SentinelOne, Inc. (S) | The Buildout — AI Infrastructure
The Verdict
SentinelOne’s Singularity platform uses AI models to autonomously detect, investigate, and stop cyber threats across endpoints, cloud workloads, and data systems. As enterprises deploy AI, they create new attack surfaces that legacy tools cannot defend — SentinelOne’s AI-native architecture and dedicated AI security products aim to fill that gap, making it a direct enabler of the broader AI buildout.
| Market Cap | — |
| Revenue (TTM) | $1.0B |
| Revenue Growth | +21.4% |
| EBITDA Margin (TTM) | -23.9% |
| Net Cash | $657M |
| Earnings Beats | 6 of 7 |
| P/E (TTM) | — |
| EV/EBITDA (TTM) | — |
What We Like
- Growth reaccelerated: total ARR +23% y/y, first acceleration in over three years; net new ARR record $44M (+55% y/y).
- AI security ARR nearly doubled again, marking the second straight quarter of explosive growth in a market Gartner estimates growing >70%.
- Non-endpoint ARR approached 50% of total, transforming the company from an endpoint-centric vendor into a multi-vector platform.
- Operating margin guidance raised to ~10% for FY27 (+700 bps y/y), with exit rate “significantly above 10%,” demonstrating genuine leverage.
- Balance sheet strength: $812M cash and no debt; TTM adjusted FCF margin 6.5%.
What We’re Watching
- Restructuring execution: the 8% workforce reduction could disrupt sales productivity in Q2 and Q3; any weakness would test the reinvestment thesis.
- Large-deal lumpiness: management acknowledged back-edge-loaded quarters; a single slipped deal could cause a miss.
- Overall NRR pressure: while $100K+ cohort NRR improved to >110, total NRR is undisclosed and acknowledged as soft among smaller customers.
- Competitive intensity: Palo Alto Networks’ SASE platform ($1.3B ARR, +34%) and Microsoft’s embedded security could limit share gains, especially if AI security differentiation narrows.
The thesis appears to be strengthening, driven by growth reacceleration, mix diversification, and margin expansion. The durability of ARR acceleration and the company’s ability to improve overall NRR remain the key open questions.
Earnings Beat
SentinelOne reported Q1 FY2027 revenue of $277 million (+21% y/y) with gross margin of 71.8% and non‑GAAP operating margin of 4%. Net new ARR surged to a record $44 million (+55% y/y) and AI security ARR nearly doubled sequentially for a second quarter.
| Metric | Q1 FY2027 | Q4 FY2026 | Q1 FY2026 | YoY |
|---|---|---|---|---|
| Revenue | $277M | $271M | $229M | +20.8% |
| Gross margin | 71.8% | 75.6% | 75.3% | -350bps |
| EBITDA | −$61M | −$63M | −$77M | −20.5% |
| EPS | $-0.23 | $-0.33 | $-0.63 | −64.4% |
| Net new ARR | $44M | n/a | n/a | +55% YoY |
For the first time, the total ARR from our non endpoint solutions approach 50%.— Tomer Weingarten, Chief Executive Officer, May 28, 2026
Management tone: Management struck a confident but disciplined tone. The CEO framed the reacceleration as a structural shift underpinned by AI security demand, while the new CFO emphasised operating rigour and a commitment to Rule of 40, candidly acknowledging large-deal lumpiness and NRR softness outside the top cohort.
Management Guidance
For FY2027, management maintained revenue guidance of $1.195–$1.205 billion (~20% y/y) but raised non‑GAAP operating margin guidance to $115–$125 million (~10% at midpoint), implying an exit rate significantly above 10%. The Q2 revenue guide is $289–$291 million with op margin ~8%. The CFO attributed unchanged revenue guidance to early-year conservatism and back-end loading of large deals.
Trajectory
Revenue reached $277 million in Q1 FY2027, up 21% year over year, as total ARR growth accelerated to 23%. Gross margin compressed to 71.8% from 75.3% a year earlier. Non‑GAAP operating margin improved to 4% from negative territory a year ago, aided by sales and marketing efficiency gains (39% of revenue vs. 47%).
The Model
The model projects FY+1 revenue of $1,213 million with an EBITDA loss of $138 million (-11.4% margin), and FY+2 revenue of $1,500 million with a narrowing EBITDA loss of $72 million (-4.8% margin). Near-term revenue is anchored by the ARR base and guided 20% growth, while FY+2 assumes continued platform adoption and large-deal conversion. The path to EBITDA breakeven requires sustained revenue growth in the low 20s and further operating leverage.
| Metric | FY2026 | Next FY (E) | Following FY (E) |
|---|---|---|---|
| Revenue | $1.0B | $1.2B | $1.5B |
| YoY Growth | — | +21.1% | +23.7% |
| EBITDA | −$266M | −$138M | −$72M |
| EBITDA Margin | -26.6% | -11.4% | -4.8% |
Projections are the median of 5 independent model runs. The model’s revenue sits 6.2% above analyst consensus.
For FY2027, management maintained revenue guidance of $1.195–$1.205 billion (~20% y/y) but raised non‑GAAP operating margin guidance to $115–$125 million (~10% at midpoint), implying an exit rate significantly above 10%. The Q2 revenue guide is $289–$291 million with op margin ~8%. The CFO attributed unchanged revenue guidance to early-year conservatism and back-end loading of large deals.
What Could Go Right — and Wrong
- AI security revenue becomes a material contributor (>15% of total ARR) and growth sustains over 50%.
- LevelBlue partnership ramps faster than anticipated, adding tens of millions of endpoints and pulling through significant ARR.
- Overall NRR improves to above 115 as expansion across all cohorts accelerates, reducing reliance on new logo acquisition.
- Margin expansion outpaces guidance, reaching Rule of 40 within four quarters as S&M leverage continues.
- Competitive displacement accelerates, with Prompt Security and Purple AI capturing material share from legacy SIEM and next-gen endpoint vendors.
- Net new ARR growth stalls or turns negative, proving the Q1 acceleration was a one-off large-deal spike.
- Restructuring disrupts sales productivity, causing Q2 or Q3 revenue miss and undermining reinvestment narrative.
- Competitors match or surpass SentinelOne’s AI security capabilities, neutralizing the differentiation wedge and compressing win rates.
- Large-deal lumpiness becomes chronic; a single slipped deal causes a quarterly miss, eroding investor confidence.
- GAAP losses widen again, forcing a dilutive capital raise despite non-GAAP improvements.
Looking Ahead
Over the next twelve months, SentinelOne’s trajectory will be shaped by the durability of its ARR reacceleration, the monetisation of AI security and Purple AI, and the operational impact of the restructuring. Key catalysts include the Q2 and Q3 earnings prints, the ramp of Flex and LevelBlue, and the rollout of zero-click automation and Amazon Bedrock AgentCore integration.
- Q2 FY2027Q2 FY2027 earnings — Tests net new ARR growth trend and any sales disruption from restructuring.
- H2 FY2027Margins toward exit rate — Operating margin expected significantly above 10% guided full-year rate.
- UpcomingAmazon Bedrock AgentCore launch — Integration delivers runtime guardrails for AI agents; could open new pipeline.
- Near-termPurple AI zero-click automation — Product milestone; potential to accelerate adoption and per-customer ARR.
- Multi-yearLevelBlue endpoint consolidation — Tens of millions of endpoints migrating; early ARR contributions validate MSSP leverage.
- FY2027Flex pipeline conversion — Large-deal momentum tested; management expects continued Flex strength.
Financials
Annual Summary
| Metric | FY2026 | TTM |
|---|---|---|
| Revenue | $1.0B | $1.0B |
| Gross Margin | 74.9% | 74.0% |
| EBITDA | −$266M | −$544M |
| EBITDA Margin | -26.6% | -23.9% |
| Net Income | −$451M | −$319M |
| Free Cash Flow | $52M | $63M |
| Net Cash | — | — |
Key Ratios (Trailing)
- P/E TTM—
- EV/EBITDA TTM—
- EV/Revenue TTM—
- Price/FCF TTM—
- Gross Margin (TTM)74.0%
- EBITDA Margin (TTM)-23.9%
- Net Margin (TTM)-30.4%
- ROIC-31.5%
- SBC / Revenue29.0%
The Company
SentinelOne’s Singularity platform is an AI-native cybersecurity suite that autonomously prevents, detects, and responds to threats across endpoints, cloud workloads, and data systems. The platform’s behavioural AI models are trained on petabytes of telemetry, enabling it to stop novel attacks without signatures — a capability that becomes increasingly critical as AI generates more sophisticated cyber threats. Its product set includes endpoint protection, AI security tools for enterprise AI usage (Prompt Security), an agentic SOC (Purple AI), and an AI-driven data lake replacement for legacy SIEM.
SentinelOne is capital-light, operating entirely on public cloud infrastructure (primarily AWS with Google Cloud as a secondary partner) and leasing offices across the U.S., Israel, Europe, the Middle East, and India. It sells through channel partners and a growing direct sales force, and recently introduced Flex, a hybrid commitment-plus-consumption program that attracted $200M in TCV in its first three quarters. The company’s workforce was reduced by 8% in mid-2026 to refocus investment on AI, data, and cloud growth areas.
Business Segments
Competitive Landscape
SentinelOne competes in a crowded market against next-gen endpoint vendors, legacy security providers, and broad platform companies. The company differentiates with its AI-native architecture, autonomous behavioural detection, and strength in Mac/Linux and air-gapped environments — areas where Windows-centric rivals are weaker. It lacks a SASE offering, which puts it at a disadvantage in integrated edge-to-cloud RFPs.
- CrowdStrikeListed as a direct next-gen endpoint competitor; SentinelOne claims wins over next-gen incumbents using Prompt Security as an entry wedge.
- Legacy AV and Defender compete at endpoint; also sells SIEM (Sentinel); bundling threat remains latent but not acutely intensifying.
- Competes with SASE, XSIAM, XDR, and cloud security; PANW’s AI security is also doubling, but S’s SASE gap is a differentiator.
- Cisco / SplunkSplunk on-prem business shrinking, creating displacement opportunity; S’s AI SIEM wins against Splunk in deals.
- Wiz (Google Cloud)Cloud security rival; SentinelOne differentiates with AI-native runtime protection and autonomous behavioural analysis.
Supply Chain
SentinelOne is a software provider with limited physical supply chain; its primary dependencies are on public cloud infrastructure and frontier AI models.