SentinelOne, Inc. ($S)

Pleased to welcome. It's a stock I recently upgraded. So I'm always happy. Well, let's say the other way, it's awkward when I just downgraded and host companies. It's better to upgrade and then host companies. So I'm very happy to host Tomer and Sonalee to speak about SentinelOne. And I want to start before we do, like I do in any other session, I want to start with 30 seconds of our views. The space is great. When you think about cybersecurity and you think about endpoint as a domain, not as a solution, as a domain and where you can grow from an endpoint there are really only 2 companies at the high end of technology, and it's CrowdStrike and SentinelOne. And the difference is scale. But at the end of the day, what you're seeing today, what we've seen last quarter and that's the reason why we upgraded is because you see the signs of growth. You see that the company is translating all these efforts to go into new areas, into numbers. It's tangible now and margins are going to grow also. So this is why we thought the timing is right. And I took advantage of the fact that stock went down, and I said today is a great entry point because in my view, I hate to say I'm sure because I'm never sure. But in my view, as we progress through the year, you will see more growth and more margins. And at the end of the day, the space is good. If growth is accelerating and if margins are going up, that's the reason to buy stocks. So that kind of the introduction, I would like to give on SentinelOne. So, Tomer, thank you very much for joining us.

Absolutely, really appreciate the upgrade and the kindness.

Thank you. I want to step back and understand the drivers for growth. What are the areas that are successful? We've seen growth in multiple areas and multiple ways. Take the time to kind of take us through the story -- the growth story of the company. What are the areas you've invested in and you are currently seeing the progress? And what are the areas that you're still working on and focusing on?

Yes, yes. Look, I mean, AI, obviously, is something that is driving a ton of customer interest. And with AI, I think what's really interesting is that there is no good idea on how you adopt AI securely. And the customers are left with a myriad of different actions on how they can think about it. But the reality is that AI needs to run someplace. It needs a compute surface, which has an operating system and typically is either a device, something that you use or a workload in the cloud. In both of these situations, the only control in all of cybersecurity that is designed to produce visibility, enough visibility to see what AI is doing is these things that we call EDR solutions or endpoint protection solutions whether on the endpoint or in the cloud or on the workload. So in some way that I think none of us can claim to have predicted over the past decade. AI is driving complete tailwinds for endpoint security products, knowing that when you think about the new wave of agents that are going to be deployed in the enterprise, already being deployed in the enterprise you need something alongside these agents that verifies what they're doing in any given moment. That is not identity protection. That is not network security. And I'm not saying these are not needed, but they cover a very different facet of security. They allow for access management, but once an agent, authenticated identity security pretty much finished the job. And there's nothing else out there that can actually give you the view as to what is happening. How do you monitor it? And then where does that data go? Where does it go? And it goes into something that should serve as a real-time data lake, which is another capability that we've, I think, innovated into the market 3 years ago. So you're kind of seeing 2 of the most critical parts of our platform naturally be in just incredible demand today, and that is driving a lot of the pipeline, a lot of the growth that we're seeing. And on top of that, we also made an acquisition in the form of Prompt Security that is designed specifically to secure AI. So we are now sitting in 3 critical junctures all being driven by the massive influx in AI usage and all of those are providing for us for complete platform adoption because now you're not just talking about the endpoint security or the workload security aspect, but you're talking about a broad-based platform that you can consume whichever part you want in your AI journey. And the AI journey differs, the pace differs, what you're deploying differs. The type of Frontier AI that you're deploying is different, but the common theme is that you have to have broad-based security and visibility that starts with endpoint protection and workload protection or more broadly, runtime protection and then ends with data visibility and actioning all that stuff that you're seeing. So it's really a tremendous tailwind for all of cybersecurity. But I think more specifically and just given your intro, 4 vendors that can provide modern endpoint and workload security and there's 2 of those, as you mentioned. And we're just seeing, I think, a lot of pull from the market, from our customer base. Now it's incumbent upon us. So, of course, to deliver that and to make sure that the customers have the most streamlined way to procure these capabilities from us.

Another background question is the positioning of the company. So we have Microsoft offering endpoints, we have even Palo Alto with Cortex. We have CrowdStrike, of course, a direct competitor. How do you articulate the addressable market of SentinelOne? What is the niche or what is the area of the market you're going after?

I think, look, we've talked about the platform. And when we say platform, and that would probably be true for all 3 other vendors that you mentioned. And in total, there's 4 platforms in this market, it's us, and it's the folks that you mentioned. And you got endpoint security is one leg. You've got SIEM and data is another leg. You've got cloud, cloud workloads and such is the third leg, and the fourth leg is now becoming AI. So endpoint data, cloud, AI. That is the totality of a $100 billion market opportunity with no single winner in sight, that never happened in cybersecurity. It's not happening now in cybersecurity, and it will not happen in cybersecurity. So when we think about that broad-based opportunity, true platform is the only play that can actually capture it. And that's where you're seeing all 4 companies succeeding in different scales to your point. But that is the opportunity we're going after, much like the others. And our customer base is similar to all of the others. We secure 25%, almost 30% of Fortune 500s. People think we're an SMB company. No, we're also SMB company. Being an SMB company in this market, a mid-market company is not a disadvantage. The long tail of the $100 billion market sits with the mid-market. It doesn't sit with a Fortune 500 alone. So our ability to sell to every segment in the market is the strength. Our ability to give a fully self-served platform, that's intuitive to use, easy to deploy, doesn't require protracted services. That gives us a lot of strength. And I think that to us, every account in the Street is something that we feel we're applicable to. Our go-to-market motion, I think, is not as mature as some of our competitors. Our motion in general is very different given that some of these companies have amassed 70,000, 100,000 accounts. Most of the growth is coming through upsell and cross-sell to their existing account bases. We got about 15,000 customers, not a small customer base. But at the same time, 50%, and that's still true from pretty much every quarter for us, the bookings come from new logo acquisition, which is a motion that the others have largely kind of stop pursuing or just don't really focus on pursuing. So we have the same type of market opportunity. We have a different scale. We have a different challenge. We're going after new logos, they're mostly defending, it's just a different type of a ball game. But in essence, technology is, to me, the biggest determining factor and we got the best technology in the market when you think about endpoint security, when you think about workload security, and we can talk about some of the attacks that we're seeing right now that also point to a very specific way of deploying endpoint security and another one that we've talked about for many, many years, which is autonomous security. The last couple of years, people have opened up to the notion of, okay, things can happen in an autonomous way. When we said autonomous security 5 years ago, many people raised their eyebrow and said, maybe yes, maybe not. Today, if you're seeing this onslaught of supply chain attacks and when you understand that AI agents are becoming the attack surface, and they are being abused by their automated mechanism of work, the import libraries, automatically, these libraries can be poisoned and can be used to trick the AI agent, to take all your credentials and passwords and send them out in the course of 20 milliseconds. Then you understand that most of what you have in cybersecurity today is defunct, not designed to understand when something goes wrong, not designed to do it in real time and not designed to stop it while our EDR can. We stopped all of these supply chain attacks in the past 30, 60 days that we've seen that hit many Fortune 100 companies, frontier labs, I think OpenAI disclosed publicly that they were affected by 2 of those, not our customers, some other frontier labs are our customers, not them. So it's also about what technology you can deploy, when can you deploy it? Not all EDRs were created equal, and I think that if we put direct competition aside, there's still 50% of this market that's in the hands of incumbents. And a lot of the conversations that we're hearing right now are about customers, even our customers that still have footprints with incumbents. We're now waking up and saying, okay, now is the time to move and we need to move fast because a non-modern EDR would not stand any shot. And obviously, an autonomous EDR is something that can really help us, especially if we're deploying more and more of these AI agents. Now the notion of an AI agent is also expanding. It's not this code-based thing that is not applicable. This is Claude. Claude is an AI agent. If you have Claude installed on your desktop, you have a tab that's called Claude co-work, that's a fully-fledged autonomous agent that can do stuff for you, sometimes doing stuff for you without you even knowing. So that growing recognition for a customer that they need visibility into it, that they need better regulation, that they need governance is driving EDR sales. It's driving Prompt Security generative AI, DLP protection and it's driving more data that needs to go someplace. All of those are the exact same I think, areas that we've been focused on, and we're now even more focused on. So we moved away a little bit. People have been asking us throughout the day and through earnings. Okay, so you said you're reinvesting and you're putting more stuff in the focus areas. What are those? And what are you moving from? These are the areas. All the other small adjacencies in cybersecurities, exposure management here and there and identity and some others, let's let other people deal with that. To me, we have such tremendous opportunity in the core of cybersecurity and such adequate technology to deal with it, that if we're not doing that, if we're not putting everything we can into that opportunity, which is big in itself, then we're just kind of wasting our time or not yielding as much which is part of what Sonalee and I decided to do.

It's why I took the job.

Last question before I ask -- I speak with Sonalee. Last year, we spoke about a lot of initiatives, but the results were not as good, this quarter when I look at below the surface, above the surface, everywhere I looked at your numbers things were clicking. What changed? What changed in the last year that now -- and I don't care what the share price did because that's just a different market, kind of different issue. I care more about the numbers. The numbers were strong across the board. And the question is what changed in the last year? And how sustainable is the strength that you are seeing today in the numbers?

Yes. I mean, a lot change. I think we took all of last year to basically, redo a lot of parts of our business. So I think we talked a lot about go-to-market in the previous earnings call last year, maybe more than I ever wanted to talk about go-to-market. But it was needed. We needed to adjust. We needed more rigor, we needed a better sales force, we needed better talent. We were saying, we want to move up market. We weren't as much of an upmarket company in the past couple of years, now look at our ACV per customer. I mean it's shooting up in a pretty significant way. Our logo acquisition in the upper end of the market is much, much better. And that starts to create a dynamic where you're becoming more effective. If ACV per customer is up, if the percentage of sales and marketing for revenue is starting to look much more like a grown-up company, I think that just drives the right type of secular tailwind that we want to see across our business, making sure that we can create the customer experience that we need. If we're moving upmarket, if we're talking to different customers we haven't talked to before, we want to make sure that we do in the best way possible to create the outcome that we set out to create. So all of that, it doesn't change overnight. I think it's something that we started seeing evidence of internally throughout last year. You're right. It wasn't fully reflected in the number because there were still a lot of moving parts. We're rebuilding lots of parts of our executive team. We have pretty much a fresh ready-to-roll executive team for a couple of quarters now and these are amazing people, amazing people that we just didn't have, that same caliber in the past. So all of these things, I think, are now -- I think things that are now driving is better rigor across the business. Technology was always great. We always have phenomenal technology. I think like throughout the years, that was the one thing that we didn't manage to mess up. I'm kidding, of course. But I think now it's aligning which is a better operational rigor, better go-to-market. And I'm not declaring victory by the way. There's still much more work to do, but it is looking better.

Sonalee, I'm going to start with a tough question. You're the third CFO in a short period of time. Tell us about the infrastructure you have seen from the numbers management point of view, what are you working on? What are you focusing on? What needs to -- what do you need to do in order to have consistent reporting and not to have the hiccups we had in the past?

Yes. That is a tough question. And then you're the first one to ask me that particular question. So firstly, just with respect to the infrastructure and the team I inherited, kudos to my predecessor, I inherited an extremely strong finance bench. One of them is sitting right there, who has made my life amazing in the last couple of months as I prepped for earnings, our Head of IR. So in terms of bench strength infrastructure, like I don't worry about things like the control environment, that is just not even on my radar. I actually feel like -- it is on my radar, but I don't need to worry about it. I actually feel like I have been able to go really deep in some of the operational things that are big priorities for my boss here really early on because the infrastructure is so good. In terms of priorities and where I'm focused, so first and foremost, I feel like it's incumbent on me in the seat to ensure that we are allocating our capital and investing in our highest conviction opportunities, and Tomer talked about some of those. But one of the things he didn't say about what are the factors of our success in the last year is we are a true platform, and we are now truly diversified. Like we are not just an endpoint company. We now have 50% of our ARR coming from outside of endpoint. And there are some real growth drivers within that. So we talked about AI security and Prompt. Prompt has basically doubled ARR for 2 consecutive quarters and nearly quadrupled since we acquired it just a couple of quarters ago. I mean that's phenomenal growth. It's my job to ensure that we feed that baby, so it can grow. In my first week, I asked for a meeting with the GM of Prompt, and I asked him what he needed from me in order to ensure that the target that he has for the full year is actually 20% or 25% higher. And why can't that be a $100 million business in a couple of years. So these are the kind of things I'm focused on, which is great because this category has a lot of opportunity. Tomer talked about the $100 billion TAM. So AI security data, where we have a very strong presence. Again, we saw that accelerate this quarter. Cloud, again, accelerating. So I think my biggest priority and what I really feel like I need to get right is ensuring we make those investments. Secondly, operational excellence and rigor. And there are certain things that when I arrived, when I looked at our sales and marketing spend as a percentage of revenue, it was really off benchmark, and we've made some progress this quarter. Hopefully, you saw. 39% as a percentage of revenue as opposed to 47% a year ago. But there is more to do there. And I think actually some small changes that we've even made on some of our marketing channels and the efficacy of our marketing spend has already started to yield results, but you'll see continued progress there as the year rolls on. Thirdly, I think net retention is a big one for me. And our platform strategy really helps with that. This quarter, we saw -- it was a number I was extremely focused on. We saw net retention for our customers spending $100,000 or more with us going above 110%, so that was a significant improvement. And as I look ahead and I think about what's going to drive our growth, I think we will continue to see improvements in that net retention number. So those are kind of near-term priorities. In terms of the cadence around earnings and getting back into this beat and raise cadence, like, of course, that is what we want. Of course, that is discipline that I will hopefully bring. And some of you in this room have known me for a long time. It's -- hopefully, I have a track record in doing that. I think one of the things that I have become really involved in is the weekly forecast meeting. I work very closely with our sales ops team. I think there are investments that we are going to make there. And I think the CFO office will be a lot closer to sales ops than perhaps in the past. And other investments we're making on the customer success side around our churn and downgrade. And that's, again, an area that I think has real scope to improve with some small changes. So those are, again, priorities right now. And in terms of the margin side of the business, I see already a very clear multi-quarter sequential margin improvement story that will translate into a multiyear margin improvement story because of the industry-leading gross margins that we have today and the operating leverage that's inherent in this great business as we continue to grow 20%.

So margin -- in the past, a year ago, I remember that I compared your margin to CrowdStrike that were at the same level, and I showed a big difference. They were higher margin. And the question is what are the levers in margin? What are the things that you can improve with margins over time that is it just about revenue growth and leverage on revenue growth? Or is there anything that you can structurally change within the expense level?

Yes. I think -- I mean, on the gross margin side, I think we're already pretty -- like there might be some optimization, but I think -- so it's really in the other line items and that roll out to operating margin. I think like sales and marketing, I'm going to come back to that we're not stopping at 39%, right? And I think if you look at not just CrowdStrike, but if you look at other peers and software companies that are $1 billion plus, we're going to be ARR significantly above $1 billion. We are outside the benchmark, and I do not see any structural reason. We see no structural reason, and we are fully aligned on the efficiency measures that we're taking that, we actually feel are going to drive not just better outcomes and unit economics, but we think it's actually going to drive better revenue growth as well. Because I think that there were layers of pockets of inefficiency that were actually dragging the whole business down. And I ran this playbook at other places that I've worked as well and when you eliminate those bottom producing sellers, you create way better books and territories for your great sellers to go and attain and over-attain. And like we have no problem incentivizing our sellers to go and over attain. We want them to. And we think we're creating the conditions for that to happen. So like if you were to ask me, is there any structural reason why you should not have best-in-class operating margins? Absolutely not. We did 700 basis points year-over-year this year. We will have significant operating margin expansion next year, but we also believe really strongly in investing alongside those operating margin improvements. And while we have these incredible opportunities like shame on us if we squander the opportunity to go and fuel the growth. So it's going to be balanced.

I would say, I mean just to add to that, and we're fully aligned. We are expanding margin pretty fast. So 700 basis points year after year almost, just look at where we're going to exit this year, and I think that's going to give you a good sign as to, hey, we're starting to look pretty close to everybody else. So you're right that at that same scale. I think it's just a different opportunity in a different interest environment and hard to compare. But now that things are starting to be more aligned. I think you're going to see us kind of operate at those same levels pretty quickly.

So I tell you what caught my eyes this time, this cycle. I stopped covering you for about 6 months. We had another analyst, and I came back to cover you about 2 months ago. And when you reported the numbers before that when we were preparing, I look back at your -- and I look back at your growth. And I said, this company had so many issues with sales and some products. And still you grew revenues over 20% consistently.

That's the way we look at it, too.

Right. And the question I have is, do you think you can accelerate growth? Do you -- what's your goal? Accelerate -- achievable goal, accelerate growth, maintain growth, 20% is pretty darn good in this kind of market.

I don't think there's a day that passes that we don't think about how we accelerate growth.

Yes.

Can we do it? Are we committing to do it? I think that's not for us to say at this point, but it is something that, by far, we have as a target internally for ourselves to figure out how we do it. And I think there's plenty of levers in the business to achieve that while recognizing that what you call -- we've had so many issues. It's also flying a very fast plane and changing its parts at the same time. Those are the issues that you see. And look, I would take -- this has nothing to do with Sonalee. I'll take the full responsibility for all of it. These are needed changes. Now we're at the scale that as a public company, there's no way for you to hide some of these things. Ideally would want to maybe do some of these things in a private setting, but it doesn't make them less of an imperative to do. And my sense is, I'd rather do it. I don't care if it looks like an issue or doesn't look like an issue. It's the right thing to do. It's what's serving the business for the long term, and we're going to keep on doing that to the dismay of sometimes even people that work at SentinelOne, to the dismay that some of my loss of my hair, to the dismay of all of it, I'm going to keep on taking the right decisions for the long term. But I think we're seeing less and less of that, and we're becoming better and better. And I think those are the exact same things that then funnel into accelerated growth. And that's something that we absolutely want to see, we believe the opportunity for the SentinelOne is bigger than even that 20%. But there are things that still need to line up for us to sit on this stage or other stages and come and say, hey, we're now guiding up. We're accelerating and it looks tremendous. By the way, we've had some acceleration even in Q1 from Q4. So that was nice. We've had massive improvement in net new ARR, 55% year-over-year, nontrivial by any degree. So the components are there. There's still a lot of things that we need to align, but I think it's on both of ours radar for sure.

So in the interest of time, I'll just go maybe to my last question, which is something we spoke about, but I want to understand it. We speak a lot about AI. But there is a difference between what I -- when I talk to cybersecurity companies. There is a real concern over AI, et cetera. But when I speak with software companies, deployment of agentic AI is not giant. It's not big. It's starting. We talk about it, but it's a relatively small piece of revenues. Why is it the driver now in cyber? Meaning, is this just a potential opportunity in the future? Or do you see already now enterprises customers deploying, not just thinking about, but rather deploying AI cyber solutions?

Yes. No, we're definitely seeing them deploy. And I think that you're going to have to have the cybersecurity controls to deploy AI. So cybersecurity comes first. And I'm glad that that's actually happening. And I think the Mythos and Glasswing beyond the tangible specific like vulnerability discovery and all that stuff. I think the awareness that you really have to have a handle on what's happening before you just start deploying things, that awareness is there. So I think we're starting to see kind of cybersecurity become a prerequisite for AI adoption. You're still seeing AI adoption that's uncontrolled. You're still seeing a lot of AI in the enterprise right now, maybe not agents. But AI usage that is completely unregulated. Not every one of our customers have Prompt Security, and I can tell you that they have nothing else. And same is true for many other customers across the cybersecurity landscape. So the need is there. the deployment is starting. I think the understanding that a lot of these agents are not something that is easily controlled is both delaying the pace and making cybersecurity a much of a needed ingredient. But there's going -- it's going to take a little bit of time. I think these agents are just not as accurate as we want them to be. And we're great partners of Anthropic and OpenAI and Google across all these facets. Lots of promise, lots of talk, lots of examples, but true production grade type of capabilities, I'll be wary of deploying at scale at this point. And I think the more that proves to be a tried and tested motion. I think your SaaS companies might have a different aspect at that point, but cybersecurity has to be infused in it. Otherwise, you lose control very quickly, and you have no idea what's happening. And that is, I think, the most critical thing that our customers are worried about when I have kind of conversations with large customers, they're not asking about EDR. They're not asking about the capability. They're asking about security strategy. They're asking how to deal with everything given the portfolio that you have.

Right? Tomer, Sonalee, thank you very much.

Absolutely. Thank you for having us.

Thank you, Tal.