Investment Memorandum · Preview
For informational purposes only. Not investment advice.
SentinelOne, Inc.
S
May 27, 2026
SentinelOne is an AI-native cybersecurity platform offering endpoint detection and response (EDR), extended detection and response (XDR), cloud-native application protection (CNAPP), and SIEM via a single-agent architecture (the Singularity Platform). The company's Purple AI copilot enables natural-language threat hunting and investigation and has achieved >50% customer attach rate. FY2026 (ended January 31, 2026) revenue was $1,001.3M (+22%) with ARR of $1,119.1M (+22%) and non-GAAP operating margin of 3.5%. The company is debt-free with ~$770M net cash. FY2027 management guidance calls for ~$1.20B revenue and ~9.5% non-GAAP operating margin ($110-120M operating income). Fiscal year ends January 31 (non-calendar).
▲ Bull Case
- ◆Purple AI attach rate exceeds 70% by FY2029, driving NRR above 120% and compounding ARR well beyond base-case forecasts; natural-language threat investigation becomes the daily analyst workflow interface creating deep switching costs that differentiate S from CrowdStrike and legacy vendors structurally.
- ◆FY2027 non-GAAP operating margin beats guidance at 10-11%, triggering a violent multiple re-rating from 3.16x toward peer-level 10-12x NTM Revenue; the market recognizes the margin inflection as durable and closes the 83% valuation discount to CrowdStrike, driving the stock toward $63 (FY2029E bull case at 12x revenue).
- ◆FedRAMP IL4+ certification approval in FY2028 unlocks the federal vertical, potentially adding $100-200M of highly sticky ARR in the hardest-to-displace customer segment, while CrowdStrike's BSOD-related reputational overhang stalls its recovery and S gains net new enterprise logos in a greenfield competitive environment.
▼ Bear Case
- ◆FY2027 non-GAAP operating margin comes in significantly below guidance at 6-8%, the largest single-year margin ramp in company history proves unachievable, the re-rating catalyst is deferred 12-18 months, and the stock retests or breaks below $10 as investor patience exhausts and the GAAP loss narrative dominates sentiment.
- ◆Microsoft Defender AI achieves autonomous response parity with Purple AI at E5/E3 pricing, commoditizing SentinelOne's core value proposition for the majority of enterprise prospects who already own E5 licenses, compressing the addressable TAM from $80-100B to $15-20B and structurally limiting S's achievable multiple.
- ◆Revenue growth decelerates below 15% YoY for two consecutive quarters due to CrowdStrike aggressive discounting post-BSOD recovery combined with macro IT spending pressure, repricing S permanently to value multiples (3-5x EV/Revenue) as the growth narrative collapses; FY2029E revenue tracks toward $1.40B yielding only $19/share at 5x.
“The central Wall Street debate is whether SentinelOne's 9.5% non-GAAP operating margin guidance for FY2027 is achievable and durable, or whether it represents an aspirational target that will be missed as the company attempts the largest single-year margin expansion in its public history while competing aggressively against a recovering CrowdStrike. Bulls argue the 3.16x EV/NTM Revenue multiple already prices in failure and that any margin delivery triggers a violent re-rating; the risk-reward is asymmetric with a -9% bear case floor. Bears argue that GAAP losses remain deep (SBC $280-320M/yr), margin guidance is untested, CrowdStrike's post-BSOD discounting compresses new logo ASPs, and Microsoft's continued E5 bundling expansion makes the mid-market TAM structurally smaller than modeled. A secondary debate concerns Purple AI: bulls see >50% attach rate as genuine workflow lock-in and a moat-widening mechanism; bears view it as a feature that Microsoft or CrowdStrike can replicate natively. The resolution — Q1 FY2027 earnings (June 2026) — is the first binary data point for the thesis.”
- ◆Q1 FY2027 earnings (June 2026): first data point on non-GAAP operating margin trajectory toward 9.5% — 8%+ tracking triggers re-rating initiation
- ◆FY2027 full-year earnings (March 2027): definitive confirmation or refutation of 9.5% non-GAAP operating margin — THE defining re-rating event
- ◆Purple AI attach rate acceleration above 60-70% with NRR expansion to 115%+ demonstrating platform cross-sell monetization
- ◆FedRAMP IL4+ certification announcement opening the federal vertical ($100-200M ARR potential in hardest-to-displace segment)
- ◆CrowdStrike post-BSOD competitive dynamic: any evidence S is winning net new enterprise logos from CRWD's reputational overhang
- ◆Third Point Investors 13F filings confirming maintained or increased position (validates the $12 floor investment thesis)
- ◆FY2027 non-GAAP operating margin significantly below 9.5% — largest single-year margin step in company history; 30-35% probability; delays re-rating 12-18 months
- ◆Microsoft Defender AI reaches autonomous response parity with Purple AI at E5/E3 pricing — 15-20% probability; VERY HIGH impact; structurally compresses TAM and multiple
- ◆CrowdStrike aggressive discounting post-BSOD recovery damaging new logo ASPs and slowing S ARR growth — 30-40% probability; MEDIUM impact
- ◆Revenue growth decelerates below 15% YoY for two consecutive quarters — 20-25% probability; HIGH impact; reprices S to permanent value multiples
- ◆SBC remains above 30% of revenue through FY2028 — 25-30% probability; GAAP losses persist; dilution compounds; sentiment overhang on non-specialist investors
- ◆CEO Tomer Weingarten departure without named successor and/or Third Point Investors exits >50% of position simultaneously — 10-15% probability; dual signal loss of operational and investment conviction
Full Memo Continues
5 more sections, locked
- ●Valuation Range & DCFBase/bull/bear fair-value range, WACC, terminal growth, sensitivity to revenue + margin assumptions.
- ●Risk/Reward AssessmentPosition-sizing framework with explicit upside/downside skew and entry conditions.
- ●Management & Capital AllocationMulti-year capital-allocation track record, incentive alignment, and management readout.
- ●Monitoring FrameworkWhat to watch each quarter — leading indicators and inflection signals tracked by the analyst.
- ●Unresolved QuestionsOpen analyst questions and follow-up research items — the depth signal.
For Agents — $2 per memo
Call the JSON API with a Stripe Shared Payment Token. No account, no signup — just pay and call.
GET /api/v1/research/S/memo Authorization: Bearer spt_...
Fund managers — coverage subscriptions launching soon. See marginofinsight.com.