CrowdStrike vs SentinelOne, and What Happened When I Checked the Sources

Updated October 2026. Originally published March 2025.

This page used to carry two AI generated vendor comparisons in full. It now carries what I found when I stopped reading that output and started checking it. If you came here to be told which product to buy, the honest answer is in the last section, and it is not the answer the original page gave.

What the experiment was

I wanted a comparison of two endpoint products that did not come from either vendor’s marketing. So I gave the same brief to two models and published both results, labeled, without editing them.

The first prompt was this:

Compare CrowdStrike and SentinelOne based on their official comparison pages. You represent the collective intelligence of CISOs, CTOs, and CIOs from companies with 500 to 5,000 employees in the US. Based on the information provided, choose a vendor and explain why.

Then I asked for a deeper pass incorporating third party research, naming Gartner, Forrester and the MITRE ATT&CK evaluations. Then I asked for the source links, on the assumption that asking for citations would make the output checkable.

It made the output look checkable. That is not the same thing.

The persona in the prompt came back as a fact in the output

One of the two results opened like this:

After months of evaluating both platforms across dozens of mid-market enterprises, our CISO council has reached a consensus.

There is no council. I asked a model to answer as the collective intelligence of security leaders, and it did exactly that, then wrote in the first person as if the collective had met. Further down, the same output produced a number from the same imaginary sample:

Most mid-market organizations in our collective reported 15 to 20% lower total security spending after standardizing on one of these platforms.

That figure has no origin. It was not measured, surveyed or cited. It was generated to fit the voice I had requested.

This is the part worth paying attention to, because the labeling I put on the page does not travel. A reader skimming, a person quoting the page, or a model crawling it, all pick up “our CISO council has reached a consensus” without the heading that says which model produced it or the prompt that told it to speak that way. A persona instruction is a style request. The output treats it as standing.

The two models disagreed on a checkable fact

One reported that CrowdStrike achieved 100% detection coverage in the MITRE evaluations while SentinelOne reached roughly 88%. The other reported CrowdStrike’s 100% claim and, separately, SentinelOne’s claim of superior performance in the 2024 round.

Both cited MITRE. Both were summarizing vendor pages that cite MITRE.

MITRE’s evaluations do not produce a league table or a single headline percentage. Vendors derive percentages from the underlying detection data, which is why two vendors can both claim the better result from the same exercise, and why a model reading both vendors’ pages inherits both claims and presents them as findings.

Then I checked the citations

The longer of the two outputs carried 24 numbered sources with URLs. I opened the ones that could be opened.

• Gartner, “Market Guide for Endpoint Protection Platforms”, document 4024445. The URL resolves to the Gartner homepage. There is no such document at that address.
• Gartner, “How to Optimize Your Cybersecurity Vendor Portfolio”, document 4024446. Same. The URL resolves to the homepage.
• Ponemon Institute, “The Economic Value of Prevention in the Cybersecurity Lifecycle”. Returns 404.
• IDC MarketScape, “Worldwide Modern Endpoint Security for Enterprise 2023 Vendor Assessment”. Returns 404.

Two others, from Forrester and ESG, block automated requests, so I cannot report on those either way. The MITRE Engenuity evaluation host cited in the output no longer resolves at all, which may be a retirement rather than an invention.

Look at the two Gartner document numbers again. 4024445 and 4024446. Two unrelated reports, one on endpoint protection platforms and one on vendor portfolio optimization, with consecutive identifiers. A research library does not number its catalog that way. A sequence looks like that when it is generated rather than retrieved.

The reports themselves are real categories of document. Gartner does publish on endpoint protection. Forrester does run an EDR Wave. MITRE does run the ATT&CK evaluations. What was invented was the specific pointer to each one, which is the only part that makes a citation useful.

Why this matters beyond one page

A buyer evaluating these two products now starts the same way I did. They ask a model, and they get back something structured, confident and footnoted, in a fraction of the time it takes to read one analyst report. The output arrives already formatted as a conclusion.

I have written elsewhere about how buyers now arrive holding a pre formed position they did not have to work for. This is the supply side of that problem. The confident answer the buyer arrives with was assembled the same way the one on this page was.

What I do differently now

• Open every citation before quoting the claim attached to it. A link that loads is not a source that says what the text claims, and a link that 404s tells you the rest of the paragraph was written without one.
• Keep persona out of the prompt when I want information. “You represent the collective intelligence of CISOs” produces text that sounds like security leaders. It does not produce what security leaders know, and it manufactures an authority that then has to be stripped back out.
• Use models to find the documents, not to summarize them. The genuinely useful output of this experiment was a list of which reports to go and read. Gartner’s Magic Quadrant for Endpoint Protection Platforms, the Forrester Wave for endpoint detection and response, the MITRE ATT&CK enterprise evaluations and the AV-Comparatives business security tests all exist. None of the summaries of them survived checking.
• Treat a long source list as a warning rather than a reassurance. Twenty four citations took me longer to disprove than four would have, which is the only function the extra twenty served.

So which one should you buy

Not on the strength of this page, and not on the strength of any page that produced its comparison the way this one originally did.

What survives is the shape of the decision rather than the answer to it, and these are things you can settle in a trial rather than take on authority:

• Connectivity. One architecture sends most analysis to the cloud, the other does more on the endpoint. That difference only matters if you have sites with poor or no connectivity, and if you do, it matters more than anything else on the list.
• Who responds. Automated response at machine speed, or deeper analytics for a team that wants to investigate. This is a question about your staffing, not about the products.
• Deployment constraints. If on premise or air gapped deployment is a hard requirement, that narrows the field before any feature comparison starts.
• Coverage hours. Whether you have 24 hour internal coverage decides how much managed detection you are actually buying, and that is usually the larger number on the invoice.

Answer those four against your own environment and the comparison mostly resolves itself. Run both in a trial on your real estate, with your real connectivity, and measure. That is slower than asking a model, and it is the only version that produces something you can defend to the person signing.

What changed on this page

The two generated comparisons have been removed. I have kept only the passages quoted above, because publishing unverified claims with a label attached still publishes them, and the label is the first thing that falls off when the text is quoted somewhere else.

The experiment was worth running. It is more useful as evidence than it was as a recommendation.