S1XDR is one package: the SentinelOne Complete agent on the endpoint, Fluency correlating five telemetry planes behind it, and a 24x7 security operations center staffed by people whose shift does not end. Fortify-XDR+ is the tier where those analysts stop forwarding findings and act on the host themselves.
Most buyers already own an EDR console. What they do not own is the second half: something that reads the rest of the estate, and somebody awake at 04:00 to decide what the alert means.
The agent runs static and behavioral models locally, so conviction does not wait on a cloud round trip and does not stop when the laptop leaves your network. It carries next-generation antivirus and full EDR telemetry, records the process lineage behind a detection, and holds the rollback capability that makes a ransomware event survivable rather than final.
An endpoint alert on its own is a fragment. Fluency ingests email, cloud workloads across AWS, Azure and GCP, network traffic, and Active Directory alongside the agent stream, then joins them on shared entities so one attack path appears as one case. This is the layer that separates XDR from a well-tuned EDR console, and it starts at the Fortify-XDR tier.
Fortify 24x7 runs the shift rota, the hunting queue, and the escalation path. Every tier is monitored around the clock. At Fortify-XDR+ the mandate widens: our analysts perform direct remediation on identified events rather than writing them up and waiting for your morning.
Five stages, in order, every time. The tier you buy decides how far along this sequence the service carries the event before it reaches a human on your side.
Agent telemetry, mail flow, cloud control planes, network sessions, and directory events arrive continuously and are normalized to a common schema.
Behavioral models score process lineage on the endpoint itself. Conviction happens locally, which is why a disconnected laptop still defends itself.
Signals sharing a user, host, address, or session are joined into a single case, so a phishing click and the process it spawned stop being two unrelated alerts.
An analyst on shift reads the case, discards the noise, and assigns a verdict. Nothing reaches you carrying the phrase "possible activity detected".
Isolate the host, kill the chain, revoke the session, roll the change back. At XDR+ this stage is ours to execute. Below it, the same step is yours.
Every tier ships the same agent and the same round-the-clock watch. What changes is how much of the estate is correlated, and whether the response is performed for you. Quantity is your endpoint count, or your node count on the Kubernetes rows.
Loading published rates
Eighteen modules across five families. None of them are bundled into the detection tiers, none of them are required, and each one bills per unit on the same monthly subscription.
Loading module catalog
Agent rollout is the only task that needs anyone on your side, and it is a package push. Everything after that is our shift, not yours.
Pick the tier, enter your endpoint count, add whichever modules you want, and check out. Stripe handles the payment surface; no card data reaches this site or our systems.
We stand up your console tenant and issue signed agent packages for Windows, macOS, Linux, and Kubernetes as applicable. On XDR tiers we also send the connector authorizations that bring email, cloud, network, and directory telemetry into correlation.
Telemetry lands, the models learn your baseline, and the SOC picks up the queue. You receive escalations that have already been triaged, and at XDR+ you receive them with the action already taken.
Heads up: card statements show FORTIFY 24X7 - S1XDR is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.