SentinelOne Extends Wayfinder Threat Hunting's Continuous Coverage to AWS, Azure, and Google Cloud

AI-powered security paired with elite human threat hunters to extend continuous hunting across rapidly expanding AI, endpoint, identity, and cloud attack surfaces

SentinelOne® (NYSE: S), the AI Security leader, today announced the expansion of Wayfinder Threat Hunting to the major public cloud services: AWS, Azure, and Google Cloud. It’s the latest offering from SentinelOne's Wayfinder team and combines the power of SentinelOne's AI-powered Singularity Platform telemetry with expert human-led hunting to protect the modern attack surface across AI, endpoints, identities, and cloud workloads.

The cloud has become an even more attractive attack surface with the rapid adoption of AI. A threat actor who compromises a cloud identity or exploits a misconfiguration can rapidly move directly to data without ever touching an endpoint, often leaving little trace in the logs a security team already watches. SentinelOne’s Wayfinder Threat Hunting continues to expand to meet attackers wherever they operate: first across the endpoint, then into identity with hunting for Okta and Microsoft Entra ID, and now into the cloud control plane itself. As with all Wayfinder services, this new capability uses threat intelligence and intrusion findings from both SentinelOne and Google Threat Intelligence in a single hunting workflow.

The new Wayfinder Threat Hunting for Cloud gives customers a single, continuous hunting capability across their full environment, giving defenders a decisive operating advantage as their cloud infrastructure spans endpoints, human and agent identities, and the cloud. It provides continuous, expert-led hunting across AWS, Azure, and GCP control-plane activity, with coverage spanning cloud control-plane abuse, IAM privilege escalation, and unauthorized access, and data exfiltration. Hunts include IAM user enumeration, S3 bucket reconnaissance, root account logins, AKS cluster-admin credential access, suspicious IAM policy changes, AMI deregistration, telemetry destruction, and cross-tenant delegation changes. Curated indicators and behavioral rules are mapped to MITRE ATT&CK techniques, and findings arrive with enriched Purple AI™ summaries for triage. The result is stronger protection with fewer incidents and less operational overhead.

“Attackers have learned that the fastest and most easily accessible way to an organization's data is often through the cloud control plane,” said Steve Stone, Chief Customer Officer, SentinelOne. “Extending Wayfinder’s elite hunters into AWS, Azure, and GCP means customers get the same continuous, AI-plus-human scrutiny across their entire footprint to eliminate the gaps in coverage that modern attackers prey on.”

Availability

SentinelOne’s Wayfinder Threat Hunting for Cloud is generally available today to all existing Wayfinder Threat Hunting customers. Enablement runs through existing Singularity Marketplace plugins for each cloud provider. Customers already leveraging Wayfinder Threat Hunting on identities in Microsoft Entra ID require no additional setup for Azure environments.

About SentinelOne

SentinelOne (NYSE: S) is the leader in AI security, setting the standard for using AI and automation to give defenders a decisive operating advantage. Built for those who secure our world, its platform delivers unified coverage across endpoints, identity, cloud, and AI. Powered by Autonomous Security Intelligence, SentinelOne stops attacks at machine speed, reducing risk and delivering clarity and control to stay one step ahead. Headquartered in Mountain View, California, with teams worldwide, SentinelOne protects nearly one-fifth of the Fortune 500 and hundreds of Global 2000 enterprises. From Main Street to Wall Street, the world's most critical organizations trust SentinelOne with their security.

Third-Party Disclaimer

All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third party.

View source version on businesswire.com: https://www.businesswire.com/news/home/20260924339917/en/