SentinelOne, Inc. (S) Earnings Call Transcript & Summary

Okay. Great. And so we spoke a lot about endpoints. And again, I'm going to advertise the primer that we put out an endpoint. We have a lot of primers in this conference. And every time -- if you're with me for the whole day, you heard this every single presentation. And I apologize, but we do have a primer about the endpoint market, and we talk a lot about SentinelOne, and it's down in the lobby in the main area. So I'm very pleased to host Dave Bernhardt, CFO of SentinelOne; and Doug Clark, VP of Investor Relations. And we're going to -- I have prepared a list of questions. We're going to speak about the company and the competition. And I have to tell you that I'm hosted -- this is the kind of middle of the second day of the conference, and almost every other company spoke about you. So we got the education from the other company, but we want to hear it from you because I don't think they said good things about you. But that's expected.

So the first question I want to ask, Dave, is about the evolution of the company, meaning I've taken public -- I was involved personally in taking public most of the endpoint companies, including yourself. And what I've seen is companies 2 years after look very different, or 3 years after, they look very different from where they started. You're much younger in the public markets, but how did the company change? How did the company evolve? How did your thinking evolve from the time you went public until now?

Sure. Sorry. Yes, I think it's interesting. We've only been really selling our products in the public market -- or in the market in general since 2018. So we were obviously not one of the early endpoint companies. But we did come in and we were the first of -- or one of the first of the next gen, us, CrowdStrike, other companies like that. And I think the biggest differentiator we have was our technology. So we always came in where we wanted to be the best-of-breed technology. And I think what you've seen as we've continued to scale is we just continue to add more modules. We've continued to build this out into a more comprehensive platform. So we're -- endpoint first is our DNA, but then we're continuing to expand that technology across an entire platform of cloud, of IoT, of data. And that's really where we are now, where we're taking all those things together and we're building out XDR. And we want to be that connective glue of your entire security landscape. And that's really the trajectory that we're working on now.

Right. And how are -- we'll drill down. We'll talk about all these components, but how are they connected together? Why SentinelOne, for example, is positioned well to provide cloud security or identity?

Yes. So the underlying technology in our product is the same across all these platforms. And cloud, in general, is just -- it's just another landscape for us to protect. And that's a market, I think, that you're seeing grow potentially larger than the endpoint market. Cloud is -- you think about how much data is being aggregated, how much stuff is moving to cloud-based solutions, and that is just something that the trajectory that we're on as a world is phenomenal growth, like we've never seen growth like this. And if we can take our underlying core DNA and apply it to that, we -- at the endpoint, we probably see more security data than anybody else. Being able to leverage that with our AI, that makes us way more powerful in the cloud.

And I would just add to that. I think data is the key, right? Like that is how we identify anomalies and potentially malicious behavior, file-based, file-less types of attacks. We apply that to the EDR ecosystem first. That also transcends to other workflows, cloud workloads, identity workflows. So using data as kind of the core kernel of what we're analyzing transcends the entire enterprise. And I think what's actually interesting press release this morning, Skylight takes that to the next level. What we do with the data is we can [ textualize ] it. We look across it. We allow the machine and the AI to determine if there are likely threats and then escalate those further, take action upon those autonomously as opposed to relying on really big teams, cost-prohibitive, cumbersome and time-consuming, none of which work in today's threat environment. And with Skylight, we're actually unifying that across the entire attack surface, so across endpoint, across cloud, across identity and across third-party telemetry. That is transformative, like that is future-proofed and looking forward in terms of how you scale and actually create a platform, either in an EDR or in an XDR context.

Yes. Maybe I'll start with the endpoint market. And I'm -- the question is, how differentiated are you? We have Cortex from Palo Alto. There is a CrowdStrike, and you have all the legacy. I'm sure we all understand your differentiation versus legacy. But when I do my, what we call channel checks, and I hate this word, and I talk to the channels, I talk to your reseller, distributors, they love you. And they -- and it's a combination of technology and also pricing and the way you work with them. And that's something that, I think, everyone that talks to the channels see. That's the first thing that comes up in the discussion. So the first question is, what is your differentiation? Technology, product, et cetera? The second thing is how do you achieve this kind of love within the channels?

Sure. I think from the technology standpoint, the biggest differentiator is I think we do have a more advanced technology. If you look at the MITRE framework, past 2 years, we've been the top company in terms of keeping people secure. Gartner Magic Quadrant, we're up there with the leaders. I think when you look at even -- what we're trying to do is do everything in real time. So whether it's in the cloud, whether it's on your local device, our goal is always to identify and fix any security threat in milliseconds. So it's happening as if you had the best security person on everyone's machine at that exact moment. If you look at even like a CrowdStrike, I think they're a minute to detect it, 10 minutes to identify it, 60 minutes to remediate it. I can't give someone a minute, 30 -- 10 minutes or 60 minutes with a machine without it being encrypted, ransomwared, just advanced threats that proliferate throughout the network. I want something in real time. I think that's our biggest differentiator and always has been is we're doing everything in real time essentially. And that's, I think, why if you are in the channel, you want to work with us because you can get the best-of-breed technology, which makes them more efficient as a service provider. And we don't compete with the channel. Like I think that's another piece that's really core to our DNA is if you look at some of the incumbents like a CrowdStrike, maybe they own 10% of the market. Well, I want to be the security for the -- I want to be the security software for the other 90% that competes against them. So they never have to look over there back to see if we're trying to take over a service component of their work or we're trying to take them over as a direct customer. Like we are very nurturing of our channel relationship. We're constantly training them to make them more efficient. We really want to make sure that we have a great channel ecosystem, and that's something that I think has been just something we've done since our beginning, as we looked at that as a way to accelerate ourselves faster and then to continue to just own a much larger percentage of the market than we would have done if we were just naturally doing it on our own.

Yes. And I would just double-click on MITRE. I agree, exceedingly easy to claim leadership. I would say, prove it, back it up. Third-party testing and emulations are the best and most viable way to do that. I think the results speak for themselves. One of the biggest competitors, not even participating. The other one, configuration changes, delays, misdetections, that's not a recipe for true protection and detection.

Yes. Those are all things you can't do in real time. If you have to reconfigure your machine or reconfigure the software to make your software work well, that -- it just doesn't work in today's landscape. Like you need to be out of the box, installed, ready to go, ready to protect, and that's what we are.

How important is automation of response in your view?

I think it's very important. I think being able to do all of this on the machine is very important. So I mentioned we have our AI in the cloud. We have our AI on the machine. A lot of these attacks sometimes will sever that connection to the Internet. So if you're purely cloud-based and you're trying to feed -- you're trying to fix it from the cloud, that doesn't work. So by having it on the machine and from the cloud, where it's sharing that data back and forth so you always have a really -- kind of the most current offering, that's really important because you want limited downtime. You don't want a bad actor to have access to your machine for very long. And if we can fix that without seemingly any human interface on that, like that's really where you want to be. We can tell you how the attack happened. We can do all of this while remediating it, rolling it back in real time. You may not even know you got attacked, but your security team will. And then they can see, okay, let me look through all the data we've collected, see how this got there, see where the attack started. And by having all of this data available to customers, it's very valuable because it can help protect them in other ways.

Okay. I want to understand your success. So in -- at the end of 2021, ARR was, give or take, $300 million, give or take. What is endpoint protection? What is identity? What is cloud security? I'm not looking for numbers. I'm looking to understand the key parts of your success so we can drill down and understand these better.

Sure. So when I think about where we've been growing, obviously, new customers is at the forefront of that. Our -- we're continuing to grow predominantly from new customers. We've been growing, I think, 5 straight quarters at over 100% growth on the customer and total ARR. And then we have -- our NRR has been accelerating. So I think when we went public, we were 120. I think before that, it was 115. Most recently, we were 131, which is a record for the company. And that's without really prioritizing our existing customers. We're predominantly focused on capturing market share. So we want to make sure that all of our efforts are on adding new customers. And we know that when we get these customers, even with limited work against that, we're seeing 30-plus percent additional spend from them on a year-over-year basis. I think a lot of that is coming from module attach. So we're seeing customers that are adding cloud, adding data, adding Ranger, adding now identity, where they're continuing to add more features from our platform, which has continued to expand over time. I think if you look back, we've sort of seen this starting when it was customer may have started with us for endpoint and then moved up to our Control offering, our Complete offering. So you're seeing that happen. And then I think probably one of the biggest drivers recently is just our growth in enterprise customers. So our -- while our customer growth has been very significant, our biggest growth is coming from customers over $100,000 ARR and over $1 million ARR. That has been the biggest growth driver for us is our move up the enterprise. And I think a lot of that really started around the IPO, where we were branded as we're not just a great technology company that's sort of stealth and behind the scenes. We're now in the public market. We're a safer bet. We're not going anywhere, and you can see all of our data in the public eye. So I think that helped, where companies now are trying to make that decision of which resource do I go with? Who do I want to partner with on something like this? And we're seeing decisions from the Board, decisions from audit committees that really we're seeing a lot more bake-offs of multiple technology companies. We've been able to maintain a 70-plus percent against Microsoft, against CrowdStrike. We're just being invited to more and more of those competitions now as the bake-off process has become more important.

Is the growth in new customers mainly coming -- or I assume it's mainly coming from legacy? Legacy displacements?

Legacy has been one of the primary drivers, certainly. I'd say it's the largest. When you think about companies that were with us, Symantec or a Sophos or Trend Micro and even more recently, a Carbon Black or now Kaspersky, there's a lot of -- whether it was lack of innovation, whether it was just the desire for a more full-blown feature set, we're seeing that happen, absolutely. I think we're still in fairly early stages. There's such a glut in the market that is available to us and our peers in kind of the next gen. That's going to continue for years.

Yes. What about upsell -- cross-sell/upsell of -- can you talk about what are the modules that are being sold the most? Do you need to add more? Do you have any areas where you see weakness or...

We continue to advance our feature set. We want to have a comprehensive feature set. And we continue to add multiple modules every year. I think a lot of that is just listening to our customers and what they would like us to add. We're very centralized around the customer and really listen to them. Why we went after identity was because we were hearing it was a pain point from our customers. Hey, your software is great. But if I can get in the door and pretend to be somebody, I can get better rights to do things within your network that may not be right. And this sort of cut off the front gate. We would always catch those things, but you don't want anyone to even be able to attempt it. So the reason we went after Attivo is they were best-of-breed identity. And we wanted to have our history as -- of being the best in endpoint, throw them on top of it and then build that feature set across everything. And Attivo's software is going to be part of our agent. So we're taking what they do. It's going to be a single-agent product. It's going to be released. We're already selling it. We're super excited about where that's going. And Doug was at RSA all day yesterday, and it was something that he heard from every customer out there is like, how do I have this? So there's a lot of excitement about it from our sales team and from the outside. In terms of additional modules, cloud is our fastest-growing product. Like we are seeing so much acceleration there. It's been growing, what was it, 10x last year. And this year already, it's up significantly over Q4. It's still in a lower cycle in terms of where it's at. But ultimately, I see cloud, and I see that being as large as endpoint over time when I think of the TAM for that. So we're really excited about the acceleration we're seeing there. With Ranger and IoT, you want to know everything on your network. What devices are out there? How do I make sure everything is protected? Our Ranger product does that. And now just thinking -- we purchased Scalyr and we've got DataSet so we can do data analytics for even nonsecurity functions. So we obviously leverage that for our own back end to make sure that we could make everything more scalable, obviously, helped margins. We really wanted to drive to have this product that made sense in the market and be able to solve a lot of problems for a lot of people. And when I think of DataSet, is that a Splunk or an Elastic competitor over time? It may be. I mean we're not there yet, but there's clearly a need in the market for something that's more efficient and cheaper, and we bring that.

The reason why I'm asking about the growth and try to break down the components is because we also -- we follow this whole space. We talked recently with Microsoft, and it seems like they're focusing on security more than ever in the last few years, right? It's -- the growth is phenomenal, from a $10 billion base to grow to $15 billion. It's just a high number on a high base. How much is Microsoft a threat to you? Do you see where -- do you see any market segmentation where Microsoft is going one way and you're going another way?

Where we tend to see Microsoft most, strangely enough, is in the SMB market. When I think of Microsoft, obviously, they're an amazing technology company. But security has never been something that they've been great at. When I think about the machines that are written to create these problems, it's their machines. When I think of how many times we've identified 0-day errors on their technology, we find those frequently and we inform them of it. If -- let's be honest, if Microsoft is really good at security, most of our companies wouldn't exist in this space. And we're seeing them in SMB because it's generally very inexpensive or free if you are an Office 365 or you're on Azure. So if you have -- if you're trying to be really price-conscious and you just need to check the box that you have security and you're not trying to pick a best-of-breed security, we tend to see them. If we actually go up against them in larger enterprises, like we beat them most of the time.

Got it. So we spoke about your portfolio. We spoke about kind of the modules, and I want to touch on 2 big modules: one is identity; the other one is cloud, cloud security. Starting with identity. First, I need the explanation, the education. What is the difference between identity that is given by Ping or Okta and identity given by you or other? By the way, I've seen almost every other company that sells endpoint protection also speaks about identity. So how does these 2 markets live together?

Yes. So they are kind of cohabitations, but they're not doing the same thing, right? Like one is multifactor authentication. It's creating a better identity barrier. But the reality is, what if you're inside of an organization, you're actually yourself, but you're doing sinister things with your own identity credentials or escalating to degrees that you shouldn't? What if an attacker has come in and actually stolen your identity, they are able to multifactor authenticate? So I think they work in tandem to create a much stronger security posture from an identity perspective. Technologically, the Attivo portfolio has a few different areas, specifically deception and hologramming. It also has active directory assessment, and then it has identity security. So the portfolio is incredibly broad. And again, in a world where we're seeing more identity-based attacks and threats, this is another layer of protection for an emerging surface that is becoming kind of a problem area for the enterprise. And you kind of mentioned cloud, so I just -- at a higher level perspective, right? Like you can talk about these as modules, which indeed they are. But the reality is the endpoint, the cloud and the identity are all surfaces by which the enterprise needs to cover, which, for us, from a business perspective, means that they are market opportunities that are either kind of underpenetrated or have disruptive capabilities on top of them. They work in tandem. They make sense in a platform context. But especially in the cloud piece, which just by virtue of Attivo having only closed in an acquisition recently in a month -- in the past month. With cloud, we're seeing that wins with an attachment to endpoint but also on a stand-alone basis, which means that we're opening up an entirely new greenfield opportunity associated with both of these.

And what makes you positioned well to win identity? Why you and not someone else, not -- even not from the space?

The competitive landscape is actually quite small. Our largest public competitor is really the only other company that has a true identity security portfolio. And even in that with deception and with some of the capabilities of Attivo, the extensibility and the comprehensive nature of it is really, really compelling. The active directory assessment component, how easy it is to use, how quickly you get the results back and the value add to the customer from a potential vulnerability scanning standpoint is incredibly differentiated. So that subs very nicely into our broader Ranger portfolio, which is essentially attack surface management and vulnerability detection. So I think the exhaustive nature of the portfolio, the proven scale that Attivo has in market even pre-acquisition is really compelling, 300-plus customers. Strong and scaled kind of ARR and revenue base makes it both a proven and comprehensive technology. Put that into the SentinelOne portfolio, it's something that customers are asking for. And again, thinking about this as a data problem that we're solving, we're now able to collect and look more holistically across multiple attack surfaces in the context of data.

Right. So same -- kind of same question about cloud security. Where does it fit in the market with the Prisma portfolio, Palo Alto and others? I mean we've had here with an Orca yesterday. And where -- what exactly are you doing with cloud security just because it's a huge space?

Yes. Go ahead.

So yes, I mean, obviously, we've been primarily focused in CWPP, cloud workload protection. We're continuing to expand that where we add the analytics on top of it. Obviously, you mentioned [ Wizz Air ], Orca. They're more CSPM. Are those on a collision path with each other? Possibly. I think there's -- we look at that a lot as kind of as a commodity. We're not seeing a lot of differentiation between them. So we're sort of making sure that we're the differentiated layer. Is that something that we could expand into over time? Potentially. I think the cloud is such a big opportunity that you're going to see a lot of these feature sets similar to the way you saw endpoint become EDR, becoming XDR, you're going to see that advanced evolution happen in the cloud, too. Why we think we're good at it. We have always had the better underlying technology. If we can continue to push that in through the cloud, protect people across your entire Kubernetes layer, that's the solution for me. I want to be the greatest protection against any potential issues out there. And I think we offer that, which is why we feel it's our right to go after the space.

Yes. You mentioned multiple times it's a big opportunity. Why?

Think about the amount of data that's being collected and the amount of data that's moved to the cloud. We saw the advancement of endpoint over the past few years as it became a more mobile workforce. Now you need your data accessible by every employee wherever they are worldwide. This became something where -- I think it's within the last 2 years, we've collected all the data -- or we've created all the data that we had in the previous 30, and they're expecting that to continue. Like the sheer amount of data that's being captured now by companies, by people, by everything, like data, it's sort of endless as an opportunity, and all of that's going to need to be protected. And we believe we're going to be at the forefront to protect that.

Yes. And just to add to that. Like the evolution to server-based computing to Kubernetes, like you've essentially created a new attack surface where your most valuable processes and applications throughout your organization are running. So that's kind of the macro perspective. I think the reason why you're hearing more from a narrative perspective from us is we're seeing it in our business. So in Q1, the quarter that we just reported a week ago, nearly 10% of our ACV, which is an acronym for basically bookings, renewals, expansions and new customers, came from cloud specifically. If you go on the deal basis, we're winning large deals where the cloud component is of equal size to the endpoint component in isolation. We're winning large deals where there's cloud on a stand-alone basis, no endpoint. Some customers that are kind of trialing or moving into cloud workload protection, their full footprint, if deployed, could be 10x what this initial footprint is. So the deal generation, the pipeline opportunity and what's actually kind of coming from customers is the piece that's emboldening us to kind of talk more about it and do more with it and get excited about.

We're even seeing customers that may be with one of our competitors for endpoint that are choosing us for cloud. And I think they're looking at what our offering is. And in some respects, obviously more advanced. And I think that becomes something where -- if it's a new greenfield and you don't necessarily need it to be attached with your legacy, that's something where let's pick the best-of-breed technology to start with. And we're seeing customers move to where we can complement their existing data. And when you think, obviously, XDR, we're going to be able to capture telemetry from everywhere and combine it to make it actionable across whatever you're using.

So Dave, it's a -- SentinelOne is extremely successful, but it's also a relatively small company. How do you manage the growth? When the company grows over 100% for such a long time, what keeps you awake at night? Meaning, what are the things that you need to focus on to make sure that the lights are still on when the company is growing so much so fast?

It is a challenge. I think I was employee 400, and I've been here 20 months, which is sort of insane. We've -- we're now almost 2,000 people. So growing 5x in less than 2 years in terms of head count, some of this through acquisitions, some of this just, obviously, we're growing and scaling. That's a challenge. When I think of managing the growth we've been able to do so, I think the extra effort that I'm concerned about is how do I continue that trajectory where we're able to capture more market share, we're able to grow, we're able to maintain this while also scaling the business to where my expense structure is improving. And we went public, and I think the year prior to our IPO, we were 120% EBIT loser. We were -- we ended last year at 85% the year of our IPO. So that was a significant pickup. This year, we've guided negative 55% to negative 60%, and we're continuing to do this. So if you look averaging 30-plus -- 30-ish percent year-over-year in terms of marching towards a break-even adjusted EBIT margin, that's what I'm focused on most is how do I make sure that the investments that we're making are going to pay off, that I'm going to see the positive ROI on anything we make. We want to get to cash flow-positive. We want to get to be a profitable company. Obviously, at the scale we were out at the IPO, that was going to be impossible. It's not something I can flip a switch on, but I can make sure that every decision we make is marching us towards that and make sure, obviously, I have the cash runway to do it. And right now, we feel very confident that we're in a good position to do that.

What's your view on profitability? I'm asking it is a philosophical question. Profitability, GAAP profitability, getting to a point where you start to return capital to shareholders. How do you see the company evolving for the next few years?

I think that's farther off. Just in terms of getting to breakeven and to get to a -- I think we published at the IPO a long-term model that showed we'd be 75 to 80-plus percent gross margin, we'd be at 20% EBIT contribution positive. We're -- we've accelerated towards that. On a GAAP basis, it's going to take a little longer. When I think about stock-based comp, ours has been traditionally higher on a percentage of revenue basis based on our scale. If you look at us as a percentage of GAAP expense, we're kind of in line with industry standards. We're also declining because of the scale that we hit. When I think of our burn as a percentage of shares outstanding at approximately 4%, we're an industry standard. Even with the stock price we're at today, we were planning on being lower than industry standards because we're very protective about our shares and obviously want to make sure that our investors are taken care of. So our original goal was to do this. Even with absorbing a depression in the stock price, we're still able to maintain an industry standard. This is something that's just really important in our progression as a company. When I think of the really large growth companies, we want to be one of them. And we are making the investments to make sure that happens. One of the things right now -- it's never going to be cheaper for me than right now to go after the market that we're in. If I were to try to make a faster advancement to profitability, like I'm giving up market share or potential market share to my competitors. And to fight back to get that back later, it's going to cost more. So as long as we can continue to do this while improving margins, like those are the investments we want to make.

And I mean, we've seen this play out in public markets in our space, right, that path to profitability. So it's not we're not manifesting anything that hasn't already happened to an extent, right, the unit economics, the platform approach and the module cross-sell high incremental margin, and we're unlocking data efficiency. So that's kind of the gross margin upside that you're seeing will continue. From a sales standpoint, the efficiency is there, magic number over ones. Even with very aggressive investment in continuing to grow head count, we're doing so in a reasonably efficient way, and that's magnified by the channel partnerships and the extensibility of that ecosystem. And then from an R&D standpoint, like we've really started to globalize our employee base into disparate and geographically broadened locations, which should help us continue to both invest and grow but do so efficiently. So scale will solve a lot of this but also being thoughtful about the investments.

Yes. And one of the things -- just you mentioned gross margin. I think we went public -- we were 53% gross margin in Q1 of last year when we went public. Q1 of this current year, we are 68%. So 15 points of margin pickup in a year. To me, I mean, that's incredible. Obviously, some of that is scale. Some of that is the ability that when we collect data from a customer and then I can sell additional modules that use it, the incremental margin on those is incredible. So we're seeing customers as they expand their footprint with us, this is more profitable, and that's just going to continue. I think the big question we got when we did the IPO was 75%, 80%, like how could you possibly get there? And here we are 3 quarters after our IPO and already, you're -- we're -- we've guided essentially we're going to exit the year at, I think we said 69% to 70%, which would imply that Q4 would be above 70%. So great strides towards that in a really short amount of time.

One product question I forgot to ask you about data analytics or analytics. And how does it -- first of all, how does it fit within your portfolio? And what are the opportunities in this segment?

Sure. So obviously, purchasing data set, the immediate need that I -- that we had was to be the back end of our own products. And in doing that, I think we realized that the data analytics piece was very powerful. And then now that's its own company essentially within SentinelOne. So it's just expanding our platform. So now even for nonsecurity work, nonsecurity use cases, like you can have a really powerful data analytics engine to evaluate all the data you have. And we mentioned Skylight. These are all things that you look at us, whether it's security or nonsecurity, we're -- the amount of data and the data analysis that we're doing on the data that we're aggregating, whether it's our data, whether it's data that we ingest, we're able to do that in a really thoughtful way. And I think this is something you're just going to continue to see expand within the company. And this is -- it's a great opportunity. I think the incumbents you think of a Splunk, you think of an Elastic, very strong companies. But we're able to do this where we can ingest it, and we're getting like 10x improvement over our existing back end. We're seeing customers that use their products or maybe a CrowdStrike customer that are also now using our products for overages, and that's kind of our Trojan horse to get our foot in the door. And then they see the savings they get, and they start to come over. So we're seeing this where not only do we offer something that's really great in the market, but it's being able to do it and ingest it faster and be able to do this analysis cheaper than some of the competitors out there.

So if I go back to margins, you guided margins higher. But if I'm not wrong, you also guided OpEx higher, beyond Street expectations. So what drives it? What's the outlook for expenses?

Sure. So we kept our guidance flat for the year in terms of our OpEx. So we said we'd be in the 55 -- negative 55% to negative 60% EBIT margin for the year. We're doing all that while also picking up the expenses from Attivo. In addition to that, I spent $3 million in Q1 on legal and diligence costs. Over the remainder of the year, I probably have about $9 million of costs that were more onetime in terms of advancing the integration to make sure that we have a comprehensive product later this year. So obviously, I absorbed $12 million of expense that wasn't in my original forecast while keeping the same guidance. If you think about that, that means I would have guided down about 3% if I didn't have that. So we look at that as success. We're able to -- obviously, we want to make Attivo successful, we want to make ourselves successful. And being able to do all of this within the scope of our existing guidance, we thought was pretty powerful.

Got it. A question about the environment. How sensitive do you think your revenue growth, your overall demand you see in the market will be to an economic slowdown?

We haven't seen signs of it yet, and we're certainly looking. I think we happen to be in a pretty enviable spot where security spend, we haven't seen really any signs of decline in it yet. And I think I wouldn't want to be the legacy providers, where you're trying to compete against companies that are offering a more comprehensive product, where we may be able to replace multiple products they're using for a better price. So I worry about it more at the lower end. We're seeing customers spending more with us at higher price points. We're seeing enterprise customers grow. We're seeing our NRR grow. Like all the signs that we have to look at, the forecasts are all positive. I'd heard the same from our competitor on their call. So I think we just happen to be in a really attractive spot where if I'm an investor, that seems to be -- I hate the term recession-proof, but we're just not seeing the signs of it. We had record pipeline, and it was a significant step-up from our Q4 pipeline. So it wasn't just, hey, look, the company is growing and their pipeline should always be a record. Like we were actually surprised at how much it was picking up. And we're really excited about it. We guided up our revenue from 80% organic rate to 85%. We beat Q1 by 5-plus percent. So we see this continuing, and we haven't seen any signs of slowdown. And I think just the opportunities that are out there, whether it's displacing incumbents, whether it's the acceleration of cloud or other modules, there's just so many things that are providing tailwinds for us that we're pretty excited about where we're at.

Timing-wise, when do you think cloud starts to be a much bigger contribution? When do you think identity -- so are there -- are these already now you expect them to be growing very strongly? Or are these slated for the future?

I think -- identity we've owned for a month. So we're still trying to gauge that. We're excited about what we're seeing, but I'd still say that's newer. Cloud, we're continuing to see accelerate. It's not -- it's just growing from a smaller base. So when you think about where our growth is coming from, it's going to come from the existing business that is growing really quickly. It's just going to take time before that's a material aspect of the business. I think -- maybe you can answer cloud. I think it's just -- it's going to be a while before the -- it's at the same level that we're at now.

Yes. I think it's a good challenge to have the -- our core products, meaning the dominant driver of our revenue and ARR today remains endpoint. That is still growing exceedingly fast. You're kind of playing a catch-up game into a moving target that's also growing quickly. So over a long period of time, the diversification of the business is absolutely right. Layer in Attivo, $35 million in ARR, you're looking at right around 10% of ARR immediately upon kind of when we report Q2 now that that's part of the business. So the diversifying agent will continue and the pillars and the contributions will be substantial across endpoint, cloud identity and data in aggregate. The ultimate resting mix, I think, is more a function of relative growth rates. But they're all -- again, the good news is they're all growing very, very strongly.

They're all triple digit.

Perfect. Great. Great message.

Yes. Not bad.

And then complain.

Yes. Absolutely.

Thank you, Dave and Doug. We ran out of time. Thanks so much for your insights.

Thank you.

Excellent. Thanks.