Executive Summary / Key Takeaways

• SentinelOne is leveraging its differentiated AI-powered Singularity Platform to drive market share gains across endpoint, cloud, and data security, positioning itself as a leader in autonomous cyber defense.
• The company achieved significant profitability milestones in Fiscal Year 2025, including its first positive net income and operating income quarters and positive full-year free cash flow, demonstrating improving operational efficiency and scale.
• Despite macroeconomic uncertainty impacting Q1 FY2026 net new ARR, SentinelOne expects growth trends to improve, guiding for 22% revenue growth and positive operating margin for the full Fiscal Year 2026, targeting over $1 billion in both ARR and revenue.
• Strategic partnerships (Lenovo (LNVGY), Google (GOOGL), CISO, cyber insurers, MSSPs) and architectural advantages highlighted by recent industry events are expanding market reach and creating opportunities, particularly in large enterprise and government sectors.
• Key growth drivers include rapid adoption of emerging solutions like Purple AI (exceeding 25% attach rate in Q1 FY26) and AI SIEM (surpassing $100M ARR in Q1 FY26), alongside continued strength and competitive wins in the core endpoint market.

Setting the Scene: An AI-Native Approach to Cyber Defense

SentinelOne was founded in 2013 with a vision to redefine cybersecurity through artificial intelligence and automation. Recognizing the limitations of traditional, human-dependent security tools against increasingly sophisticated threats, the company set out to build a truly autonomous defense platform. This foundational focus on AI has shaped its evolution from a disruptive endpoint security provider to a comprehensive platform player.

At its core is the Singularity Platform, designed to unify security across endpoints, cloud workloads, and identity credentials. Unlike legacy systems that often rely on static signatures or require constant updates and deep integration into sensitive operating system kernels, Singularity employs a patented behavioral AI approach. This technology allows for real-time threat detection and response directly on the device, even when offline, complemented by cloud-based streaming AI for broader context and anomaly detection. This architectural choice, emphasizing less reliance on kernel-level access and fewer updates, is highlighted by the company as a key differentiator enhancing system stability and operational resilience – a factor gaining prominence in the wake of recent industry outages.

SentinelOne's journey has been marked by strategic expansion beyond its initial endpoint focus. Through internal development and targeted acquisitions like PingSafe (cloud security) and Stride (security automation) in Fiscal Year 2025, the platform has grown to encompass solutions across cloud security (CNAPP, AI-SPM), data security (Singularity Data Lake, AI SIEM), and advanced AI capabilities (Purple AI, Hyperautomation). This expansion is driven by a strategic imperative to address a broader spectrum of enterprise security needs with a unified, AI-native approach, moving away from siloed point solutions.

The company's go-to-market strategy has mirrored this platform evolution, shifting from a product-centric approach to a platform sales strategy. This involves acquiring new customers with initial platform modules and then expanding their footprint across the Singularity ecosystem. Partnerships with major players like Lenovo, Google (Mandiant), AWS (AMZN), CISO, cyber insurers, and a robust network of MSSPs are crucial to extending its reach and accelerating market penetration across diverse segments, from large enterprises to SMBs and government agencies.

While this aggressive growth and expansion strategy has historically resulted in net losses, SentinelOne has recently demonstrated significant progress towards profitability, achieving key milestones in Fiscal Year 2025. This trajectory, combined with its differentiated technology and expanding market presence, forms the core of the investment thesis: a high-growth cybersecurity innovator leveraging AI to capture market share in a dynamic and critical industry, while increasingly demonstrating financial discipline.

Technological Differentiation and Innovation

SentinelOne's competitive edge is fundamentally rooted in its AI-powered Singularity Platform and its unique architectural design. The core differentiator is the company's patented behavioral AI, which operates both locally on the endpoint and in the cloud. This dual-engine approach enables autonomous threat detection and response in real-time, without requiring constant updates or cloud connectivity for initial detection. This contrasts with some competitors that may rely more heavily on cloud lookups or frequent signature updates, which can introduce latency and potential points of failure.

A key aspect of SentinelOne's architecture is its minimized reliance on deep kernel-level integration, particularly on macOS and Linux where it avoids the kernel entirely, and on Windows where its kernel footprint is limited. This design choice is stated to significantly improve system stability and operational resilience, reducing the risk of blue screens or system disruptions caused by updates or errors – a critical benefit highlighted by management, especially following recent industry events.

The tangible benefits of this technology are evidenced in third-party evaluations. In the latest MITRE ATT&CK Evaluations, SentinelOne achieved 100% detection for the fifth consecutive year. Crucially, it delivered zero detection delays and 88% fewer alerts compared to competing solutions, with some rivals requiring significantly more alerts (4x, 8x, or even 9,000x more). This superior signal-to-noise ratio is a direct result of the platform's AI-driven analysis and autonomous capabilities, enabling security analysts to focus on genuine threats rather than alert fatigue.

SentinelOne is actively innovating across its platform, particularly in AI and data security. Purple AI, the company's generative AI security agent, is a rapidly growing solution, achieving triple-digit year-over-year growth in quarterly bookings and an attach rate exceeding 25% across eligible endpoints sold in Q1 FY2026. Purple AI aims to transform security operations by providing capabilities like natural language queries, auto-generated summaries, auto alert triage, and threat hunting, promising significant productivity gains (e.g., 80% faster threat hunting and investigations). The recent introduction of Athena, the next evolution of Purple AI, targets an end-to-end agentic AI platform, capable of understanding context, drawing connections, and acting autonomously. Hyperautomation, now generally available, complements Purple AI by enabling no-code automated workflows for detection and response.

In data security, the Singularity Data Lake and AI SIEM are positioned as modern, cloud-native alternatives to legacy SIEM solutions. AI SIEM, which surpassed $100 million in ARR in Q1 FY2026, is designed for real-time detection on streaming data, accelerating investigations and enabling autonomous responses. Management highlights that AI SIEM deals often involve replacing incumbent vendors like Splunk (SPLK), resulting in significant cost savings for customers (over $1 million per year for one retailer) while ingesting more data and improving detection/response times (up to 12 hours faster).

The "so what" for investors is clear: SentinelOne's differentiated AI technology and architectural choices provide a quantifiable edge in security efficacy, operational efficiency, and analyst productivity. These advantages contribute to strong competitive win rates, drive adoption of emerging high-growth solutions like Purple AI and AI SIEM, and enable the company to capture market share from both legacy and next-generation competitors. Continued investment in R&D, particularly in agentic AI and data analytics, is intended to widen this technological gap and fuel future growth, supporting the company's trajectory towards becoming a multi-billion dollar business.

Platform Expansion and Go-to-Market Momentum

SentinelOne's strategic evolution from an endpoint-centric provider to a comprehensive platform company is a key driver of its growth and market positioning. The Singularity Platform now spans seven key solution categories: AI and Automation, Data, Endpoint, Cloud, Identity Security, Exposure Management, and Threat Services. This broad coverage allows SentinelOne to address over 30 distinct use cases, positioning it as a strategic partner for enterprises seeking to consolidate their security stack.

A significant indicator of this successful platform expansion is the increasing contribution from non-endpoint solutions, which crossed 50% of the company's full-year bookings in Fiscal Year 2025. Data and AI solutions, in particular, have emerged as the fastest-growing areas, fueled by the strong adoption of Singularity AI SIEM and Purple AI. The company has seen a substantial increase in customers adopting multiple platform solutions, tripling the number of customers with three or more solutions and quadrupling those with four or more over the past two years. This demonstrates the effectiveness of the company's "land-and-expand" motion, where initial adoption of one solution leads to broader platform usage.

This expansion is directly contributing to higher ARR per customer, which reached a new record in Q1 FY2026. The company is successfully moving upmarket, adding a record number of customers with ARR of $100,000 or more (1459 as of April 30, 2025, up 22% YoY) and seeing even faster growth in customers with over $1 million in ARR. While maintaining healthy expansion rates within its existing customer base, SentinelOne's go-to-market strategy remains focused on acquiring new logos, which management views as crucial for long-term growth potential and future expansion opportunities.

Strategic partnerships are amplifying this go-to-market reach. The partnership with Lenovo to bundle the Singularity platform on new enterprise PCs is expected to significantly increase the company's reach over time, particularly in out-years (FY2027+). Collaborations with major IR firms like Google (Mandiant) and a broad network of cyber insurers are expanding access to new customer segments, including millions of SMBs. In the public sector, achieving FedRAMP High authorization across multiple platform components (endpoint, AI SIEM, Purple, CNAPP, hyperautomation) and partnering with CISO are opening doors to securing sensitive government environments. The launch of the Partner One program in Q1 FY2026 is aimed at deepening engagements with MSSPs, IR firms, and VARs, enabling them to adopt and resell a broader range of Singularity solutions.

While macroeconomic uncertainty, particularly in April 2026, impacted Q1 FY2026 net new ARR due to elongated sales cycles and deal downsizing, management noted improved trends in May and remains confident in the underlying demand and pipeline strength. The strategic decision to retire the legacy deception solution is expected to cause a near-term ARR headwind ($10M churn in FY2026), but is viewed as necessary to realign resources towards higher-growth, AI-native solutions. Overall, the combination of platform innovation, successful cross-sell/upsell, strategic partnerships, and a focus on new customer acquisition positions SentinelOne for continued market share gains and growth, despite the challenging external environment.

Competitive Positioning

The cybersecurity market is intensely competitive and rapidly evolving, with SentinelOne vying for market share against a mix of large, established players and other next-generation vendors. Key competitors include Palo Alto Networks (PANW), Crowdstrike (CRWD), and Fortinet (FTNT), among others.

SentinelOne's competitive strategy centers on its differentiated AI-native platform and architectural advantages. While competitors like PANW and CRWD also leverage AI, SentinelOne emphasizes its patented behavioral AI and autonomous capabilities that operate with minimal kernel dependency and fewer updates. This architectural resilience has become a significant point of differentiation, particularly following recent high-profile security incidents involving competitors that reportedly caused widespread outages and disruptions. Management highlights that these events have increased customer awareness and interest in SentinelOne's platform, leading to significant pipeline pickup and engagement with large enterprises previously less accessible.

Quantitatively, SentinelOne's performance in independent evaluations like MITRE ATT&CK (100% detection, zero delays, 88% fewer alerts) provides a strong, objective measure of its security efficacy compared to rivals. The company consistently wins a significant majority of competitive technical evaluations across endpoint, data, and cloud security. In the endpoint market, SentinelOne was recognized by IDC as the fastest-growing among the Top 10 vendors in 2023 and continues to see accelerated growth and competitive displacements, including against its "closest competitor."

In terms of financial performance relative to competitors, SentinelOne has demonstrated industry-leading revenue growth rates (23% in Q1 FY26, 32% in FY25), outpacing some larger rivals like Fortinet (15-20% growth) and comparable to or slightly exceeding Palo Alto Networks (20-25% growth) and Crowdstrike (30-35% growth). However, while SentinelOne's gross margins (around 79-80%) are competitive, its operating margins, though rapidly improving (negative 2% non-GAAP in Q1 FY26, positive 3-4% guided for FY26), still lag the higher profitability levels of more mature competitors like Fortinet (20-25% operating margins) and Palo Alto Networks (10-15% operating margins). This suggests that while SentinelOne is effectively investing for growth and gaining scale, it has yet to achieve the same level of operational leverage as some established players.

SentinelOne's strategic focus on emerging areas like AI SIEM and Cloud Security (CNAPP) positions it to disrupt markets traditionally dominated by legacy vendors (like Splunk in SIEM) or rapidly evolving spaces where architectural differences matter. The ability to offer cost savings through its cloud-native data platform and enhance analyst productivity with Purple AI provides compelling value propositions that resonate with customers facing budget constraints and talent shortages.

While SentinelOne's smaller scale compared to cybersecurity giants like PANW or FTNT could be a disadvantage in terms of brand recognition and sheer sales force size, its focused innovation, architectural differentiation, and expanding partner ecosystem are enabling it to effectively compete and gain market share. The company's open ecosystem approach, allowing integration with third-party security tools, also contrasts with some vendors that favor closed platforms, offering customers greater flexibility and choice. The competitive landscape remains dynamic, but SentinelOne's technology and strategic execution appear to be driving positive momentum.

Financial Performance

SentinelOne has demonstrated a compelling trajectory of rapid revenue growth coupled with significant margin expansion and progress towards profitability. In Fiscal Year 2025, the company achieved revenue of $821 million, representing robust 32% year-over-year growth. This growth momentum continued into the first quarter of Fiscal Year 2026, with revenue reaching $229 million, a 23% increase compared to the prior year period, exceeding management's expectations.

Underpinning this top-line growth is a strong and improving profitability profile. The company has consistently delivered best-in-class gross margins, reaching 75% on a GAAP basis and 79% on a non-GAAP basis in Q1 FY2026. This reflects healthy pricing power and the inherent efficiency of its platform architecture. Operational efficiency has also improved dramatically. Non-GAAP operating margin expanded significantly, reaching negative 2% in Q1 FY2026, a four percentage point improvement year-over-year. Fiscal Year 2025 marked a pivotal year, with SentinelOne achieving its first quarter of positive non-GAAP operating income in Q4 FY2025 and its first full year of positive non-GAAP net income and free cash flow. This progress is driven by increasing scale, disciplined cost management, and focused investments.

Despite the positive trends, the company reported a GAAP net loss of $208.2 million in Q1 FY2026, significantly higher than the $70.1 million loss in Q1 FY2025. This was primarily attributable to a large discrete income tax provision of $133.5 million related to the reassessment of an uncertain tax position concerning the ongoing APA negotiations with the U.S. and Israeli tax authorities. Excluding this discrete item and other non-GAAP adjustments, the company's operational performance continued to show improvement.

Key operational metrics also reflect healthy business momentum. Total ARR grew 24% year-over-year to $948.1 million as of April 30, 2025. While Q1 FY2026 net new ARR was impacted by macroeconomic uncertainty, management noted improved trends in May and expects sequential net new ARR growth in Q2 FY2026 to exceed typical seasonality. The company continues to expand its relationship with existing customers, maintaining healthy expansion rates, and saw its dollar-based net retention rate at 110% for the full year FY2025. The number of customers with ARR of $100,000 or more grew 22% year-over-year to 1459 in Q1 FY2026, indicating continued success in the mid-market and enterprise segments. Remaining performance obligations (RPO) stood at $1.2 billion as of April 30, 2025, growing 33% year-over-year and providing future revenue visibility.

The company maintains a strong liquidity position, with $1.2 billion in cash, cash equivalents, and investments as of April 30, 2025, and no debt.

Free cash flow generation has turned positive, reaching a record 20% margin in Q1 FY2026. This robust balance sheet and cash flow profile provide ample flexibility for continued investment in growth initiatives, strategic partnerships, and capital allocation, including the recently authorized $200 million share repurchase program.

Overall, SentinelOne's financial performance demonstrates a company effectively balancing aggressive growth investments with a clear path towards sustainable profitability. The recent profitability milestones and strong cash generation signal increasing maturity and operational efficiency, positioning the company well to execute on its strategic objectives and capitalize on market opportunities.

Outlook and Guidance

SentinelOne's outlook for Fiscal Year 2026 reflects a blend of continued confidence in its strategic execution and market position, tempered by the persistence of macroeconomic uncertainty. For the full Fiscal Year 2026, the company expects revenue to be between $996 million and $1 billion, representing approximately 22% year-over-year growth. This guidance implies surpassing the significant milestone of $1 billion in both ARR and revenue during the year.

For the second quarter of Fiscal Year 2026, management guided for revenue of approximately $242 million, which would represent 22% year-over-year growth. They anticipate sequential net new ARR growth in Q2 FY2026 that exceeds typical Q2 seasonality, based on improved trends observed in May following a softer April.

A key focus for FY2026 is achieving full-year operating income profitability. The company is guiding for a non-GAAP operating margin between positive 3% and 4% for the full year, a substantial improvement of over 650 basis points at the midpoint compared to Fiscal Year 2025. For Q2 FY2026, they expect to reach non-GAAP operating margin breakeven, implying a year-over-year improvement of approximately 300 basis points. Gross margins are expected to remain strong, guided between 78.5% and 79.5% for the full year FY2026 and approximately 79% for Q2 FY2026.

Management expects to deliver approximately $200 million in net new ARR in FY2026, representing about 2% year-over-year growth. This figure includes an anticipated headwind of up to $10 million in churn related to the strategic retirement of the legacy deception solution, with nearly half of this impact expected in Q1 FY2026. Excluding this impact, full-year net new ARR growth would be in the mid to high-single digits percentage year-over-year.

The guidance is based on several key assumptions: continued underlying new business growth, contributions from newer platform solutions (AI, Data, Cloud), anticipated conversion and win rates, and the strength of the pipeline. However, management remains mindful of potential external disruptions, including ongoing macroeconomic volatility, deal timing variability, and uncertainty surrounding U.S. federal spending. The strategic decision to prioritize investments in high-yielding areas like AI, data, and cloud, while instilling operational discipline and efficiency, is expected to drive both growth and margin expansion.

Furthermore, the company expects its full-year free cash flow margin to exceed its operating margin by several percentage points, building on the strong positive free cash flow generated in Q1 FY2026. This indicates a healthy cash flow profile supporting the company's financial flexibility and investment capacity.

Overall, the outlook signals a year of continued growth, albeit at a slightly more measured pace than in prior periods, with a strong emphasis on achieving and expanding profitability. The focus on platform adoption, AI leadership, and strategic partnerships is expected to drive market share gains and position SentinelOne for long-term success in the evolving cybersecurity landscape.

Risks

Despite its strong growth trajectory and technological advantages, SentinelOne faces several pertinent risks that could impact its financial performance and investment thesis.

Firstly, macroeconomic uncertainty remains a significant factor. Worsening global conditions, including inflation, interest rate volatility, and potential recession, can lead to elongated sales cycles, deal downsizing, and decreased IT spending by customers, particularly larger enterprises. This dynamic was evident in Q1 FY2026, impacting net new ARR, and management has factored the potential for continued external disruption into its guidance. Geopolitical conflicts, including the situation in Israel where the company has a significant employee presence, also pose operational risks.

Secondly, intense competition in the cybersecurity market is a constant challenge. SentinelOne competes with larger, more established players and other innovative vendors who may have greater resources, broader portfolios, or more mature distribution channels. While SentinelOne's win rates are strong, competitive pressures could lead to pricing concessions, impacting gross margins, or require increased sales and marketing investments, affecting operating profitability.

Thirdly, platform defects, errors, or security vulnerabilities in SentinelOne's own products could severely damage its reputation, lead to customer churn, and expose the company to significant liability, including potential product liability claims or costs associated with customer breaches. While the company highlights its architectural resilience, no software is immune to vulnerabilities.

Fourthly, integration risks associated with acquisitions could divert management attention, disrupt operations, and fail to deliver anticipated benefits. The company's strategy involves potential future acquisitions, which could also dilute stockholder value if financed through equity.

Fifthly, reliance on third-party cloud infrastructure providers, primarily AWS, exposes SentinelOne to risks of service interruptions or increased costs, which could impact platform availability and profitability.

Sixthly, regulatory and legal risks are notable. The ongoing APA negotiation with tax authorities could result in significant, potentially adverse, financial obligations. The company is also subject to various and evolving data privacy and protection laws globally (CCPA, GDPR, DORA), compliance with which can be costly and complex. Ongoing securities and derivative litigation also pose potential financial and reputational risks.

Finally, execution risk remains. Achieving aggressive growth targets while simultaneously driving significant margin expansion requires effective management of headcount, operational processes, and go-to-market initiatives. The ability to successfully hire, train, and retain skilled personnel, particularly in sales and R&D, is critical but challenging in a competitive labor market.

These risks, individually or in combination, could adversely affect SentinelOne's ability to achieve its growth and profitability targets, impacting its business, financial condition, and stock price. Investors should carefully consider these factors alongside the company's opportunities and strengths.

Conclusion

SentinelOne stands at a pivotal juncture, having successfully evolved from a disruptive endpoint security player to a comprehensive, AI-native cybersecurity platform. The company's core investment thesis is compelling: leveraging differentiated AI technology and architectural advantages to capture market share in a large and growing market, while demonstrating a clear path to sustainable profitability.

Recent financial results underscore this progress, with strong revenue growth continuing into Q1 FY2026 and significant milestones achieved in Fiscal Year 2025, including the first positive non-GAAP net income and operating income quarters and positive full-year free cash flow. While macroeconomic headwinds created some pressure on net new ARR in Q1 FY2026, management's outlook for FY2026 signals continued growth, targeting over $1 billion in ARR and revenue, coupled with substantial operating margin expansion towards profitability.

The company's technological leadership, particularly in AI-driven autonomous defense, is a key differentiator, validated by strong performance in third-party evaluations and driving rapid adoption of emerging solutions like Purple AI and AI SIEM. Strategic partnerships and architectural resilience are expanding market reach and creating opportunities, especially in the large enterprise and government sectors, positioning SentinelOne favorably against competitors.

However, investors must remain mindful of the risks, including ongoing macroeconomic volatility, intense competition, potential tax liabilities from the APA negotiation, and execution challenges inherent in scaling a high-growth business.

In conclusion, SentinelOne's story is one of innovation and execution in a critical and dynamic market. The company's focus on AI-powered autonomous security, expanding platform capabilities, and improving financial discipline positions it for continued market share gains and long-term value creation, making it a compelling consideration for investors seeking exposure to the future of cybersecurity.