SentinelOne, Inc. (S) Earnings Call Transcript & Summary

All right. Hi, good morning, everyone. Welcome to day 2 of the Barclays Tech Conference. My name is Saket Kalia. I cover software here at Barclays. I'm honored to have with us the team from SentinelOne. We've got Co-Founder and CEO, Tomer Weingarten. We've also got the IR -- the dream team, IR team here. We've got Doug Clark as well as Saad Nazir in the audience. So we've got about 30 minutes together. Let's spend maybe 20 or 25 minutes doing some fireside chat here with Tomer, which I know is going to be really fun. And then anyone has any question, just pop your hand up, and we've got a mic run on the back. So maybe with all of that said, Tomer, thanks so much for being with us here today.

Absolutely. Thank you for having us.

Yes. Absolutely. So Tomer, I mean a lot of us were on your Q3 earnings call last week, but maybe just to make sure we're all sort of on the same page, could you just maybe recap some of the highlights from the quarter that you were most proud of?

Yes. First and foremost, just the net new ARR reacceleration and a break away from seasonality is just exactly the dynamic that we wanted to see. This is something that we've, I think, designed and planned probably about 3, 4 quarters ago, in a really conscious attempt to drive just a different trajectory to the business and to see that really kind of come to fruition exactly as we imagined, just gave us a lot of confidence that we can keep on doing that, that if we stitch together the same ingredients, the same motions, we can continue to drive acceleration in net new ARR and more than anything, I think that seeing that -- seeing the pipelines that we have, putting these 2 together is just like a very different picture than the one that we've had last year. And that, to me, is the most exciting part. Seeing acceleration in the endpoint business, not a super exciting element of the thing that also continuing to appear in forward pipelines. Also really, really nice to see. I mean we've been very focused on driving emerging business. This was becoming like 40% of our business almost in any given quarter, but now seeing endpoint also uptake, I mean, that's a good boost to the business as well. Big deals, big customers, average deal sizes, just creeping up significantly. That's exactly the dynamics that we're going to see. I mean we've been trying to drive the business to go there. We've been telling you all about that. And I think Q3 was probably the most pronounced, I would say, testament of these initiatives.

Yes. Yes. Absolutely, it showed. So it's funny, we were talking about the earnings call last week. But ever since the earnings call, a little bit of news out here from MITRE. I think it was yesterday, MITRE put out their enterprise sort of results, if you will, in the endpoint space. And it was good to see that SentinelOne achieved strong results here, which I think has been the case in prior years as well. Could you just maybe highlight some of the key takeaways from that MITRE reported?

Yes. Look, I am just super proud of our teams, delivering consistent results, 100% detection for 5 years in a row, I mean, there is no other vendor in our space, outside of space -- in outer space, nobody is able to do that. And that is just tremendous. And this year, this has been such an important test because the test some of the most advanced capabilities that we see adversaries employ. And again, to see the performance to see how others performed. I think that some people just didn't show up. Our closest competitor is not even there. I think that is also pretty significant. In the end, people want to know that what they're buying is tried and tested and stable and able to deliver what you advertise. And I think that MITRE was kind of this unbiased body was always one of the best in the business to really net out what these EDR platforms can do. There's a lot of marketing in cybersecurity, as we all know. So the need for something neutral and unbiased to just tell you what's going on, I think, is so important. And again, just leading it for 5 years in a row, is pretty tremendous. I think it's fairly unprecedented in any type of these tests over the years.

Definitely speaks to the strength of the product over the years. Tomer, I want to start a little high level because I know you spend a lot of time with customers. And I just want to put the July 19 aside for a second, right? The question is, what do you hear from customers about their interest in endpoint right now? It's been interesting to see we do a couple of CIO surveys every year, and we ask about prioritization of different security areas. And endpoint consistently comes out -- up at the top. What do you think is driving that from based on your conversations with the customers?

Yes. Look, we just talked about the reacceleration in our endpoint business. And I think this is probably kind of a reawakening of that space. It's the most I think, consideration and attention that we've seen in the past 3 years or so in the endpoint space. And to your point, I mean, it's always a good space. There's always a lot of action. But I think this past year, definitely some more of that came through that outage. But there's definitely just better, I think, understanding of what the role of the endpoint is in this world of 5,000 cybersecurity vendors. And at the end of the day, you can slice and dice it any way you want and talk to a lot of these folks here in this conference. But endpoint is the stuff. Endpoint is what stops the attackers. Endpoint is the most critical part of your entire cybersecurity ecosystem. And when people look at what the adjacencies that endpoint can deliver and stop as well because it's not really just endpoint protection, it's also workload protection. Let me go back to MITRE for 1 second. MITRE this year, it was the first year when they actually tested coverage not just for Windows endpoints, but also for Mac and also for Linux. So in essence, it's also testing the protection for server-based and workloads. That entire thing is really the most important factor in cybersecurity. So I think the traction in endpoint is most likely going to taper up. There's still 50% of this market that is in the hand of incumbents. Even McAfee or Trellix or whatever you want to call them, that's still kind of probably like a $1 billion business, right? I mean, so there's a lot more there. And then you got Trend Micro and you got Sophos and you got Webroot and Bit Defender. So there's a lot more that we expect to do in that space. And I also want to maybe kind of tie it and put some frame around this. There's been a lot of talk about the benefit from the outage and all that stuff. And I think what's really important to understand is that, that company that suffered the outage, they're still a pretty good execution company. And to displace a customer of theirs is something that takes typically more energy, more time. I can do 10 incumbent displacement at the time that I do 1 company displacement. So the -- at the end of the day, I mean, you also want to kind of pick and choose if you're going after these opportunities. The ACV, given their discounting is sometimes not as lucrative. So it's really much more what you want to take out of that versus am I going to just spend all of my sellers time in all these customers looking to leave and looking for a great price point. But at the same time, they're fighting tooth and nail to try and keep them. So we kind of prioritize what we want to get from that long list of people that contact us. But we have to balance it with the inertia that we have in the business sales were because time is time. So to me, I just want to focus on what I can -- the most I can do with my time. That's not always that displacement opportunity.

Yes. No, listen, I think that's thoughtful. And I think that punctuates one of the things that you said on the last call, which is the outage is certainly 1 factor in helping SentinelOne gain share, but it's not the only factor. But maybe looking at that because I know we'll get the question, maybe looking at that event, I mean you just sounded great about sort of the pipeline. What have you seen about just around the size? And I think you've also talked about the quality of the pipeline. What have you seen around the size and quality of the pipeline compared to before the outage? How has that changed? Whether it's from CrowdStrike displacements or just opportunities from other non-CrowdStrike?

Yes. I would say even before the outage, again, that concentrated effort that we had to drive up market and to start selling lending with the platform has already started driving up the size of the opportunity in the pipeline. So I can share, I think, last I've looked at it, the average deal size in our pipeline is up 40% year-over-year, that significant. And that partially outage, some of it is outage. I wouldn't say the dominant stuff we have in our pipeline is outage displacement. I think there's quite a bit there. But at the same time, again, we got multiple capabilities, multiple avenues to market, some parts of the market where that competitor is almost not present despite their attempt. So again, the diversification of our kind of revenue funnel, I would say, makes it that not 1 thing is going to control the entire pipeline. But as a whole, it's the biggest pipeline we've had, it's record pipelines as we go into next year. We just experienced net new ARR acceleration, all the fundamentals are intact. We're getting more efficient. We just crossed last 12 months free cash flow positivity. So I'm fairly confident that we can keep on accelerating net new ARR. I'm fairly confident that next year for us is going to look better in terms of net new ARR. But I don't want people running like in all kinds of speculation. I just think that the strength you've seen in Q3 should carry on. And I think every indication that we have sitting here points to that direction.

Maybe just to put a bow on the salvage point, right? Because again, I just want to make sure all of these questions are asked, but how do we feel about the momentum going into Q4, given everything that you just said. Because Q4 for that competitor as well as a lot of other competitors, that ends up being a very heavy renewal quarter for them. I know that the displacement is one part of the pipeline, but those renewal opportunities are also great opportunities for you to take share. How is that playing into your view on Q4?

Yes. Look, Q4 has traditionally been a strong quarter for us, and I think it's going to continue to be a strong quarter for us. There is really good momentum in the business. Like anyway I slice and dice it, I see just better dynamics than the ones I've seen a year ago. And all of it is really the function of our go-to-market organization changes, I think, more than anything else, honestly. I mean outage or not, we just invested a lot of work in up-leveling, improving, getting new talent in, getting new leadership in across the board almost.

And to your point, that was 3 or 4 quarters ago, well before the outage , right, when that foundation was laid?

To me, I mean, when I look at that outage I'm saying, "Okay, at least is a good timing for me," because that has happened a year prior, we probably not would be in the same position to capture the same amount of benefits. So I'm kind of at least happy that we've been able to kind of shift our go-to-market gears. And now our overall competitive position is better with MITRE, even. I think we're just in a better position to capture the demand, and demand is definitely rising, outage related or not. So again, I'm more encouraged now than I've been in a while. I think for us, there's been like almost a year of stabilization and rebuilding of our go-to-market force. The vast majority of that is in the rearview mirror. From here, it's net positive evolution, I would say, versus fixing things that we felt were really broken.

Absolutely. I want to -- that's a great segue into go to market, right? And I think 1 of the area that really enhances that go-to-market is this Lenovo partnership that you expanded, right? Can you just maybe walk through what the current partnership sort of looks like and how that announcement in October enhanced it?

Yes. So first of all, I mean, incredibly strategic. I mean, if you have anybody that's willing to take your software and embed it and ship it on, call it, 30 million PCs in the next few years, that's big, that's substantial. It will come up online probably towards the latter end of next year. I want to also maybe kind of frame it for people. I mean this is not something that you're going to see kind of popping into ARR and suddenly ARR boosts up by a ton. We took a very conservative portion of that commitment for this 30 million PCs. By the way, Lenovo ships 70 million PCs a year. So there's a level of conservatism in the amount that we have contracted. There's a level of conservatism in what we took into ARR when we signed that contract. So don't expect like any ARR-based dynamic until we start seeing the pace, until we start seeing how Lenovo ships? How long does it take? What are the dynamics that we're seeing? And from there, we might revise the contract and then take more into ARR. But right now, our focus is get this up and running, every PC that ships is a boost to our revenue, not to ARR yet. And that's where I want people to kind of get the right frame around that partnership. We, at the end of the day, don't know exactly all these dynamics. Every OEM deal is a bit different. I'm definitely not going to base this OEM dynamic when anybody else's OEM dynamic, but I think all of it is going to be positive. It's just the magnitude, the pace, the velocity of it. We want to see how it looks like. And then I think we're going to be smarter on how much of this we can really kind of take as a future commitment. We definitely don't want to inject like a big slug to ARR now where we don't know exactly what's the pace, how fast it's going to get into revenue and then you create this big bifurcation. So right now, that's kind of how we look at it. I think it's going to be probably a lot more pronounced in FY '27 than even in FY '26. But to us, it could be and should be something that also helps us sustain our growth rate in the out years, which when we sit here, we think 3 years forward, we want to see our growth rate as high as it can be throughout these years, not just next year and how do we parse that. So that's really how we're looking at it.

So super helpful framework there, Tom, right? And I just want to make sure -- I'm sorry, it's probably a dumb question, but why -- we asked this question of Barbara on the last call as well. Why is it -- why would a Lenovo shipment just be a benefit to revenue and not just ARR? Because if there's -- is there something around the deployment or anything? Maybe touch on that a little bit.

No, it's really simple. I'll try and kind of give you whatever I can share -- but if you think about any ARR deal, let's say, this deal with Lenovo is a 4-year deal. And can I say, okay, conservatively, I'm going to benefit x millions of dollars from that deal over the term. Obviously, you divide it by 4. And then we take that specific portion, we put it into ARR, and that is it. And that is all that there is. Moreover, we already had an existing partnership with Lenovo prior to the OEM deal. So in essence, we already had some ARR and revenue coming from Lenovo. So in our first year of recognizing that ARR, we basically took just the offset of it into ARR. And that's just accounting. We're not doing anything out of the ordinary. And that is it. You don't get to take it again to ARR until you revise up, true-up or true-down, but in this case, hopefully true-up. When you start seeing shipments, where you start seeing usage. So this is very much like any other consumption deal, if you think about it, where the moment people start consuming the services, that's when you get to start and talk about, okay, what does this look like in the out years? Do I need to revise my contract, are my ARR assumptions that I signed in the beginning of the contract are right, right now or not? And that's all there is to it. I mean it's a pretty -- think about it as a commitment deal.

Yes. Very clear and very helpful. One of the areas that I want to touch on just that I think one of the most important topics that came out of One Con is sort of the momentum around non endpoint solutions. We've talked so much about endpoint. That's obviously an accelerating business, but the non-endpoint solutions like Data Lake, like Purple AI, like cloud and identity, can you just remind us of the rough sizing of kind of that in aggregate? And maybe stack rank those in terms of opportunities for growth.

Yes. I think all in all, you're looking at about a $200 million kind of roughly emerging set. Dominant part there, obviously, is cloud right now. Data is growing incredibly fast. Identity is a really good attach for us. Purple AI, obviously, is definitely boosting growth rates across the board for a lot of our adjacent capabilities. So it's not only about Purple, it's about also what Purple drives in terms of more attach from different modules. And then there's an overlooked part of our business. We don't talk about it a lot, but like our services business, our MDR business is also quite sizable. It's probably in the top 3 in the world. And it's also something that we are now extending to manage not only SentinelOne endpoints, but really anything you put into our SIEM. So it's becoming this complete managed enterprise solution and we're seeing really good traction with that already, and honestly, also a much better price point, to be honest. So all of that are things that we are looking to continue and accelerate. I think the most challenging thing we have going in SentinelOne is just pushing all of these things in parallel at the same time. For better or for worse, it's not like we have just 1 capability, and we're putting our entire might behind it. We are moving in a pretty compounded fashion, where we're driving a lot of different growth vectors at the same time. To me, 1 of the biggest unlocks that we have yet to really fully fulfill is really the upsell and cross-sell opportunity. So going back, I think in a more methodical way to our customer state, which is still very underpenetrated predominantly on kind of the endpoint model, maybe another module or 2, definitely not on a lot of the emerging capabilities, and that could be another lever for growth for us. So to me, the right way to think about that opportunity is SentinelOne needs to lend with the platform, and that opens up the gate for the gates for all these different imaging capabilities. And SentinelOne needs to start selling more to its existing customer base. And I think these 2 things in tandem could just show better dynamics in the years to come.

Yes, yes, absolutely. So maybe I want to use that to pivot to some financial questions here, right? So -- and I fully appreciate you've just got so much more product. There's a net revenue retention opportunity there in the base as well, right? So let's put all this stuff together. I mean you still have tailwinds from the outage. You've got all these seeds that you've planted in terms of go-to-market, let's see how Lenovo sort of goes. But -- and we've kind of crossed the $1 billion -- yes, you've crossed the $1 billion market in ARR. Not looking for guidance here, but how should we think about sort of the moving parts for ARR next year, if you will?

Let me try and give some direction, I would say. I think -- and actually, I mean I just said it as well. I mean I think the only saying that we kind of are focused on is just driving more net new ARR acceleration. So if anything, I think we'll add more net new ARR than we've added this year. The magnitude. I don't know even to tell you right now. We want it to be as big as possible, but I don't want nobody to runway, including our own teams. So I think it's safe to assume there's going to be some acceleration, a continued acceleration. The magnitude, I think, let's get through this quarter. We're very focused on closing a strong Q4. And from there, I think, obviously, we will be smarter. But I think we -- given all these dynamics, it's clear that we're going to have a better year next year than the one we had this year.

Yes, it definitely feels that way. I mean, we've spent so much of the time just on growth and SentinelOne as a growth company, and that's why I wanted to focus there. But I also don't want to lose sight of the fact that we're on track to achieve positive free cash flow, I think, for the year. What are some of the drivers of that stronger free cash flow this year? And how do you kind of think about that growth trajectory going forward? I know that's a great question for Barbara to when we have her here next year at some point. But curious how you think about that.

Yes. No. Luckily, we were very aligned. So I don't think you're going to hear anything different. Probably she will be a bit more articulate about it than I can be. But look, at the end of the day, we care a lot of our profitability. I think next year for us is one where I think back in the previous quarters, sometimes you all have asked me like, are you going to keep it at breakeven and reinvest everything? The answer is no. We're not going to keep it at breakeven. We want to show a degree of profitability. We want to show meaningful profitability. We want to become sustainably profitable. And that's what we're going to drive into next year. Is it going to be the exact same magnitude of improvement that you've seen in years past? We've improved about 25 percentage points on operating margins every single year. I don't know that we can and want to do that into next year. That will definitely take a lot of our ability to reinvest. But I think we can reinvest, I think we can become more efficient in our operation and thus show meaningful improvement in profitability and definitely, still maintain kind of a good level of growth. Where does it come from? I think some of it comes from scale, a lot of it comes from just us optimizing the processes in the company. We feel like there is still a lot of leverage that we can drive. I mean, you can kind of look at our sales and marketing expense as an example. I mean we want to drive it down to the long-term growth profile that we've outlined, and that's doable. We've had a year of change in go to market. There's a bit of an overlap. There's a bit of a bloat, we're going to start pruning that away. We got a new CMO. We're starting to drive more and more focus on ROI in marketing and how much we're yielding. We're starting to prune away things that don't yield as much. And we can't do everything and we don't want to do everything. So really sharpening the pen, I think, on many areas in the company where we can drive down cost, I mean be a G&A, be it S&M. One place we're not going to taper away is R&D to me in cybersecurity...

Spoken like a technologist.

I mean that comes baked-in. I can't remove that. Some of the things are very unique. And I just think that in cybersecurity, the moment you stop innovating, the moment you stop developing and pushing forward, you become irrelevant. And I think we're kind of seeing some of that already happening. And to lead MITRE 5 years in a row, I mean it doesn't just happen. You really have to have a really good product. And given that our AI capabilities right now are second to none in the market, we never want to lose that advantage, right? We just want to keep on pushing it forward. And thus, we're not going to see savings in R&D. But oddly enough, R&D is actually the one part of our business, which is pretty much in the long-term target profile. So we also don't feel bad about not pruning anything out of R&D.

Yes, absolutely. I want to ask a couple of last questions here. But any questions here from the audience before we move on?

Just to follow up on your comments on the go-to-market investments. You said that [indiscernible] larger deals at this point [indiscernible] Is there a change in the go-to-market you might need to now make for that? Because is it harder to predict when those land because the sales cycle may be longer or how are you handling that?

Yes. Look, we've been doing a lot of big deals even before that. Now that means we need to do more of those. So the 1 thing that does change is, I think, the amount of sellers that we put in that part of the market. So there's definitely been a concentrated effort to put more strategic sellers, to put more high enterprise sellers into the business. We're factoring some of these sales cycles. We're very familiar with what these sales cycles look like. It not like we've never done very large deals. So to me, it's just that continuation of going upmarket. And it's all positive dynamic like I have a hard time seeing it differ.

And then just 1 follow-up on managing current rate profitability. Maybe I remember [indiscernible] but I've always kind of thought in the past [indiscernible] for the company -- do you want [indiscernible] stable margins. I know you were okay with that and you said that [indiscernible] mindset change in the company that will maybe versus a year or 2 ago?

Yes, I think just at our scale right now, I think that 40% growth is untenable at this point in time. So how do you get the rule of 40%, with 40% being untenable I'm not saying that even 30% is tenable at this point. I mean, who knows. Let us get through a quarter, let us figure out what's happening. I mean we're not going to be guiding anything. And I think don't assume that we can get to rule of 40% within FY '26 because that's another thing. I mean, we'll get as close as we can. I mean that's part of the trajectory. And I think we can get relatively close. But with that being 40% and 0, I wish, but we have other considerations as well. I think that we -- kind of with the state of the public market, a lot of investors favor profitable companies or stay away from nonprofitable companies. So if I take that as a consideration and not just my growth rate as a consideration, then we need to balance it as well, right? Even if we could drive something like 40% growth, it's probably not the way to unlock the most value in the stock, I would say.

Any other questions here? I've got 1 last one. So just going back to, I mean, just the technology focus here. And I mean we've spoken so much about the organic growth here, Tomer. How do you think about sort of inorganic growth down the road in terms of just opportunities to bolster the portfolio?

Yes. Look, we're always looking for interesting opportunities. I think there is definitely assets out there that kind of provide ingredients that we might want to consider owning. But with that said, I think at this point in time, we're just really, really focused on our stand-alone path. I mean with all the great things that are happening in our business. The biggest yields are going to come from us investing our time in growing our own business, nurturing all these different seeds that you talked about. These are $200 million worth of seeds so it's pretty good. They come with high growth so you want to keep on nurturing that. If we see an interesting opportunity, I think that's always an option. But right now, there's nothing imminent or nothing that we feel we kind of have to do.

Yes. It feels like just heads-down execution and focus. I think that makes a ton of sense. Well, I couldn't think of a better way to end on that. Tomer Weingarten, thank you so much for the time. Really appreciate it.

Thank you so much.

Absolutely.