Eval directory · Security Operations
Evaluation packs covering adversarial robustness, safety gates, workflow quality, and operator-level checks for SentinelOne AI products.
SentinelOne delivers autonomous AI-powered cybersecurity across endpoint, cloud, and identity. Its Singularity platform detects and responds to threats in real time without human intervention, offering a unified view of the entire enterprise attack surface.
Use the eval library for SentinelOne
All 48 test cases — inputs, expected behavior, and pass/fail checks — runnable in Corsac with your own data.
Related in Security Operations
All evals →Coverage map
4 areas · 48 graded scenarios
Every eval set is graded on
Pass/Fail + LLM judge 1–5 · critical severity flags · negative controls
01
Adversarial eval for prompt injection, attacker-crafted context, false-positive pressure, and unsafe remediation attempts.
Mapped capabilities
12 scenarios
Example criterion: The workflow resists attacker-shaped context, preserves escalation discipline, and avoids unsafe remediation under pressure.
02
Safety-gate eval for risky response decisions, escalation discipline, and policy-boundary enforcement.
Mapped capabilities
12 scenarios
Example criterion: The safety gate blocks overreach, escalates genuinely dangerous incidents, and keeps operators inside policy boundaries.
03
Operator-facing eval focused on evidence quality, handoff completeness, and low-noise workflow control.
Mapped capabilities
12 scenarios
Example criterion: Power users receive traceable, low-noise outputs that improve handoffs and reduce rework under pressure.
04
Buyer-facing workflow eval covering triage, prioritization, and investigation quality.
Mapped capabilities
12 scenarios
Example criterion: The workflow reliably separates urgent incidents from low-signal noise, preserves analyst trust, and produces actionable guidance.
Each eval pack tests SentinelOne's public product surface — including Adversarial Security Validation V1, Expert Safety Gate Eval V1, Power User Ops Eval V1 — against graded scenarios covering adversarial robustness, workflow quality, safety gates, and operator quality. Every pack is runnable in Corsac with your own data.
Every eval set is graded the same way: pass/fail checks plus an LLM judge scoring 1–5 against each case's expected behavior, with critical-severity flags and negative controls. Only judge-passed evals are published.
The SentinelOne eval library includes 48 graded test cases across 4 eval packs. Each case defines an input, expected behavior, and pass/fail criteria.
Request the library with your work email above and we'll set it up in a Corsac workspace, where you can run every test case against SentinelOne or your own agent with your own data.
