SentinelOne, Inc. ($S)

Hello, and welcome to the SentinelOne Q4 FY 2026 Earnings Conference Call. [Operator Instructions] Also, as a reminder, this conference is being recorded today. If you have any objections, please disconnect at this time. I will now turn the call over to Saad Nazir, Head of Investor Relations.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the fiscal year ended January 31, 2026. With us today are Tomer Weingarten, CEO; and Barry Padgett, Interim CFO. Our press release and an earnings presentation were issued earlier today and are posted on the Investor Relations section of our website. This call and accompanying slides are being broadcast live via webcast, and a replay will be available on our website after the call. Before we begin, I would like to remind you that during today's call, we'll be making forward-looking statements about financial performance and future events, including our guidance for the fiscal first quarter and full fiscal year 2027 as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual results or events could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our quarterly reports on Form 10-Q and our annual report on Form 10-K. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons why actual results may differ materially from those anticipated even if new information becomes available in the future. During this call, we will discuss non-GAAP financial measures, and all comparisons made are year-over-year unless otherwise noted. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our earnings presentation. These non-GAAP measures are not intended to be a substitute for our GAAP results. Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges, gains on strategic investments, impacts of the previously announced ITA tax settlement and income tax provision, which cannot be determined at this time and are therefore not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fourth quarter earnings call. Fiscal '26 was a landmark year for SentinelOne. We achieved $1 billion revenue scale, growing 22% year-over-year and delivered full year operating profitability, a significant milestone towards profitable growth. In Q4, our total ARR grew 22%, driven by strong new logo acquisition and expansion with existing customers. We delivered $64 million net new ARR in Q4, a company record. This marks our third consecutive quarter exceeding ARR expectations, showing execution consistency and positive growth. We drove about half of our new business through new logos, showing a balanced split between new logo acquisition and expansion within our existing customer base. We're gaining traction in the most critical domains of cybersecurity, both AI for security and security for AI. We're helping organizations advance their digital transformations securely and intelligently. SentinelOne offers the only cybersecurity platform that delivers the unifications truly. AI represents a significant TAM expansion and a long-term tailwind for our business. From early on, AI native security has been foundational to our platform architecture. This early advantage positions us to emerge as the category winner in the AI era across more than $100 billion market opportunity. We've established SentinelOne as a clear technology leader in cybersecurity. Our relentless focus on delivering AI-powered innovations that truly unify security, data and automation has positioned us at the forefront of the industry. As we enter the new fiscal year, we're accelerating our path towards achieving the Rule of 40, driven by durable growth and higher profitability. Now let's dive deeper into the details of our quarterly performance. We are winning new logos and expanding our footprint across diverse platform categories. Enterprises are choosing the Singularity platform for unified AI-native security that provides a single pane of glass and seamless workflow. We firmly believe that cybersecurity shouldn't be complicated. Beyond the Singularity platform's best-in-class efficacy, its intuitive design and operational simplicity are driving stronger customer adoption. Today, our unified platform spans 7 core solution categories, delivering more than 40 different modules designed to solve the most complex use cases, all while providing end-to-end autonomous cybersecurity. In fiscal '26, our non-endpoint solutions surpassed half of our total annual bookings, a clear testament to the diversity and customer outcomes of the Singularity platform. Customers are increasingly consolidating on our platform. In fiscal '26, the percentage of our enterprise customers using 3 or more solutions increased to 65% versus 39% a year ago. Enterprises using 4 or more solutions more than doubled to 42% versus 19% a year ago and enterprises using 5 or more solutions increased to 22% versus 9% a year ago. And for many of the enterprise logos we're adding, this is just the beginning of a long-term expansion journey. In Q4, our cross-platform adoption drove a record ARR per customer, signifying solid momentum and contributions from our AI, data, cloud, Wayfinder and endpoint solutions. Customers of all sizes, especially large enterprises, are increasingly recognizing Singularity's architectural advantage. Our Q4 performance clearly demonstrates this momentum. We drove sequentially higher win rates across every market segment, anchored by accelerating gains in the enterprise. Let's look at an enterprise win that exemplifies this. Internet Security giant Cloudflare, the company securing about 40% of all human-originated Internet traffic moved to SentinelOne in less than 24 hours, completely uninterrupted. After a rigorous POC, they selected SentinelOne to replace our closest competitor as their security platform of choice, citing our superior technology and ease of use as the deciding factors. This 7-figure deal included endpoint security, Purple and our Wayfinder Elite services. This is a clear testament to our technological edge and the platform value we deliver. Next, looking at our key growth drivers, Purple is becoming the bedrock of modern security operations, empowering teams to respond faster, accelerate detection and automate investigations. The trajectory of Purple adoption continues to outpace our internal expectations, hitting a record attach rate of over 50% on licenses sold in Q4. According to IDC's independent study, Purple user experienced 55% faster threat remediation, 60% lower likelihood of major incidents and an impressive 338% return on investment over just 3 years. We're seeing strong Purple uptake across both new logos and existing customers. Many of our Purple AI customers are expanding their usage, signifying future growth potential and the value it delivers. For AI security, we are benefiting from the accelerating enterprise demand for secure adoption of AI models, agentic workflows and employee AI usage. In Q4, ARR from Prompt Security more than doubled sequentially. In addition to existing customer upsells, we started winning stand-alone AI security deals with Fortune 500 companies. Moreover, we are beginning to win AI security deals from customers of our direct competitors, creating a new strategic entry point to expand our market share and footprint. There are no serious scalable alternatives to Prompt Security in the market and customers need to adopt AI now. For example, in the past quarter, a Fortune 100 financial services company deployed nearly 100,000 licenses for AI security and governance. Prompt is helping solve complex AI governance and compliance challenges for customers across our industry. In another example, a multinational retail giant deployed Prompt Security to eliminate a visibility black hole surrounding unmonitored employee AI usage. They chose SentinelOne for quick deployment, visibility and real-time AI security, all while satisfying strict European GDPR requirement. We also launched Claw Security, the industry's first open source security suite to secure emerging autonomous agents like OpenClaw and others. For data solutions, we surpassed $130 million in ARR with growth accelerating sequentially. We are seeing rising demand for our AI SIEM as it delivers deeper visibility, real-time detection and autonomous response, all with far more efficient unit economics than legacy alternative. In Q4, we also launched our new AI native data security posture management solution, or DSPM, to help customers secure their data and AI workloads. Furthermore, through Observo AI, we now own the data pipeline that powers modern security operations. The market is clearly recognizing this value. We were just named SIEM Innovation of the Year in the Cybersecurity Breakthrough Awards. We have now fully integrated Observo AI's data pipeline solution into the Singularity platform. This creates a truly comprehensive data architecture, natively unifying petabyte-scale ingestion, data pipeline, orchestration and hyperautomation into a single seamless experience. For data solutions, we signed a multiyear infrastructure partnership with a global hyperscaler. As part of our expanding alliance, SentinelOne's threat intelligence data now pairs with this company's native threat intelligence services. This shared telemetry model powers our own joint offerings and establishes a highly strategic growth vector for our data business. In addition to taking share from legacy incumbents, our platform is now beginning to serve as the foundational data layer for the world's largest technology innovators. For cloud security, we are seeing strong expansion, especially with our best-of-breed runtime workload capabilities, covering both on-prem and cloud environments. In Q4, our cloud security solution surpassed $160 million in ARR. As cloud environments expand and AI workloads multiply, the need for robust security is increasing. We are meeting this demand by delivering comprehensive cloud-native detection and response that scales with our customers' infrastructure, simplifying their operations and elevating defenses with our unified platform. For endpoint, we achieved double-digit ARR growth in Q4. We continue to outgrow the broader market by delivering the most autonomous endpoint security solution available, combining industry-leading efficacy, performance and user experience. Nearly half of the existing endpoint sector is still using legacy antivirus solutions. We see this as a clear opportunity for continued market share gains. Our leadership in AI native security is attracting the most advanced technology innovators in the world. In Q4, one of the top frontier labs selected the Singularity platform to secure its mission-critical infrastructure and the development of its flagship models. This win underscores that the architects of the AI frontier recognize SentinelOne as the definitive security layer for the future of intelligence. In the era of AI, securing of highly restricted on-premise environments where true sovereignty is of paramount importance are becoming one of the most strategic growth opportunities. While our competitors have no ability to secure these environments, we saw triple-digit booking growth in the quarter, signifying an emerging growth avenue for us. We have the distinct advantage of delivering fully autonomous high-velocity AI protection, both in the cloud and on-premise. This differentiation was clear in our recent win with one of the largest postal operators globally. The customer signed a 5-year commitment to secure their vast network with SentinelOne. Our ability to deliver specialized on-premise security at scale while meeting the most rigorous government standards was the deciding factor. In addition, we are seeing strong enterprise interest in Wayfinder Threat Services, which crossed $100 million in ARR in Q4. As enterprises race to adopt generative AI, they often lack the blueprint to do so safely. Wayfinder fills that gap by serving as both an implementation arm and a managed supervision layer for AI cybersecurity. Our Wayfinder AI augmented services deliver immediate time to value by deploying in under 15 minutes and resolving 99% of threats without any customer action required. Trust is a big factor. We believe that expert human oversight is the way forward to build customer trust when adopting new autonomous technologies. Wayfinder embodies this vision by pairing our AI native platform with elite AI security experts. As expected, SentinelOne Flex is proving to be a highly effective model for broader platform adoption. By simplifying the purchasing process, Flex is driving larger deal sizes, multi-solution deployments and extended commitments. Flex simplifies the path for large-scale platform adoption and secures long-term high-value partnerships. For a platform consolidation win, we secured an 8-figure TCV deal with an iconic global logistics company that standardized on the Singularity platform for unified AI security. To protect their highly distributed and critical infrastructure, this enterprise consolidated multiple competing vendors on the Singularity platform. SentinelOne was the clear choice to modernize their operations and securely implement AI. Alongside industry-leading efficacy, Singularity platform's intuitive design, unified interface and ease of use are key differentiators that are driving strong platform adoption. We're delivering the only single-plane platform on the market capable of being deployed anywhere, which stands in stark contrast to our next-gen peers. Large enterprises, especially leading innovators are recognizing this, in many cases, securing millions of assets in a single deployment. Our continued upmarket trajectory is driving larger deal sizes and steady retention rates. Lending these premier enterprise logos at scale provides us with a significant, highly durable runway to drive strong growth for years to come. Today, we proudly secure nearly 1/5 of the Fortune 500 and hundreds of Global 2000 enterprises. Our expanding customer base now includes some of the most sophisticated and iconic companies on the planet alongside highly regulated mission-critical infrastructure. From the pioneers building today's frontier AI models to the global category leaders in semiconductors, automotive, aviation, finance and smartphone giants the world relies on. In the partner ecosystem, we continue to expand and deepen our engagements. Our partners are a force multiplier, helping expand our reach and scale. We are seeing strong traction driven by increasing platform adoption across AI, data, cloud and broader platform solutions. We are increasingly winning at the top end of the market, highlighted by an 8-figure strategic partner win in Q4. This deal provides access to our entire Singularity platform through a flexible deployment schedule. In addition, we are strategically scaling our mid-market adoption by driving operational leverage for our partners. Our success across the managed security ecosystem is a clear testament to this strategy. In fiscal '26, we achieved over 60% ACV growth with our top 20 MSSP partners and over 75% ACV growth with our top 10 MSSP partners. These partners are rapidly expanding beyond the endpoint. They're adopting our AI, data, cloud and broader platform solutions. Our MSSP partners are standardizing on SentinelOne. Our unique platform architecture delivers the multi-tenancy and remote management capabilities that drive real operational leverage and technology differentiation. This technology advantage translates directly into a dominant competitive position for SentinelOne in the managed security ecosystem. We're also deepening collaboration with hyperscalers by integrating our technology and platform across their cloud marketplaces and AI services. Together, these alliances are enhancing our market presence and positioning SentinelOne as a trusted partner for enterprises worldwide. In the public sector, we achieved GovRAMP authorization at the high impact level, and this opens more public sector opportunities for us in both federal and SLED environments. Let's shift gears to the broader industry dynamics and why SentinelOne is a distinguished beneficiary for the AI era. There has been a lot of debate about the impact of AI on traditional SaaS business models. While some of these concerns are justified, especially if you're selling an antiquated platform built upon a legacy code base, modern security operations remain mission-critical. Cybersecurity is an imperative for safe adoption and usage of AI. It is a significant tailwind for SentinelOne, and we're already seeing AI security as the fastest growth category for us today. We are the builders enabling secure AI adoption for builders. Our enterprise success clearly validates this. Our platform and AI models are forged from real-time proprietary threat intelligence data at petabyte scale that is gathered across tens of thousands of organizations and tens of millions of assets globally. That scale, intellectual property and depth of data, combined with human insights are a unique competitive moat. The reality is that cybersecurity is paramount in the age of AI. The market needs reflect this reality. Gartner recently highlighted that AI security is the fastest-growing segment in cybersecurity, expanding over 70%. Security and trust remain the single biggest barrier to enterprise AI adoption in the United States and globally. At SentinelOne, we're helping organizations to move from basic AI assistance to true autonomous agentic action with trust and safety embedded as our guiding principles. We are putting defenders firmly in control of the AI boom, delivering the platform tools, strategies and services they need to build, secure and benefit from AI. We are delivering an end-to-end AI native platform that seamlessly delivers security for data, infrastructure and run time as a single unified system. We actively partner with, invest in and protect the pioneers building today's frontier AI models. Grounded in this ecosystem, we are pushing into the frontier of autonomous agentic security. where AI doesn't only assist humans but also independently detects and stops complex threats in real time. Reflecting upon the past year, we've delivered strong growth and margin improvement while driving innovations that are shaping the future of cybersecurity. With an increasing scale and durable top line growth, we're continuously refining our operating model to be well positioned for the opportunities ahead. We remain laser-focused on our most efficient go-to-market channels while unlocking structural productivity gains by integrating AI throughout our business. We have always operated with a builder mindset. Looking ahead, we're establishing a stronger SentinelOne that is well positioned to lead in an AI-first security landscape while creating long-term value for our customers, partners and shareholders. Before I turn the call over to Barry, I'm pleased to welcome Sonalee Parekh to our leadership team. Sonalee is joining SentinelOne as our new Chief Financial Officer. She brings more than 25 years of experience across public software and technology companies. Sonalee has proven track record of scaling high-growth software platforms, driving financial discipline and overseeing multiproduct strategies. That's an ideal fit to lead the next phase of SentinelOne's financial strategy, delivering growth and profitability. I look forward to our partnership. I would also like to thank Barry for his leadership and steady hand as interim CFO. He has been a trusted partner, ensuring a seamless transition and leading our finance function. In closing, I want to take a moment to acknowledge the contributions of all Sentinels. The relentless focus, dedication and execution drives our success. And thanks to all our customers, partners and shareholders for their continued support. Our mission to be a force for good remains as important as ever in ensuring AI is also a force for good. Thank you again for joining us today. With that, I'll hand it over to our Interim CFO, Barry Padgett.

Thank you, Tomer, and thanks, everyone, for joining us today. Let's review the details for Q4, the full fiscal year '26 and our guidance for Q1 and fiscal year '27. As a reminder, all comparisons are year-over-year and financial measures discussed here are non-GAAP unless otherwise noted. Fiscal year '26 was a transformational year for SentinelOne, highlighted by 2 major financial milestones. Firstly, we scaled the business past $1 billion in revenue, growing 22% year-over-year. Secondly, we achieved full year operating profitability, driving a 600-plus basis point year-over-year improvement to expand our operating margin to 3.5%. Let's review the financial performance of our fourth quarter. In Q4, our revenue grew 20% year-over-year to $271 million. International markets grew 30% and represented 40% of total revenue, reflecting strong international demand and a growing global footprint. In Q4, our total ARR grew 22%, and we added a record $64 million in net new ARR, which exceeded our expectations. These results were driven by a balanced split between new logo acquisition and platform adoption by existing customers. As we continue our strategic shift upmarket, our ARR per customer reached a new company record. We are seeing strong momentum at the top end of the market as our cohort of customers with ARR of $1 million or more grew 20% year-over-year to 153 customers in Q4. Additionally, customers with ARR of $100,000 or more grew 18% to 1,667. Furthermore, retention rates across our large customers remained strong, underscoring the mission-critical nature of the Singularity platform. For customers with $100,000 or more in ARR, our gross retention rate was 96% in Q4. Our dollar-based net retention rate for these customers was 109%, driven by these large organizations continuing to adopt the broader platform and consuming multiple products from us. Overall, we are maintaining a balanced split between new logo acquisition and existing customer expansion. Given our scale and relative market share, this focus allows us to increase our market share with significant future expansion potential. Turning to margins. We maintained a solid gross margin profile in Q4 at 78%, highlighting healthy platform unit economics and scale efficiencies. In Q4, our operating margin was 6%, representing an improvement of 450 basis points year-over-year. We also achieved a net income margin of 9% in the quarter. On a trailing 12-month basis, we delivered a free cash flow margin of 5% and successfully delivered our second full year of positive free cash flow. This is an important milestone that underscores our path towards sustained profitable growth. We ended the year with a robust balance sheet, including $770 million in cash, cash equivalents and investments and most importantly, no debt. Given our strong balance sheet and confidence in our long-term trajectory, we opportunistically repurchased 6.5 million shares this quarter, bringing the total shares repurchased to $12.2 million in fiscal year '26. We will continue to employ a balanced capital allocation strategy, prioritizing organic investments while returning capital to shareholders. Turning to our guidance for Q1 and fiscal year '27. As we enter our next chapter of scale and profitability, we are enhancing our guidance framework. In addition to our revenue and operating income outlook, we are providing guidance for earnings per share and some helpful modeling assumptions. We believe this enhanced framework offers a more comprehensive view of the company's earnings growth and cash generation. For the full fiscal year '27, we expect revenue to be between $1.195 billion and $1.205 billion, representing 20% year-over-year growth at the midpoint. For Q1, we expect revenue to be between $276 million and $278 million, representing 21% year-over-year growth at the midpoint. Our fiscal year ' 27 revenue outlook also implies a year-over-year improvement in net new ARR. Overall, our outlook is supported by a solid pipeline, strategic partnership opportunities and rising contributions from our emerging solutions, including AI, data, cloud, Wayfinder and others. At the same time, we continue to monitor the evolving macroeconomic environment and geopolitical uncertainties, which can still influence deal timing and sales cycles across the industry. Turning to our profitability metrics. For fiscal '27, we expect operating income to be between $110 million and $120 million, representing an operating margin of 10% at the midpoint. For Q1, we expect operating income to be between $4 million and $6 million, representing an operating margin of 2% at the midpoint. Our strong operating income outlook is driven by increasing operational efficiencies with scale and with cost discipline. We're accelerating toward the Rule of 40, mainly led by sustained top line growth and improving profitability. For full fiscal year '27, we expect fully diluted earnings per share to be between $0.32 and $0.38 per share, representing $0.35 at the midpoint. And for Q1, we expect earnings per share to be between $0.01 and $0.02. We expect a non-GAAP tax rate of approximately 17% for fiscal year '27. We expect our weighted average diluted share count to be approximately 345 million for Q1 and 352 million for the full year. Adjusting for the scheduled tax settlement payments of $40 million for fiscal year '27 disclosed in our January 8-K, we expect our adjusted full year free cash flow margin to closely track our operating margin outlook for fiscal '27. For Q1, we expect adjusted free cash flow margins to be in the low teens, reflecting our standard historical seasonality and strong underlying cash generation. Taking a step back, our technology leadership and competitive position remains strong. We are scaling the business while consistently driving strong operating leverage. Our investment approach strikes a disciplined balance between capturing long-term growth opportunities and maintaining a responsible, profitable financial profile. This strategy is foundational to scaling SentinelOne into a multibillion-dollar, highly profitable business. Before closing, I'd like to welcome Sonalee as our new CFO. Her expertise scaling global businesses is a great fit for us. Over the coming weeks, I'll be working closely with Sonalee and our seasoned finance team to ensure a seamless handoff. In summary, we are very well positioned at the intersection of AI, data and cybersecurity, leading the industry into the next era of autonomous security. Security is no longer just a safeguard. It is the strategic enabler of AI innovation. With a strong financial foundation, a highly differentiated platform and a vast market opportunity, we remain firmly committed to maximizing our business potential. Thank you all for joining us today. We'll now take your questions. Operator, please open up the line.

[Operator Instructions] Our first question comes from Brian Essex at JPMorgan.

Maybe for Tomer, I would love to understand some of the dynamics around the growth that you've had this quarter, particularly in light of the lower sales and marketing growth. What percentage of the deals were partner-led or partner influenced? And what are the plans for hiring and expectations for productivity as we kind of move through fiscal '27?

Thanks for the question, Brian. We delivered record fourth quarter net new ARR, 6% year-over-year growth and strong and probably the strongest sequential growth we've had in the last 24 months. It really demonstrates more than anything, execution consistency and solid demand pretty much across the board. I'd say that there wasn't any big change between our business with partners and our business with end customers. We are doing larger deals, and I think that's probably reflected. Flex is taking, I think, a more pronounced part of our overall bookings. So all in all, I would say the dynamic is one that we've seen throughout the quarters and throughout the year. As we look into next year, when we kind of review how we want to focus, I think we're pretty clear that we're on a quest to optimize. So I don't think you're going to see us grow headcount in a significant way. And it will imply that sales productivity, which is reflected in the margin guide, is going to get better. And we are clear on our continued upmarket trajectory. We are clear on the need and the desire to do more with our partner base. We are clear about the potential in our partner base. You can see some of the figures with our growth with MSSP partners, top 10 partners growing 75% year-over-year. Obviously, there's a lot of potential both in our partner base and with our move to upmarket. So all in all, we plan to do much of the same this year in an improved manner with an optimized sales force.

Our next question comes from John DiFucci at Guggenheim.

Since Brian asked about the top line, I'm going to ask about the bottom line. It's just a little confusing like this quarter and in the first quarter, profit margins are a little lower than I think people were looking for, at least we were. But for the year, they look great. So if you guys can explain that a little bit, maybe, Barry, again, just so we understand what's happening in the model.

Yes, John. On the free cash flow side, we feel pretty comfortable on the cash collection. We've seen a meaningful improvement over the past few years. That being said, that can be a little lumpy just in terms of larger deals and kind of when they fall into a particular quarter. And as they -- those larger deals kind of roll out maybe over months and quarters as opposed to days like smaller deals.

Our next question comes from Meta Marshall at Morgan Stanley.

Great. I guess I just wanted to ask, clearly, a lot of success selling with the 65% of customers having 3 or more solutions. Just how do you -- kind of in combination with maybe NRR ticking down a hair, just how are you thinking about just ability to continue to add new or get further adoption of new products into the base?

Absolutely. We definitely think that this is a source for additional growth for us. We're very stable on the NRR front. I think the -- the biggest thing I would call out there is that, that actually for us means that we're doing more new logo business, which is exactly what we want to see. And we've kind of executed that strategy for the last few years. It's not going to change this year. So we're really driving those in tandem. And what you can see is that not only we're creating more and more adoption within our customer base, even with that, our customer base is still relatively underpenetrated. We got tremendous capabilities. Our platform is incredibly broad. And that just means that for a lot of the new logos that we're just starting the journey with, the expansion opportunity is really in the future, which is great, which really means that we can continue and onboard new customers. And then with time, we yield more and more from the customer base. That's exactly the dynamic we want to see. That's exactly what's reflected in these results.

Our next question comes from Brad Zelnick at Deutsche Bank.

This is Nasr Islam on for Brad Zelnick. So we've heard from you, Tomer, and your peers in recent quarters of the importance of endpoint security, especially in the GenAI era. Can you provide an update on how endpoint progressed in the quarter and any changes in the competitive landscape that you're seeing, if any?

Of course. Endpoint still remains a strong growth driver for us. We grew double digit, and that is nontrivial in the market today. We're still gaining share in endpoint, and there's still a lot to go after in terms of incumbent providers. It's clear that the best control point right now for GenAI is actually attached to those same endpoints. So when you look at us selling AI security, I think the success we're seeing there is pretty much tied to our ability to deploy that within minutes sometimes on those exact same endpoints, whether our agent is already there or not, our ability to continue and expand our endpoint footprint is what makes our AI security product incredibly successful. So all in all, not only you're gaining the best and the most complete telemetry from the endpoint today, it's also becoming probably one of the only true control points to regulate what employees, what the workforce is doing with generative AI, block it, sanitize it, make sure there's no data leakage, put the right guardrails, and that's exactly what we're doing with our AI security platform and with Prompt Security specifically.

Our next question comes from Shrenik Kothari at Baird.

So Tomer, you brought in Sonalee. As she steps in, what are the top 2 to 3 priorities you are explicitly asked her to or will ask her to focus on first? And then just related to kind of financially, how should investors think about the next phase of the model under her?

Of course. Thank you for the question. I think clearly, we're incredibly excited to have Sonalee. And her focus is going to be durable growth and acceleration in our go-to-market. I think what we're seeing right now is, I would say, growing demand for our platform with multiple avenues for growth. We've talked about AI security that's growing triple digit. We've talked about on-premise, which is a new avenue for growth for us, now growing triple digit as well and infrastructure deals that are also growing triple digits. So obviously, her job is going to be to balance that with continuing and improving and honing in on our entire go-to-market and sales and marketing expense. There is no surprise here that as we look into next year and the coming year, the landscape is changing in terms of what customers are looking for. And it's very clear that we have some of the most unique solutions right now for some of the most urgent problems in the market. So as we look at this year, it's a lot about realigning a lot of our resources to go after these opportunities as we improve our business. You can see some of that already reflected in operating margin. This is the trajectory we're on. We're accelerating our path to even better profitability. We're optimizing on cash flow. I think these are the things that we will collectively be focused on.

Our next question comes from Patrick Colville at Scotiabank.

And Tomer, let me ask this one to you. I mean, nice reacceleration in new ARR this quarter. You kind of gave us a little breadcrumb that you're expecting a year-on-year improvement in new ARR in fiscal '27. So I guess 2 parts, if I may. One is, can you just unpack that last bit a little bit more to provide any more color? And then the -- what would be the driver of that? Is it kind of core endpoint to your point earlier that there's like this renaissance spend on endpoint? Or is it that plus these emerging products and the kind of multiple tailwinds coming together in fiscal '27?

Yes. Let me try and unpack that. And I think that obviously, that's exactly what we want to see. We want to improve net new ARR. You've seen a little bit of that in Q4, but I think that's what we're looking at for this coming year. I think on top of that, we're also starting to see a seasonality change. We're really -- we're moving from this 40-60 first half, second half dynamic we've had in the past couple of years, more to roughly kind of 50-50. So that obviously means that the first half of the year is very solid. And obviously, that has positive impact on growth for the year for both revenue and ARR. So these are some of the dynamics that we're seeing there. Some of it is coming from endpoint. I wouldn't call it a full renaissance, to be honest, but there is definitely more traction in endpoint. I think if you're seeing some of our businesses kind of crossing the $100 million ARR mark and still accelerating in a pretty significant way, those are kind of our sources of added revenue growth and added ARR growth. So all in all, we believe that an improved net new ARR, that's kind of a good starting point for us is our revenue guide.

Our next question comes from Richard Poland at Wells Fargo.

I guess just on the gross margin side, I've noticed that gross margin ticked down a little bit in the quarter, but I think it was maybe a touch better than expectations. As we look forward to next year, could we see that start to stabilize or tick up? Or just kind of anything underlying there that we should think about?

Yes, of course. I would say our gross margins are incredibly stable. They're also best in the industry, so they're incredibly high. We kind of put it exactly at the high end of our range of our long-term targets. So all in all, we feel like they're stable. They're going to continue to be stable. We don't forecast any change in that.

Our next question comes from Mike Cikos at Needham.

Tomer, if I could come back to the prepared comments in the opening script, great to hear about the 7-figure deal over at Cloudflare displacing your next closest competitor. Can you just discuss that a little bit more as far as how Cloudflare came to you, how the deal came together, again, just given their positioning in the software ecosystem, they're thought of as being pretty market-leading. And I'd just love to get some more color there.

Of course. It's a combination of, obviously, the set of capabilities that we have today that through the prepared remarks, I think we've tried really outlining how unique the capabilities that we have today are, especially at scale. So when customers are looking to add and prepare themselves for adopting more generative AI, more AI agents, the most advanced ones really need these capabilities now. They can't buy over a demo. They can't buy over something on the road map. They need something tangible that works today and works at scale and is proven. And that's exactly what Prompt Security and Purple AI brings to bear. These are already fully deployed, fully scalable products that are covering right now millions of devices, assets globally. So that drives, I think, a lot of demand from customers of all competitors. And in the case of Cloudflare, I think efficacy was a big deal, the ease of deployment, coverage for systems of all operating systems, these were some of the key things that they wanted to find. I think they also wanted a like-minded partner that can move fast with them in AI. And again, as you pointed, despite them being a leading partner for some of our competitors, they've chosen the best technology that they could. And doing this at a scale where you need to be completely flawless in your transition to create no interruption. I think that was also a very impressive feat by both teams. And I think that kind of just punctuates the win.

Our next question comes from Shaul Eyal at TD Cowen.

Tomer or Barry, can you talk to us about the sources of operating leverage and margin for fiscal '27 as we think about double digit for the year?

Sure. Happy to share here. A couple of things I think that we're super focused on. Firstly, really sharpening the focus on the highest-yielding go-to-market opportunities. So you heard Tomer talk about some of the product lines and some of the businesses that are rapidly growing for us, some of them in the triple digits, making sure that we really are investing behind those and giving them the oxygen they need. And then secondly, not necessarily germane just to us, but integrating AI throughout our business and our business operations, and we're seeing meaningful productivity gains across the board, everything from engineering and development to how we serve customers to how we just run the internal organism itself.

Yes. I would just add to that. You've seen us through the past couple of years also taking pretty hard decisions on what not to invest in and what to potentially deprecate and prune away. I think these are decisions we're going to continue to make. You've seen us do that with a couple of product lines last year. We don't expect the exact same thing this year, but we are definitely honing in on more areas that we just see higher yield. So I think it's not going to be farfetched to see us kind of narrowing our focus, at least in go-to-market on the most -- not only the most yielding, but the most important parts of our platform and what's the most important right now for customers. So all in all, we have not grown our headcount. We have not inflated our ranks in the past couple of years. That's definitely not going to happen this year. We're definitely finding more and more ways to become more productive with AI. It's already happening. A meaningful amount of the code we generate today is already generated with AI. That has tremendous impact on us. We're a big R&D shop. We're a big innovation hub. That means that we can build more with less, that we can take products to market faster, that we can iterate and get better outcomes to customers. All of those are going to help us also drive, I think, just benefits to the bottom line as well.

Our next question comes from Roger Boyd at UBS.

Tomer, it looked like it was a pretty strong quarter overall for new customer acquisition. You noted, I think, half of new business came from new customers. And against that, you had 50% attach rate of Purple. I guess any kind of directional color on what that attach rate looks like with new customers? And to what extent are you finding that Purple is maybe driving some of these new customer wins and really influencing your win rates in areas like endpoint?

Of course. First of all, it's pretty balanced. I mean we're seeing the uptake both from existing customers and new customers. I think we mentioned a couple of earnings calls ago that we've created a new bundle and we took our complete bundle and made it a complete AI bundle, basically adding in some of the Purple AI capability. That's definitely creating a nice differentiator for us kind of in the mass market. So that is driving some of that attach. But at the end of the day, I think it's really clear when you can create 60% faster outcomes, when you can have 300% plus return on investment, it becomes almost a no-brainer that if you're using one of these things, you're actually saving money and the economics are actually looking favorable for customers. And that, I think, is the main driver behind the Purple uptake. We're also, as I've said in the past, we're continuously adding more capabilities to the Purple suite. We're adding more and more agentic capabilities that are completely integrated to the platform. We don't require customers to buy another product or to deploy something else or to build their own agents or we just give them a studio. We're giving them complete integrated AI capabilities. They can turn on with one click of a button. And that in itself, that type of seamlessness, that user experience is resonating in the market.

Our next question comes from Joe Gallo at Jefferies.

It was great to see the $130 million in data ARR. Can you just talk through the sustainability of growth in that business? And then, Tomer, just regarding SIEM, how do you think that market evolves in an LLM-based world? Does it become more or less important? Is there any risk of disruption?

Thank you for the question. Our data business is going to go only one way, which is up, and that is terabytes and terabytes and petabytes of data that we're seeing down our pipeline. There is a very familiar dynamic in the data space where obviously, the initial land is just a piece of customers' overall data needs. And obviously, as they onboard our data lake, it's just the starting point for them into how much more they can put into it over the years. We're starting to see those expansion opportunities pop up. We're absolutely seeing more and more demand for our data lake capability. Specifically for SIEM, and I think there's a small nuance here, SIEM, you can think about it as a front end for security operations that you put on top of the data lake. And I would say that certain customers, they want still that front end, they want those capabilities. But at the same time, what we're seeing more and more is that when we apply some of our Purple suite agentic operations, directly on the data like, directly on the ingested data. Obviously, now with Observo integrated into it, the ability to now ingest data in real time and apply LLMs that are on the backbone of Purple AI to then orchestrate an autonomous operation to us, that's the future of where cybersecurity is going to go. And I'm saying the future, but it's also happening right now for certain customers. So I do think that it's really a question about what models are you going to support for customers. Some customers are going to want more controls, more dashboard, more of that legacy experience. I would call that the SIEM experience. And other customers, they're much more focused on automation, on embedding LLMs and embedding agentic workflows into their data ingestion as close as going to be to the point of ingestion. And that to us, again, is almost a new model for cybersecurity that maybe in the course of the next few years is going to make SIEM something that is less mandatory than it is today. But right now, we're obviously in the market with both approaches, and we're doing what customers are asking us to do.

Our next question comes from Eric Heath at KeyBanc.

Nice finish to the year. Maybe, Barry, Tomer, can you just speak to the linearity in the quarter that you saw, just given that the DSOs were a little bit higher than they have been and revenue being in line with your guidance?

Yes. I think the revenue beat for us, the entire year was kind of very, very kind of minimal beats, I would say. Q4 was a little bit more back-end loaded. I think you kind of see that as well reflected. As Barry mentioned, some of the collections kind of came a bit later than we wanted. I mean, but nothing too dramatic. I think that's the full extent of the dynamic that we've seen. Otherwise, I think the other thing, obviously, when you're not getting these collections in time, they're just going to show up a bit later. So we expect for something a bit more healthy maybe in Q2. And I think, again, I've called out the kind of changing seasonality for us. So that's another dynamic that's going to be at play, probably going to look a bit different for us this year in a very positive way, I should say. So these, I think, kind of the dynamics that we're seeing.

Our next question comes from Adam Tindle at Raymond James.

Okay. I just wanted to continue on that last comment there, Tomer, on net new ARR and seasonality. I think you said earlier 50-50 for first half, second half. And if I'm doing the math right for the full year, you're probably going to be somewhere in the neighborhood of $200 million of net new ARR. Correct me if I'm wrong there. But I think that would imply $100-ish million or so in the first half, which would be very strong, I think, up over 20%. I know it's important with Sonalee coming on and under prior CFOs, we had kind of early stumbles in terms of relative to expectations and numbers and just wanting to avoid that. You talked on the call about gaining credibility, which you're certainly doing as you're executing. So I wanted to give this a forum to kind of flesh out those net new ARR comments so we don't get too far ahead of ourselves for the first half as Sonalee comes on.

Of course. Good questions overall. I would say, first, I think you're not wrong on the net ARR number, probably a slight improvement over that. And I think the seasonality is just what we have line of sight to right now and just a very solid start for the year. Once we kind of are able to transact earlier in the year, I mean, you can just do the math of what that means for the rest of the year. And that's really what we're seeing. That's really what's happening. So we're just calling it out. And as I mentioned, just a good starting point for us. So we're starting to maintain that consistency. And I think that should persist. We don't see a reason why it's not.

Our next question comes from Jonathan Ho at William Blair.

I wanted to maybe dig a little bit into Wayfinder. And could you maybe give us a sense of what some of these enhancements like human plus AI capabilities at Intel, how does that allow you to maybe reimagine modern MDR solutions?

Thank you. Great question. And I think that's exactly it. I mean it's really clear that the role of MDR is shifting. If MDR in the past years was really manual human work to sift through alerts with the increased automation and autonomous action of our platform, our MDR analysts and overall service is graduating to be more of a supervision layer. And that's helping us, I think, not only scale, but also achieve much better outcomes for customers. And I think more than anything, it's really clear that we all need to still establish a level of trust when we talk about autonomous agents. Obviously, the margin of error is quite big with some of what these autonomous agents are doing. So for us, a good way to control that and a good way to make sure that agents always stay within their guardrails that all autonomous action and critical action is always happening with human supervision, is attaching services like Wayfinder to really monitor these agentic actions that are happening, and we're doing so in a highly scalable way. And once again, that's something that really resonates with customers. Right now, with us, they can actually onboard agentic workflows and have humans regulate that. And that's a big thing. We're not just offering them a piece of technology. We're offering them complete managed supervision of their security stack.

Our next question comes from Ittai Kidron at Oppenheimer & Co.

A couple for me, maybe one for you, Tomer, one for you, Barry. Tomer, on your side. Can you -- clearly, you have a very broad portfolio at this point, and it's nice to see the traction there. Can you talk about how the comp plan for quotas for salespeople is changing because of that? And what are you incentivizing and how to get salespeople focused on the right thing? And then for you, Barry, with your initial guide for fiscal '27, again, kind of going back to the previous questions, in what way are you more conservative? Or in what way is your guidance philosophy right now for '27 different from the exercise you guys went through in '26?

Thank you for the questions. Comp plans haven't changed in a dramatic way. I just want to remind everybody that we always have this component that we call emerging products, and we're just changing what we put in that basket of emerging products. And we like the behavior that we're seeing. We also see some natural affinity to what customers are asking for, and we're making sure that we're aligning that basket of emerging products to reflect what is happening right now in the market and what we believe are the best products that obviously are the best fit to what customers are trying to solve right now. You're not going to be surprised that you find things there like AI security. You're not going to be surprised that data is still there. So obviously, that is a great tool for us, has been and will continue to be to just drive people in the right direction and in where the market is currently showing the most demand.

And I think just to your question on sort of guidance overall, I think this is the right starting point for the year. We're really comfortable with the guide. And if you look at the things that are supporting it, it's really a few things, solid pipeline, strategic partnership opportunities. We've been talking a lot about the rising contribution of our emerging solutions, AI, data, cloud, Wayfinder, others. So we feel like we're at the right spot.

We have no further questions at this time. I will turn the call back over to Tomer Weingarten for closing remarks.

Thank you all for joining us today, and talk to you next quarter.