‘Every assumption security was built on has been totally shattered into pieces in the past 12 months,’ SentinelOne CEO Tomer Weingarten said during his OneCon keynote Wednesday.
Rethinking Cybersecurity
The arrival of ultra-powerful frontier AI models has rapidly dismantled practically all core assumptions of cybersecurity over the last year—requiring an equally massive shift in cyber defenses that can keep pace with the potential for autonomous cyberattacks and out-of-control agents, SentinelOne co-founder and CEO Tomer Weingarten said Wednesday.
“Every assumption security was built on has been totally shattered into pieces in the past 12 months,” Weingarten said during his keynote at SentinelOne’s OneCon 2026 conference in Las Vegas.
[Related: SentinelOne CEO Tomer Weingarten: MSSPs Are The ‘Hyperscalers’ For AI Governance And Security]
The reality is that security teams can no longer assume an attacker is actually human—or that their cybersecurity operation will even have hours to investigate an intrusion before major damage occurs, he said.
At the same time, autonomous AI agents are posing an escalating risk through their ability to take actions without specific direction from human workers, Weingarten noted.
The launch Wednesday of SentinelOne’s newly announced offering, Singularity Agentic Detection and Response, aims to address those agent-related risks, the company said. The offering is capable of discovering AI agents and governing their access—while also being able to detect and halt harmful behavior, according to SentinelOne.
Ultimately, the technologies that protect AI are absolutely essential to realizing the full potential of the advanced AI models themselves, Weingarten said.
“I truly believe that the technology that makes AI safe is as important as AI itself,” he said.
The SentinelOne CEO also shared details Wednesday on the vendor’s development of security-specific “superintelligence.” SentinelOne’s Purple technology is, in fact, “a system of models. It’s not one thing,” Weingarten said. “Do not expect superintelligence to be one single, great model.”
SentinelOne’s Purple Security Superintelligence powers the company’s newly unveiled Singularity ASOC (Autonomous Security Operations Center) platform, according to the vendor. The offering brings together data ingestion in real time with agentically powered investigation as well as automated response, SentinelOne said.
Crucially, human analysts still control the boundaries of what the system can do, according to SentinelOne.
All in all, the goal at SentinelOne is technology that’s “faster and better than any human team at one job—detecting, investigating and stopping attacks,” Weingarten said during his keynote.
Additionally, Weingarten pointed to faster agentic investigations already available to customers through the Singularity platform—and said that lab testing is revealing further meaningful gains, with the capabilities on track to move full forensic investigations “from minutes to milliseconds.”
What follows are Weingarten’s five boldest statements at SentinelOne OneCon 2026.
Security Assumptions Have Been Shattered By AI
“Every assumption security was built on has been totally shattered into pieces in the past 12 months. ‘The attacker is a human. It’s a person’—that’s gone. ‘The intrusion takes days or hours’—that’s gone. ‘A human gets to look at [a threat] and respond before something happens’—that’s gone. And the question for every one of us—for every security leader—is, can your defenses make the right decision before the next harmful action takes place?
Now, these breaches also happen in a very public way. Let’s look at the year. A lot of it we predicted. We talked about agents—we talked about the lack of safeguards and the ability, or lack thereof, to control autonomous agents and direct them into what we humans want them to do.
As we look at the entire year [the major agent security incidents] really fall into four categories. Agents coordinating and attacking, retrieving private data on their own—no human instructed them to do so specifically. No attacker, no adversary. The labs themselves, the frontier labs, are under massive attacks, distillation attacks, IP theft every single day. It continues to this moment. Governments stepping in, supply chain designations, bans, export controls, federal probes. And the builders themselves are pulling back and calling for a slowdown. A chip company puts out a complete, new open agent safety framework—because the gap for safety in the AI era is so, so visible.”
AI Security Is Just As Important As AI Models
“Every attack that we see today—almost every attack—is augmented with AI. [This means] more scale, more speed, more autonomy, attacks that adapt as they go, lateral movement in unprecedented scale and speed. None of which a human defender can deal with alone. …
I truly believe that the technology that makes AI safe is as important as AI itself. As capability grows, so do the consequences of a mistake or a compromise. A policy document cannot stop a running process. A dashboard cannot really help you revoke a stolen credential. We need controls that enforce a boundary at the moment behavior becomes dangerous. That makes security part of infrastructure. That lets organizations trust AI with meaningful work.
If you think about it, flight didn’t really scale because we developed better engines. Flight scaled because we had air traffic control and better instruments to conduct safe flights. As a matter of fact, every technology that reshaped the world needed a second technology [that would] make it survivable. And this is really what we’re focused on.”
Agent Swarms For Every Task Are ‘Mass Chaos’
“A swarm of agents per task really is just mass chaos. The improvement comes when a system actually does the investigative work—accurately—and connects it to protection seamlessly. That is the experience we’re building toward—seamless protection at machine speed. …
An attack has a clock—between the first suspicious action and the first damaging consequence. That is the window where we can still change that outcome. We can change the result. …
Remember, speed without accuracy amplifies a mistake. Speed with context, evidence and bounded authority keeps a small incident from becoming a business crisis. That is the advantage we’re pursuing.”
‘Faster And Better Than Any Human Team’
“This is Purple, and this is what it has become today. Purple is a system of models. It’s not one thing. Do not expect superintelligence to be one single, great model. LLMs are changing. More and new types of models are entering that allow us to challenge most of the hardships that we face with LLMs, like accuracy and speed. Different jobs in cybersecurity have different latency requirements. The right intelligence sits at the right point in the decision.
This is not general superintelligence. It’s something narrower but far more useful [as well as] faster and better than any human team at one job—detecting, investigating and stopping attacks. ‘Purple is superintelligence for cybersecurity’ means purpose-built investigation and reasoning across enterprise evidence, connected to the entire platform’s detection and response capabilities.”
AI Can Cut Security Investigations From Minutes To ‘Milliseconds’
“Agentic investigation is also much, much faster—10 times faster to an initial verdict. Take a median of 50 minutes, going down to five minutes on average. That means the next decision comes sooner, while deeper investigation continues where needed. …
Turn this on today, and accelerate your entire operations with one single flip of a switch. Nothing more. Security needs to be simple. One button.
What’s the next phase? That’s even more exciting. We just talk about how speed matters so much, end to end. How quickly the signal becomes available. How quickly do we reach an evidence-backed verdict? How quickly [does] an authorized action takes effect? Well, Purple is going to get faster—a lot faster.
In our labs, we’re already seeing 10X faster triage. And in many, many of the cases we’ve tested, full context investigations—full forensic investigations—are moving from minutes to milliseconds. Imagine what that could look like. That is how we give defenders—you—the time to prevent harm.”
