AI Use?

SentinelOne uses a multi-model approach combining Anthropic’s Claude, OpenAI’s GPT and its own Ultraviolet models. Foundation models are swappable, and SentinelOne says customer data is isolated and not used to train models.

Can Purple AI Stop Attacks Without a Human?

Yes, within limits you set. A verdict can trigger a policy-driven automated response through Singularity Hyperautomation, but automated actions only run inside pre-approved policies and are logged. You can also keep it to recommendations only.

How Does Purple AI Differ From CrowdStrike Charlotte AI?

Both are agentic analysts built into an endpoint security platform, so the deciding factor is usually which platform you run. Purple AI reasons over OCSF-normalized data, including third-party sources in Singularity, and meters investigations in Singularity Credits.