SentinelOne, Inc. (S) Earnings Call Transcript & Summary

Please welcome our CEO and Co-Founder, Tomer Weingarten.

It's always so incredibly exciting to see everybody here and do this every year. I actually want to start by welcoming everybody to OneCon, but I also want to start with thank yous. I want to thank our customers, obviously, I want to thank our partners. I want to thank our teams. There have been so many dedicated Sentinels working day and night to make this possible, the people that build the products, the people that support the products, the people that sell the products, everybody is putting their heart and soul to make this event happen and also, obviously, to fuel the innovation that protects all of us collectively. So let's give all of you and them a nice round of applause, please. Okay. And yes, this is always a very exciting event. But I don't know, for some reason, it kind of feels even more exciting this year. Maybe it's the smell of GPUs in the air, maybe it's the fresh sound of data center compute cycles. I don't know what it is, but it seems like the future is upon us. It's very clear that this year, with the advancements in AI, we are looking at a whole new landscape. We're looking at a whole new future of possibilities, not only for cybersecurity, but for all of humanity. And sometimes it's exciting, sometimes it's a little bit scary. I mean, the unknown, the uncertain, it's definitely very interesting to see it where you're on the front row, defending from the bleeding edge use cases of how people leverage AI, both for good and for bad. So there's not like a really great way for me to ease into it. But at the end of the day, cybersecurity has become the single most important factor in the survival of humankind. It's no joke. It's no longer a technical discipline. It's a survival imperative. Humanity's dependence on intelligence and on infrastructure, on systems and on data makes the protection of these systems fundamental to civilization itself. The digital, biological, geopolitical, all of these worlds are merging together, making the security of intelligence and of systems synonymous with the security of life itself. I'm not exaggerating. This is the meaning of cybersecurity. The question is no longer whether cybersecurity matters, should we do it more? Should we do it less? Is it working? Is it not working? It's really becoming a very simple question. Can we sustain existence without cybersecurity, without mastering the discipline of cybersecurity? And given that the balance of power, the stability of this world will depend on how we govern AI, how we control AI, how we harness AI for our own benefit, for humanity's benefit, it's important for us to always remember that AI's potential mirrors its destructive potential as well. Nation states and individuals alike can easily wield AI for disinformation, for disruption, for creating havoc and mayhem complete digital warfare. We're starting to see that already. You'll hear about it in some of the sessions that you listen to today. This new arms race is not about weapons. It's about control. It's about control of autonomous intelligence. It's about control of compute, and it's about control of energy. A secure AI future requires global cooperation. It requires all of us bending together and working together to create a different reality. It's about ethical design and it's about resilient architecture. What does the world need most from cybersecurity? We've all been doing cybersecurity for quite a long time now, but it doesn't seem like we're giving all of us that use cybersecurity, both as enterprises and as end consumers, what they need. So let's try and figure out like what are these things that cybersecurity needs to deliver to make the world a more secure place. Well, the first one might be an easy one, but it's not. Trust, security must be intelligent. It must be autonomous. It should be anticipatory. It cannot be reactive. All of cybersecurity today is entirely reactive. That is a huge problem. It also has to be fully auditable, steerable and transparent, which again, is not the case today. We have a hard time trusting our cybersecurity. Continuity. We all look at cybersecurity today as this force that is there to block the badness and rein us back in, make sure we're not doing things that could eventually lead to a breach or to a compromise. But in essence, cybersecurity should empower progress, should not restrict it, should not limit it. It should enhance the flow of information and not stop it. And lastly, confidence. The world needs confidence in the systems it uses and the systems it depends on, the ability to move fast, safely and with agility. But there's many, many, many challenges with cybersecurity today. We here wake up every day trying to solve some of the most monumental challenges in cybersecurity. And to get to where we believe the promise of cybersecurity needs to be, we have to overcome these challenges. And the first one, and I'm sure none of these are going to be very surprising to you, is complexity. Too much data, too little understanding. The volume and diversity of data today is beyond any human comprehension. We got no way to decipher all the data alone. We got no way to make sense of it. We got no way to do it in a manner that actually provides the outcome that we want. The second thing is fragmentation, probably one of the most deeply rooted issues of cybersecurity. Fragmented defenses, where defenses remain siloed. They don't talk to one another. They don't know one another, no idea what each one of these surfaces are doing. Endpoint, cloud, identity, network, all of them are disconnected. You can put all the data in one nice place. It doesn't mean these surfaces are connected or that they know how to exchange data and exchange insights between them. And lastly, speed, which is one of the most critical ingredients to ever be able to protect any asset in this world. Attackers weaponize AI faster than defenders can adapt. I think this is very, very clear and true to today. Without being able to monitor what's happening right now in this instant and act instantaneously, we will become irrelevant. Cybersecurity will become irrelevant. If cybersecurity continues to be after the fact, it will become completely irrelevant. Okay. As we think about all these different ingredients and components, I think it's also important to ask what do we need to secure even? I mean, are we securing servers? Are we securing the cloud? So when we kind of wake up in the morning and we think, okay, how do we design our systems? How do we design the systems that we give you, we really try and focus on what are the biggest things that we want to make sure are going to be safe. And the first one is us, people, human identity, protecting who we are and what we do in digital form. And it's no secret that our digital identity is becoming as important, I guess, for some people, even more important than our physical identity. Think about all these influencers. Their identity online is greater than their identity in the physical world. Eventually, and it's happening today, both identities are going to merge together. We will not have a separate identity. It will be one of the same. So we have to protect that. And then obviously, data, but not data itself, but data integrity. If we can trust that the information that we're consuming is authentic, that it's uncorrupted, that it's not painted, we cannot trust anything that's built on top of that data. So we have to go back to our foundations to make sure that this world is secure. And lastly, intelligence, artificial intelligence, system intelligence, as our dependence grow, we have to make sure that artificial intelligence itself is not being manipulated by any type of bad actor. Truth itself is under attack in the world of today, synthetic identities, deep fakes, misinformation, you name it. It's all happening. And that algorithmic manipulation sometimes blur what's actually real. Okay. How do we get there? I mean enough with the doom and gloom. Let's do something about it. Let's make sure we can actually live in a safe world for all of us. But we need an entire change of approach, an evolution of approach, if you may. And it's really about the architecture of the future and what we need to build right now, autonomous architectures, streaming architectures, contextual and accountable from reacting to preventing, from this concept of detection and response to, let's say, proactive and predictive from complex to simple and ideally from simple to invisible. This is where security will go. And we're putting some tangible foundations. You're going to hear a lot today through our innovation sessions of what's coming to the platform that you all use. And that's really important. Why we work on this vision? And I'm actually going to show you a quick sneak peek video on what's coming next, what we've been working on and what we're going to continue to work on. What's going to be important to remember is that we're taking a gradual approach that doesn't only end with a spectacular mode for cybersecurity, but also that infuses capabilities every single day to the console that you use today to the Singularity platform. There's no one big bang where security gets solved. It's all going to be gradual. It's what we need to make sure that we move from this reactive mode of today and into an autonomous mode in the future. But again, it's not going to happen in one fell swoop. Streaming data, high-frequency ultra-scalable data lakes. What took hours with legacy systems processing data is now taking seconds in high-frequency data lakes like the Singularity data lake. That's a step function change in what you can now do and what you can now create with these types of technologies. And it's very, very meaningful because when data lives within the platform, it really means that artificial security intelligence like Purple can now act immediately, instantly and across all that data, all these entities and all the time. When you can query up to 7 years of history of data and you put all that context into AI, you get a very, very different outcome than just the bolt-on AI, let's query, let's do some NLP type stuff that you're seeing from a lot of others in our space. To get AI actionable for cybersecurity, it's not enough just to put the data into it. You have to build contextual augmentation, you have to reduce the noise, and you have to enhance the signal. It's not as easy as taking data and putting it into an LLM. It's about building a whole system that creates that outcome, an outcome that is autonomous, but that is also incredibly accurate and is fully auditable. We don't want any system out there that has something that we cannot explain or that we cannot audit or that we cannot trace back. That's a huge imperative to how we build AI systems. So let me show you a quick video. And when I say quick, it's going to be really quick. If you blink, you might miss the interesting bit. We've been trying to balance between exposing what we're working on, but also giving you some understanding of how we're thinking about the problem. And again, I think you'll find it really, really interesting. [Presentation]

Okay. Yes, I know. I know. I know. It's fast. I know. I know. Look, it was either this or not showing anything. So we opted to give you something. But really, I think when you look at what we're building today and that fusion between humans and AI, I think that's the most interesting bit of all of cybersecurity right now. How do we bring these disciplines together so we can actually create a safe mode of operation for AI without taking away any of the speed. And you'll see some of the components that go into the system are being actually now introduced in the Singularity platform, but I'm not going to steal their thunder. There's going to be a great innovation session later on, and you're going to see what investigations are looking like. So all of this comes with a pretty significant ethical imperative as well. We have to harness AI responsibly. We can't just put AI and hope for the best or just enjoy the benefits without thinking about the guardrails needed in place. So we have to do it with accountability and supervision. Every AI decision must be explainable, governed and aligned with human intent. So AI is not just this force that goes through tasks, it's actually something that is aligned with what we want to achieve. It's an autonomous system that can act at machine speed, but is always in service of human purpose. And that's hard. Aligning these models to what we want is hard because sometimes we don't even know exactly what we want them to do. Connecting all these endpoints, these clouds, users, everything together, that's the goal with AI, deciphering through the masses of data and putting it together in one context. That's the adaptive ecosystem that we want to create. And that's why you've seen us go and acquire. You've seen us go and build. You've seen us go and partner to create that adaptive ecosystem. And all of it is for one purpose that you are a part of, securing the human future. The mission of cybersecurity is freedom. It's freedom to innovate, it's freedom to build, it's freedom to thrive. Cybersecurity should protect human potential, not limited. And the measure of success will be a world where humans and machines collaborate safely. That's what we all want, creatively, ethically. The mission of cybersecurity is not control. It's freedom to ensure that technology remains humanity's greatest ally. And that's our commitment. That's what we're here to do. That's what we have been doing for the past decade. We are here to champion humans. We're here to empower. The world needs security that is invisible yet omnipresent. The world needs security that is intelligent enough to protect without friction. And it has to understand purpose, which is probably the most difficult thing about this entire problem. But we are here, and we're committed to innovation. We're committed to creating this future with you and for you. This is why we wake up every single day. Every single Sentinel knows that this is the mission that we have today, that the technology that we built and are building is doing one of the most critical and important things one can ever do. So with that, thank you so much. I'll see you through the innovation sessions as well, which will be much more interesting than this one. So thank you so much. Really great to see you all.

All right, folks. Thanks, everyone, for being here. I really want to start with that. Time is our most valuable commodity. You've chosen to spend that with us today. So we just want to say thank you for us here at SentinelOne. So as Eran mentioned, I work inside an organization where we focus exclusively on threat. All we do is bad guys and breaches. No other topic hits our portfolio. And so we really get to spend our time on what are we seeing today and what are we expecting tomorrow. I was initially asked to do kind of the fairly typical conference talk. Let's stand up, let's talk about a year-end review, let's tell you what we saw, pretty safe. So we wanted to be a little bit riskier actually. We wanted to provide 2 different things. First, we wanted to talk to you about what we think is coming. That's risky because we are often wrong when we do assessments in the Intel business, most folks just call that guessing, but it's Tradecraft and Intel. And the second, we want to give some visibility into how we see the world. We want to be transparent with our customers and partners, so you can make your own assessments based on our world view. So we're going to really focus on 4 major needle movers that we think are going to radically reshape the threat landscape in the next 3 to 5 years. I'll cut to the ending here and tell you what those are going to be. Those are going to be Russia, China, North Korea and AI, but we'll dive into all 4 of those more as we go through. As we kind of kick off, though, I really want to kind of start with this. This is what intelligence is. I've spent 25 years doing threat intelligence in the military, in the intelligence community and in the private sector. We love to overcomplicate this topic. We love to explain Tradecraft. Don't even get us started on classification markings and sharing. But ultimately, intelligence is really straightforward. Our job is inform decision-makers by providing the right data at the right time in the right format so it can be actioned. That's it. That's all we do when the [ day ] is done for intelligence. So in that spirit, what we will do today is we're going to give you the same thing that we give our executives and our Board. How do we think the world is going to change? For us, we use that to forecast what capabilities we need. For you, it's no different. How do you secure your businesses not from yesterday, but from what's coming tomorrow. This is really hard, though. I made that sound really, really easy. Where do you focus really comes down to 2 core challenges. And the first is just signal-to-noise ratio. Both of these are going up dramatically. I'll kind of start with the noise first. I won't waste anyone's time. All of our news feeds are full of cyber threat stories. You can see them everywhere you go. It's almost -- it never ends. It just keeps going. But we're also seeing just as much signal, actual real things. Every single measure in the threat landscape is up and to the right. We see more actors than ever. We see more malware than ever. We see more vulnerabilities than ever. Like there's a trend here, right? Like I could just keep going. Not one trend is going down in the threat landscape. So we see both the increase in signal and noise. And I'll talk a lot this morning about context. I think context really helps us make good decisions. Cybercrime, according to the FBI, has gone up 144% in the last 6 years. Let's compare that with traditional crime. Burglaries are down almost 50%. Drug crimes are down 27%. Homicides are down 15%. Imagine if I stood on this stage and said, we think in the next 6 years, there will be 144% more murders. That's the comparison we have when it comes to cyber threat. We're not saying that to scare. We're not saying that to spook. We're really saying that as a call to action and how to use this time to prepare for those things. So ultimately, when it comes down to intelligence, we make guesses. We make assessments. This is kind of a typical one. I'm not the first person to stand on a stage and give an example of an assessment gone wrong. But I want to flag this not because it's funny, not because Robert Metcalfe got this wrong, but to show how challenging this business is. For those who might not know Robert Metcalfe, he was the co-creator of the Ethernet. This person knew technology. He's a Turing Award recipient, the highest honor in his field. He has an actual law named after him. Metcalfe's law dictates the way that modern telecoms work to this day. And this is what he thought the Internet was going to do in 1996. It's easy to get this wrong. It's also easy to stand on stage and kick rocks at other people. I've been doing this business for 25 years. I have been wrong more times than I can count, but that's the job. The job is not to tell you history, it's to tell you what we think is going to happen. In one of my more and more infamous papers, when ransomware was starting to flip over from targeting individuals to corporations, I was asked to author a paper that went to multiple governments, multiple Fortune 500 companies where my assessment was relax. This ransomware thing is not a big deal. It's going to be like DDoS, we'll figure it out and it will just be background noise. So I don't want to tell you not to listen to me, but let's also add some context. Some of this is going to be us saying what we think and some of that's going to be incorrect. So as we move forward, how do we do that? How do we predict the next 3 to 5 years, knowing we're going to make mistakes. The way that we approach this at SentinelOne is we really do it very similar to the futures market. I'm not a finance person. I'm not a quant. I won't dive really into how this market works. But the model that we use is let's look for the major trends and then let's assume variance, just like the futures market does. So this is why we're going to talk today about what we think the 4 major trends are going to be, what is going to fundamentally shift the threat landscape versus describe to you what the threat landscape looked like yesterday. As we go through that, there's going to be of the 4, 3 of them that require geopolitical context. I think one of the things that is different at SentinelOne, and we take quite a bit of pride in, we don't just do cyber intelligence. We also do geopolitical intelligence. This is part of what we do. So the 3 events that we think require some scene setting before we dive into the landscape starts with Russia. Multiple governments are assessing that Russia is going to invade a second European country no later than 2030. This is one of these assessments that's actually not that hard to make. You can actually literally see it from space. We're watching Russia rebuild multiple military bases. At the same time, they are an active armed conflict with Ukraine, and some of these bases are different. Some have more context. This one you see here, this is a Russian military hospital that they're building right on their border. You only build military hospitals on borders when you expect casualties. There is no other purpose for these institutions. So we could talk all day long about why we think Russia is going to invade another country in 2030, but we think this will be the scene setter for 1 of the 4 needle movers that we're going to see, and we'll come back to this. The other part we see is we're watching them do this today. Literally yesterday in the news, Russian military aircraft were probing European airspace. They've been doing this all year long. This is a typical Russian playbook that they run in advance of intrusions -- sorry, invasions, I should say. The second major needle mover we see is going to be China, Taiwan. I've spent most of my career as a China watcher. I love, love, love China from an intelligence perspective because it's the easiest thing in the world. They do this crazy thing in China where they write down what they're going to do and then they go and do it. They literally follow their plans. They tell you 5 years ahead of time what is going to happen. And then they write another paper that says, here's what we need to adjust, and then they do it again. Forecasting China is like the simplest thing in all of threat intelligence. Number one on their list is reunification with Taiwan. We've been talking about this as long as I've been doing this. This was here before I showed up. However, we think this is changing right now. We think the China-Taiwan situation is potentially the single most important thing we will deal with from a cyber threat perspective by the end of this decade. And it's based on a few things. Ultimately, it's based on one person. Xi, who runs China, when 2022 was appointed to his third term in the Chinese Communist Party. I won't spend too much time getting deep into Chinese politics. This is a big deal. A big deal there is a third term senior leader. And immediately upon him taking office, he starts going through and making actions for Taiwan. Within a week of taking over, he officially tasks the Chinese military to have the capability and war plans to invade Taiwan no later than 2027. We're going to come back to that date. That data is really important. We then start to see other things happening. We start to see things like China building up its maritime fleet, not its Navy, it's actual commercial shipping. Why in the world are we talking commercial shipping at SentinelOne's OneCon event. This is how invasions work. There's a great quote that's hundreds of years old now where Napoleon talks about amateurs talk tactics, professionals talk logistics. This is how invasions are fed. This is how invasions are equipped, and we're seeing it in real time. Again, I would love to say we're really smart, but you can see it from space. Like this is not hard to find and ascertain why this is happening. We also look at other things that are happening that they are forecasting. And in 2027, there are 2 major events that will concur at the same time. First, the Chinese Communist Party will celebrate its 100th year anniversary. They are already planning this being their largest event for 2027. This is going to be a huge deal in China. And Xi is laser-focused on his place in history. He is adamant in carving his name into the rock that is Chinese history. He wants to be viewed on the same page as Mao, and he looks at this 100-year anniversary as his window to do that. Also, he has already declared he has every intention of taking over a fourth term. No Chinese senior leader has ever taken over a fourth term. And all reporting indicates that he wants to do this because in his fourth term, he can unify China and Taiwan. We are seeing multiple indicators, this long-term topic is likely to come to fruition in the next 2 to 3 years. So this is going to be our second needle mover that requires some geopolitical context. And the third is North Korea. North Korea is the opposite of China. This is the wildcard. They routinely do things both in cyberspace and also in the real world that just surprise us. And the world changes very quickly in North Korea. One of the major events we've seen over the last 10 years is in 2017, North Korea underwent significant international sanctions based on their testing of nuclear weapons and ballistic missiles. That led to what the world thought was going to be an economic suffocation of North Korea that would force them to move off of their aggressive geopolitical situation. And that's not really what happened. Let's pin 2017 in our minds. I'm going to come back to 2017 here in a few minutes. That's going to be a very important date. So as we fast forward a few years, what we saw was the opposite. North Korea actually became more aggressive. Something happened between 2017 and 2021 that allowed them to not only survive sanctions, but become more emboldened, become more aggressive, and that has been accelerating in the last 8 years. The largest acceleration occurred in 2024. North Korea, for all of its aggression in this world, had always stated publicly they intended to unify with South Korea peacefully, no longer. In 2024, they said that is not an option, and they believe absolute kinetic warfare is the only way to unify the peninsula, and that is their #1 goal is North Korean regime. We then see this pick up even more speed as 2024 plays out. We see North Korea send tens of thousands of troops to fight in Ukraine along with Russia. This is the first time in decades, North Korea has sent troops abroad. They are able to pay for this. They are able to pull this off, and they are willing to go to a higher level of aggression geopolitically on an international stage. And as we look at that, we also see this recently. In the last 2 months, for the first time in years, North Korea sends representative to the UN and their entire message is we are going to become more aggressive. They are not going to give up nuclear weapons. They are not going to give up ballistic missiles. They are not going to give up sending their troops somewhere else. So as an international community, we're kind of stuck to say, why are they able to do this? Why are the sanctions not working? And we think that will be the scene setter for our third major needle mover. Before I dive into how we think all of this is going to manifest on the actual cyber threat landscape, I think we owe all of you an explanation on how SentinelOne sees the world. It's great being up on stage talking about politics, but I can't load doctrine into a firewall. I can't take a public statement from the UN and make that go find something on EDR. That's not the way this works. So let's walk through how SentinelOne converts this and how we see this playing out across the world, and then we'll dive into what we think are going to be the really large landscape shifts in the coming years. The first thing that we talk about is we see the world through you. Our clients are our visibility. This is how we interpret everything that we talk about when we look forward. We have about 14,000 clients in about 80% of the world's countries. We're not in North Korea. They're not a big fan of ours. We don't have a lot of agents deployed in Russia. I don't think anyone would be surprised at the 155 countries that we're in, but this is the space we're at. This is ultimately the highest level view that we have is through your organizations. That manifests one layer down by our access to about 40 million endpoints and about 2.5 exabytes that we can hunt and move across. In essence, this is where we test our theories. This is how we say, we think the world works this way. Let's go look and verify. I'm not a math guy. My undergrad is an Anthropologie. So millions and trillions and billions confuse me pretty easily. But just to give some context here, if every one of you was a SentinelOne EDR agent, it would take 73,000 rooms to equate how many endpoints we have access to right now. All I know about exabytes is it has 18 zeros. That sounds like a lot. If I converted that to my Spotify playlist, that playlist would be 2.5 billion years long. I'm not saying we know everything. I'm saying we believe we have enough data to make qualified assessments on where the threat landscape is going. If we take that down one level, it's a difference what we can see versus what we know. How do we test these ideas? And there's our detection engines, there's our hunts. In this case, we just took indicators, it's tangible. We can openly talk about how many things we see, how many groups we are tracking. This is what we apply across the visibility you as our clients provide to us as an organization. But all of this ultimately comes down to outcomes. Outcomes are where we actually get to assess how the landscape is changing and where we are going. And if we look at just some examples here, ransomware, I'll come back to ransomware. It turned out I was super wrong in 2016. We did not solve the ransomware problem in 2016. In the first 9 months of this year, we have stopped over 1,000 attempts to deploy ransomware actively inside of client environments from more than 65 distinct threat groups. This is now where we start making our assessments. This is really where the rubber meets the road, and we synthesize down that combination of what we can see, what we're testing and then what we know. And that synthesis is really where intelligence comes in. I'll just take one example from our MDR organization. The first 9 months of this year, they triaged about 26 million alerts. Nobody cares. Absolutely, nobody cares how many alerts we looked at. There is no inherent meaning in that. What happens is we synthesize that and crush that down to about 15,000 incidents. Incidents are where we can make decisions. This is actually what matters. That synthesis is how we talk about intelligence and how we create our world view. So now that we've given a little bit of geopolitical context, we've given a little bit of synthesis and how we see the world, let's dive into what we think these 4 major shifts are going to be across the threat landscape. Number one, let's go back to Russia. We started with Russia. I think it's the first place for us to start. What we look at is if Russia invades a second country inside of Europe, what's that going to look like? We know what happened with Ukraine. So let's start with that. We got to see in 2022 when Russia invaded Ukraine, the first real cyber war. We've debated this for decades. We've talked about it. We've got papers written. We actually got to see it with our own eyes in 2022. And what Russia did that I think are important for takeaways are 4 things. First, they synchronized their military operations with their cyber operations. They did not view cyber as a silver bullet. They did not view it as stand-alone. They viewed it as part of their overall warfighting capability. Second, they did not just use their nation state programs. They did not just use APT28 and APT29. They leveraged their own inherent organic programs. They leveraged all of the cyber criminals that they have allowed to operate [indiscernible] inside of Russia, they had expectations for them. Those bills came due in Ukraine. So we saw cybercrime as an active component of Russia's push against Ukraine. And then we saw the exact same thing with hacktivist communities. Russia applied a full spectrum of their overall capabilities against Ukraine. Third thing we saw, and this is one that if you would have been in a conference with us 4 years ago, this is all we would have talked about. We have never really seen destructive cyber, actual destruction on the ground. Any intelligence analyst as recent as 4 years ago could have told you exactly every single time we saw destructive events because there was like 2 of them. Like there just was not that many, so they matter greatly. In the first 6 months of the Ukrainian invasion, we saw 9 distinct destructive tools. And then it became so prevalent, we kind of lost count. And I would love to tell you we have all these absolute answers. But as an intelligence community, we don't even agree. We kind of threw our hands up at dozens. So the reality of will nation states use destructive cyber? Russia will. They absolutely will. And then the last part, for the first time ever with any country and any conflict, we got to see the endurance of a country. We can talk about intrusions in isolation, but that's what it is. It's a one-off. We actually got to see in Ukraine how long and how deep and how persistent could the Russian cyber efforts be? And the short answer is, yes. Short answer is all of those things. They did not have to stop running intrusions in other parts of the world. They did not stop innovating, and they were basically daily drivers going after Ukraine day after day after day for 3-plus years in counting. They have the endurance to execute these programs on multiple fronts. We expect all of this will happen when Russia invades a second country in the next 3 to 5 years across Europe. Here's what we think will be different. We have a list across the international community of like the most 2 to 3 likely countries Russia will invade. All of those countries are either part of the EU or are a member of NATO. Those will make the next conflict inherently more complicated. And that will start with Article 5. Article 5 inside of NATO is, in essence, a call for common defense. You attack one NATO country, you attack all NATO countries. So now this will not be Russia versus Ukraine. This will be Russia versus a country and then all of NATO, EU involvement. This battle space will get incredibly complicated very, very quickly. That's difference number one. Difference number two, Russia has a much broader target surface. Ukraine is not that big. It just really isn't. They will have the ability to go after entire swath of the globe to produce their impacts. That will impact our business. Third, Russia is deeply integrated with the European economy and also Russia struggles with sanctions, both that interdependence will produce impacts and sanctions will produce impacts. We think that will drive a more immediate extreme reaction from Russia. They will need to have an incredibly severe kickoff versus a 3-year prolonged event. We expect to see a much more widowmaker-like type initial event because they're racing the economic clock. And then fourth, before the Ukraine invasion, no one would have assessed Ukraine as a very cyber-resilient place. That wasn't what any of us had on the scorecard. Ukraine turns out as incredibly cyber resilient. They've impressed whole swaths of the cybersecurity industry. We then compare that with the European countries, on paper, they're far more resilient. They are far more secure. That is likely to be stress tested. Our entire way we think about resilience is likely going to be stress tested when Russia invades the second country. Ultimately, for our businesses, we think these are what you need to pay attention to. We should expect everything we saw in Ukraine, except it will be applied at, at least, a regional scale, if not a global scale. What is happening to Ukraine now is what we should prepare our businesses to, especially if we work inside of Europe. Second, we should expect an extreme event very early, and then we have to find a way to survive through that. And then these last ones really all kind of go together. It's going to be complicated. There's going to be multiple countries with their own competing priorities, their own assessments, all having to come together to figure out how to work against this threat. I've been lucky enough in my own time, I've spent some time working with NATO. It's complicated. For any folks that have had to work with allies, the only thing worse than going to war without allies is working with them every single day. Allies are hard, like that's just the reality. Ukraine is simple. It's Russia and Ukraine. And our cybersecurity entire industry is largely supporting Ukraine. That is highly likely to be very different when we have this first needle mover with Russia. The second needle mover is going to be China. I mentioned how China is the easiest thing in the world. China as an intelligence analyst is also the hardest thing in the world. And here's why. It is almost impossible to talk about the scope and scale of China's cyber program without sounding like a crazy person. Like you just sound like you're making stuff up. You sound like you're saying just crazy stuff that no one can believe. So let's just baseline with one thing. In the last year, we've seen significant media, government and industry reporting on only 2 Chinese cyber groups going after telecoms. Let's quick refresh. China has dozens of cyber programs that we're aware of. These 2 alone have compromised more than 80 telecoms with access going back at least 12 months. The U.S. government assesses every single U.S. citizen has been impacted in that effort from these 2 groups. And oh, by the way, most of those intrusions go back at least 3 years. This is just a baseline. And the telecom piece is not unique. This is what they do in every industry and have been doing for at least 20 years. This is not a one-off. So when we think about that long-term access, that espionage event, all of a sudden becoming an invasion. Guess what happened? China told us exactly what they're going to do. They have every intention of using cyber specifically to infect and influence multiple global populations, so countries stay out of the war. They do not want the U.S. involved. They do not want NATO involved. They do not want Japan involved. They do not want Australia involved. So their intention is to use cyber to make the home population so uncomfortable that governments have to stay out of this conflict. We think on our best assessments, this will go on for 18 to 24 months globally. That's how long we think it will take them to accomplish their invasion. That will be a mix of highly targeted attacks against specific places, widespread espionage, just like they're doing now. And then the third bucket, information warfare. We really haven't dealt with this. Outside of Taiwan and some dissidents and some other areas, we have never really encountered China's information warfare apparatus. We assess it to be significant, and we will now have that problem to deal with along with everything else. If we look at this, what are these likely outcomes going to be? These are the things that we think companies need to be prepared about. You have to assume they already have access. They are spending years and years preparing for this scenario. They are telling us they're preparing for this scenario. They are telling us they will go after water supplies. They will go after trade routes. They will go after ports. They intend to shut down communication. Let's talk about the comms piece alone. Every time there's an AWS outage, I find out because like Roblox is down, my kids can't get on their programs. And oh, by the way, all of our stuff goes down. That happens for a 2-hour AWS outage. That happens when Azure goes down. Imagine when the intention is to put down massive communication capabilities for weeks to months. We will have to operate our defenses without having all of our capabilities in that. And then also the last couple here, China wants to influence the population. Of all the access China has had and all their intrusions, they have never leaked secrets. Russia has, Iran has, North Korea has, ransomware has. China has access to material that will undoubtedly change the way people look at their governments. They have access to data that will undoubtedly reveal things that we do not know about our own governments, and they have every intention of using that. So not only will be dealing with intrusions and impacts and information warfare, we will also have to navigate this through. This goes from being a CISO job to like your CMO is now part of this. Your CMO is now going to have to answer questions. Your comms people are going to be involved. So we think about what these mean. We think these are the things that we're looking at. And ultimately -- and this is where Russia -- or this is where China makes it sound inflammatory a little bit. We think this has the potential to be the single most important cyber event we've ever seen. That sounds dramatic, but we think it will be that important. We think if China invades Taiwan, it will be unparalleled across the cyber threat landscape. Third one is North Korea. I can talk North Korea all day long. I promise I won't. If you've read anything North Korea in the last year, it's been about IT workers. I want to use this as just a quick baseline. We know as an international community, North Korea has 10,000 North Koreans that log in every day and get paid by IT companies to do an actual IT job, like they're actually working and they're actually getting paid because it generates between $400 million to $600 million for the regime. If they're willing to put 10,000 people every day on generating $500 million because they need it, that's important, and we'll come back to why that's important. Just for some examples here at SentinelOne, we put some research out from our Sentinel Labs team. The first 6 months of this year, we were successful in stopping more than 360 personas apply for more than 1,000 jobs against SentinelOne. They're not interested in SentinelOne. International reporting has this happening at about 6,000 companies where they've actually been hired and their actual employees. I'll kind of point to another session. Tom Hegel is going to give a great talk on how we've gone about this, highly, highly recommended. But this is pennies compared to crypto theft. We have become snowblind to crypto theft from North Korea because it's been happening nonstop since 2017. Can I tell you definitively, North Korea started stealing cryptocurrency at wholesale because of sanctions? I cannot. I can tell you it started happening 60 days after sanctions went into place. I can tell you they've doubled down on it every single year, and it's gone up 28x since they started in 2017. To rotate the problem a little bit, 2/3 of every cryptocurrency stolen was stolen by the North Koreans. This is how important this is. And if they're willing to put 10,000 people on $500 million, what do we think they're going to put on $2 billion and counting for this year alone. This matters as a needle mover because it just provides huge returns for them. We compare it against traditional crime. You can see it's not like a 2x, a 4x, it's 1,000x. It's 100x return on their investment. And the bottom line here is the most important part. We know they're doing it. We absolutely know they're doing it. They're being attributed, and it does not impact them at all. So they're just going to keep doing this more. So I mentioned earlier, MetCalfe's law. I'm going to take a swing here at Steve Stone's Law. I'm going to try my own little math formula here. So this is patent pending. No one steal this. It's a $100 bill plus EUR 100 times [ fakeair ] is greater than Bitcoin. That's Steve Stone's law. And what this really means, when we talk about why North Korea matters and why it will shift the landscape, this has always been a criminal regime. They are so good at crime, the U.S. government and the EU had to completely rebuild the $100 bill and the EUR 100 because they were the top counterfeiters in the world. Oh, by the way, both organizations had to do it twice. This is how persistent they are at generating criminal money for their organization. [ fakeair ], I hope this is the only [ fakeair ] presentation you've ever been in. This is their #1 export. The #1 export out of North Korea is [ fakeair ] at $170 million a year. Their entire GDP is $15 billion a year. They're generating at least $7 billion in stolen cryptocurrency alone, more than $2 billion this year. They've made more money still in cryptocurrency than 12x their top export of [ fakeair ] and 5x more than their total export list. Oh, by the way, if we just look at their GDP, we assess that their cryptocurrency theft is about 15% of their total GDP. This is how they are funding their regime. This is how they are able to be as aggressive as they are, and this is going to produce 3 major things that we look at. First, they are sinking those gains right back in. They are investing their returns and they're making it work. That is then allowing them to be very aggressive geopolitically. That will have consequences on a geopolitical stage. Third, at some point, we will likely get to a point, just like it did with counterfeit money, where they are injecting so much doubt into this system that we start questioning the actual system itself. And cryptocurrency is already under doubt. That has the potential to have profound ramifications across the globe. We don't know what that will be. The last part, these guys are really innovative. Like they're using AI to become valid workers. No one saw that coming. The methods they're using is still cryptocurrency are really innovative, and they're just sinking more and more resources back into that. We really actually don't know what they're going to do next. They are the actual wildcard out there. And then the fourth needle mover that will hit, there's no way we're not going to talk about AI-facilitated malware. I want to kind of level set real quick on where we're actually at today. Let's just talk about 4 quick things. We have LLM created malware, technically feasible. Like it's happening a little bit, but it's not meaningful. We are having LLLM embedded and post-runtime cases. It's real. Mal Terminal's example. Ely will talk about that a little bit later on. We're seeing LLM invocation at a local level, it kind of works a little bit. And then we're seeing prompt injection and data exfil using AI. This kind of went from 0 to where it's at, say, in about 12 to 18 months, but it's brittle, it takes humans and it's pretty unstable. We don't think that's the forever answer, though. That's where it's at today. If we look forward, we think all 4 of these areas are going to change demonstrably. The first, we think will be the operationalized LLM-assisted payloads. We're probably a year away from that being really common. The offline LLM malware, the only thing keeping that back right now is the packages are too big. Technology always shrinks the packages. We think that, that will be there. The third one, AI augmented social engineering at scale. The only reason we probably really haven't seen this, we haven't been in the right geopolitical situation yet. This is almost undoubtedly a matter of time. And then the fourth one, the real bogeyman that we all talk about is autonomous chained attacks. This is limited by a couple of things: cost, compute and just more experience. This is not happening today. Although we are seeing multiple governments research it, we are seeing cyber criminals try it. This is inevitable. It will happen. Our assessments are we're probably 3 to 4 years away from that happening. But we've been talking about the future. This is all heady stuff. It's hard to get our brains around. I want to kind of go back to how we see the world. I want to give you one specific example. How are we actually seeing the world shift on the wire? And I can't think of a better person to walk us through that than Drea London, our Head of Incident Response -- sorry, we've got some slides missing there. I apologize. Drea will come out and walk us through how we're actually seeing Evil AI operate inside of these environments.

Wow, you guys know you're going to wake up and be terrified. First day. That's what we're doing. So I'm going to tell you a story today about a threat that we're seeing, and it's not going to create global cyber warfare, but it might be a little more accessible. It's something that we see rampant right now running around and a lot of customers of ours. So Evil AI is a -- it's a malware family that's basically using AI and efficiency tooling to disguise itself and using the human interest in AI to basically create lures, right? So we know that in the world that we live in today, AI makes us more efficient. It makes us, frankly, not have to work sometimes, right? It makes everything so much easier. And so that creates an element of trust. So looking at the question of how is AI being used by threat actors today. If you look back to Black Hat last August, I was on stage in our beautiful booth basking in the fact that I have one of those gorgeous booths at Black Hat, all the lights, and I've got Benji and our marketing team asking me all these questions about how are threat actors using AI today? And I get that question a lot, pretty much all the time. And I gave the same answer that I always give to him, which is like, we're really not. Okay? We're really not, not so much. We see them using natural language models in phishing and things like that, making malicious code seem more relevant or reasonable or trusting, but we're really not seeing it day to day. There's no polymorphic malware running around the universe that we've all been afraid of from publications and things like that. But little did I know that at that exact moment that I was speaking, we were, in fact, experiencing or several customers of ours were experiencing AI being used in a very novel way that we had not seen before. And it's -- again, it's not polymorphic malware, but it is new and interesting and really capitalizes on the human element of AI technology. So how does the story start? Mid-September, we get a phone call from a customer of ours, a very large customer, one of my favorite customers. I'm sure they're in here somewhere. I can't see any of you with this light. But we get a call. And usually, unless I'm on the phone call trying to sell you something, if I'm on a call or in a room, it's probably not your best day, okay? So I'm on this call. We're evaluating the incident with a customer. And this is a large customer. They have a very sophisticated security team of their own. So they've already been sort of performing their analysis. They're providing us with the information that they've gotten to date. And we recognize that this is something that's quite prolific in their environment. Again, mid-September, we get engaged, DFIR team is on the phone, scoping an incident. And there were several files that we knew were likely bad. The first one that we reviewed is file -- an installer for an application called JustAskJacky. Now JustAskJacky is an AI assistant. And if you were to install JustAskJacky on your computer, you will be presented with this beautiful little cartoon character [ bluntly ]. I kind of picture here like 1950s, like she can be vacuuming and with her Martini glass at the same time, she can do anything you want. She's here for you. Andrea, I'm here for you. What do you need? What can I do for you? And she does it. And this is the difference from other trojanized malware that we have seen in history is that she is actually completely capable. She does what she's supposed to do and so then she solicits trust in you. You believe that she is a legitimate application because she is doing what she said she's doing, right? She's answering all your questions. Oh, you want this recipe. Oh, you want me to fix your picture for you, make this more clear. I'm here for you, Andrea. I can do whatever you want. And I can also drink a Martini and vacuum at the same time. She's doing all these things. But in the background, Jacky, is kind of naughty. She's not actually just doing good things. She's running some auto runs and registry key and setting up what will be a large scale global account information stealing campaign. So JustAskJacky is the first piece of software that we start to look at. We then identify another piece of software appsuite.msi. Okay. This is actually very similar to Jacky, but she's he, she, whoever is written a little bit different, different type of code. appsuite.msi purports that it is a PDF editor. Have you guys ever tried to edit a PDF? Not real fun, but how you want to spend your time, okay? We have evolved, but it's not a good use of your time. So it is not surprising that the population when presented with a beautiful Google ad or a phishing lure that's like, I can help you edit your PDF. You're like, yes, please. Oh, I meant it actually does. It does what it says it's going to do, and therefore, even now you trust it. So appsuite.msi, again, another loader, very similar to Jacky, different purpose, fully effective. This is what is different than trojanized malware that we remember from history, right? Like we look back at Trojan and we think, oh, I remember Excel spreadsheets that were meant to help me be more efficient, it's a Trojan. This is the same type of mentality and purpose that we have seen in history, but using AI and productivity because that is the place that our minds are in today. That's what interests us today. Interestingly enough on appsuite.msi, so just as Jacky got a clean bill of health from VirusTotal, appsuite did not. Viruses were like, [indiscernible], I don't think so. I think you're a [ pub ]. I don't really like you. I'm going to go ahead and classify you. And the threat actor that created appsuite.msi, frankly, same threat actor that created Jacky, submitted a ticket to VirusTotal. They said, no, no, no, that's a false positive. [ Mine hour ] is safe. That's a bold move. That's not something we see very often. And I don't know if VirusTotal just didn't look at the ticket or didn't care, but they have continued to persist that yes, just kidding. You are, in fact, not good. But all of this is spread via malvertising campaigns, SEO poisoning, Google ads, phishing lures, very typical strategies that we see in cyber crime today. It is not focused on any industry or segment or geography. It is anyone -- anyone and everyone. So moving right along. What we've determined after reviewing these 2 pieces of malware is that their actual intention was to deliver TamperedChef, which is an information stealing module within these applications. And it's whole purpose is basically steal cookies, credentials, secrets, whatever it can from the endpoint that it's living upon. What's super interesting is its life cycle was exactly 56 days. Now I did not know this. I learned this as a part of this research. That 56 days is the exact amount of time that a Google ad is active. So what it's essentially doing and intentionally and purposely is collecting every single amount of information it possibly can over the exact amount of time and then detonating itself 56 days later. And this is interesting because when we start to look at the time line of how this all manifested this last summer/fall, you can see that execution on that time line in effect. Okay. So OneStart.exe, this is another file that we looked at, and I'm not trying to just give you guys follow names, IOCs. Honestly, there's like hundreds of them. But just to kind of give you a picture of how all this comes together. OneStart.exe is a piece of the puzzle. It's one of the files that the loaders, Jacky or Appsuite install on your computer that essentially perpetuate, right? It launches TamperedChef, it perpetuates the collection of the malware. It really is kind of just like one piece in the middle of the puzzle. What's interesting in OneStart.exe is it's one of the first things that we see when we start to go back in time being tested. And it also kind of connects all these pieces together because we can use that executable as the connective tissue between different pieces of malware that might be written in different types of code but have this exact same [ C2 ] or command and control language within them. And so it allows us to kind of put all of these things together. This is, again, end of August, is when we see this in this one specific victim environment. Okay. So mid-September, September 11, we see the first publication of EvilAI. And this is written by Trend Micro, it was actually very good write. I definitely recommend reading it. And it's the first time that we see the industry really putting all of these pieces of the puzzle together. We've been seeing them kind of independent. But this really provided an understanding of how everything worked together and create this entire life cycle. And it goes forward and really explains to us as researchers and industry professionals, how the threat actor is exploiting AI, branding to deliver this persistent backdoor and steal credentials. It's really using the concept of AI and how -- what it means to individuals to essentially lure them and be effective. So as one does, whenever you have a cybersecurity incident, well, in this case, one where we know we need to introduce detection. At SentinelOne, we take all the research we have from our breach responders within my team, within the other customers and partners that are sharing information with us and we built a bunch of platform detections. We were already detecting this from a behavioral aspect early, early, early on. But I think that we didn't exactly know what it was that we were detecting. And so we -- this is me telling you, don't be scared, we did good things. We're here to help you. We did. We did. We immediately deployed these protections and sent them out to all of the end points that SentinelOne was protecting. And then we started to look back in time. In breach response, I mean, I would never give you in this life cycle presentation, but we all know what the missed life cycle is, right, and part of that is our postmortem analysis. And so looking at our postmortem, we said here, we're really skeptical of this timeline, we weren't really sure. And like ma'am this seems like only been going on a couple of months, but it's super prolific. And so, fortunately, this victim, again, one of my favorite customers if you're in here, please, had really, really good data retention. We had to like a lot of time that we can search through. And we started looking, and we found evidence dating all the way back to February of 2025 of parts of this campaign. And at that point, it was very low noise. The threat actor was in a testing phase. But it just shows you that conceptually, they had a plan, and this is a multi-month plan. A lot of times in cyber crime, you're kind of in and out in a hurry, right? This was very thoughtful. It was very broad, and it obviously impacted hundreds of thousands of people all over the world. But so we find our first evidence, dating all the way back to February and then continuing our research between March and August. So we had like our first detection in February, next detection kind of mid-March. Between March and August, we have 36 independent versions of AI -- or EvilAI-related malware in this one single victim, which -- that's not good, right? But what it allowed us to do was really get an idea of the entire life cycle of how this malware evolved and developed and what it did. And so what we started to see is January -- sorry, February, March, very low noise. We're just testing stuff. We were purchasing domains. We're creating our trojanized installers. We're refining our infrastructure. But then by late June is when we really started seeing the campaigns on Google ads, this is one that's getting a large global rollout. And then you have your 56 days, right. We were dormant for 56 days. So by late August, that malware that had been laying dormant for 56 days at TamperedChef, completely executes and start sending secrets back to its control server. That's when larger-scale compromise is assumed. That's when we can start seeing -- the utilization of those credentials are secrets. We can start to see them being sold, et cetera, massive data exfiltration, et cetera. So at the end of the day, again, not here to just try to scare you. You have a whole conference full of like AI-related conversations and information and all the reasons why we can protect and secure you. And we can. And we did all the way back to February, these detections were detecting and that's great. But the point is, I was wrong the first week in August, when I sat on stage at Black Hat and I was like, no, no, no, we're not really seeing AI being used by threat actors in breaches. And I didn't think that this is how we would start there, okay? We are all afraid of -- you saw it o Steve timeline, what is it, 2029 and 2030 when we start to see completely autonomous delivery of malware. What we're seeing is the human element, the same exact human element that we've seen in trojanized malware forever, which is simply between the keyboard and the chair, how do we make your life easier? How do I make you more effective and efficient but now I can do it easily and in a way that actually works. So I solicit trust. So we're not seeing polymorphic malware, but we are seeing malware being used by AI. By the way, all of these installers, we believe, are written in AI. You can tell by the obfuscation techniques that were used that not only did AI likely create these installers, but they're also again soliciting the human element of AI interest. And that is it for me. I bring Steve back.

All right, folks. We talked a lot here. We covered the globe literally and figuratively. Our real hope here, we're not trying to scare anybody. We're trying to give 3 things. One, we want to give visibility into how we interpret the world. Two, we want to give context for the things that we are looking forward to. And then three, our real hope is to be a scene setter for everything else that comes to OneCon so we can set the stage for why we are building what we are building, why we are pushing the way that we are. So you can see our goals and ideally how we can help to secure your environment. Thank you very much for your time, everyone.

So the next 30 minutes are going to be all about what we've been building, what we've been doing and how we actually make tangible progress towards that vision that we set out to build into usher into this world. So I'm going to be joined by quite a few leaders and we're going to talk about how we're taking all of these different components that we have in the platform today and those that we've just added either through acquisition or building or partnerships. We're going to show you how these innovations come together to create the autonomous SOC vision. Now what's important to understand is that a lot of what you're going to see in this session is actually either already available on the platform or coming in the next, let's call it, 90 days. So these are all tangible real things that you're going to be able to do with our platform, some you can also already do today. So that showcased some of these pivotal steps that we've been taking to solidify SentinelOne as the leading AI security platform. I want to first open with data. As we talked about, when we think about creating that innovation entire fabric of cybersecurity, it has to start with bringing the data in, which is why I'm incredibly excited to invite to the stage Gurjeet Arora to tell us more about how Observo AI and the Singularity platform are coming together to put data into one place and action it. Gurjeet?

Thank you, Tomer. It's a profound privilege to be part of the SentinelOne team. One month in, and I can already feel it, this team runs on innovation. Together, our shared passion for customer impact and innovation will define the future of cybersecurity. At Observo from day 0, we are focused on one clear mission, empower security teams with the right data at the right place at the right time. This chart from Gartner shows the exponential growth in machine data we have seen in the last 2 decades. What used to be terabytes just a decade ago, it's petabytes today. That's 1,000x growth in the last decade. In practice, most teams can't even capture all this data and even if they do, the signal gets lost in the volume that is [ noise] . The net result is exponential increase in costs, while the overall security stance of the enterprise deteriorate rapidly. This problem of noisy data impacts every single security team out there. This is the problem we are solving. Let's see how we solve this problem. To solve this problem, we have built the industry's most advanced data pipeline. This data pipeline uses [ 4 ] specific machine learning models to deeply classify and denoise data. Further, to make data operations easier, we have created Orion, our agentic data engineer. Today, Orion has become a go-to tool for security teams. They are automating day-to-day time-consuming operations like data enrichment and data classification using Orion. In terms of scalability, today, large organizations like Bill.com, Alteryx and Harbor Freight are using our platform at petabyte scale. What's the most clarifying to me is the value that customers are getting from our platform. So on an average, our customers are getting more than 50% in cost savings while improving productivity by more than 40%. Let's see how easy it is to adopt the Observo platform. We basically ship in 2 configurations, 2 very simple configurations for our customers. The first configuration is applicable if a customer is currently not using the Singularity AI-SIEM. In this configuration, Observo becomes the central vendor-agnostic data engine that crowds data from any source to any destination. Further, all features of the Observo platform are available in this configuration. The second configuration is applicable if a customer is currently using Singularity AI-SIEM. In that configuration, the enriched data from the pipeline turbocharges the Singularity AI-SIEM, further features like Purple AI and Singularity hyperautomation work exponentially better. To wrap up, our teams have worked relentlessly to create the industry's most advanced security platform. This platform seamlessly combines the power of streaming analytics with deep agentic analysis in a single system. What this means for you is, we can deeply classify and transform your data, your noisy security data into actionable insights. That's really how we accelerate the path from manual threat hunting to autonomous defense. Finally, I'd like to invite you all to visit us at our booth to experience the platform in action and to see how it can turbocharge your security dreams. Thank you.

Thank you, Gurjeet. So simple, easy, complete, getting data into the Singularity platform has never been easier. And with AI native pipelines, you can take any source and put it ideally into our Singularity platform data lake or routed into any other destination that you want. That is the power of this unity. That is the power in data pipelines. That is the ingredient that allows us to start seeing everything that you have in your enterprise environment, collect, classify, enrich data, optimize, filter it, make sure you're taking what you need and putting it to action. And as Gurjeet mentioned, this is actually a substantial cost saver for all of you. A lot of the data that's beaming between systems today is actually not optimized. A lot of it is redundant. We're building AI capabilities to immediately introspect your data sources to give you an immediate analysis of what you need, the cardinality of data and how distinct is the data source you're interrogating. These are all incredible capabilities to help you gain better control over all of your data sources no matter where they come from, network, e-mail, identity, it doesn't really matter. With Observo, we opened up the gates to put data into the Singularity platform. So what's next for us? We're going to now talk about how we extend the Singularity platform to secure AI, which obviously is a complete new attack surface for all of us. And to talk about that, I want to invite to the stage Itamar Golan, the co-founder of Prompt Security.

Thank you, Tomer. Pleasure to be here. Guys, we are living through one of the most exciting times in history. Organizations everywhere are adopting AI at the pace we've never seen before. Every team, and I mean every team, is already adopting AI, marketing, finance, legal, everybody is using it. And if not yet, they are experimenting, testing, learning, but with this incredible wave of innovation comes the all new set of challenges, security teams, well, you guys, you find yourself at the center of it all, facing threats. We could not even imagine a few years ago, prompt injection, jailbreaks, data leaks. The rules have changed and we are all trying to figure out how to stay secure in a world that is moving faster than ever. So the main question is that, how do you enable AI innovation, but safely, securely and at scale? Well, that's exactly why we build Prompt Security, a comprehensive AI security platform that weaves together security, governance and privacy for every AI interaction. From day one, our mission has been simple but powerful. We would like to help organizations like yourself adopt the incredible power of AI without compromising data privacy, security or governance. That mission, by the way, extends to everyone, to the employee using ChatGPT, Gemini or Claude, to the developer using GitHub Copilot or Cursor and to the innovation and R&D teams building AI agents from the ground up, Prompt Security is what makes that possible. We make sure that the AI revolution doesn't just move fast. It moves safely. The Prompt Security platform, as you can see now in the demo behind me, can show you the entire AI footprint of the organization, which AI applications are being used, who is using them, which data is being shared. You can also configure specific granular policies to your business contextual needs and you can even apply them as you wish, on a combination of specific AI users, AI applications and content. The screen behind me is probably familiar to most of you. Imagine one of your employees going to some random AI and revising an e-mail, but unfortunately, sharing sensitive information. Prompt automatically detects this sensitive information, alerts the user about his violation, educating him, making him better for the next time and behind the scene sanitizing all the sensitive information. But there's the magic. We're not blocking him. We are enabling to use it safely and responsibly, and that's our mission at Prompt to find the sweet spot between governance, security and privacy and employee enablement.

Thank you. What you just saw on the screen, guys, this is only one example, pretty simplistic one, of Prompt stopping sensitive data from leaking into an AI application. But the platform we've built, it's much more comprehensive. It protects the entire AI ecosystem, AI sites, AI components, enterprise tools, copilots, code assistants, MPP servers, you name it, we protect it all. And if you are interested to learn more, please join me afterwards to my product session, I'll dive into any one of our Prompt Security offerings. Guys, SentinelOne has been the most powerful platform to harness the power of data and AI to protect every attack surface. And now with Prompt Security, we take it to the next frontier, securing AI itself. Thank you.

Okay. So securing AI, this is, as you've seen one of the most complete platforms on the market today. It doesn't stop with securing only employees from the usage and data acceleration that may happen when they're leveraging AI at work, either for sanctioned usage or unsanctioned usage, but it also helps you protect AI agents, all these building studios that you have out there, all the new workflows you're putting into work and in MCP environments as well. Obviously, AI adoption is accelerating across every team and across every facet of your organization. Security has to keep pace, Prompt is how you do it. It gives you immediate visibility into every AI bound action you have in your enterprise. Deployment is incredibly easy. Again, emphasis on simplicity, completeness of visibility and completeness of control. Find AI, see what it does, put a policy, done. That's how AI should be managed in the enterprise. That's how you facilitate your workforce to work securely and to adopt AI at the pace that they need. Okay. So earlier, I talked about how agentic AI needs to actually work, how we can harness it to potentially accelerate what we do in cybersecurity. Well, it isn't an empty promise. We're well on our way to create that reality for every customer out there. No more bolt-on AI, no more workflows, no more specific agents to tweak and to configure and to test and to have no idea what the outcome would be. We're moving into a complete integrated AI, agentic AI into the existing security operation fabric that you all use today, which means full context, fully tailored actions and complete human oversight which is one of the keys to actually be able to use agentic AI in mission-critical environments. So to share more I'm really excited to introduce Rachel Park and Heather Phipps to the stage.

Hi, everyone, welcome. We are so excited to be here today to discuss the topic we feel very deeply about and has real-world consequences. So 2 months ago, researchers discovered PromptLock, a malware prototype that can generate new ransomware code in real time. No command and control server, no script kitty. Just an LLM that could write and immediately implement unique Lua scripts, so every infection looks different. In less than a year, we've gone from early AI malware prototypes to credible demos of fully autonomous attack chains. One example, Ransomware 3.0, showed an LLM executing every stage of an attack for reconnaissance to payload creation to even ransom negotiation. When attackers can automate at this pace, when the code itself can adapt, we defenders cannot afford to stay manual. At this point, autonomous security isn't really optional now. It is how we stay protected. So how do we shift the advantage back and equip our analysts with agentic AI to unleash what we believe is our greatest weapon, human ingenuity.

Rachel, we're here to answer exactly that. Life in a SOC is intense. Endless alerts, too few people, newer enough time. Triaging, investigating, responding at scale is tougher than ever. Proactively improving security posture fields nearly impossible. Our mission is to flip the script to place AI directly in your hands so you can stay ahead of the most sophisticated attackers. This is why Purple AI exists. It's your proactive partner for true autonomous security.

Exactly. Look, Purple AI is the brain of the Singularity platform, unifying intelligence, proprietary models and threat data into a single adaptive system for modern security teams. It shifts the paradigm from human work assisted by AI to AI work approved by humans, so you can focus on the actual critical high state incidents requiring creative expertise. To us, humans are the mission commanders. You lead a strategy, let AI handle the chaos. But Heather, can you help us make this concrete? And can you show us how Purple helps at every stage of the SOC analyst workflow?

Let's dive in. In the console, my infinite queue alerts me to a potential identity compromise. With one click, I launched the investigation. But Purple AI has already been working in the background, surfacing alerts, correlating data and investigating for you. Normally, this sort of alert sparks chaos. Is it an identity compromise or an insider attack? How widespread is the threat? Analysts spend hours digging through logs, connecting dots, tracing the attack path. But with Purple AI, this looks completely different. When I took on the incident, I get a complete summary of the agentic investigation from the initial discovery and alert correlation to impact analysis and recommended actions. Purple AI dynamically planned and executed this investigation tailored to the specifics of the incident. It formed hypothesis, tested them and adapted instantly as new contexts emerge. This is Purple AI agentic auto investigation with dynamic context-based reasoning across any alert any data. And Rachel, I would like to share this is coming next quarter.

Okay, this is important. Purple's AI agents figure on what to do when novel info comes in, but the playbook isn't obvious. Where other vendors really love to count their numbers of agents, at SentinelOne, we are focused on orchestration and outcomes for you. Now earlier, I called Purple the brain, and that is because it reasons, it learns. And it clearly demonstrates its logic for the human analysts approval. So our end-to-end agentic investigations give you scale, automate across every alert free from the limits of static playbooks. Adaptability. Purple learns and pivots dynamically with high accuracy; and transparency, that means full explainability with you in the commander seat. Let's take us in action. Purple AI kicks off the investigation from an Okta in possible travel alert. It asks, Who is the user? Where do they log in from? It identifies James Sabalo with a suspicious login from an unknown location. From this, Purple hypothesizes that we may have a compromised identity. It queries often Workday from our background on James. Purple AI's seamless integration with singularity hyperautomation, lets it act quickly and safely. It instantly reaches out to James on Slack and confirms the log-in was unauthorized. This is Purple AI integration with Singularity hyperautomation, also coming soon. Next, Purple AI investigates how James' identity was compromised. It pulls in proof point data to confirm evidence of phishing and it identify suspicious [ SCC ] overwrite linked with his credentials. Finally, Purple AI assesses the blast radius. It queries, EDR, Zscaler and cloud trail logs confirming that this attack is isolated with no evidence of lateral movement. In seconds, Purple AI has traced the complete attack chain from the original phishing e-mail to identity compromise to data encryption, all agentically without any human configuration, giving you clear evidence for decisive action. Look, our AI doesn't stop at investigation. Of course, it also drives response. Purple AI agentically surfaces preapproved recommended actions via Singularity hyperautomation, rotate AWS credentials, block the attacker IPs, restrict S3 access and immediately suspend the user in Okta. Done, just like that. This is how Purple AI delivers you an agentic SOC. It is thinking through the problem, crafting its hypothesis. It is investigating, trying to validate that hypotheses and then only taps into preapproved workflows to execute approved response actions. And then finally, it documents everything in one clear auditable view.

But, Rachel, Purple AI doesn't rest even once the threat is contained. With one click, you can close the loop, instantly creating a detection to identify and stop similar threats before they spread. No more manual rule writing, no more missed chances to incorporate what you've learned. Every investigation instantly strengthens your defenses. Remember, the original overwhelming SOC workload that we started with, imagine no endless alerts, no brittle playbooks and fewer but far more targeted manual investigations. At every phase of the SOC workload, Purple AI and hyperautomation deliver true autonomous security, working tirelessly and accurately while keeping you firmly in control. Rachel, this is a transformation that every SOC needs from reacting to threats to anticipating them from barely keeping up to staying ahead.

Okay. So speaking of staying ahead. We do have one more exciting announcement for you. We've just shown you turnkey agentic workflows inside the platform but we know many of you are also experimenting with your own LLM and custom models. So today, we are extremely excited to announce the Purple AI MCP server, a secure bridge between SentinelOne's live intelligence and real-time context and your AI ecosystem. Now you can create your own custom agents, rooted in S1 data and able to reason using your security context. Whether you're using OpenAI, Anthropic, Gemini or other internal models, you now have the freedom to innovate securely and at scale. And look, this isn't just another integration. This is about the future of autonomous security. It's giving you the power to extend the Singularity platform truly as far as your imagination will go. And the best part is the Purple AI MCP server is open source. You can actually get started today on GitHub. We cannot wait to see what you build.

Okay. I'm very excited about this. I mean we just saw a complete cycle from alert to immunization and prevention happen within a few seconds, minutes with a human in the loop. But how do we scale it now? How do we do it across thousands of alerts? And I'm not just talking about SentinelOne's alerts, I'm talking about any alert that comes from any connected product, be it Okta, Microsoft Defender, Splunk, whatever it is. How do we take what we've just seen for one alert and we do it across the board, asynchronously for everything that's happening? That's the goal with the next release of Purple. But to do that, you also need to scale the human control. You also need to scale the ability to make sure there's somebody monitoring the system at any given moment. And that is exactly why we are launching Wayfinder services. Not only we're launching Wayfinder services, we're also teaming up with Google Threat Intelligence to make sure that we can funnel real-time threat intelligence, best-of-breed threat intelligence directly into the Singularity platform and action it with Wayfinder's AI-powered human services. So this is how you scale AI. This is even when you don't have enough workforce, enough analysts to go after any alert or every alert, we have that supplemental force. So before I invite Steve and Vijay to the stage, let's quickly recap. Agentic auto investigations, Singularity hyperautomation, automatic actions, custom detection rules and the Purple AI MCP server, which is obviously an insane bridge to everything you want to build, this is the world's first fully agentic AI SOC. You have all the components, all the ingredients to basically unleash the power of AI to make your SOC infinitely faster and more productive and you don't need to code it. You don't need to configure it, you don't need to build it. You don't need to invent it, you don't need to grapple with it. It's there, turnkey, click and it happens. That is the future that we envision for cybersecurity. So let's jump to Wayfinder. I'm really, really excited with this partnership. It's taking the world's best threat intelligence and fuses it with elite defenders 24/7. I want to welcome to the stage Steve Stone and Vijay Ganti.

All right. Thank you, Tomer. I appreciate it. Vijay, thank you for joining us here.

Thank you.

So we've spent several hours here talking to you about tomorrow. Let's take a step back. Let's talk about today and some ground truth. I live and die in the services world. We have to solve problems now. We work with clients every single day who are struggling with legacy technology. It's often just jointed, complicated workflows and ultimately, blind spots. When we go back and look at what has made us successful at SentinelOne in our almost 8 years of delivering services, it's when we are connected and it's when we are coordinated not just with our clients, but other organizations in our industry that our clients also rely on. Based on this, as Tomer mentioned, as of today, and you can get it this month, this is not coming in 6 months, this is now. We are relaunching our services with a real focus on 3 things: how do we combine artificial intelligence with our human expertise and world-class threat intelligence from both SentinelOne and Google Threat Intelligence. As we look at how we expect this to operate, our ethos remains the same. We are not changing the spirit and intent of what we've done so far. We are here to work with clients preventing intrusions, reducing risk and being there in that critical moment in that breach moment, we will still do that. The difference with Wayfinder is we will provide more capabilities around that, and that will be the next evolution of our services. We will take our existing managed detection and response, our incident readiness and response and our threat hunting and combine them into a seamless client experience. Additionally, we are combining what you see upfront with what's happening behind the scenes are detection engineering to ensure that as seamless as well. And then we're going to provide outcomes across whatever data you put in front of us. You apply the surface, we will apply the expertise. And the point I want to just really kind of drill down on here, why we have Vijay with us is the threat intelligence piece. I mean -- you heard me talk about this earlier. I won't go back and recap all that 45 minutes. But this is foundational to us. That threat intelligence is what allows us to move its scope and scale. It allows us to provide the right outcomes, and this is ultimately where Google Threat Intelligence comes in.

Thank you, Steve. And you had mentioned this morning that attackers are innovating, attackers are collaborating. We as defenders must do the same, it's time. What's unique about today is that 2 reputed top cybersecurity companies are coming together to deliver intelligence to our customers. But this is not just about shared intelligence, it is about actually delivering actionable outcomes to our customers, which is what you talked about. The visibility that we have together, the capabilities that we have together, actually will eliminate the blind spots for our customers. So let's talk a little bit about what Google Threat Intelligence is. It's actually a combination of Mandiant, VirusTotal, and Google Insights. Let me just elaborate on that a little bit. With Mandiant, what you get is frontline threat intelligence that we get from responding to thousands of security incidents every year. With Mandiant, you get curated threat intelligence from 600-plus researchers who are looking at threat landscape. With VirusTotal, you're getting the best cloud source and open source threat intel out there. And with Google Insight, you're getting visibility into threat landscape that Google has as it protects billions of consumers and thousands and thousands of businesses. But it's not just about sharing data here. We don't just collect threat data. What Google does, it has the analytical infrastructure to curate, enrich and contextualize all of this to deliver actionable threat intelligence. And what happens because of that is that you will actually get active security. Now let's look at MDR, managed [ detection ] and response. And that essentially starts to deliver these outcomes to our customers.

I appreciate it. Thank you for that rundown. I think as we look at this, I think this is where we really at SentinelOne see, this is where our unified platform shines. And we combine our services with that, which was delivered across our platform. Every single services client will benefit from the combination of Google Threat Intelligence and SentinelOne automatically. Let me give just a little bit of context on how important we're taking this. You will not be able to engage Wayfinder services and not receive the benefit of GTI. We are bringing this into the core of what we are doing, combining it with our intelligence, our findings and then applying that across our clients, all at the benefit of speed and scale. Bringing these 2 organizations together, I'll be honest, I still don't know how we got the bosses to sign off on it, but it's too late, patent-pending, legal paperwork all signed. So what I would leave with is this, this is how we are going to approach this on behalf of our clients. We're not here to sell intelligence. We're not here to send you a PDF of what to think about. We're going to take this intelligence, combine it with ours and then move it through our artificial intelligence and then present that in front of our human expertise that allow us to work at scale. We will be applying that. We will be taking the actions, and we will be responsible for ensuring the right parts of intelligence are applied across their environment all while we will provide rapid onboarding and near immediate outcomes as soon as we are enabled. This is how important we think this combination of SentinelOne and Google Threat Intelligence will be. Not just when we find more threats and find them sooner, we can respond faster and more precisely. And you've heard us talk a lot about AI today. I know AI can get real [indiscernible] real quick. We talk about human expertise much the same way. But this is how we think about it here at SentinelOne. We think about it in this concept of a flywheel. And this is why this is so important to us on the services side. We use artificial intelligence to drive that human expertise. It allows us to see more, move faster, it makes our people better and then in return, this is what makes our AI better. It is being trained 24/7, 365 by human experts and the combined intelligence of our 2 organizations and every single incident, both SentinelOne and Google Threat Intelligence experience.

Yes. I was going to say AI, what is that [indiscernible] just kidding. I think this human AI collaboration that you talked about is probably the most exciting part. It creates this virtuous cycle that creates a learning system, which is so important for us. Imagine this Google Threat Intelligence provides context to Purple AI. Purple AI drives actions and decisions for security analysts. Security analysts provide feedback into Purple AI. And that's the virtuous cycle we're talking about. It is a learning adaptive system that we're delivering, which is absolutely world-class.

I completely agree. I really appreciate it coming out and join us with this. I know you've got a lot going on. And just what I would say to all of you in the audience, if you want to know more about Wayfinder, we have multiple sessions throughout today and tomorrow. We'll be talking about this for the foreseeable future. We are incredibly excited to build on top of years of experience serving you, thousands and thousands of incidents and now also the added benefit of Google Threat Intelligence. Thank you so much. We appreciate your time.

Thank you. Hi, everyone. I think I have the best job in the company because I get to see how our solutions are helping customers solve real-world problems. In this industry, when we talk about cybersecurity, it's often about the technology. We talk about the platforms, automation, AI and all the things that, that technology can do but it's really never about the tech. It's always about how the tech is empowering the people behind it. And that's what today's session is about. You're going to hear from some of our customers that talk about how they're using our solutions to solve problems that they couldn't before. So without further ado, please join me in welcoming our panelists to the stage. Okay. Let's start with some intros. [ Angel ], why don't you kick us off?

Sure. Hello, everyone. Very excited to be here. My name is [ Angel ], Director of Software Engineering at DirecTV. For those who are not really familiar with us, DirecTV is about delivering that premium content with unforgettable customer experiences to millions of homes across the country, and we're especially proud of our superior sports packages that's really put our fans in the front of the game, they care about the most. So in a world where media technology and AI has been evolved so fast, our challenges are really clear. How do we deliver secure and scale that digital experience without miss a beat? And that's exactly where my team has come in. We're sitting right in the intersection of cybersecurity, observability and automation. And I'm really fortunate enough to lead a group of very talented individuals and who are always looking forward and asking how do we prepare for what's next, not just reacting to what's happening now. So that's why I'm very excited to be here, share some stories and pick up the new ideas. And just have a great conversation about where our security operation is going to head in next.

Absolutely. Thanks, Angel. My name is Jörn Graf, I'm Team Lead of Endpoint and Application Security Team at Schwarz Group. So for those who don't know Schwarz, Schwarz is 1 of the top 3 retailers in the world. Besides retail, which is our core business, of course, we also operate our own production facilities. We operate a recycling facility, shipping line, cargo line. That makes our infrastructure-wide a bit complex. Currently, we are talking about 600,000 employees all over the world. And yes, I'm really enjoying to share some stories out of our daily business. I think a lot of you in the audience also can identify with.

Hi, everyone. I'm [ Shrishti Chatterjee ]. Thanks for having us here. Actually, I'm a global lead for security architecture and cyber defense at Thoughtworks. Thoughtworks is actually a global technology consultancy. We are located in multiple locations in the Asia Pacific, India, Middle East, Europe, in the Americas, LATAM and North America. We actually work more on the providing -- delivering software to our clients and making sure we are delivering with AI because AI is now top of everyone's mind right now. So providing modern design with AI and engineering, keeping in mind and security all the time. So for us, security isn't just an internal function where my role sits between engineering, having some strategic roles for continuing to improve our architecture in security and at the same time also working as an incident commander in the cyber defense team helping and understanding how we can continue to improve our security structure. A lot of the work is not just internal function, like I mentioned. We do have a bunch of things that we have to do for our clients. So keeping security in mind for our clients actually having that implemented into our development design and also continuing to improve our business with security as well.

And good morning, [ Mike Francis ], Director of Cybersecurity Advanced Threat Wyndham Hotels & Resorts. We are the world's largest hotel franchise here. We have over 9,500 hotels across 22 brands worldwide. In my role, I'm responsible for all things cyber threat intelligence, digital forensics, incident response and detection engineering. So my day-to-day role consists of very closely aligned to all the stuff that Steve was talking about, keeping on top of our adversaries, keeping on top of the threat landscape, informing our stakeholders, influencing strategic business and tech decisions and when something does arrive, running that into response kind of similar to [ Chatterjee ].

Wonderful. I'm going to do a complete icebreaker, right? I'm going to throw you guys off. I've got a little question. I'd like for you to describe your job by using a movie title. And then just explain quickly why and bonus points, if you don't say the Titanic. I'm going to start with you, Michael. We'll just come back down this way.

Sure. I'm going to go with my favorite movie so far this year, which is One Battle After Another. So kind of what I just spoke about, right? We have a very complicated threat landscape involving both cybercrime and nation state actors. So it literally is day-to-day one battle after another with adversaries varying TTPs and keeping on top of that evolving threat landscape is complex. And then as part of that movie, the resistance network, I think about. And I think about how we as defenders just all need to have solidarity for each other, share that information, defend as one. So that's what comes to mind with that.

Okay. That's really good. Very thoughtful. I hadn't even heard of that movie. Let alone the movie of the year. I guess I'm behind on my culture. Tristy, what about you?

I'm thinking the Avengers, kind of thinking of like you're kind of -- there are a lot of movies, obviously. You're kind of an elite team always looking at things that you have not seen. Anything will be there on top of your screen right there. So there are new threats every day, which we don't know about. So yeah...

Yes. Very good there, you got to like it.

So literally, the Avengers was the first thing which came into my mind also, but more thinking about we have all those individuals in our cybersecurity landscape in our teams, and I think also here in the audience. And everybody has a very specific skill set at the end, which overall comes together as a team to defend our world. In our case, it's our infrastructure, our customers, whatever. And I think that wraps it up. So we just need to protect everybody, and that's -- that's what I think.

All right. I got a couple of movies I need to watch on the plane ride home. What about you, Angel?

I'm sitting between Top Gun and the Hidden Figures.

Hidden Figures and Top Gun.

I think our team is always challenging the status quo and always thinking about what's next and very inclusive about the idea. Now we talk about things, we discuss and we're always thinking what can we do better right? How can we step one -- how can we stay one step ahead, right? There's a lot of things going on right now with the AI and the cybersecurity as well.

Yes, especially that Top Gun, you definitely need to have like speed and precision and all of those things.

Yes.

Well, good. Well, I -- we're all anxious to hear about your SentinelOne deployments and how you're using us today to solve problems. [ Yaron ], you've been a customer the longest. Why don't you tell us a little bit about what you have deployed, how your journey started?

Sure. So yes, we are customers since 2020, so late 2020. We did the evaluation during the year. And in the meantime, we protect around about 450,000 endpoints.

450,000 endpoints.

It also includes like cloud workloads and the likes. So when did we start? We analyzed the entire market. So we ended up having a short list. I think most of the audience here can identify with 3 vendors, Microsoft, CrowdStrike and [ on ]. And at the end, we did our technical analysis because even if our company is that big, we are still -- the technical teams are still kind of taking decisions. And so we had a very great cooperation with the account team, so shout out to everybody of our account team back then. So yes, at the end, that's the phrase a lot of companies throw out, which means customer focused. But I can totally agree that SentinelOne is living customer focus. That's a thing -- I'm in the company for 17 years now. I saw a lot of -- did some projects globally with a lot of tech companies. And well, that's outstanding for me, at least. Yes. And well, our first broad deployment started when there was with our old antivirus solution. We had a breach in some of our remote locations and somebody was like, "can we just deploy SandinOne?" Yes, sure, we can. So we provided the installer. So they provided the site token and they went ahead. And somehow, our management was like, so we did that now for branch office, I think 100 to 500 endpoints or something. And we were like, yes, sure, why not? So we went ahead, and it was close about Christmas that year. And during the holidays, there were a lot of people offline, but we decided to go ahead and install immediately on the first wave of our clients, which replicates like 20,000 endpoints. So -- and after 3 months, we reached 40,000 endpoints.

40,000 in 3 months. What took you so long.

Yes. Well, obviously, our testing and change requirements. But at the end, we forced it. And within 6 months, we reached the 100,000 endpoints.

That's fantastic. And quadruple from there. That's amazing. Thank you. Tristy.

I need a question back. I can think I forget.

Your S1 deployment. Tell us how you're using it.

Yes. I think we're a heavy Mac shop. So we have like at least about 11,000 endpoints. So it was a clear win.

That's great. We're super strong in Mac.

I know, I know. This was -- it was giving us -- we get like full-on deep visibility on anything we want in Mac. And we do have Windows machines, too, but Mac was our thing we're looking for. In addition to all the EDR functionalities that we get, we also had more visibility with what's happening, plus all of the auto remediation and the user-friendly interface that you get. Everything is farle, but we love it. It's really -- it's more like you don't have to spend a lot of time trying to understand what you're trying to figure out. It's much easier for anyone was learning first time also to pick up on the work. Obviously, you do need to do some little bit of groundwork before that was done to make sure a lot of the automations are done. The open API that's there, which allows us with a lot of the integration for our SIEM and other tools that we want to integrate with, collect some of the data that we need to and send it over wherever we need. I'm also looking at the browser extension now. I didn't know it's all there, but that's another thing that's getting me excited now moving forward.

Wonderful. That's see. We're moving pipeline at the same time that we're working. I love it. Angel, why don't you tell us about how DirecTV is using SentinelOne?

Yes. There's obviously many things you're looking for where you're trying to pick as security partners. At the time when we look into SentinelOne, our biggest challenge is how do we have that clear unified view across our super hybrid environment. And at DirecTV, we have data come from everywhere from cloud, application, EDR and our legacy environment. And they're kind of leaving the silo, didn't really talk to each other. And that made it really difficult to detect the things earlier and for the security team have to see the whole picture. At the time, we're also evaluating a few other vendors. We're evaluating [ Strong ] SIEM, Google SIEM and some open source tools as well. But it all come with very heavy teaming and load operational work that we are not really need to go for and/or it doesn't really integrate very well with our existing ecosystem. So SentinelOne really stood up at that time is it's not just another data lake to us, is it integrates really well with our existing system and the AI-driven insight and the hyper automation that's really the game changer to us is we're able to using the natural language, create the security data and trigger the automation, really made the process so much faster and make that visible to the teams that beyond just the security. So -- and also, I think really important, like I think -- and [ Yaron ], you touched that point is that what's really set SentinelOne apart is a partnership. Your team has been incredibly transparent and responsive to our need and really invest and believe the success of DRTV. And the result is really clear. We are able to reduce our data onboarding by 30% and cutting our automation development time by almost 50%. So in the end, for us, choosing SentinelOne is not just about what's solving our problem today, but more building that intelligent security operations that we wanted to really operate on for DRTV. So that's one of...

That sounds fantastic. I love it. You guys are really making us all happy here, hearing how great our teams are. Michael, how about you?

Yes. So our journey with SentinelOne actually goes back to 2017. We did an EDR bake-off back then, and SentinelOne was one of our finalists, just didn't have everything that we were looking for at the time, to be honest. There was some core functionality that was missing. I think the company overall is a little bit different than they are today. I should say a lot different than they are today. So we selected a partner in cyber reason. They served us well for 6 years. Let's didn't really innovate. I don't think cyber reason even exists anymore. And we had to do another bake-off in 2 years ago. And as Jorn said, it was the same top 3, CrowdStrike, SentinelOne or sticking with Cyberason and seeing what happened. And really, it was the team and a big shout out to Victoria, who really just directly became an extension of our team almost immediately even during the presales phase. It was just a wonderful partnership. You guys were incredibly humble about Wyndham. You fit so well into our company culture, what we wanted to do. The way you guys viewed threat intelligence and how we viewed hunting, how we viewed remediating threats and tackling these problems was huge for us. The efficacy testing also blew us away as well. I mean my team is highly technical. I specialize in malware analysis and reverse engineering. We threw a ton of malware at it, stuff that we were pulling live, live off our endpoints are live from our sandbox and it proved out really, really well. The biggest differentiator for us, though, compared against your competitors was just the simplicity of the UI, the consistency of it, we have a fairly junior SOC team. And I think that, that really proved out in the testing that the team, even though they're not super technical, was just so comfortable within SentinelOne, and that really went a long way. And then adding on top of that was the Purple AI functionality, which really sealed the deal for us, just being able to translate needs and asks and wants in human readable format, bouncing that off Purple AI, getting those results back, even adding tweaks and to those results, that really was a for us, and we've been extremely happy. And as of last week, we closed AI SIEM. So we are now an AI SIEM customer. as well.

Thank you. Thank you for that.

Yes, absolutely. We're super thrilled. We're coming off of a Splunk Cloud deployment that, as I mentioned, the team that's kind of running that today, not as technical. We are considered a small enterprise. So there's not a lot of hands to go around. And those of you that know Splunk know it's -- there's a lot of carrying and cheating that needs to go into it. And we just wanted to get out of that. It just wasn't serving our needs. And SentinelOne came in during the POC, blew us away, everything is production, and we're carrying that right through. So it's been terrific.

That's awesome. Thank you for that. You talked a little bit about when you rolled out our data, our AI SIEM in your environment. What were the challenges that you were trying to solve when you were looking at our solution for that?

Yes. Definitely, I was -- like we mentioned earlier that, that unified view of all the data come in, right? We want to make sure we have visibility into the application security login to the network, to the infrastructure, our legacy environment, cloud environment, all that needs to be combined together as one comprehensive view for our security team. Not only that in the extension is we want to make sure that information can be useful for other team beyond just the security as well. And I think that's where the SentinelOne really come in. And give us that capability and able to using the like AI, Purple AI and hyper automation, the team is going to be so excited about it and we reduced our pretty much automation development time by half.

That's impressive. That's absolutely impressive. One of the things that I always love to see is when by the adoption of our solutions, there's a culture or technology shift that occurs within your company. Do you have any examples of how using SentinelOne may have broken down barriers or changed your team's day-to-day productivity?

Yes. I can take that to start. I think with us, the biggest thing at Wyndham is definitely our culture. We have a no-silos cybersecurity team. And with that, we have a terrific relationship with our IT team and being able to onboard our IT team directly into SentinelOne. So they're working the problems with us or troubleshooting the agents with us. I think that's just been terrific for the partnership because they're getting much more comfortable with what SentinelOne is doing, right? A lot of these EDRs, sometimes to these technical teams are just black boxes. Sometimes they don't understand why they do the things that they're doing and why they're making the decisions that they make. So for us, we decided to bring them in on this go around just with the flexibility of the role-based access control that's allowed us to do that. We didn't have that in our prior product. And I think that's really helped to just get folks comfortable with SentinelOne as we've started this journey.

Fantastic. [ Yaron ], anything to add from your perspective?

Well, we kind of did it the other way around because our old antivirus solution was like very decentralized. We had around about 140 whatever servers to deploy the pattern updates and the like. And our countries around about 35 countries overall. We had a lot of administrators, which were doing something, exclusions, whatever else. we totally busted it. So rolling out SentinelOne, we -- currently, my team contains 4 full-time people taking care of the operation of SentinelOne for that scale. And we just limited our permission. So we are the only ones who can set up any exclusions besides the SOC. Our SOC team, yes, is asking us or is forwarding us requesting exclusion to be set based on their analysis. And it was tough to get all the administrators in the countries convinced that, that's the right way. But well, we did it in 2020. And until now, there's the ISOs and the SOC team and us having role-based permissions and it works. So it was quite the other way around, but it was a huge shift for everybody. But as they always complain about too much work to do for the countries. Well, we took work away. And I don't have any numbers to give you statistics, but yes, they don't have to do that much anymore.

That's fantastic. Fantastic. [ Srishi ], what's top of mind for you these days?

There are a lot of things. Right now, I think we can say AI is definitely on top of our mind. There's an AI battlefield going on. What's happening now? What's the next malware that's coming out. That's definitely on top of everyone's mind. We actually focus more on like, I would say, like I could divide them into like 2 or 3 things. One of those AIs and the other one would be more like focus on human risk. Even if AI is doing something, unless someone clicks a button, nothing is going to happen. So how do we continue to improve our human risk, like that could include insider threats, it could include data leakage prevention from that and protection from that in general. And then the other one is like how can we quickly remediate and recover from what has happened. So we are -- that's actually going to be more of our focus also, but we look into if something -- if there is a problem, if there is a virus, it shouldn't happen to anyone. If there is a malware, it has done whatever damage it has to do, how quickly can we come back? And that's one of the things we want to be good at. There's no way of saying it won't happen.

Yes. That's true. It's what happens when it happens.

And how quick can we get back to it?

Yes, what's top of mind for you these days?

Yes, I'm sure everyone is going to have AI is there part of their answer, right? I mean for us, we have several business practices -- business projects in place right now involving both generative and Agentic AI. So it's just wrapping our hands around that, getting in front of the project team and making sure that we build a secure foundation before the business comes in and starts building these products out. We're also going through a major website replatforming. So we're completely rebuilding our whole website and mobile app right now, and that's gotten a lot of attention, obviously, a lot of cybersecurity focus.

I want to bring it back to deployment. Yaron, you talked about how quickly you could get us deployed on the endpoint. Angel, what was it like when you guys made the move from Splunk to AI SIEM? Can you tell us what that deployment was like?

Yes. Our environment is very super hybrid environment. So we have data from our legacy data center to the cloud and to some hybrid cloud environment as well. So when we look at the data onboarding, we're like, wait a minute, how can we get all this data in so fast. And your team is right there, providing the right solution there, give us, hey, you know what, for these applications, we can using the existing EDR bring the data in, and we can also using the Scalar agent bring the data in that we're able to deploy within our system and collect the data really, really, really fast for us. So that -- and your team is right there with us not only provide the right solution, but also make sure that validating all the integrated test cases and give us the knowledge that we need to run fast and also ensure our entire pipeline going to production running very smooth. And that is a huge success for us. Yes, we definitely were not able to do that fast without you guys' expertise there to help us and really, really make the big success for us. Our team will be route there and completely agree with me on that.

That's awesome because one of the biggest barriers that we see when customers want to adopt our ASM technology is their Splunk environments, their existing SIEM environments. They're very sticky. They're very customized, lots and lots of dashboards, and they have a lot of fear of migrating those dashboards or even migrating how they search in one repository today to how they'll search in ours. Any -- I know you're about to join that -- join the journey, but you obviously did a POC. What do you think about those challenges? And how are you going to get those people on board with this?

Yes. I think from a deployment strategy, I think what worked really well for us is that we invested when we did Splunk in a data pipeline solution in Cribl. So that did make kind of moving the data over from one tool to another worked really well. Like we were -- we had full production visibility in our POC instance, I think, within the first 30 days of deployment. That said, we're a lot smaller than Schwartz in DirecTV, but I'm sure we have a lot of the same technical complexities. Yes. And I think what was interesting going from Splunk into SentinelOne is it allowed us to kind of rethink what we wanted to do from a metrics perspective. So from those legacy dashboards to legacy reports, what were we doing before? Shifting that whole paradigm. So I think we're -- honestly, we're going through that now with that reimagining effort, but going into it with open eyes. Yes.

Were either one of you putting your EDR data into your SIEM before -- so now you have a...

Bringing that data together is really what's the driving factor and being able to see a full attack lifeline go from endpoint up to the application layer through the network and having that all in a single pane of glass, potentially even through a single story line. I mean that just makes my job so much easier.

That's fantastic. How important is to you, the research and staying on top of the threats with the data? I know you are a student of the game, Michael, and you as well, [ Srishi ], but how important is the data that you get from SentinelOne in that regard?

Huge, absolutely huge. I mean just the talk before us with the merging with GTI, I'm super excited for that, having the Mandiant Intel baked in. We're not a Mandiant shop, so being able to get that -- or Mandiant GTI shop, I should say, but being able to get that baked into the product, I think, is awesome. I think SentinelOne has the right approach to staying on top of what really matters. And so yes, we couldn't be more excited for that. And for us, how do we stay on top of these threats. It's a lot of reading. I read a lot of news, but also, we work closely with our ISAC, big shout out to RH-ISAC, any members in the room. Fantastic organization. There's one thing I can't stress enough to follow offenders in the room, seek out who your local ISAC is and join it, they will be a force multiplier for you.

Yes. We -- actually, one thing I was thinking like we are actually multi-tenant. We're global, right? Although we're trying to have everything in one place as well in one dashboard, but then there are certain places sometimes the client will be like, can we ensure that this laptop or these machines or these [ pough workers ] actually have like a policy added to it. We have that flexibility that we can do per client per region if we have to. And that's like one of the things which gives us more -- we're not on AI SIEM yet or it doesn't mean we can be, but we definitely get that pushed data over. It can help us detect those customer needs at that time. And we can -- like maybe for us, it's maybe we might be saying, oh, suspicious, this is suspicious. But for our clients, it might be malicious. So we have to make sure it's put up according to their client policy and requirements. And that flexibility, we get that S1. Sorry, I'm used to calling an S1.

Yes, that's fine. That's all good. You can call us any nickname you want. That's fantastic. Yaron, you've been a customer for several years, and you continue to invest in us. Anything that stands out that you would want to share with the audience today?

Well, yes, I'm not a SOC analyst. So -- but I can fully agree with what Mike just said. Our SOC analysts were very, very, very, very happy when we had this opportunity to have all the data, which they needed to collect from one system to another or from another and running through the world wherever they need to pull that data to identify, okay, is that a real threat? Or what does it do? So -- and out of the sudden, I can recall discussion or a talk I had with one of our senior SOC analysts when we just rolled out the first phase, he was like, well, that's -- that just took me 5 minutes, what I just had to do in more than half an hour before, right? And I think that's the great opportunity SentinelOne provides you with all that Purple AI today, if you have like junior SOC analysts, our stock is around about 40 to 45 people right now, not only senior analysts, but also like junior analysts. And I think that approach to include AI, not to replace anybody because at the end, you need some human interferes. But at the end, that was a big winner. And at the beginning, they were like, no, that's our work. We need to do that because yes, we are the analysts, but I think they will adopt soon. So yes, that's a great thing. So as already mentioned, it's a great solution technically. And having this kind of a partnership is unique, I would say. So...

That's wonderful. It's been so great to hear about the partnership on the human level as well as with the solutions. And I know you're going to be on stage later talking about your cloud deployment. So we're going to hear a lot more about it. Just in closing, first of all, I want to thank you guys. We've talked about Purple. We've talked about the EDR. We've talked about hyperautomation and of course, our AI SIEM. I would -- just let me turn the mirror on yourself. If you had to give some advice to your younger self, what kind of advice would you give to your younger self, Angel?

I will probably teach my younger self to be more mindful of this. Like I don't have to be the one who have the answer for everything. Okay. Is more open-minded to have the team contribute together. And I think that is the most powerful thing we can come out and how we can innovate on top of that as well.

That's very insightful. That's very insightful. Yaron?

Well, the question kind of makes me feeling old. So, but at the end, I think I had quite a nice session last week with a colleague of mine, and he was like, it's kind of a life lesson. So if you drive 200 kilometers or miles per hour on the highway, you can't just look into the back mirror, right, or the rear mirror. So it's all about looking forward, don't care about what has been in the past, all this legacy stuff we still might have to handle, but just go ahead, use opportunities like new tools, AI, whatever else there is and go ahead and go for it, give it a try.

Fantastic. [ Tristy ]?

I would say I'm still struggling with this. I can't say trying to be perfect on everything. It's like everything has to be the way this is. And I think I'll go back and tell myself and still tell myself like it doesn't have to be perfect. And things can go the other way, and it's totally fine. You just learn from it.

Perfect. Michael.

Hold NVIDIA stock longer than I did. In all honesty, probably trusting my gut more. I think throughout my career, it's been 17 years now, my entire formal working career. And I've seen a lot, I've experienced a lot. And I think with that, just trusting your assumptions because they worked out more than anything.

We're glad you trusted your gut with SentinelOne.

That was definitely one of them.

Well, thank you all for being here today. This has been a lot of fun. Thank you for sharing your story.

Good afternoon, everyone. It's incredible to see this community of defenders, our customers, partners and friends gathered here in Las Vegas. You are the reason we're here. Every attack you stop, every risk you contain, that is our shared purpose. And our mission has always been unchanged to help you defeat cyber adversaries and enable true cybersecurity resilience. But the world is changing. And over the next 10 minutes, I want to show how we can adapt together in this changing world and how our platform will help you defend differently in the age of AI. So we're going to start with a little recap. We're going to start how things are changing for the attackers. And as you heard this morning from Steve Stone and Triya, the pace of innovation for our attackers have gone into hyperdrive. Attackers are using AI to discover zero days faster, to automate malware builds and even to start to generate new types of malware. One example of this comes from our very own Sentinel Labs. They recently discovered a new strain of ransomware called MalTerminal. And with MalTerminal, instead of having a static payload like traditional ransomware, it actually calls ChatGPT APIs once it's installed. They will send natural language commands like create code for this operating system for a reverse shell and now create code to encrypt this directory. With MalTerminal, every execution is unique and no 2 payloads are alike. This means that traditional detection methods, signatures, static analysis, heuristics will not work. Ultimately, it means that we're fighting adversaries who rewrite their playbook with every move, and they're doing so at machine speed. But attackers are not just using AI, they're targeting it. AI workloads are the hottest new attack surface. This reminds me a lot of the early days of cloud adoption. Back in 2015, you'd read the news headlines and every week, there will be an example of an Amazon S3 bucket left wide open to the Internet, exposing sometimes millions of sensitive data records. Well, thankfully, we've moved beyond open S3 buckets, but now we're seeing the advent of prompt injection attacks that trick AI systems into leaking data. One recent example of this is the Salesforce force leak vulnerability. With this vulnerability, an attacker can discover a publicly accessible Salesforce leave form and put in it a malicious prompt. And then when the Salesforce AI assistant processes that lead, it's directed to start sending out sensitive information via tiny image speaking. So with this type of prompt injection attack, all takes is one public exposed field, one malicious prompt and then you have the potential for massive data exposure. This is the new frontier. It's evolving faster than any technology wave before it. So what do we do? How do we defend in this new era? We go back to first principles and focus relentlessly on outcomes. Everything we do at SentinelOne can be tied back to 1 of these 6 outcomes. First, comprehensive visibility. This means all your data, endpoint, identity, cloud, now AI logs, unified and searchable at any scale. Second, hardened attack surfaces. This means fewer exposures anywhere an attacker might land. Third, detection of all threats. No blind spots, no noise, even against the latest AI-powered threats. Next, faster investigations and remediations because resilience comes from action, not just alerts. And then lastly, less administrative overhead because security tools should simplify your lives, not complicate them. This is the modern mandate. Fewer tools, faster action, stronger outcomes. So to achieve these outcomes, we've revamped the Singularity platform. It now consists of 7 integrated layers. First, our core platform. This is our new and improved auto scaling cloud-native architecture deployed in 10 regions worldwide, including our latest region launching next month in the Kingdom of Saudi Arabia. The reliability, scalability and resilience of our platform is job 0. And this is something that we're continuously focusing on and improving. The next layer, our data platform. This is petabyte scale search and performance, now powered by Obsero AI for intelligent log collection against any data source. Getting data in now takes hours, not weeks. And the Singularity graph automatically correlates this data for graph visualizations and analytics. On top of this, we have our detection platform, 10 different AI-powered detection engines and now nearly 2,000 out-of-the-box detection rules that chew on those logs going into our data lake. We're also now producing new detection logic with unprecedented speed and precision by using Agentic AI internally by our detection engineering teams. Next up, we have our analyst platform. This is our new singular operations center experience. This is the default experience for all new customers. It brings together unified asset inventory, unified alerts, unified exposures, plus modern dashboards and reporting to make triage and investigation easier. Next up, our attack surface protection products. This includes our core products around endpoint security, identity security, cloud security, plus our new prompt security suite for AI workload protection. At the very top here, we have our AI and automation tools. At the core of our platform's AI strategy are Purple AI and hyperautomation, working together to turn intent into instant action. The vision you saw here, which you actually saw both in Tomer's talk and in the innovation talk with Heather and Rachel is that Purple AI reasons, plans and acts autonomously, while hyperautomation deterministically executes response actions at machine speed. This allows defenders to focus more on strategy instead of just tax. Lastly, on the side here, we have our revamped Wayfinder managed threat detection and response services launching today. You heard about that a bit this morning. We're going to go in more detail in just a bit. But the key here is that we're merging human intelligence with artificial intelligence to more effectively find people. This platform, these 7 integrated layers is what let us outpace even AI-powered adversaries. It's an integrated platform that's learning its fast as adversaries evolve. Okay. Let's s out now. From AI-driven malware to AI-targeted attacks, there's one truth, speed and autonomy now define cybersecurity. And the Singularity platform is built on a philosophy that turns that truth into action. You can think about this philosophy as 3 concentric circles. First, at the outer ring, we will protect every attack surface, endpoint, identity, cloud and now AI. In the middle ring, we will use AI, data and automation to act faster and smarter. At the center, we have people. This is human expertise, yours, ours, our entire community of defenders because AI cannot win this battle alone. It must be guided by the wisdom of humans. We'll use these guideposts throughout the product talks today, so keep them in mind. So that's the story from evolving threats to outcomes matter that matter to the platform and philosophy built to deliver against those outcomes. The same forces transforming our attackers are also transforming cyber defense. And SentinelOne is leading that AI defense transformation. We're not just reacting to the age of AI. We're defining how to defend within it with the #1 platform for autonomous security. Lastly, before I move on, I think you'll hear thank you a lot throughout the day today. But I want to give my personal thank you to our customers. Your partnership and trust is what makes SentinelOne what it is. You don't just use our platform, you shape it and now I'm going to hand off to my very talented [ TAM ] leaders to walk you thorough the details that how we can defeat adversaries together.