Who does what
Provider
- Monitor and investigate Singularity alerts
- Document findings and escalate incidents
- Execute authorized containment and mitigation
Your team
- License and deploy Singularity modules
- Connect telemetry and authorize response actions
- Remediate business systems and restore services
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
Details
Service scope
Best for Teams standardized on SentinelOne endpoint, cloud or identity controls
Platform and coverage
The service operates through Singularity. The quote must name enrolled endpoint, cloud and identity scope and the licenses and telemetry each requires.
Response policies
Native containment follows agreed policies. Third-party response through MDR Workflows requires configured integrations and customer-defined triggers. Your team retains recovery and actions outside enabled controls.
Essentials and Elite
Essentials includes MDR and integrated hunting. Elite adds a dedicated Threat Advisor and incident-readiness and response access. Confirm the included hours and exercises.
Full service analysis
Wayfinder MDR analysts investigate Singularity alerts and execute policy-approved containment and mitigation. You maintain platform deployment, telemetry coverage, response policies and recovery outside those controls. Essentials includes ongoing MDR and hunting. Elite adds a dedicated Threat Advisor and incident-readiness and response access, with the quoted entitlement defining the work included.
- Your team owns
- License and deploy the covered Singularity modules and agents
- Maintain telemetry, response policies and escalation contacts
- Configure any Workflows integrations and approve the actions they may trigger
- Complete business remediation, recovery and work beyond contracted controls
Policy-approved containment
The current Wayfinder datasheet describes containment governed by policy. This supports the containment lane, while platform deployment, authorization and wider recovery remain buyer responsibilities.
Elite adds advisory support
Dedicated Threat Advisors and incident-readiness and response access belong to Elite. They do not establish outsourced ownership of the whole SOC or unlimited incident response.
Configured workflows
The August 2026 MDR Workflows announcement describes customer-defined actions after analyst validation. Ask which integration permissions, workflows and entitlements your quote includes.
Current and legacy naming
Wayfinder MDR Essentials and Elite are the current names. Vigilance review pages and older procurement documents describe earlier service packages, so their experience and terms need that context.
Pricing & contract
- Billing
- Per-endpoint, Custom
Wayfinder MDR is quoted by tier and endpoint scope. Current CDW Essentials and Elite listings require a quote. Specify Singularity licenses, cloud and identity coverage, any Workflows entitlement and Elite incident-response hours separately.
Tradeoffs & buying questions
Strengths
-
Native investigation and containment for Singularity deployments
-
Essentials includes ongoing threat hunting alongside MDR
-
Elite adds a dedicated Threat Advisor and incident-readiness support
Considerations
-
Requires the enrolled Singularity platform and healthy telemetry
-
Third-party response requires configured workflows and permissions
-
Elite response access needs an explicit hours and scope agreement
Ask before buying
- Which Singularity licenses and endpoint, cloud and identity sources are included in our Essentials or Elite quote?
- Which containment actions follow standing policy, and which Workflows actions require approval or separate entitlement?
- What Threat Advisor time, exercises and incident-response hours does Elite include?
Customer feedback
Customers value
-
In incentivized G2 reviews from 2023–24, several Vigilance users describe reduced alert-handling work and continued analyst involvement
-
An organic October 2024 G2 account and an incentivized July 2024 account describe responsive staff and useful incident documentation
Reported concerns
-
An incentivized April 2024 G2 reviewer wanted faster responses, while an incentivized August 2023 reviewer reported false positives
-
These accounts cover legacy Vigilance deployments and do not establish performance for the current Wayfinder tiers
Integrations
Endpoint
- SentinelOne Singularity Endpoint
Other integrations
- SentinelOne Singularity Cloud
- SentinelOne Singularity Identity
- Google Threat Intelligence
2 more integrations
- Purple AI
- Singularity Hyperautomation
Common questions
Is Vigilance still the current MDR name?
SentinelOne now markets MDR Essentials and MDR Elite under Wayfinder. Legacy review pages and procurement SKUs still use Vigilance. Confirm which current tier appears on the order.
Can Wayfinder act on threats?
Yes, through policy-approved Singularity containment and mitigation. Configured MDR Workflows may extend response into connected tools. Your team controls permissions and retains broader recovery.
How is Wayfinder priced?
Current Essentials and Elite reseller listings require a quote. Confirm endpoint quantities, Singularity licensing, cloud and identity scope and the incident-response entitlement.
Company details
- Headquarters
- Mountain View, California