The Modern Runtime Challenge

Cloud infrastructure no longer sits still. Containers spin up and disappear in seconds, microservices talk to each other across clusters and clouds, and serverless functions run for just long enough to do their job. That agility drives innovation, but it also gives attackers a moving target and defenders very little time to react.

The threats have adapted. Modern attackers exploit workloads while they’re running, using zero-day vulnerabilities, fileless techniques, and unauthorized binaries to gain a foothold and move laterally before anyone has a chance to investigate. Perimeter-only defenses can’t see what happens inside a workload at runtime. Siloed point tools can see pieces of an attack, but they can’t connect a runtime detection to the identity behind it, the network path it travelled, or the other systems it touched. The data bears this out: in Splunk’s State of Security 2025 report, 78% of respondents said their security tools are dispersed and disconnected.

Closing that gap takes integrated identity, network, and endpoint context, plus the ability to act on it automatically. That’s the idea behind combining SentinelOne’s runtime protection with Cisco Security and Splunk.

SentinelOne Runtime Protection and CWP in Action

SentinelOne Cloud Workload Protection (CWP) delivers autonomous, real-time threat detection and response across containers, Kubernetes, virtual machines, and serverless workloads. Because detection and response happen at runtime, on the workload itself, threats are stopped without waiting for a human to triage an alert.

In practice, that means:

• Stopping zero-days and active exploits by detecting malicious behavior as it happens rather than relying on known signatures.
• Blocking unauthorized binaries before they can execute and establish persistence.
• Containing threats before lateral movement, so a single compromised workload doesn’t become a cluster-wide incident.

Cloud workloads are ephemeral, but the attacks against them are not. Our customers need protection that acts at machine speed, on the workload, at the moment of exploitation. That’s what SentinelOne Cloud Workload Protection delivers.

Braden Preston, VP of Product Management, SentinelOne

Stopping the threat on the workload is the first half of the story. The second half is making sure the rest of the environment responds just as quickly.

The “Better Together” Architecture: Unified Enforcement and Response

Most organizations aren’t ready for this. According to Cisco’s 2025 Cybersecurity Readiness Index, only 4% of organizations worldwide have reached the “Mature” level of readiness. Closing that gap takes controls that act on a shared signal rather than in isolation.

When SentinelOne detects a runtime threat, the integration with Cisco Security and Splunk turns that single signal into coordinated action across identity, network, perimeter, and the SOC.

Cisco ISE: identity and access policy. A SentinelOne detection can trigger immediate, dynamic network quarantine and microsegmentation changes through Cisco Identity Services Engine (ISE). A compromised workload or endpoint is isolated from the network in real time, without a ticket or a manual handoff.

Cisco Duo: continuous identity security. With Duo IAM comes Duo Desktop and the ability to verify that SentinelOne is installed and running on an endpoint before access to a Duo-protected application is granted. Users on devices without an active SentinelOne agent are blocked and guided through remediation, so only protected endpoints reach your applications.

Identity is the control point that connects every part of a modern attack. When Duo verifies that an endpoint is protected by SentinelOne before granting access, and Cisco ISE enforces network policy on the same devices, customers can apply least privilege continuously rather than at a single point in time.

Matt Caulfield, VP of Product, Cisco Identity

Cisco Secure Firewall: edge and perimeter defense. Runtime indicators of compromise (IOCs) and malicious IPs identified by SentinelOne are automatically ingested to update firewall access rules dynamically. Command-and-control (C2) traffic is blocked at the edge, cutting off the attacker’s path back to the compromised workload.

Splunk: SecOps and threat analytics. SentinelOne telemetry and alerts stream into Splunk Enterprise Security and Splunk SOAR for unified correlation, cross-domain investigation, and automated triage playbooks. Analysts get one place to see the full picture, and routine response steps run on their own. This matters because, per Splunk’s State of Security 2025, 46% of respondents spend more time maintaining tools than defending their organization, and 55% say they deal with too many false positives. Feeding high-fidelity SentinelOne telemetry into one correlation layer is aimed at exactly those problems.

Detection is only valuable if it leads to action. Working with Cisco and Splunk lets us extend our autonomous response beyond the workload, so identity, network, and SecOps tools all react to the same threat at the same time.

Braden Preston, VP of Product Management, SentinelOne

Key Customer Outcomes and Operational Impact

Together, these integrations create a closed-loop workflow: detect, contain, enforce, investigate, and learn, with minimal manual intervention. For joint customers, that translates into:

• Dramatic reductions in Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). Automated workflows replace the delays of alert hand-offs and manual policy changes.
• Frictionless collaboration across SecOps, NetOps, and Cloud Engineering. Each team works from shared context and enforcement happens automatically, rather than through fragmented dashboards and email chains.
• Consistent protection across the attack path. Identity, network, perimeter, and workload controls act on the same signal instead of operating in isolation.

Industry data points in the same direction. IBM’s 2025 Cost of a Data Breach Report found that organizations using AI and automation extensively in their security operations saved an average of $1.9 million per breach and shortened the breach lifecycle by 80 days.

Our mutual customers don’t want to stitch together tools. They want outcomes: faster detection, faster containment, and less operational burden on their teams. This integration is built to deliver exactly that.

Braden Preston, VP of Product Management, SentinelOne

Take the Next Step

Cloud workloads move fast, and so do the attacks against them. SentinelOne stops threats on the workload at runtime. Cisco Security extends that protection across identity, network, and perimeter, and Splunk gives your SOC one place to correlate, investigate, and automate the response. Together, they replace disconnected point tools with a coordinated defense, so your teams spend less time stitching tools together and more time stopping attacks.

Defend every layer, from endpoint to cloud, at machine speed.

Here’s how to get started:

1. Talk to our Cisco sales team or reach out to SentinelOne sales.
2. Dig into the technical details. Review the integration guides for Cisco ISE, Duo, Secure Firewall, and Splunk.

• Cisco and SentinelOne Partner Page
• Cisco ISE + SentinelOne Integration Guide
• SentinelOne App for Splunk
• Cisco Duo Marketplace