Arcjet vs SentinelOne

How does SentinelOne agentic detection and response compare with Arcjet?

SentinelOne Singularity Agentic Detection and Response (ADR) watches AI agents on the endpoints, cloud workloads, and software as a service (SaaS) platforms that SentinelOne protects, then detects, investigates, and contains an agent that goes off course. Arcjet decides whether each agent action can run before it runs, with a policy evaluated in your code and in the hooks of coding agents.

Choose SentinelOne ADR when your security operations center (SOC) already works in the Singularity Platform and many of your agents are ones you don't write, such as Salesforce Agentforce. Choose Arcjet when you build agents in code or run coding agents such as Claude Code, and you want a per-action policy, threat intelligence on destinations, and protected health information (PHI) detection under a business associate agreement (BAA). The two can run together, because Arcjet exports its decisions to SentinelOne on the Enterprise plan.

Arcjet publishes this comparison. Competitor details come from SentinelOne's public materials, checked on November 6, 2026. Singularity ADR is in early access, so check the linked sources before you decide.

What is SentinelOne Singularity agentic detection and response?

Singularity ADR is a SentinelOne offering, built on the Singularity Platform, that discovers AI agents, enforces what they're allowed to do, monitors their behavior, and detects and stops unintended and malicious activity. SentinelOne announced Singularity ADR on October 21, 2026 at its OneCon 2026 conference, and made it available in early access the same day.

ADR inventories every agent, tool, skill, connector, and Model Context Protocol (MCP) server across endpoints, SaaS, and cloud providers, sanctioned or not, with the permissions each holds and the employees behind it. MCP is the protocol that agents use to call external tools. SentinelOne names coverage beyond its MCP gateway into Salesforce Agentforce, Microsoft Copilot Studio, OpenAI ChatGPT workspace agents, and Anthropic Claude managed agents. The release also names Claude Code, Claude Cowork, and Codex as tools that put agents in every employee's hands, but it doesn't describe per-agent coverage for coding agents.

Detection builds on SentinelOne's endpoint detection and response (EDR), software on each device that records process, file, and network behavior and responds to threats. ADR sends every agent event to the Singularity Data Lake, where you can search it and write detection rules. Unified Storyline puts agent events and EDR behavior in one execution graph, so an analyst sees the user request, the AI assistant, the MCP server that supplied the tool, and the process or file that followed.

Intent drift detection flags the gap between what an agent was asked to do and what it did. Agent containment stops one agent mid-action while the rest of the workflow keeps running, and agentic investigation runs a response within boundaries that you set.

ADR also has prevention controls. Its governance controls allow or block which agents run, who uses them, and what they can reach, with approval workflows for high-risk tools. In-line prevention blocks prompt injection, jailbreaks, credential exfiltration, and tool poisoning before the action executes. According to SentinelOne, the behavioral detections that the Singularity Platform runs on endpoints, cloud workloads, and identities judge anything that gets past policy.

The release doesn't describe a separate installation for ADR, which runs on SentinelOne's coverage of endpoints, identity, mobile, and cloud workloads. On November 2, 2026, SentinelOne announced a Claude Cowork integration that will run a SentinelOne agent inside the virtual machine where Cowork works on macOS and Windows. The release doesn't include pricing for ADR. Help Net Security covered the launch on October 22, 2026.

How does Singularity ADR relate to Prompt Security and Purple AI?

Singularity ADR draws on two SentinelOne product lines, Prompt Security and Purple AI. Prompt Security governs what people and applications send to AI tools and how agents connect to tools and data. Purple AI is SentinelOne's AI analyst for investigations in the SOC. ADR adds runtime detection and response on top of both.

SentinelOne agreed to acquire Prompt Security in August 2025 and has since completed the acquisition. For its products and how it differs from Arcjet, see Arcjet vs Prompt Security. In March 2026, SentinelOne introduced Prompt AI Agent Security to discover agents and enforce policy on the MCP servers in a customer's environment, and ADR's inventory and governance controls extend it. Purple AI investigates over the telemetry in the Singularity Platform, and in June 2026 SentinelOne opened Purple AI Agentic Investigation to its customers. ADR adds agentic investigation for agent activity.

What is Arcjet?

Arcjet is an AI agent runtime security platform. It discovers the agents running in your organization, enforces policy on each action, prompt, and tool call, and keeps the evidence of what happened. It enforces in your code and in the hooks of coding agents, not on the network.

For agents you build, the JavaScript, TypeScript, Python, and Go SDKs call guard() before a tool call runs. A Guard policy is a set of rules that returns allow or deny, written in Rego, the policy language of Open Policy Agent, or with a visual builder. You run each policy in dry run, where it records what it would have denied, and then publish it from the Arcjet Console.

For coding agents, Claude Code, GitHub Copilot, Cursor, OpenAI Codex, and Muse Code call Arcjet from their hooks. A hook is a call the agent itself makes at a point in its work, such as before a tool runs. There's no SDK and no code change, and one policy applies across all five agents. You install it through managed settings, so developers can't remove it without administrator access.

Arcjet detectors cover prompt injection, sensitive information including PHI identifiers, and destination threats scored with Arcjet threat intelligence. On managed macOS and Windows devices, the Arcjet Discovery endpoint agent reports which app connected to which AI service, from which device and account. Arcjet isn't an EDR, and it doesn't record process or file activity on the device.

How do SentinelOne ADR and Arcjet differ?

SentinelOne ADR and Arcjet differ in when they act, what they see, and who supplies the context for a rule. The following table compares the two, and the sections after it cover the differences that shape most decisions.

A detection after behavior versus a decision before the call

Take a coding agent that a developer asks to fix a failing test. Partway through, it reads a file with instructions planted in a comment and runs curl to post the repository's .env file to an unfamiliar host.

With Arcjet, the agent's hook fires before the shell command runs. Arcjet pulls the destination out of the curl arguments, and a policy denies the call because threat intelligence rates the host high risk or because a rule you write over destinations doesn't list it. The credential access policy can also deny the read of .env earlier in the sequence. The command never runs.

With SentinelOne ADR, in-line prevention can block credential exfiltration before the action executes. Past that, the EDR sees the spawned process and its connection, Unified Storyline ties it back to the request, and intent drift detection flags that fixing a test didn't call for an upload. Containment then stops that agent.

Each approach has a blind spot. Arcjet sees only what passes through a hook or a guard() call, not a child process that the command spawns. ADR sees the device, but a behavioral detection usually needs some behavior to judge, and SentinelOne's release doesn't describe policy over a coding agent's individual tool calls.

Agents you build and agents you don't

For an agent your team writes, Arcjet's check is a function call in the tool handler, so the policy can read context that only your application knows. A rule that denies a refund above a tenant's plan limit needs the tenant, the plan, and the amount, and your code passes them as policy inputs. SentinelOne's release describes governance by agent, user, and reach, and doesn't describe rules on values that your application supplies.

For agents you don't control the code of, SentinelOne has the advantage. Arcjet has no hook into Agentforce, Copilot Studio, or ChatGPT workspace agents. For Claude Managed Agents, Anthropic runs the built-in tools such as bash and file access in its own environment, so Arcjet can only screen the inbound message and gate your custom tools.

Sensitive data and PHI

PHI is health information that can be linked to a specific person, such as a diagnosis next to a name or a medical record number. Under the Health Insurance Portability and Accountability Act (HIPAA), a covered entity, such as a health plan or provider, needs a BAA with each business associate, a vendor that handles PHI on its behalf (45 CFR 164.502(e)). This is technical guidance, not legal advice.

Arcjet's server-side sensitive information detector recognizes 25 entity types, including five for PHI: medical record numbers, health plan beneficiary numbers, license plates, vehicle identification numbers, and device identifiers. You can run it over a developer's prompt to a coding agent or over a discharge summary your own agent is about to send to an external API. Arcjet doesn't store a value that the detector flags, only its entity types and positions. For details, see PHI detection.

Arcjet supports HIPAA compliance and offers a HIPAA-compliant environment. Arcjet enters into a BAA with Enterprise customers whose use of Arcjet involves PHI, and both parties must sign it before any PHI passes through Arcjet. Detection doesn't de-identify or redact data, and it doesn't make a system HIPAA compliant on its own. It finds identifiers so that a policy can block the call or route it for review. SentinelOne's ADR release doesn't describe PHI-specific detection. For more information, see how to stop AI agents leaking PHI.

How does each product handle AI agent threat detection?

SentinelOne ADR detects threats from behavior, using the Singularity Platform's detections on endpoints and cloud workloads plus intent drift. Arcjet detects threats per call: it scores the destination, checks text for prompt injection, and flags a coding-agent session after a risky finding.

Arcjet's IP threat detector reads hosts from a policy input, resolves each one, and looks up its addresses in Arcjet threat intelligence. For coding agents, Arcjet fills a destinations input from URL arguments and from the targets of curl, wget, ssh, dig, and git in shell commands. The coding-agent.destination-threat starter policy then denies a high-risk host:

1
deny contains "malicious-destination" if {
2
  input.signals.ip_threat.dest.risk_level in {"high", "critical"}
3
}

Plan for the detector's limits. It doesn't fetch URLs or follow redirects, and it isn't a defense against server-side request forgery. A host that can't be looked up scores a risk of none, and so does an address with no threat intelligence record, so pair the detector with an allowlist. For more information, see AI agent threat detection.

For coding agents, Arcjet also screens what the agent reads. A hook that reports a tool result runs after the tool ran, so Arcjet can't block or withhold a result that the agent already received. Session analysis screens those results, and when it finds a prompt injection or an exfiltration attempt, it flags the session. The coding-agent.session-analysis starter policy then refuses shell, web, MCP, and file-write calls until a Console user clears the flag or it expires. Session analysis can't undo what happened before the flag, and the agent can make more calls while background analysis runs. Claude Code and GitHub Copilot HTTP hooks also fail open on a timeout or error, while the Codex, Cursor, and Muse Code hooks fail closed. For more information, see what session tainting is and why coding agent hooks fail open.

Which fits: SentinelOne ADR, Arcjet, or both?

Choose SentinelOne ADR to extend a SentinelOne estate to the agents running on it and in your SaaS platforms. Choose Arcjet for a decision on each action of the agents you build and the coding agents your developers run. Run both when you need each kind of coverage, because a detection on the device and a decision at the call catch different failures.

When SentinelOne ADR fits

SentinelOne ADR fits when any of the following apply:

• You already run SentinelOne for EDR, and you want agent activity in the same Storyline, data lake, and SOC workflows.
• Your agents include ones you don't control the code of, such as Agentforce, Copilot Studio, or ChatGPT workspace agents.
• You want detection and containment to depend on what the agent did on the device, not only on what it asked to do.
• Your analysts already investigate with Purple AI and want agent incidents handled the same way.

When Arcjet fits

Arcjet fits when any of the following apply:

• You build agents in code and want a policy as code that reads your application's context before each tool call runs.
• You run Claude Code, GitHub Copilot, Cursor, OpenAI Codex, or Muse Code and want one policy on their tool calls and prompts, installed through managed settings.
• You want each destination an agent contacts scored with threat intelligence, alongside an egress allowlist.
• You handle PHI and need identifier detection from a vendor that signs a BAA.

For other products in this market, see AI agent security platforms.

Can SentinelOne and Arcjet work together?

Yes. On the Enterprise plan, Arcjet exports its decisions to SentinelOne, as well as to Datadog, Splunk, Panther, and Amazon S3, so an Arcjet deny sits next to SentinelOne's own detections where your SOC already triages.

Arcjet stops the actions that a policy can name in advance, such as a read of ~/.aws/credentials or a call to an unapproved MCP server. SentinelOne watches the device and the SaaS agent platforms for behavior that no rule anticipated. An analyst who picks up a SentinelOne alert can see which actions an Arcjet policy already refused, with the actor and the rules that ran. For more information, see how to keep an audit log of AI agent activity.