SentinelOne (S) OneCon 2026 summary

Conference sessions and priorities

• OneCon 2026 opened with sessions on combining AI and experts in Wayfinder Threat Hunting services, followed by the Sentinels League Threat Hunting World Championship, with finalists selected from thousands of participants.

• The opening keynote emphasized accountability for prior commitments and focused on AI-assisted threat hunting as an example of pairing technology with expert judgment.

• Upcoming conference sessions were set to cover new technology and the vision for the evolving threat landscape; a live threat hunting challenge was also planned.

AI and threat hunting results

• A U.K. government assessment cited in the keynote said frontier models’ offensive cyber capability was doubling every four months; the speaker said it had tripled since the previous OneCon.

• Autonomous models remain the foundation of detections; threat hunting adds flexible investigation and analysis, with threat intel-based, real-time, retrospective, and AI-assisted approaches designed to complement production detections.

• True-positive detections rose 50% over the last year, with more than 14 million identified in the last calendar year; AI-assisted hunting findings increased 2,200% in the last year, generating 28 daily customer notifications on intrusion activity.

• AI-assisted hunting launched Dec. 1; malicious-activity findings rose 380% in its first quarter and 1,400% by six months into the effort.

React2Shell response

• AI-assisted hunting launched two days before React2Shell was publicly announced on Dec. 3; the critical vulnerability had a CVSS score of 10.0 and could be exploited with a crafted HTTP request without authentication or user action.

• The first customer observation was Dec. 9; a broad web-exploitation hunt surfaced suspicious activity, which experts investigated before refining findings into production-grade platform detections.

• Within the first week, research identified at least seven significant threat groups exploiting React2Shell; across the first 30 days, eight attempted victims were identified, including activity involving reconnaissance and crypto mining.