SentinelOne, Inc. (S) Earnings Call Transcript & Summary

Okay. Well, good afternoon, everyone. Welcome to Day 2 of the Barclays TMT Conference. Very happy to have with us the team from SentinelOne, actually, for the first time as a public company, so a very special welcome, indeed. We've got Tomer Weingarten, Chief Executive Officer; we've got Nick Warner, Chief Operating Officer; as well as Dave Bernhardt, Chief Financial Officer. We also have Doug Clark, Head of Investor Relations on the line as well. Just as an added benefit here we're talking about, before we start it, the team here from SentinelOne just reported their Q3 earnings last night. So this is all going to be really hot off the press, which is going to be really fun. So just to frame this out a little bit. We've got about 30 minutes together. Let's maybe take the first 15 or 20 minutes to do some fireside chat here with the team. And then I would love to make this interactive. So any of you folks on the webcast that have got questions, just shoot me an e-mail at [email protected], and I'll do my best to weave them into the presentation. So with that, Tomer, Nick, Dave, thank you so much for being with us here today.

Sure thing. Thanks for having us.

Yes, for sure.

Tomer, again, first time for SentinelOne at the conference, hopefully the first of many times to come as a public company. I think most of us know SentinelOne. But just to make sure that we're all on the same page, could you just maybe recap some of the highlights this quarter that you were most proud of. And Dave, maybe you could just -- maybe just add a little bit of financial color there as well on what you were most proud of from a financial perspective.

Yes. Sounds good. Look, I mean, to us, obviously, we're a fast-growth company to say the least. And I think getting to the point that we're able, in a consistent manner accelerating ARR growth for the third time in a row. That, to us, is just a phenomenal achievement. I think that is really a great way to showcase the momentum we have in our business. I think one of the things that I think most people don't completely realize about us is really how broad the platform is. SentinelOne today is a complete enterprise security platform. Endpoint is our core, and I think it will remain our core for years to come. But at the same time, the contribution we're starting to get from our emerging product lines are now making a big difference, and it's fueling growth for the years to come. So to me, I mean, the performance that we've seen this quarter, the contribution from product lines that are adjacent to endpoint, like cloud worker protection, like IoT security, like some of our more management-focused modules like RSO and STAR, I mean, those, to me, are just great points of strength in our business. And then obviously, as we are starting to transition our customer base, onboarding new customers on top of our new Scalyr back end, we're seeing some great margin expansion opportunities there. I mean all in all, that's just incredibly encouraging. Great performance by the team. I love the fact we've actually won several culture awards that really put front and center how we are as a company. I mean the people that work here, I think that mainly goes unnoticed through earnings calls for everybody, but it's something that really is important to us. The people here is what makes the difference. And I was really proud of the accomplishment this quarter around culture and diversity. So to me, I mean, again, just a great quarter and hopefully one of many. So on to you, Dave, to give more of a financial view.

Sure. Yes. No, I'm always excited about the numbers. This was a great quarter. We had 75% customer growth. If you go to customers over $100,000 in ARR, we had 140% growth. So we're seeing a push to larger enterprise customers, which is great. Record NRR, 130%, 97% gross retention, 131% annual ARR growth. And we raised our guidance, which -- for Q4, which was so -- all around a great quarter for us.

Yes, absolutely, a lot to be proud of there. Tomer, I maybe want to start with -- just to your point, just the core here, which is the corporate endpoint market. And I definitely want to talk about the other parts that are additive to that. But just maybe just start off with endpoint. I know competition gets a lot of focus in this market. But if you zoom out a bit, and you've seen this market for years, why does it feel bigger now kind of compared to prior years when endpoint arguably felt just a little bit more mature? What do you think has helped this corporate endpoint market expand, if you will? Am I reading that wrong? Curious about your viewpoints.

I think you read it completely accurately. And I think that you call it mature, I call it stagnant. It's been a market that was mainly revolving around one element, which was the antivirus, and that was really it. And most of these offerings were very on-prem focused, which means that you're not really selling the platform, you're not really selling something that can expand. And also the attack surface was something that was mainly regarded as something that's in the control of the firewall and the network providers. And when you look at that same market today, obviously, when you take on a platform like ours, which becomes a data processing platform, which has probably 24 different capabilities, all delivered natively from the cloud and are there for the consumption of that same user that bought that core next-gen antivirus offering, next-gen EDR offering, device control, application control, management capabilities, MDR, and that's all before we even talk about the cloud footprint and how that's changing the landscape and endpoint. Just looking at a very, very different, call it, yield per node. So if back in the day, you had one machine and the license cost was really all there is to it. I mean it was x amount of dollars. Here, you're seeing a very different function where the cost per machine is completely different. The capabilities you deliver are completely different. The data retention element is also different because now you're not only just putting a protection piece of software on these devices, you're actually actively monitoring them at any given moment and all that data is flowing into a data platform that has been used to manage these endpoints. So it's a constantly evolving, I think, landscape that we're predicting right now. Customers need new capabilities all the time. Attackers are shifting their methodologies faster and faster. We're all moving into Zero Trust. That has a complete, call it, tectonic effect on how you should be securing the enterprise. And now it's mandated and it becomes mainstream by things like the Biden executive order around cybersecurity. So all of that just fuels more spend in cybersecurity. And I think it's anchored in endpoint protection. I think that every incumbent dollar is really probably 5x, 7x in next-gen land. And that's kind of what we're seeing today. We're seeing it with bigger lands. We're seeing it with a better cross-sell and upsell overall performance. So to us, this market just on the TAM size itself is already bigger just because every dollar is worth more. And that is, again, even before you talk about the expansion surfaces. And cloud is, again, changing everything, in a very dramatic manner. Each workload in the cloud is -- can be regarded basically as another endpoint. Even if it's another container, it needs protection. It needs telemetry, it needs enforcement. And that provides for more opportunity for a vendor like ours. Maybe Nick has something to add there as well. I mean he's been a -- he's an endpoint veteran. He's a true endpoint veteran back from the McAfee days, so I'm sure he has a perspective there.

Yes, not stagnant, not legacy, talking for myself, at least. I think something that we are definitely seeing is a consolidation in terms of requirements. And as Tomer had mentioned, the market really isn't an AV market per se anymore. And it's not even really just an EDR market. It's requiring both as well as requiring extensibility, both in terms of data ingestion, but also surfaces that we protect. And so one of the things that we're most excited about recently announcing Singularity Mobile, so extending our ability to protect and see out to all the mobile devices on an enterprise's network as well as -- and this is really interesting, if you think about the education sector, extending our protection prevention and visibility out to Chromebooks, which is the mainstream OS as it's #2, ahead of Mac now. So that really also radically increases our addressable market and also really increase the value that we're providing to our customers.

Yes, yes. Absolutely. Dave, maybe just for you. I mean -- I think the endpoint business here, right, it's one of the things that Tomer here was talking about, of course, right? Endpoint business here is still the majority of total ARR, it seems, for SentinelOne. But the team has also talked about growing emerging products. I mean Nick just talked about Mobile. That's brand new, of course, right? But I guess maybe wondering, David, if you could just give us some color or anything that you've said just around the relative sizes of sort of endpoint versus emerging. And just to make sure we're all on the same page, recap anything that you said about the emerging parts of the business and how they grew on yesterday's call.

Sure. So yes, I think if you take Ranger, cloud, data, MDR, the more emerging products, and you combine them, it's around 10% of total ARR. It's actually growing faster than the rest of the business. So we're really excited about the growth that we're seeing there. And it's -- when I think about something like cloud and kind of the early innings we're at in that, I foresee that being the same size as endpoint at some point, when you think of the TAM there. That cloud is just such a greenfield right now, such a vast opportunity for us and being able to leverage everything we've built, we're pretty excited about the opportunity.

Yes, yes, absolutely. Maybe, Tomer, just on kind of focusing on some of the highlights from last night. It feels like -- I think I asked this question on the call and you talked about this a little bit, but it feels like SentinelOne is leading more with the Complete package here, right, particularly on the endpoint side, right? I mean can you just remind us why customers are opting for that more and more? And maybe as part of that -- and Dave, maybe if you want to touch on this. Maybe if you talk a little bit about the value uplift that SentinelOne gets when a customer makes that shift from Core to Complete or whatnot. Curious about that, sort of the differences in SKU, if you will.

Yes, yes, definitely. And it's a dynamic that we've seen, I think, as early as the beginning of last year where we're just seeing -- we're seeing a wholesale shift to Complete. And I think it's mainly because to Nick's point, earlier point, EDR and EPP are becoming one of the same. And our Complete package is really bundling both. And we kind of mentioned a couple of things on the earnings call also on our ability -- and that is true to about 95% of the sales that we do to actually rip out the incumbent antivirus vendor that's running in the account. That's not always true for some of our competition. So when you look at the Complete package, it's actually something that solves both for the prevention piece, the classic EPP and the Complete next-gen AV to replace antivirus. But at the same time, it layers best-of-breed EDR capabilities all in the same package. And I think that couple that with our kind of upmarket success, these are the offerings that those customers are looking to actually deploy. And moreover, in my view, given that almost everything we sell today starts with Complete, it's probably going to be something that's going to be the entry package for us in the next couple of years. So expect us to actually build on top of Complete, making Complete the baseline. Maybe we'll do away with the name Complete, it's a bit misleading. But I truly think that becomes the baseline almost of everything we sell. To your question about uplift, it's -- if I remember correctly, and Nick can probably give you the accurate detail, but it's roughly 20% to 30% uplift above the Control package, which is the [ MID package ] that we have today and it's double core, which is the entry package that we have today. Once again, I don't think it's farfetched to think that going into next year, some of these packages are going to go away, and our focus will be Complete and beyond, so to speak.

Got it. That's super helpful. And I think a really important point as well. Maybe just to expand on that a little bit for you, Dave, can you just remind us -- I mean, at the time of the IPO, I think you've given us just some broad brushes around the mix of the business across Core, Control and Complete. Understanding you're not going to update those all the time, can you just remind us what you said about sort of the rough mixes across those different families [ compared to peers ]?

Sure. Complete is growing. So at the time, our enterprise customers that were predominantly using it we're about 1/3 of our customers, but about half of our revenue. So we're seeing that continue and uplift. If you just look at the last couple of quarters of where we're at in the enterprise customer growth, customers over $1 million grew 4x this last quarter. So we've got a lot of push where customers are moving upstream. Customers are adding more endpoints, customers are adding more modules. You're seeing that in our NRR. There's -- it's the IPO but better, yes.

Well said. Got it. And actually, maybe this touches on it a little bit, but maybe for you, Nick, just to put a bow sort of on pricing here. I thought one of the really impressive metrics from last night was the ARR per customer actually accelerated its growth -- its year-over-year growth this last quarter. And Dave touched on this a little bit, but Nick, maybe you could expand on it a little. Can you talk about the big deal environment here in Q3? And how do you feel about that going into Q4?

We felt great about how we did pushing further and further upstream in terms of penetrating large and very large accounts. If you look at the growth there, 140% year-over-year growth with customers, over $100,000 of ARR. And -- but doing that combined with really impressive metrics like growing total customer count by over 75% to over 6,000 today, and just numerous large deal examples like protecting the world's largest financial exchange in a multimillion dollar deal. And what's really important about -- below the surface on a deal like that, is that -- and this goes back to your point and question before, it's not just buying us for AV replacement and first wave EDR replacement. It's actually going with SentinelOne to protect endpoint cloud data. Also buying modules like Remote Script Orchestration. So what we're finding is large deals are also consuming more of our technology platform upfront. And so if you combine that with further acceleration in terms of new customer adds, we're really in a great place as far as customer acquisition is concerned. And then entering into Q4, we have record pipeline. Typically, from a seasonality perspective, Q4 is the busiest quarter of the year in cybersecurity in terms of purchases, especially at the higher end of the market. And so we feel like we're in a really, really great place going into Q4.

That's great. That's great. Maybe just to dovetail on that back to you, Dave. While we're talking about ARR -- while we're talking about Q4, sorry, I mean, understanding that SentinelOne does not guide to ARR on a quarterly basis, maybe just the open-ended question that I could ask you here is, are there any points that we should keep in mind for Q4, when just thinking about this from either a seasonality perspective or a customer mix perspective? Again, open-ended, anything you want us to know about Q4 ARR.

Yes. And I think Nick just touched upon it quite a bit. So obviously, Q4 is our largest quarter, and it has been historically. We have a really strong pipeline going into the quarter. We're confident in the guidance we provided. And really, what we're seeing is the momentum that we've been seeing is continuing. So all the same drivers that are creating this momentum are in place, and we're excited about achieving our goals in the quarter.

Got it. Got it. Understood. Tomer, let's maybe switch gears to XDR a little bit. And also loop in Scalyr as well because there was some stuff to talk about there a little bit also. But maybe just stepping back, Tomer, it feels like some companies define XDR differently than other companies. I'm curious, how do you define XDR? And why do you think SentinelOne can win here with the help of a product like Scalyr?

Yes. Look, XDR, it's something that every vendor has their own spin on. And to be honest, I don't think anybody has a formidable XDR offering right now, including us. I think it's a market that's [ happening ]. I think it's something that is very, very gradual. I think the approach that we're taking is the right approach or at the very least, it's the right approach for us. And I think that approaches will differ from vendor to vendor. I think you're seeing some of our competitors really separating between EDR and XDR. So they have one platform from -- for EDR. And now they're selling a different platform based on a different technology that they bought for XDR, I don't know if that's the right path. For us, when we decided and we were the first cybersecurity company ever to buy a data analytics company, and I think others have followed, we did that because we believe that, that's going to be the future is one holistic data analytics backbone that can serve all of the EDR purposes, all the while expanding EDR to be able to ingest data from other sources, infuse it together with what we believe is the most valuable data set in the enterprise, which is the endpoint telemetry. It's about 70% of all security logs that come from monitored endpoint. So obviously, if you have that toehold in endpoint telemetry, it makes sense to start ingesting and importing other pieces of data into that same platform, into that same hub. And on top of that, if you can layer in automation, if you can start not just connecting the dots, but really orchestrating the action in an automated manner, then I believe you get a highly competitive offering, and you add a ton of value to many customers out there basically by, I would say, redefining what the SIEM should have been. I think the SIEM was a very passive data store. XDR comes to do pretty much everything that the SIEM has done but layer in an active mode that can actually enforce and orchestrate action across different facets, different products, truly break down the silos between the different products in the ecosystem. And if you ever want to accomplish that, I think one very important ingredient is that your XDR platform has to be open. It has to support all vendors. It has to be inclusive. So when I see other vendors forming alliances or taking a closed garden approach to making XDR work only within the boundaries of their platform, that, to me, doesn't make a lot of sense. Again, it might be a strategy that works for them. Our strategy is to build a complete open XDR platform, one that's neutral to all vendors. We don't discriminate. We're fine ingesting data from even competing products. And I think that we're going to prove that thesis going forward into the next few quarters. But all in all, I think that XDR is something that we envisioned. I don't know that -- by the way, I wouldn't take credit on inventing the acronym XDR, but I think the notion of how we see it, I think, is very unique to us. And I think others have -- took notice of what we're doing, and they're trying to replicate. They're trying to do the same. And so far, it seems like we're leading the herd in terms of our approach. And also in terms of our migration and integration where all of our new customers are already running on a back end that has the capability to ingest more data from other sources. So once we flip the switch and allow them to do that, that's a seamless transition from the platform that they have today and into a platform that can ingest data from any other source in the enterprise, and that's big.

Yes, yes. No, that's a really interesting answer there, Tomer. So the idea of -- instead of having a closed garden approach to XDR, having an open one, very, very interesting. Maybe while we're talking about Scalyr, Dave, maybe you could just tell us a little bit about -- Scalyr, obviously, can be a very valuable product from an XDR perspective. It can also be a very valuable back end, right, for SentinelOne and all the data that you are compiling, right, with your customers. I think there was a plan to migrate customers to that Scalyr back end. Dave, I think the timing there was -- maybe has shifted a little bit, that played a little bit into the gross margin upside that we saw last night. Great gross margins, by the way. Can you touch a little bit on that timing and just anything we should keep in mind from a gross margin perspective vis-à-vis Scalyr?

Yes. So we're mapping the migration of Scalyr better in line with our product road map for XDR using Scalyr. So that shifted a little bit. So instead of seeing it in Q3, Q4, Q1, maybe into Q2, we're essentially expecting it for Q4 in the first half of next year. It's about a 4% suppression of margins from what we just recently achieved. As you would imagine, we're running duplicate back ends to make this seamless for customers. We want them to have the best experience possible. And basically, what I have is duplicative storage and ingestion costs during that time. So to make it as easy for customers as we can, customers are opting into this because of the additional functionality. We're moving customers. Any new customer we've received in the past couple of quarters is already using the Scalyr back end and they're seeing the advantages of this. When I look at this quarter in particular, it wasn't just the Scalyr shift that caused our gross margin upside. I mean we had better economies of scale in the business. We had higher revenue. We had business expansion, greater benefits from our cloud hosting renegotiation. So there's a lot of things in play. I like in it a bit to kind of a future state where everyone got a sneak peek of what we're capable of once this is completed, where we were able to significantly increase our gross margin and really start to push on the operating margin as well.

Yes, yes. I think actually, just to reinforce that point, I think you would kind of call this gross margin kind of longer term, maybe a baseline to think about, right? If I'm not mistaken, right?

No, that's correct. We provided -- when we did the IPO, we provided a long-term 75% to 80% plus. That's our goal. And we're executing on that. If you remember at the IPO, I think we were coming off 53%, 57%. So we're already making great strides and efficiencies as we're building towards achieving that 75, 80-plus percent. As customers bring on more modules where we've already ingested the data, those have high incremental margins. So the expansion there really helps us out.

Yes, absolutely. I have so many more questions for you, Nick and for Tomer, but I've only got limited time. So I want to ask one more question, and it's for you, Tomer. And it's a bit of a philosophical one. I'm actually really excited to ask it. But I think many investors have looked at SentinelOne and compared it, right? Let's put the competitive dynamic aside. I think a lot of investors have looked at SentinelOne, compared it to the success of CrowdStrike, right? I think we all [ might ] probably acknowledge that CrowdStrike has been a successful story. The question is, if you wanted to think about SentinelOne's story 3 years from today, 3, 5 years, pick your time frame, how will it be similar or different than CrowdStrike? You could -- you can answer that from any angle that you'd like, open ended. But I'm just kind of curious how you sort of think about the parallels and how you want to think about the differences going forward.

Yes. Look, I think that by definition, it's going to be different because of one very simple fact. When CrowdStrike went through the period of growth that we're going through right now, they didn't have CrowdStrike to compete against. And we're showing just unbelievable growth while you have, as you mentioned, a pretty successful company like CrowdStrike in the market. So I think that just gives us even more confidence in what we're able to do. I mean if you think about it, it's not just the incumbents that we're fighting here, while they, when they went through that period, the landscape was incredibly different. So to us, I mean, it just gives us the ability not only to compete and really control our own destiny. We truly don't feel any 1 or 2 competitors are impacting what we do in any given manner. Our growth was incredibly linear. That has to do with our strategically different go-to market. Our ability to go and cater to many different parts of the TAM, I think it's a reach that they never had, some others never had that helps catapult growth and underwrite growth for the years to come. I truly believe that there are so many different growth vectors in our business, and they're all starting to pick up pace at a very early stage. So unlike many other public companies in history, which went through a period of growth, mostly to one product line, then added more capabilities to continue and find growth in later stages, our strategy is very different. And we've planted multiple seeds in the very early stages, and they're all starting to pick up and they're all starting to accelerate. And that is, to me, the way we sustain growth into the future. And hopefully, in a 3-year CAGR view or a 5-year CAGR view, there might be a different winner in this market or a bigger company in this market. We're going to just have to wait and see. But I don't think that's going to be taking away from their success, right? I think that the market is big. The market is sustainable. The contribution to our revenue from multiple different TAMs really dictates that there's not going to be a single winner that's dominant in one given market, but the winners are going to be one that would be able to play multiple different TAMs and be successful in multiple different TAMs. I don't see any degree of a one vendor world dominance in any one of these given TAMs. So a lot of it is, again, just focused on delivering value to customers and success will follow.

Yes, absolutely. That's a really helpful answer, Tomer. And maybe just to add on my own viewpoint there, I think some -- hopefully, some investors have seen what we've written sort of comparing the endpoint market, the firewall market. Clearly, 2 very big markets, but also markets that have supported multiple winners, multiple players of size. So maybe something to consider in here as well, which is one facet of your answer. Guys, I mean, Tomer, Nick, Dave, can't thank you enough for the time here. As you can imagine, I've got a lot more questions to ask you, but I also want to be respectful of your time. Again, like I said at the beginning, this is the first Barclays TMT Conference that we had SentinelOne present at, and I'm sure we're going to have plenty more in the future, and I really look forward to it. So thank you again for the time here, gents.

Absolutely. Thank you, Saket.

Excellent. Enjoy the rest of your day. Bye now.