SentinelOne Q1 2025 Earnings Analysis
Dive into $S SentinelOne’s Q1 2025 earnings with review of financial performance, key metrics, operating expenses, dilution, customer growth, future outlook
Financial Results:
↗️$229M rev (+22.9% YoY, +1.6% QoQ) beat est by 0.4%
↗️GM* (79.2%, +0.4 PPs YoY)
↗️Operating Margin* (-1.7%, +4.2 PPs YoY)
↗️FCF Margin (19.8%, +1.7 PPs YoY)🟢
↘️Net Margin (-90.9%, -53.3 PPs YoY)🟡
➡️EPS* $0.02 in line with est
*non-GAAP
Key Metrics
↗️RPO $1.16B (+33.0% YoY)🟢
➡️Billings $202M (+22.6% YoY)🟡
↗️ARR $0.95B (+24.4% YoY, +55 net new ARR)🟢
Customers
➡️1,459 $100k+ customers (+22.3% YoY, +48)
Operating expenses
↘️S&M*/Revenue 47.2% (-3.5 PPs YoY)
↗️R&D*/Revenue 21.9% (+0.6 PPs YoY)
↘️G&A*/Revenue 11.9% (-0.9 PPs YoY)
Quarterly Performance Highlights
↘️Net New ARR $55M (-14.9% YoY)
↗️CAC* Payback Period 54.3 Months (+20.2 YoY)🟡
↘️R&D* Index (RDI) 1.00 (-0.20 YoY)🟡
Dilution
↘️SBC/rev 30%, -2.9 PPs QoQ
↘️Basic shares up 6.0% YoY, -0.7 PPs QoQ🔴
↘️Diluted shares up 9.6% YoY, -2.9 PPs QoQ🔴
Guidance
↘️Q2'25 $242.0M guide (+21.7% YoY) missed est by -1.2%🔴
↘️$996.0 - $1,001.0M FY guide (+21.6% YoY) lowered by -1.1% missed est by -1.1%🔴
Key points from SentinelOne’s First Quarter 2025 Earnings Call:
Financial Performance
SentinelOne reported Q1 FY2026 revenue of $229 million, reflecting 23% year-over-year growth and surpassing expectations. Gross margin remained strong at 79%, maintaining its industry benchmark. Operating margin improved by over 400 basis points YoY, now at -2%, signaling effective cost control and operating leverage.
Free cash flow margin hit a record 20%, up 500 basis points on a trailing 12-month basis. This marked the fourth consecutive quarter of positive non-GAAP net income. Total Annual Recurring Revenue (ARR) grew 24% YoY to $948 million.
International markets expanded 27% YoY, now representing 38% of total revenue.
Singularity Platform
The Singularity Platform anchors SentinelOne’s strategy across AI, cloud, data, and endpoint security. It supports both point solutions and full-suite deployments through a unified AI-driven architecture.
Q1 marked the launch of the unified Cloud Security Suite, combining cloud workload protection, security posture management, data protection, and AI-based posture monitoring. The platform’s modularity, simplified deployment, and new consumption model increased ARR per customer to a record high.
A Fortune 500 financial services firm consolidated several vendors under Singularity. In the public sector, a seven-figure expansion with a major U.S. agency was executed early in Q2.
The company is transitioning from product-led sales to platform-first engagements. Longer deal cycles in large accounts contributed to net new ARR softness.
Purple AI
Purple AI delivered triple-digit YoY growth in bookings and was attached to 25% of all Q1 subscriptions. Bundling Purple into the Foundation package resulted in a ~25% deal size uplift.
Athena, a next-generation agentic AI engine, launched during RSA. Purple’s Auto Triage, now generally available, enables automated investigation and response within seconds, significantly reducing SOC workloads.
While adoption is strong, expanding Purple’s use cases from detection to orchestration adds pricing and deployment complexity. SentinelOne is investing in AI-specific sales strategies to drive clarity and scale.
Cloud Security Suite
The new Singularity Cloud Security Suite integrates CWPP, CSPM, CDR, identity protection, and AI-powered analytics into one architecture.
A Fortune 500 industrial manufacturer selected the suite to replace a fragmented incumbent system. The customer cited unified visibility and real-time response as key benefits.
Designed for public, hybrid, and multi-cloud environments, the suite supports real-time defense with embedded AI and no-code automation. While adoption is accelerating, ARR for the suite was not disclosed. Competitive positioning focuses on real-time execution over legacy or CNAPP-only providers.
AI SIEM and Data
SentinelOne’s AI SIEM and data analytics business surpassed $100 million in ARR in Q1. A Fortune 500 retailer replaced Splunk, citing cost reduction, simplified operations, and AI-driven intelligence.
The product now integrates with third-party data lakes without requiring migration, removing a key barrier for enterprise adoption.
SentinelOne positions its AI SIEM not as a logging solution but as a unified security data plane—automating detection, correlation, and response across platforms. Multi-phase deployments are common due to architectural complexity in legacy environments.
Product Innovation
Key Q1 launches include:
Purple AI Auto Triage (GA): Autonomous threat investigation and remediation
Singularity Hyperautomation (GA): No-code workflow execution
Athena: AI platform for agentic cybersecurity
SentinelOne was named top-performing endpoint vendor by Frost & Sullivan and received SC Media awards for Best Endpoint and Best Cloud Security.
Go-To-Market Strategy
SentinelOne is shifting to a platform-first GTM model. This enables broader adoption and larger deals. The new Partner One program targets MSSPs, VARs, and technology partners, with streamlined tiering and incentive structures to drive channel scale.
Customer Growth
Customers with ARR >$100,000 grew 22% YoY to 1,459. Average ARR per customer rose by double digits, driven by platform expansion and AI attach. Remaining performance obligations increased 33% YoY to $1.2 billion.
About 50% of bookings came from new logos, indicating strong market capture.
Enterprise Wins
A Fortune 500 financial firm centralized security using the Singularity Platform. A Fortune 500 industrial company adopted the Cloud Security Suite to replace a fragmented stack. A Fortune 500 retailer selected SentinelOne’s AI SIEM to replace Splunk, significantly lowering operational costs and complexity.
FedRAMP Progress
SentinelOne achieved FedRAMP High authorization for Purple AI, CNAP, and Hyperautomation—extending coverage across the full platform. Purple AI is now the only agentic AI cybersecurity solution approved for U.S. government use.
A seven-figure federal expansion was closed early Q2. Federal pipeline remains healthy but deal timing remains variable due to procurement processes.
Capital Allocation
Cash and equivalents rose to $1.2 billion. A $200 million open-ended share repurchase was announced, signaling confidence in long-term fundamentals and valuation. The company affirmed this will not impact innovation or M&A capacity.
Macro Conditions
April saw an unexpected macro shift. Elongated sales cycles, especially among new customers, slowed net new ARR. No increase in churn was observed. Deal slippage, not cancellations, was the issue.
SentinelOne cited federal budget uncertainty and global trade tensions as contributors. Trends improved in May, but the company is maintaining a measured outlook for FY26.
FY2026 Guidance
Q2 revenue expected at $242 million (+22% YoY). Net new ARR is projected to grow more than 2x typical Q2 seasonality.
Full-year revenue forecast revised to $996M–$1.0B (22% growth), slightly down from prior guidance. Gross margin projected at 78.5%–79.5%, with operating margin improving to 3–4% from -3% in FY25. Free cash flow expected to exceed operating margin by several percentage points.
Future Outlook
Despite Q1 disruption, SentinelOne remains on track for long-term AI-driven growth. The shift toward a unified, agentic AI cybersecurity platform is unlocking higher ARR per customer, larger deals, and long-term contracts.
Management expects growth to reaccelerate in the second half of FY26 as new solutions like Purple AI, Cloud Security, and AI SIEM continue gaining traction.
Management comments on the earnings call.
Product Innovations
Tomer Weingarten, Chief Executive Officer
"At RSA, we announced Athena, the next evolution of Purple AI, showcasing our vision to deliver the industry's first true end-to-end agentic AI platform for cybersecurity."
"Purple AI's Auto Triage, now generally available, helps investigate threats, orchestrate multistep responses, and remediate incidents in seconds. Also generally available is Singularity hyperautomation. Combined with Purple AI, this allows enterprises to harness no-code automated workflow capabilities to execute novel detection rules autonomously."
"We're enabling customers to seamlessly connect to third-party data sources, unlocking the full potential of Purple.ai for enterprises regardless of where they are in their data migration journey."
Singularity Platform
Tomer Weingarten, Chief Executive Officer
"We continue to solidify our position as a technology leader across key growth categories of AI, cloud, data, and endpoint. Our Singularity platform is setting new benchmarks across the industry for AI-powered cybersecurity, delivering industry-leading performance and operational resilience."
"Going forward, we're making our offerings more flexible and even easier to access, adopt, and deploy. We believe this will increase velocity, drive broader platform adoption, and unlock more value for our customers over time."
Purple AI
Tomer Weingarten, Chief Executive Officer
"Purple AI achieved triple-digit year-over-year growth in quarterly bookings, underscoring strong market demand and momentum. It also achieved an attach rate that exceeded 25% across subscriptions sold in the quarter."
"Purple AI is now the first and only cybersecurity agentic AI solution approved for US government organizations."
"When we talk to customers today, the breadth and depth of our platform is significant... One example of that could be our Purple AI offering. Once we've introduced that into our foundation package, it immediately drove more and more adoption and the price uplift."
AI SIEM
Tomer Weingarten, Chief Executive Officer
"Our data solutions surpassed $100 million of ARR in Q1... This win underscores the momentum of our AI SIEM offering and the increasing preference for our modern AI-driven cloud-native data solution."
"There's definitely more and more interest in cloud-native SIEM solutions or data lakes, both because of the cost benefit, but I think more importantly, because of the need to start addressing threats and issues in real-time."
"As customers are doing that, especially in this new brave AI agentic world, they want these new solutions, these new data solutions already be embedded with AI, and that's exactly what our AI SIEM is able to provide out of the box."
Competitors
Tomer Weingarten, Chief Executive Officer
"We're one of the biggest cybersecurity providers in the world today... To us, it's only about putting the right types of products and solutions into the hands of customers. This market is incredibly big, and we're focused on our own path."
"What we're seeing more and more is that... customers want these new solutions, these new data solutions already be embedded with AI... Most of these [legacy SIEM] systems have very significant latency, and these are deep architectural issues that they have. They're not gonna be solved overnight or maybe at all."
Customers
Tomer Weingarten, Chief Executive Officer
"Our success with large enterprises and platform adoption continues to drive higher ARR per customer, which reached a new record in Q1."
"A leading Fortune 500 financial institution consolidated multiple security vendors by switching to us, reducing overhead and improving performance. Our unified platform and autonomous security were clear differentiators."
"A large Fortune 500 retailer faced significant challenges around soaring Splunk costs... Singularity directly addressed these challenges by simplifying operations, lowering costs, and providing a unified intelligence security experience."
"A Fortune 500 industrial leader was seeking to modernize its cloud security posture. Our Singularity cloud security suite seamlessly met their complex requirements and exceeded product performance expectations."
FedRAMP
Tomer Weingarten, Chief Executive Officer
"Earlier this month, we achieved FedRAMP high authorization for Purple, CNAP, and hyperautomation across the Singularity platform. Purple AI is now the first and only cybersecurity agentic AI solution approved for US government organizations."
"This milestone is an important competitive differentiator and reflects our deep strategic commitment to safeguarding the US government's most sensitive environments."
Challenges
Tomer Weingarten, Chief Executive Officer
"Given the heightened macro uncertainty in April, we observed elongated sales cycles as certain customers paused their spending decisions, impacting our Q1 net new ARR."
"We have not seen any deal cancellations. As we look ahead, unknowns around federal purchasing, global trade, all of that is still present... We're trying to be mindful and reflect that in our outlook."
Barbara Larson, Chief Financial Officer
"We definitely are seeing improved trends in May compared to what we saw in April. But we're also trying to be thoughtful about the environment and the potential that there might be further unexpected external disruption."
Guidance Lowered
Barbara Larson, Chief Financial Officer
"So, just in terms of the broader piece, I would say our outlook is reflecting underlying kind of new business growth as we move throughout the year... our revenue guide, we did decrease that by 1%, and you can assume that that means our internal expectations around net new ARR came down a slight bit as well."
Tomer Weingarten, Chief Executive Officer
"We're trying to create some more room to be able to digest better any potential further disruption. This environment is proving to be very unpredictable on almost a daily or weekly basis. So we're just trying to take a more tapered approach to our growth expectations."
Future Outlook
Tomer Weingarten, Chief Executive Officer
"The future for AI-powered security is approaching. Opportunity is vast, and our differentiation is becoming stronger."
"In a world where threats move at machine speed, legacy siloed tools or complex platforms built around static features are no longer effective. Cybersecurity also requires a new standard, one where software adapts to the need of the business, not the other way around."
"We believe our platform and innovation approach will become increasingly critical for any customer in any deployment model across any environment. For years, we've been at the forefront to lead this shift."
Thoughts on SentinelOne Earnings Report $S:
🟢 Positive
Revenue grew to $229M (+22.9% YoY, +1.6% QoQ), beating estimates by 0.4%.
Gross margin rose to 79.2% (+0.4 pp YoY), maintaining top-tier levels.
Operating margin improved by +4.2 pp YoY to -1.7%.
Free cash flow margin reached a record 19.8% (+1.7 pp YoY).
ARR increased to $948M (+24.4% YoY).
Remaining Performance Obligations rose to $1.16B (+33.0% YoY).
International revenue share expanded to 38%, growing 27% YoY.
AI SIEM ARR surpassed $100M, with major win replacing Splunk.
Purple AI bookings grew triple digits YoY, with 25% attach rate and ~25% deal size uplift.
Cloud Security Suite deployed by Fortune 500 firms, showing enterprise traction.
$200M share buyback announced, reflecting strong balance sheet and confidence.
🟡 Neutral
EPS (non-GAAP) was $0.02, in line with expectations.
Billings reached $202M (+22.6% YoY).
1,459 customers with ARR >$100K (+22.3% YoY, but weak new addition).
Partner One program launched to support GTM transition, early-stage impact.
Customer additions included +48 $100K+ ARR clients, showing steady but not accelerating pace.
Sales & Marketing spend fell to 47.2% of revenue (-3.5 pp YoY), while R&D spend rose slightly to 21.9%.
🔴 Negative
Net new ARR dropped to $55M (-14.9% YoY), pressured by macro delays and longer deal cycles.
Net margin declined to -90.9% (-53.3 pp YoY).
Customer acquisition cost (CAC) payback extended to 54.3 months (+20.2 months YoY).
R&D Index (RDI) decreased to 1.00 (-0.20 YoY), signaling slower efficiency leverage.
Q2 revenue guidance of $242M missed estimates by 1.2%.
FY2026 revenue guidance cut to $996M–$1.0B, down 1.1% from previous, below consensus.
Dilution: basic shares up 6.0% YoY, diluted shares up 9.6% YoY.
Stock-based compensation remains high at 30% of revenue, despite QoQ improvement.
Thank you for reading!
Follow me for more frequent updates on X/Twitter and Threads, and on LinkedIn. For visual infographics, check out Instagram, and for portfolio changes, follow me on Savvy Trader.
Disclaimer: This earnings review is for informational purposes only and does not constitute financial, investment, or trading advice.