SentinelOne, Inc. (S) Earnings Call Transcript & Summary

Yes, absolutely. And it all goes back, we call it the foundation because everything else is really built upon it. So let's shift now to how Latio thinks about the modern stock? And let's hit our report framework. In 2026, every vendor calls themselves an AI SOC provider. The category is real, but the marketing has gotten ahead of what most teams actually have in place. So James, let's ground this. How do you actually define a SOC platform? And what has to be there for it to qualify?

Yes. I think it's sort of the culmination of everything we've talked about so far where, from a pure feature perspective, to me, it involves some sort of EDR offering because that's a core tenet of what the SOC does, some type of SIEM capabilities and then some kind of managed SIEM MDR capabilities. And really like at a bare minimum, those 3 pieces are what probably 90% of the security operations market is looking for from a core capabilities perspective. And then when we talk about, okay, then broader picture, like how do we figure out which SOC platform to go with. This is where sort of this diagram comes in as far as like, here's what a traditional SIEM looks like and why it's so complicated. Because when I was a part of managing these SIEM architectures for tons of companies of all sizes in an MDR context, and you had 3 different full-time roles that are very challenging for teams to take on. One is a team that's actually doing the SIEM engineering and managing a complex SIEM architecture, especially if you're self-hosting it. The second is a team of analysts that are like doing the day-to-day responding to alerts. And then the third and most important was the detection engineering team or threat hunting team and trying to have them -- like they are the ones upon which everything else rest because all of the -- if the analysts are getting flooded with 500 alerts due to a bad rule, they are basically unable to work until the tool gets fixed. And so a lot of teams, I think, would overinvest if you haven't done this before, like over invest on the analyst side and then wonder why the -- all of your metrics are off because the detection engineering team is the one that is the most significant to reduce those downstream burdens on teams. But now we're really seeing that traditional locked in architecture is really exploding as far as the diversity of people want to store the data where they want to be able to store it, and they want to be able to access it quickly and with flexibility. And so that's when we're starting to think about what does a modern SOC architecture look like from a best-in-class SOC platform? It's going to have more of that data lake architecture. It's going to bring asset context in together with the incident data and it's going to allow teams to build detections, build ingest across a wide variety of storage use cases for people.

Yes. Security always comes back to layers. And this is really what we're seeing with modern SOC architecture is you have that layering, that data foundation and building up from there. And one misstep, one wrong detection rule can negatively impact everyone downstream of that, the analyst downstream of that. So let's dive into where SentinelOne landed for the SecOps market report? Now James, you named us, SentinelOne, the SOC platform leader. Walk us through what you actually saw in the evaluation that earned that designation, and what differentiated us from the other platforms you assessed?

Yes. I think -- it really comes on to the things we've been talking about as far as when it comes to what makes the SOC platform leader. It is that combination of covering all of the core use cases that a SOC would have, along with managed services, all built into the same place. And then around SentinelOne specifically, like it's how the data lake architecture plays into the AI SOC story combined with some of the emerging like attack surface management, attack testing, like red teaming light approaches to find some of those exploitability issues and help with prioritization as well. And really just getting a ton of value for your security operations seem to use SentinelOne as an all-in-one tool. And I think SentinelOne's primary strength is there's a genuine cohesion to how all of the products work together as far as building on top of that data lake architecture. As far as a lot of other platforms, you're like pivoting between pretty drastically different products in order to accomplish some of these same outcomes, but yes, it all comes back to that data lake investment early on.

Starting with that solid data foundation and layering it from there with a unified approach, absolutely. So let's -- I want to pull up some of what you've described here into a visual. So we've captured 6 areas where SentinelOne really stood out in the evaluation. And I think that this maps closely to what we've been talking about throughout the webinar. So the one that I want to highlight specifically here is AI security. So James, you described this as one of the most comprehensive AI security solutions you've evaluated. With the Prompt Security acquisition, we're covering everything from AI red teaming to MCP proxy controls in one platform. In a category that's moving this fast, can you say more about why the breadth here stood out?

yes. I think, even though our next report is the AI security report to plug it here. The -- so we'll be going in some more depth on like AI security tools and what makes them good or bad. But I think, from our last report in 2025 on AI security, like Prompt Security was one of the clear leaders of that category. And of all of the acquisition -- because basically a ton of companies did these like first-generation AI security acquisitions with different bets on what's going to help people the most, and it was a lot of like network security companies doing a lot of that. And I think Prompt Security stood out for both its breadth of different approaches very early on and was really a leader across like thought leadership and research and the tool itself in terms of delivering everything for protection from like ChatGPT-style plug-in monitoring to endpoint monitoring more in depth of tools like Claude as well as like the run time access control pieces. And so it really just comes down to of the acquisitions to make. I think the team at Prompt is a great one and continues to do great work. And yes, as far as comprehensiveness of a solution, a lot of other entries into the category have been through much more like niche or pointed offerings of things like model scanning or creating AI bombs or just runtime protection or monitoring. And so it really is that combination of approaches that creates the breadth that teams really need for AI security because it's moving so fast. And the best thing, most organizations are no longer talking to me about monitoring Hugging Face, for example, not because it's just not the primary use case anymore, even though there are many companies betting big and it's paying off in terms of like self-hosting a lot of this stuff. It's just not the primary use case compared to like Claude is the AI use case of the moment.

Yes, absolutely. SentinelOne definitely backed the right horizon and Prompt has been a fantastic acquisition, a superstrong team and the product is incredibly strong. I've gotten to play with it and demo it myself and it is incredible the protections that you can implement on AI now, especially as enterprises are adopting them at in mass. Now what ties all of this together is that unified data plane though. And so with Purple AI, which is our AI within singularity, being able to reason across endpoint cloud and identity logs altogether all in one place is really an important differentiator for us because we're pulling in and able to analyze the data without switching to different consoles or separate products to be able to actually understand the full story. So let's -- I want to pull what you described here, and this quote is from the report and it says, I'll just read it directly actually here. SentinelOne is a strong fit for organizations, either looking for a complete security platform or those with endpoint coverage looking to extend into SIEM, AI SOC and AI security without adding vendors. So that's really 2 conversations we have most often with customers. Organizations who want one place for everything and those who started with endpoint and are ready to extend the platform they already have. Either way, there's no new vendors, no new contracts and no new data silos. James, any final thought before I show what this looks like in the platform?

I think I really just want to give a practical example of why the single data model matters for the AI queriability of things because the way most tools in this category work from like a start-up perspective is basically having AI write queries across different tools. And that's what creates a lot of surprising either results or hallucinations or things not working or driving costs up because at the end of the day, they don't know if the data is there or not. And so they're trying to infer and build memories over time of like, here's how your log sources work, here's how your data structures work across all these different SIEMs. And then they're trying to write federated searches across a bunch of different data sources. And that's really what creates the messes, like the AI just doesn't have the full context to understand what's going to be there when it goes to look for it. And that's the key challenge that drives up costs and drives down performance of a lot of these systems. And that's why whether it's SentinelOne or any system, like having a consolidated data model or even if you're buying a start-up in this category, it's like it's just important that they are also trying to map and consolidate the data in some way and that it's not just the AI doing like a best guess over and over again to try to see if that data is there. Because the other thing is what's really important when you're doing an investigation is knowing what data is not there to understand like, is there a way you can make an actual judgment on if an incident happened or not. Sometimes it's really important to know we can't make that judgment because we need to turn on the firewall logs or we need to turn on the endpoint logs or there something that got missed. And really, it's just that full context of like what is and isn't there is so important for making these things work effectively.

Those are the gaps in visibility that threat actors live in. And so having all of that data available, [indiscernible] and searchable within one place is critical. So now I think it's time that we dive into it. For anyone who hasn't seen the platform, I'm going to show you some of the moments from the evaluation that map directly to what you've been hearing from James. [Presentation]

Every so starts with the data problem. Teams burn hours normalizing noisy inconsistent telemetry, storage cost spiral, analysts work off low fidelity signal, acting as data janitors instead of defenders. Most SOC investigate only about 20% of the alerts they see in a day. Observo AI changes where that work happens. In its stand-alone console, you watch the pipeline filter enrich and route data in-flight before any of it's ingested. Observe cuts noise by up to 80% upfront and less start with clean, high confidence signal instead of raw low-fidelity noise. When the data is right, every downstream tool performs better, and every decision is more confident. That is what turns data janitors into threat hunters. Before an attack begins, the smartest move is to find the door an attacker would use and close it first. That is what the offensive security engine does. Most vulnerability management ranks findings by CVSS score, a theoretical measure of how bad a flow could be in principle. OSE goes further. It safely test your live public-facing assets the way an attacker would and shows you what is genuinely exploitable right now. Here is a log for J remote code execution finding. This is not a severity rating, it is proof. You can see the actual exploit evidence, the JNDI-LDEP-string OSE injected and the DNS requests that came back confirming the call back fired. The vulnerability did not just score high, it executed. That is the difference between a list of theoretical risks and a verified path into your environment. OSE tests real assets, not hypothetical scenarios and surfaces evidence of exploitability instead of a number. So you harden what an attacker can actually reach first, proactive hardening backed by proof before anyone has to respond to an alert. Now the threat arrives. Attackers achieve lateral movement in under 48 minutes. This scenario is modeled on scattered Spyder, social engineering into identity compromise into cloud lateral movement. The question is not whether an attack will happen, it's whether your team can move faster than the attacker. Traditionally, an analyst chases that attack across 5 or more consoles, correlating alerts from different tools. Unified alert management removes the pivoting. Native SentinelOne alerts sit in the same queue as Proofpoint fishing detections and Palo Alto command and control alerts, same format, same enrichment, partner intelligence surfaces right alongside Geron with the same context. Faster triage, no contact switching, analysts stay in one view. Piecing that attack chain together by hand takes hours. Behavioral AI does it automatically. It flags OS level events as they happen and maps them to minor attack, drilling to storyline and the full attack reconstructs down to the command level. From initial access to lateral movement, the story assembles itself with 0 manual correlation. Here is the reality most teams live with. Most alerts are never investigated. The ones that are take hours because the analyst hits the bottleneck. Watch what happens instead, a critical EDR alert fires with a malicious detection, an agentic investigation triggers automatically with no analyst action. By the time anyone opens the alert, the report is already [indiscernible]. It carries an AI verdict, an executive summary, key findings, a threat summary, a full time line and recommended next steps. The investigation is complete before the analyst even looks, verdict ready, actionable from the start, response is just as immediate because hyperautomation already fired on the true-positive verdict. Normally, the analyst creates the ticket, notifies the team and works containment one step at a time. that administrative work burns hours. Here, a single true positive verdict triggers 1 playbook. It notifies [indiscernible] once, opens the Jira ticket and provides containment options directly within that ticket. The execution launch shows the average resolution time. Response executes across every tool in the stack from 1 trigger. SentinelOne's own SOC runs this way, resolving alerts in an average of 4 minutes across 250,000 alerts a month. This extends to managed service. MDR is usually opaque. You get expert coverage but lose control of the response logic. Here, MDR actions and escalations feed directly into hyperautomation. MDR becomes the trigger, hyperautomation becomes your customizable response layer. You get the expertise of a managed service and the freedom to define what happens next. All right. All right. Thank you, everyone. It's time to get into questions. We've got a few minutes. Let me pull up what's coming from the audience here. James, for a security team starting their SIEM evaluation today, what's the first question they should ask a vendor before anything else?

I mean the short version of this is to ask to see a demo. I know that was always my first question that I would always have. But I think the things to look for through a demo or through the questions is trying to really understand, first of all, their underlying data model and trying to understand the -- how that data model is going to map to the day-to-day operations of your environment? I think just I can use like a mistake I almost made early on in my career was I was doing a lot of DevOps work. We had a lot of work in a DevOps tool. I wanted to use that as our primary SIEM. But I was taking a pretty selfish approach because we had an existing SOC team that had a different SIEM for their use case. And I think it would have been the wrong decision for us to try to like split the data in that way to try to make teams happy like that, and that's how you end up in the sort of like sprawling data mess. And so I think it's unfortunately like a series of compromises that teams have to make to try to pick a place where you're getting the most value out of having as much consolidation as possible or taking the opposite approach, frankly, in trying to take on the burden of you want to store the data and ingest it however is best. And then you're asking yourself, okay, how am I going to run unified detections across this disparate data architecture that I'm going to have.

Yes, avoiding data silos and making sure that everything is monitored or unified in a way where it can be monitored, absolutely. Now I want to -- I have 1 from me here. Is there a category in the evaluation where you expect our vendors to be further along than they actually were?

Yes. And it's really a flip up. You can almost see the top-down demands around AI optimization that are happening because, frankly, I was shocked at how advanced most AI features are from most of the larger platforms like including SentinelOne to be frank, where most major providers have store capabilities at this point that they have really rushed to build AI capabilities on top of whether that is like a chatbot or like an agent builder or an orchestration layer. Like teams invested, especially the platform players invested really quickly into AI SOC-style capabilities. And so I was surprised at how quickly those have materialized. I think what's been slower to materialize is some of that underlying data flexibility support from people where there's -- basically, there's 2 pressures that have happened at once. One is on the -- towards the being able to run decentralized detections across all of your environment and the other is the AI push. And teams really, by and large, invested in AI first and then are still trying to figure out their approach to consolidated versus distributed data architectures.

Got you. So saw organizations pushing the AI before the data and now needing to really rebuild that foundation that we've been talking about.

Yes.

Awesome. It looks like we have 1 last question here. For practitioners in the audience who don't know what OCSF is, why does it matter for day-to-day investigation work?

Yes. I think OCSF is really fun because it reminds me of like open source security tooling where you either have almost no opinion and don't care at all, or you are super in the weeds and have like an incredibly strong opinion about it. And so I tried to treat really lightly on it because I think OCSF is an amazing initiative with a goal that is really important around knowing how do I -- when I query data like an IP address, I want a standard way to do that. And there are so many different logs that have similar enough log types that it should be simple to do that. And where that becomes especially important for AI is because it needs to know if the data is that are not like we were talking about earlier. And OCSF is an amazing standardized way to know if the data is there or not. But the biggest downside to OCSF is, if a vendor does not support it, it sort of breaks the whole thing because then you have this like elegant OCSF query that you've done and then you have to start slapping vendor data across it. And so the biggest weak point for it at the moment is just mixed support from different log sources and vendors, but at the end of the day, it's incredibly important, and it's only grown more important for AI to be able to have some of these standardized queries. Yes.

Yes. It's the standardization of the normalization of the log so that they are easier to query to find and OCSF really does support that. And it looks like we have 1 last-minute question coming in that I might be able to answer here. Srishti, I've always known as 1 to provide some capabilities, hence the SIEM branding. But I noticed on 1 of the platform extension slides that at list Simor just to clarify, does S1 natively include all of these core features. Now? Yes, everything that we showed today is a SentinelOne feature. And so they are all available with the singularity platform. All right. So that we are at time. Thank you so much, James, for being here. Now before we sign off, go check out the full Latio security operations market report. It's available for download right now. And the link should be on your screen. It's worth your time. It's practitioner-led research built on hands-on evaluations, and it gives you a real framework for assessing your security stack independent of any vendor. And if you want to see more of what I showed today, request a demo. We can set up a session tailored to your specific environment. Well, James, thank you so much. I really appreciate your time today. Thank you to our audience for joining us today. I hope you all have a great rest of your day and signing off from SentinelOne. Thank you.

Thanks for having me.