The Fashionable Runtime Problem
Cloud infrastructure now not sits nonetheless. Containers spin up and disappear in seconds, microservices discuss to one another throughout clusters and clouds, and serverless features run for simply lengthy sufficient to do their job. That agility drives innovation, however it additionally offers attackers a transferring goal and defenders little or no time to react.
The threats have tailored. Fashionable attackers exploit workloads whereas they’re operating, utilizing zero-day vulnerabilities, fileless methods, and unauthorized binaries to achieve a foothold and transfer laterally earlier than anybody has an opportunity to analyze. Perimeter-only defenses can’t see what occurs inside a workload at runtime. Siloed level instruments can see items of an assault, however they will’t join a runtime detection to the id behind it, the community path it travelled, or the opposite methods it touched. The info bears this out: in Splunk’s State of Safety 2025 report, 78% of respondents stated their safety instruments are dispersed and disconnected.
Closing that hole takes built-in id, community, and endpoint context, plus the power to behave on it mechanically. That’s the thought behind combining SentinelOne’s runtime safety with Cisco Safety and Splunk.
SentinelOne Runtime Safety and CWP in Motion
SentinelOne Cloud Workload Safety (CWP) delivers autonomous, real-time menace detection and response throughout containers, Kubernetes, digital machines, and serverless workloads. As a result of detection and response occur at runtime, on the workload itself, threats are stopped with out ready for a human to triage an alert.
In apply, which means:
- Stopping zero-days and energetic exploits by detecting malicious conduct because it occurs reasonably than counting on identified signatures.
- Blocking unauthorized binaries earlier than they will execute and set up persistence.
- Containing threats earlier than lateral motion, so a single compromised workload doesn’t develop into a cluster-wide incident.
Cloud workloads are ephemeral, however the assaults towards them will not be. Our clients want safety that acts at machine pace, on the workload, in the intervening time of exploitation. That’s what SentinelOne Cloud Workload Safety delivers.
Braden Preston, VP of Product Administration, SentinelOne
Stopping the menace on the workload is the primary half of the story. The second half is ensuring the remainder of the setting responds simply as rapidly.
The “Higher Collectively” Structure: Unified Enforcement and Response
Most organizations aren’t prepared for this. In accordance with Cisco’s 2025 Cybersecurity Readiness Index, solely 4% of organizations worldwide have reached the “Mature” stage of readiness. Closing that hole takes controls that act on a shared sign reasonably than in isolation.
When SentinelOne detects a runtime menace, the combination with Cisco Safety and Splunk turns that single sign into coordinated motion throughout id, community, perimeter, and the SOC.
Cisco ISE: id and entry coverage. A SentinelOne detection can set off fast, dynamic community quarantine and microsegmentation adjustments by means of Cisco Identification Companies Engine (ISE). A compromised workload or endpoint is remoted from the community in actual time, and not using a ticket or a guide handoff.
Cisco Duo: steady id safety. With Duo IAM comes Duo Desktop and the power to confirm that SentinelOne is put in and operating on an endpoint earlier than entry to a Duo-protected software is granted. Customers on gadgets with out an energetic SentinelOne agent are blocked and guided by means of remediation, so solely protected endpoints attain your purposes.
Identification is the management level that connects each a part of a contemporary assault. When Duo verifies that an endpoint is protected by SentinelOne earlier than granting entry, and Cisco ISE enforces community coverage on the identical gadgets, clients can apply least privilege repeatedly reasonably than at a single cut-off date.
Matt Caulfield, VP of Product, Cisco Identification
Cisco Safe Firewall: edge and perimeter protection. Runtime indicators of compromise (IOCs) and malicious IPs recognized by SentinelOne are mechanically ingested to replace firewall entry guidelines dynamically. Command-and-control (C2) site visitors is blocked on the edge, reducing off the attacker’s path again to the compromised workload.
Splunk: SecOps and menace analytics. SentinelOne telemetry and alerts stream into Splunk Enterprise Safety and Splunk SOAR for unified correlation, cross-domain investigation, and automatic triage playbooks. Analysts get one place to see the complete image, and routine response steps run on their very own. This issues as a result of, per Splunk’s State of Safety 2025, 46% of respondents spend extra time sustaining instruments than defending their group, and 55% say they cope with too many false positives. Feeding high-fidelity SentinelOne telemetry into one correlation layer is geared toward precisely these issues.
Detection is simply beneficial if it results in motion. Working with Cisco and Splunk lets us lengthen our autonomous response past the workload, so id, community, and SecOps instruments all react to the identical menace on the similar time.
Braden Preston, VP of Product Administration, SentinelOne
Key Buyer Outcomes and Operational Affect
Collectively, these integrations create a closed-loop workflow: detect, comprise, implement, examine, and be taught, with minimal guide intervention. For joint clients, that interprets into:
- Dramatic reductions in Imply Time to Detect (MTTD) and Imply Time to Reply (MTTR). Automated workflows exchange the delays of alert hand-offs and guide coverage adjustments.
- Frictionless collaboration throughout SecOps, NetOps, and Cloud Engineering. Every staff works from shared context and enforcement occurs mechanically, reasonably than by means of fragmented dashboards and electronic mail chains.
- Constant safety throughout the assault path. Identification, community, perimeter, and workload controls act on the identical sign as an alternative of working in isolation.
Business information factors in the identical route. IBM’s 2025 Value of a Knowledge Breach Report discovered that organizations utilizing AI and automation extensively of their safety operations saved a mean of $1.9 million per breach and shortened the breach lifecycle by 80 days.
Our mutual clients don’t wish to sew collectively instruments. They need outcomes: quicker detection, quicker containment, and fewer operational burden on their groups. This integration is constructed to ship precisely that.
Braden Preston, VP of Product Administration, SentinelOne
Take the Subsequent Step
Cloud workloads transfer quick, and so do the assaults towards them. SentinelOne stops threats on the workload at runtime. Cisco Safety extends that safety throughout id, community, and perimeter, and Splunk offers your SOC one place to correlate, examine, and automate the response. Collectively, they exchange disconnected level instruments with a coordinated protection, so your groups spend much less time stitching instruments collectively and extra time stopping assaults.
Defend each layer, from endpoint to cloud, at machine pace.
Right here’s methods to get began:
- Discuss to our Cisco gross sales staff or attain out to SentinelOne gross sales.
- Dig into the technical particulars. Overview the combination guides for Cisco ISE, Duo, Safe Firewall, and Splunk.