SentinelOne Says AI Threat Hunting Boosted Malicious Activity Finds 2,200%

Key Points

• AI-assisted threat hunting increased SentinelOne’s malicious-activity findings by 2,200% over the past year, with the company now identifying AI-only intrusion activity about 28 times daily.
• SentinelOne found more than 14 million true-positive detections for customers in the past calendar year, a 50% increase despite customer environments growing by roughly 16%.
• AI-assisted hunting helped identify and investigate React2Shell exploitation, uncovering eight attempted customer attacks within 30 days and highlighting the need for AI tools combined with skilled human analysts.

SentinelOne NYSE: S Chief Customer Officer Steve Stone said the cybersecurity company is expanding its use of artificial intelligence in threat hunting as attackers increasingly use AI to accelerate cyber operations.

Speaking at OneCon 2026, Stone said the pace of AI development has changed the threat landscape significantly over the past year. He cited a U.K. government assessment that frontier AI models were doubling their offensive cyber capabilities every four months, which he said underscores the speed defenders must match.

“AI-driven attacks are here to stay,” Stone said. “This genie does not go back in the bottle.”

AI-assisted hunting results

Stone said SentinelOne’s security strategy combines detection technologies with threat hunting, using AI tools alongside human analysts. The company’s detection approach includes indicators of compromise, signatures and autonomous models, he said, while hunting can help analysts investigate activity that may not yet be ready for production-grade automated detection.

SentinelOne launched AI-assisted threat hunting on Dec. 1, according to Stone. He said the capability increased the company’s ability to find malicious activity by 380% in its first quarter of operation, 1,400% after six months and 2,200% over the past year.

Stone said SentinelOne now notifies customers of intrusion activity found solely through AI-assisted hunting 28 times per day. He also said the company identified more than 14 million true-positive detections for customers during the last calendar year, representing a 50% increase while customer environments grew at a rate closer to 16%.

Stone characterized AI-assisted hunting as one component of a broader, multi-layered approach that also includes intelligence-based, real-time and retrospective hunting. The goal, he said, is to create multiple ways to detect, investigate, isolate, prevent and respond to malicious activity.

React2Shell response

As an example of the technology’s use, Stone discussed what he called the React2Shell vulnerability, which he described as the fastest mass-exploitation event of the past year. He said the vulnerability carried a CVSS severity score of 10.0 and could be exploited through a crafted HTTP request without authentication, user action or code being pushed to a server.

SentinelOne had launched AI-assisted hunting only two days before the vulnerability was publicly disclosed, Stone said. The company initially had stronger coverage for Linux and Mac systems than for Windows environments and used its hunting and detection capabilities to address coverage gaps.

Stone said SentinelOne’s first observation of React2Shell activity at a customer occurred Dec. 9 and was identified through AI-assisted threat hunting. The initial alert was not conclusive on its own, he said, but gave threat hunters a lead to investigate. An analyst determined the activity appeared to resemble a penetration test but did not “feel right,” prompting a broader response across the company’s managed detection and response and detection organizations.

Within the first 30 days, SentinelOne identified eight attempted victims among its customers involving numerous threat groups using React2Shell, Stone said. The activity included attempted domain reconnaissance as well as cryptocurrency mining.

Using AI to validate defenses

Stone also described SentinelOne’s work on SectopRAT, a remote-access threat the company has detected and reported to customers for seven years. He said the malware, which primarily targets browser sessions and cryptocurrency wallets, regularly changes its delivery mechanisms.

During the summer, SentinelOne updated static rules for Windows and Linux, behavioral detections and known command-and-control indicators associated with the malware, Stone said. The company also used AI-assisted hunting to validate whether those other defensive layers were continuing to identify the evolving threat.

In one instance, the company identified a new delivery wrapper posing as a fake Claude desktop installer, according to Stone. SentinelOne used AI-assisted hunting and a DLL side-loading hunting pack to examine related activity, map attack paths and assess whether its existing detection layers were functioning as intended.

Defender advantage depends on speed and expertise

Stone said AI-enabled attacks can be detectable because attackers and AI agents may leave more observable activity behind, including prompts that describe intended actions. However, he said the larger issue is the speed at which adversaries can move through an intrusion.

“For the first time, we are literally seeing attackers move at machine speed,” Stone said.

He argued that AI could provide defenders with an advantage when it is paired with skilled analysts. Automated agents can perform continuous and repetitive work, he said, allowing security professionals to focus on complex investigations and decision-making.

Stone said SentinelOne plans to provide additional detail on upcoming technology and its broader strategy during subsequent OneCon sessions.

About SentinelOne (NYSE:S)

SentinelOne, Inc is a cybersecurity company that develops artificial intelligence-powered security solutions for organizations worldwide. Its platform is designed to prevent, detect, investigate and respond to cyber threats across endpoints, cloud workloads, identities and other enterprise environments.

The company's Singularity Platform provides capabilities including endpoint protection, extended detection and response, cloud security, identity security, vulnerability management, data lake and security information and event management functionality.

This instant news alert was generated by narrative science technology and financial data from MarketBeat in order to provide readers with the fastest reporting and unbiased coverage. Please send any questions or comments about this story to contact@marketbeat.com.