SentinelOne: AI-Powered Cybersecurity with Massive Growth Potential
Deep Dive into $S: Valuation, Segment Growth, Key Metrics, Profitability, Expenses, Product Launches, Customer Acquisition, Financial Stability, SBC/Revenue, and Shareholder Dilution.
SentinelOne: Company overview
About SentinelOne
SentinelOne is a cybersecurity company founded in 2013 by Tomer Weingarten, Almog Cohen, and Ehud Shamir, with headquarters in Mountain View, California. The company specializes in autonomous cybersecurity solutions powered by artificial intelligence, focusing on endpoint protection, cloud workload security, and identity protection. SentinelOne went public on June 30, 2021, with an IPO price of $35 per share. As of 2024, the company serves over 8,500 customers globally, including 35% of the Fortune 500 companies and four of the Fortune 10. SentinelOne employs approximately 1,400 people and has achieved recognition as a Leader in Gartner's Magic Quadrant for Endpoint Protection Platforms for four consecutive years.
Company Mission
SentinelOne's mission is to provide autonomous cybersecurity solutions that empower organizations to defend against advanced threats and protect their critical assets. The company aims to revolutionize cybersecurity by pushing the boundaries of autonomous technology, enabling modern enterprises to defend faster, at greater scale, and with higher accuracy across their entire attack surface. SentinelOne is committed to developing cutting-edge solutions that leverage artificial intelligence and machine learning to proactively detect and respond to cyber threats in real-time. Their vision extends to creating a world where businesses can operate without fear of cyber attacks, knowing their data and systems are protected by cutting-edge technology.
Sector
SentinelOne operates in the cybersecurity sector, specifically focusing on endpoint security, extended detection and response (XDR), identity security, and cloud workload protection. The company competes in a rapidly evolving market driven by increasing digitalization and the growing sophistication of cyber threats. SentinelOne's Singularity Platform encompasses AI-powered prevention, detection, response, and threat hunting across user endpoints, containers, cloud workloads, and IoT devices. The cybersecurity sector continues to expand as businesses face mounting threats from malware, ransomware, and advanced persistent threats. SentinelOne's solutions address critical security needs across multiple domains, positioning the company at the intersection of several high-growth cybersecurity segments.
Competitive Advantage
SentinelOne differentiates itself through its autonomous AI-powered cybersecurity technology that provides real-time threat detection and prevention across multiple environments. The company's Singularity Platform offers enterprise-wide visibility and control, with rich AI models enabling every endpoint and cloud workload to autonomously prevent, detect, and recover from threats in real-time. SentinelOne has demonstrated 100% detection accuracy with zero delays for five consecutive years in MITRE ATT&CK Evaluations, with 88% less noise than the median across all vendors. The company maintains a 98% customer satisfaction rate and has been recognized for its execution and innovation by authorities such as Gartner. SentinelOne's platform approach allows customers to consolidate security products, maximize value, and improve business continuity, resulting in faster mean time to remediate (MTTR) and reduced operational costs.
Total Addressable Market (TAM)
SentinelOne operates in an enormous and expanding market. The global cybersecurity total addressable market is expected to reach $1.5 trillion to $2.0 trillion, approximately ten times its current size. The company's immediate addressable market is estimated at $100 billion, of which SentinelOne currently captures less than 1%. With approximately 10,000 customers, the company's market penetration remains in its infancy, suggesting substantial growth potential. Raymond James analysts believe SentinelOne can evolve into a $10 billion software business over time as it expands from core endpoint security into various needs across key areas like XDR, SIEM, IAM, Cloud, and Network security. The ongoing digital transformation across industries continues to expand the market opportunity as businesses become more vulnerable to cyberattacks and seek comprehensive security solutions.
Valuation
$S SentinelOne is trading at a Forward EV/Sales multiple of 5.7, which is significantly below the median of 7.67.
The company’s current multiple is near its historical lows, comparable to the levels seen in January 2023.
$S SentinelOne is trading at a Forward P/E of 106.5, with revenue growth of +29% YoY in the last quarter.
It’s worth noting that in Q4, SentinelOne reported positive non-GAAP operating profit for the first time, signaling progress toward profitability while still being in the early stages of growth.
The EPS growth forecast for 2026 is +95.3%, with a Forward P/E of 100.4 and a PEG ratio of 1.05.
The EPS growth forecast for 2027 is +112.6%, with a P/E of 51.4 and a PEG ratio of 0.45.
The PEG (Price/Earnings to Growth) ratio is a key tool for evaluating growth stocks, introduced by Peter Lynch.
PEG < 1: Undervalued – A ratio below 1 suggests the stock is undervalued. For example, if the P/E is 15 and earnings are expected to grow by 20%, the PEG would be 0.75, indicating a good buying opportunity.
PEG = 1: Fair Value – A PEG of 1 means the stock price matches its growth expectations, representing fair value.
PEG > 1: Overvalued – A PEG above 1 indicates the stock may be overvalued, as its price is higher than its projected growth rate, making it riskier.
Valuation comparison
Analysts' revenue growth forecast for $S in 2026 is +21.8%. Considering this forecast, the valuation based on the PS multiple appears undervalued when compared to other companies in the cybersecurity sector.
Analysts expect strong revenue growth, so let's examine the key metrics to determine whether these expectations are justified.
We'll evaluate the company's economic moat, which supports long-term revenue growth, analyze revenue trends and the forecast for next quarter, and identify key factors that could help the company exceed expectations and sustain future growth.
We'll assess the performance of key segments, the launch of new products and updates, customer acquisition growth, key financial metrics, financial stability, and margin trends.
Additionally, we'll review the SBC/Revenue ratio, shareholder dilution, and finally, draw conclusions on the company's outlook.
Economic Moat
Economies of Scale
SentinelOne shows moderate economies of scale as it grows its platform and expands its customer base. The company has achieved a 3-year CAGR of 88.3% and now serves over 8,500 customers, including 35% of the Fortune 500. Despite this, it holds just ~4% of the $20 billion endpoint security market, suggesting substantial room for scale advantages. Operational efficiency continues to improve with 11 consecutive quarters of 20+ percentage point YoY improvements in non-GAAP operating margin, steadily moving toward profitability. SentinelOne is progressing, but it hasn't yet unlocked the full cost benefits of scale in the cybersecurity space.
Network Effect
SentinelOne’s AI-powered Singularity Platform strengthens as more organizations join, feeding threat intelligence into its detection engine. This enhances real-time performance across all users. A 115% net revenue retention rate signals increasing value among existing customers. The platform has maintained 100% detection accuracy with zero delays for five straight years in MITRE ATT&CK evaluations, while generating 88% less noise than the median vendor. The more it’s used, the smarter and more effective it becomes.
Brand
SentinelOne holds a respected, though not dominant, position in cybersecurity. It's been recognized as a Leader in Gartner’s Magic Quadrant for Endpoint Protection Platforms for four consecutive years and maintains a 98% customer satisfaction rate. The company ranked #7 in Deloitte’s 2019 Technology Fast 500, growing 10,275% from 2015 to 2018. Despite this traction, some analysts, including Wells Fargo’s Malik Ahmed, question whether it has built a true economic moat. The brand is strong but not yet premium.
Intellectual Property
The company owns significant proprietary assets. Its AI-powered security platform is backed by patents and machine learning algorithms that deliver autonomous protection across endpoints and cloud workloads. Innovation is ongoing—SentinelOne has launched Singularity Hyper Automation, Purple AI, Cloud Native Security, and Singularity Data Lake. Its intangible assets are valued at $736.8 million, making up a large share of its non-current assets. This IP creates real barriers to entry and technical differentiation that are hard to match.
Switching Costs
High switching costs are a core strength. SentinelOne’s single-agent architecture replaces multiple legacy systems, integrating endpoint, identity, and cloud protection. Migrating away requires retraining, reconfiguration, and operational risk. According to Forrester, this consolidation delivers over $1 million in average annual savings, with a three-year risk-adjusted present value of nearly $3 million. The platform also reduces endpoint issue resolution time by 75% to 85%, embedding its value deeper into customer operations.
SentinelOne is building a defensible moat, particularly through switching costs. While still in its scaling phase, the company is positioning itself as a key long-term player in cybersecurity.
Revenue growth
$S's revenue growth deceleration has paused, with the most recent quarter showing +29.4% YoY growth.
However, based on guidance for the next quarter, if the company exceeds its forecast by 1.6%, as it did in Q4, growth would reach +24.2%, representing a significant slowdown in revenue growth.
RPO growth accelerated to +33.9% YoY in Q4, outpacing revenue growth, while billings grew +12.6% YoY, which is slower than revenue growth.
Segments and Main Products.
SentinelOne operates in the Security Software & Services segment, generating revenue across endpoint security, cloud security, and security operations. The company serves over 8,500 customers globally, with strong presence in Information Technology and Services. According to IDC, SentinelOne grew at the fastest pace among the top 10 vendors in the endpoint security market in 2023. The company targets a hundred billion-dollar plus security and data market opportunity with its AI-powered solutions.
Singularity Platform
The Singularity Platform forms SentinelOne's core offering, providing enterprise-wide visibility and protection across endpoints, cloud workloads, and identities. The platform unifies security data in a centralized data lake to reduce risk. SentinelOne has purpose-built a security agent running dual AI-based detection engines both cloud natively and on-device, with patented behavioral AI for real-time protection complemented by comprehensive context and triage in the cloud.
Endpoint Security Products
SentinelOne offers tiered endpoint security packages including Singularity Core starting at $69 per year, Control, Complete, Commercial, and Enterprise. Singularity Core provides basic endpoint protection for small businesses with built-in AI analysis. Singularity Control adds firewall control and autonomous prevention for mid-sized businesses. Singularity Complete delivers comprehensive endpoint detection for larger organizations. Enterprise pricing ranges from $30,000 to $110,000 per year depending on organization size and needs.
Purple AI
Purple AI is SentinelOne's AI security analyst launched in April 2024 and now available in all global regions. Purple AI translates natural language security questions into structured queries, summarizes event logs, and guides analysts through complex investigations. Early adopters report up to 80% increase in threat hunting speed and significant reductions in response times. Purple AI has exceeded adoption expectations since general availability, contributing to Q2 FY2025 outperformance. The solution enables security teams to automate investigations, reduce alert fatigue, and stay ahead of attacks.
AI SIEM
SentinelOne's AI SIEM (Security Information and Event Management) represents a major focus for the company in 2025. Unlike traditional rules-based approaches, SentinelOne's AI SIEM leverages artificial intelligence on top of cloud-native data architecture to solve security incidents more effectively. The solution addresses market disruption in the SIEM space following industry consolidation with Splunk joining Cisco and other major shifts. SentinelOne's AI SIEM enables security analysts to harness autonomous capabilities for real-time detections, generative AI-assisted hunting, and machine-speed protection against emerging threats.
Main Products Performance in the Last Quarter
Singularity Platform
SentinelOne reported strong platform momentum in Q4 FY25. Over 50% of full-year bookings came from non-endpoint solutions, a milestone indicating growing adoption of Singularity’s broader AI-native security portfolio. The platform now spans seven solution categories and 30+ use cases, including cloud, identity, data, and threat services. The company tripled the number of customers using three or more solutions and quadrupled those using four or more, with 40% of enterprise customers on at least three modules. Platform breadth, integration, and signal-to-noise advantages drove multiple large deal wins, including multi-million dollar replacements of legacy vendors. Management sees Singularity as a key vehicle for cross-sell, up-sell, and long-term retention, though enterprise deal cycles remain lengthy.
Endpoint Security
The company maintained strong positioning in endpoint protection. Singularity achieved 100% detection in MITRE ATT&CK evaluations for the fifth consecutive year, with zero detection delays and 88% fewer alerts compared to peers. High signal quality reduced operational burden and enhanced effectiveness. Though endpoint still contributes a meaningful portion of ARR, SentinelOne emphasized a strategic shift beyond endpoint, with a growing share of revenue and bookings now driven by cloud, AI, and data-centric offerings. Overall, endpoint is becoming a gateway for broader platform expansion, but not the primary growth driver.
Purple AI
Purple AI is scaling rapidly. Over 300 Purple AI deals closed in Q4, positioning it as one of SentinelOne’s fastest-growing solutions. It is now embedded by default across all Singularity platform modules, offering natural language queries, auto-generated summaries, and agentic AI workflows. Customers benefit from automated threat detection, remediation, and real-time summarization. SentinelOne also extended Purple’s reach by integrating with third-party vendors like Microsoft, Palo Alto Networks, Zscaler, and Okta. The company is using Purple to increase stickiness, platform engagement, and AI feature expansion. The GenAI capability is being used as a standard baseline and expanded through paid tiers.
AI SIEM
AI SIEM has become a standout performer. SentinelOne saw record Q4 bookings for data and AI solutions, with SIEM as a central driver. Customers are actively migrating from legacy solutions like Splunk, with use cases focused on cost reduction, faster detection, and autonomous response. One retailer cut annual costs by $1 million, another financial institution increased deal size 5x, and an APAC customer replaced a legacy SIEM in an eight-figure deal. AI SIEM, paired with other modules, enabled customers to reduce response times by up to 12 hours. The company sees SIEM modernization as a major opportunity to disrupt legacy vendors and consolidate security operations under its AI-native stack.
Innovations and Product Updates
SentinelOne became the first security company to embed generative AI across its platform by default. Purple AI and Hyperautomation form the foundation of SentinelOne’s agentic AI architecture. CNAPP offerings were expanded post-PingSafe acquisition and secured the largest CNAPP deal to date in Q4. Customers recognized SentinelOne with a 98% recommendation rate in Gartner Peer Insights for CNAPP. MSSPs and managed services providers are adopting the platform rapidly, further boosting enterprise reach.
The company also made a strategic move to retire its legacy deception solution, which contributed to up to $10 million in expected ARR churn, half of which hits Q1 FY26. This move aligns resources toward high-yield areas like AI, data, and cloud. Pricing is being modernized to support flexible platform access, encouraging broader module adoption.
Market Leader
For the fourth consecutive year, SentinelOne has been named a Leader in the Gartner Magic Quadrant for Endpoint Protection Platforms, driven by its AI-powered Singularity Platform. The platform delivers autonomous, real-time protection across endpoints, identities, and cloud environments—all from a single agent.
Backed by a 98% customer satisfaction rate, SentinelOne continues to scale rapidly with nearly 13,000 customers, including 35% of the Fortune 500. Its platform unifies endpoint, cloud, identity, and threat analytics, enabling efficient threat detection, response, and management.
Recent innovations include Purple AI for SOC automation, Singularity AI SIEM, Singularity MDR, and expanded cloud-native security through the acquisition of PingSafe. The company is also FedRAMP High authorized, trusted by governments and critical infrastructure.
Customers
$S SentinelOne added new 101 customers with ARR over $100K, marking the highest number of new large customer additions in the past two years and representing +25% YoY growth.
Customer Success Stories
SentinelOne delivered material customer outcomes across data, cloud, and AI deployments. A leading global retailer replaced its legacy SIEM with SentinelOne’s AI SIEM, realizing $1 million in annual cost savings. The switch enabled the retailer to cut incident response times by up to 12 hours, demonstrating both economic and operational benefits.
A major financial institution also replaced its incumbent SIEM provider, selecting AI SIEM to modernize data ingestion and threat detection. The account expanded 5x in total contract value, reaching multi-million dollar scale. The decision was driven by performance improvement and cost rationalization.
Customers cited high performance, unified platform architecture, and reduced alert fatigue as core differentiators. Purple AI’s automated threat summaries and natural language query capabilities increased analyst productivity and reduced manual workflows, contributing to elevated satisfaction and greater platform utilization.
Over 40% of enterprise customers now use three or more platform modules, and 20% use four or more, illustrating strong success in land-and-expand motions. Platform expansion, particularly across AI and cloud security, is driving higher deal sizes and retention rates.
Large Customer Wins
SentinelOne secured several high-value competitive displacements in Q4 FY25. A Fortune 100 airline selected SentinelOne to fully replace an incumbent cybersecurity vendor after a six-month evaluation process. The deal involved full platform adoption across network layers, endpoint, and data security.
In the APAC region, a large enterprise signed an eight-figure total contract, expanding endpoint and cloud coverage, and deploying CNAPP and AI SIEM. The company fully displaced a legacy vendor, highlighting SentinelOne’s ability to penetrate complex, multi-product accounts.
A global software firm selected SentinelOne’s CNAPP suite after a competitive bake-off, citing superior performance and lower total cost of ownership. This became the company’s largest CNAPP win since acquiring PingSafe, and marked continued traction in cloud security expansion.
Managed Security Service Providers (MSSPs) increased commitment levels, signing longer-term contracts and embracing Purple AI and AI SIEM. More than a dozen large partners onboarded advanced modules in Q4, reinforcing SentinelOne’s ecosystem momentum and expanding its indirect reach.
ARR Growth
SentinelOne $S ARR growth is slowing, reaching +27% YoY in Q4, which is below the company’s revenue growth.
Net new ARR
SentinelOne $S added $60M in net new ARR in Q4 2024, which is in line with the same quarter last year.
However, based on management’s guidance for the next quarter, if the company beats its forecast at the same rate as it did this quarter, the net new ARR addition in Q1 would be very weak, representing a -63% YoY decline—signaling the challenges management expects in the near future.
CAC Payback Period and RDI Score
$S's return on S&M spending is 25.6. The CAC Payback Period has remained steady over the past three quarters, but it is still worse than the median for SaaS companies, which stands at 20.8 months among the companies I track.
The R&D Index (RDI Score) for Q4 is 1.18, which is roughly in line with the median of 1.2 for the SaaS companies I monitor, and significantly above the industry median of 0.7.
An RDI Score above 1.4 is considered best-in-class, and the low industry median of 0.7 highlights the importance of efficient R&D investment.
Profitability
Over the past year, $S SentinelOne has improved its margins:
Gross Margin increased from 78.0% to 79.3%.
Operating Margin increased from -9.1% to 1.2%.
Free Cash Flow (FCF) Margin increased from -6.1% to -3.9%.
Operating expenses
SentinelOne’s $S non-GAAP operating expenses have gradually decreased.
Sales & Marketing (S&M) spending declined from 58% two years ago to 45%.
R&D expenses have decreased from 31% to 22%, but remain elevated, reflecting the company’s continued investment in future growth through platform enhancements and updates.
General & Administrative (G&A) expenses have also declined, from 20% to 11%.
Balance Sheet
$S Balance Sheet: Total debt stands at $0, while SentinelOne holds $722M in cash and cash equivalents, resulting in zero debt and ensuring an excellent, healthy balance sheet.
Dilution
$S Shareholder Dilution: SentinelOne’s stock-based compensation (SBC) expenses remain high, accounting for 33% of revenue in the last quarter.
Shareholder dilution also remains elevated—despite a slight decrease, dilution is still significant, with the weighted-average number of basic common shares outstanding increasing by 6.7% YoY.
Conclusion
Although $S SentinelOne delivered a solid Q4 and revenue growth has stabilized, management issued a very weak forecast for the next quarter, indicating a significant slowdown in revenue growth.
The company attributed the soft guidance to several factors:
economic uncertainty and political volatility impacting security budgets,
Federal spending slowdowns leading to longer sales cycles,
delays in AI-driven security transformation initiatives,
and the retirement of its Deception product, which resulted in $10M in ARR churn.
Leading Indicators:
• RPO growth of +33.9% exceeded revenue growth
• Billings growth slowed to 12.6%, significantly below revenue growth
• Net new ARR additions remained flat compared to last year
• Strong number of large customers added
Key Indicators:
• Net Dollar Retention (NDR) – management has stopped disclosing this metric
• CAC Payback Period slightly improved to 25.6 months, but still worse than average
• RDI Score increased slightly to 1.18, which is in line with the median of other SaaS companies I track
The forecast suggests a notable revenue growth deceleration.
Leading indicators—such as slowing billings, flattening RPO and ARR growth, and ARR growing slower than revenue—all imply that this slowdown may continue, despite the strong addition of large customers.
According to management's guidance, revenue growth next quarter will likely be around +24%.
By comparison, competitor $CRWD is forecasting ~+23% revenue growth for the same period.
However, CrowdStrike’s slowdown is tied to the well-known July 19th incident, while SentinelOne has not seen any significant benefit from its competitor’s temporary setback.
This is concerning—SentinelOne’s revenue is 4.5x smaller than CrowdStrike’s, yet their projected growth is nearly the same. That raises questions about SentinelOne’s competitive positioning.
Valuation-wise, SentinelOne appears undervalued compared to its peers based on the Forward EV/Sales multiple.
But this low valuation likely reflects justified concerns about the company’s weaker competitive position.
I previously held a sizable position in $S, but I fully exited in August 2023 after the company reported a significant revenue slowdown.
That slowdown appears to be continuing, though it’s worth noting that SentinelOne has achieved non-GAAP profitability, which is a key milestone.