SentinelOne opens Purple AI agentic investigation to all customers

SentinelOne has opened its Purple AI Agentic Investigation capability to all Singularity Platform customers, offering a complimentary trial of autonomous, zero-click threat investigation designed to ease pressure on security operations centre (SOC) teams.

The capability allows Purple AI to detect, investigate, verify and respond to threats without waiting on analyst availability. When a threat crosses a defined threshold, the system investigates, renders a verdict and acts at machine speed - while analysts retain full visibility and control.

Purple AI runs on telemetry already held within the Singularity Platform - across endpoint, identity, cloud and third-party security data - and inside existing automated workflows. The company said no additional deployment, integration or tuning is required, and no data leaves the platform. Activation is a single click, controlled by administrators, role-based and reversible.

The investigation engine draws on a multi-model approach, combining Anthropic's Claude, OpenAI's GPT and SentinelOne's proprietary Ultraviolet models. According to the company, this compresses investigations that previously took hours or days into minutes or seconds. Every verdict carries a complete, auditable evidence chain, and customers can adjust the degree of autonomy through a configurable human-in-the-loop setting.

Alongside the launch, SentinelOne introduced Singularity Credits, a unified currency for AI-powered work across the platform, including Agentic Investigation. Customers trialling the capability receive a complimentary allotment of credits; no payment method is required during the trial. After the trial period, credits can be purchased through partners, direct billing or eCommerce.

“Today’s security teams face more critical alerts than any staffing plan could investigate, and AI-powered threats are only going to make that worse,” said Chris Corde, chief product officer of SentinelOne.

“Investigation capacity has become the binding constraint of the modern SOC: detections climb, alerts queue, and verdicts wait on analyst availability. Purple AI’s Agentic Investigation capability is designed to remove that constraint by making investigations automatic, continuous, and immediate.”