# SentinelOne Inc. (S)

**Exchange:** NYSE  
**Coverage as of:** 2026-Q2  
**Updated:** 2026-05-18  
**Report type:** Primer (steps 1–3 of 19)  
**API endpoint:** GET /api/v1/research/S/primer

## Business Model

---
ticker: S
step: 01
generated: 2026-05-13
source: quick-research
---

### SentinelOne, Inc. (S) — Business Overview

#### Business Description
SentinelOne is an AI-native cybersecurity platform that delivers endpoint detection and response (EDR/XDR), cloud security (CNAPP), identity security, and security data management (SIEM) through a single unified agent architecture — Singularity. Unlike legacy antivirus (signature-based) and even first-generation EDR (human analyst-dependent), SentinelOne's behavioral AI engine detects and responds to threats autonomously in milliseconds without requiring human intervention. FY2026 (ended Jan 2026) revenue exceeded $1B (+22% YoY), marking the first full year of non-GAAP profitability and $1B+ ARR.

#### Revenue Model
Subscription-based: customers purchase the Singularity Platform base (endpoint) and expand to additional modules (cloud, identity, SIEM, managed services). Multi-module adoption drives NRR expansion. ~30% of revenue through channel partners (MSSPs, resellers). ARR grew from $548.7M (Jan 2023) to $1B+ (Jan 2026) — tripling in 3 years. Large enterprise customers ($100K+ ARR) represent the core: 1,310+ such customers growing 24% YoY. International revenue is a key expansion vector (+34% YoY in recent quarters).

#### Products & Services
- **Singularity Endpoint** — EDR/XDR: AI-powered malware prevention, behavioral detection, automated response with 1-click rollback
- **Singularity Cloud (PingSafe)** — CNAPP/CWPP: cloud workload protection, Kubernetes security, cloud infrastructure entitlement management
- **Singularity Identity** — Active Directory protection, identity threat detection and response
- **Singularity Data Lake** — SIEM + security data platform; ingests logs from any source for unified threat hunting
- **Purple AI** — conversational AI security analyst; allows security analysts to query threat data in natural language
- **Wayfinder Frontier AI Services** — next-generation AI security platform (launched 2025)
- **Prompt Security** (acquisition) — GenAI governance and runtime protection for AI applications

#### Customer Base & Go-to-Market
10,000+ customers (estimated); 1,310+ with $100K+ ARR; ~30% of Fortune 500. Notable: Amazon, JPMorgan, Tesla. Direct sales (enterprise) + channel partners (MSSPs, VARs, cloud marketplaces). Government authorizations expanding internationally. Purple AI is a key upsell driver — security teams pay more for AI-assisted investigation capabilities.

#### Competitive Position
SentinelOne competes directly with CrowdStrike (dominant market share, Falcon platform), Microsoft Defender (bundled with enterprise licenses), and Palo Alto Networks (Cortex XDR). CrowdStrike's high-profile BSOD outage in July 2024 created the largest displacement opportunity in cybersecurity history — SentinelOne was a primary beneficiary, gaining enterprise accounts. Differentiation: autonomous AI response (no human in the loop), cloud-native single-agent architecture, competitive pricing vs. CrowdStrike, and Singularity Data Lake as a cheaper alternative to Splunk/SIEM.

#### Key Facts
- Founded: 2013
- Headquarters: Mountain View, California
- Employees: ~3,000
- Exchange: NYSE
- Sector / Industry: Technology / Cybersecurity — AI-Native EDR/XDR
- Market Cap: ~$4–5B (at ~$16–20/share; trades at ~4x sales)

## Financial Snapshot

---
ticker: S
step: 04
generated: 2026-05-13
source: quick-research
---

### SentinelOne, Inc. (S) — Financial Snapshot

*Note: SentinelOne's fiscal year ends January 31.*

#### Income Statement Summary

| Metric | FY2023 | FY2024 | FY2025 | YoY |
|--------|--------|--------|--------|-----|
| Revenue | $422M | $621M | $822M | +32% |
| Non-GAAP Gross Margin | ~72% | ~76% | ~78% | improving |
| GAAP Operating Margin | ~-65% | ~-45% | ~-30% | improving |
| Non-GAAP Operating Margin | ~-20% | ~-8% | ~-2% | approaching breakeven |
| GAAP Net Income | ~-$0.28B | ~-$0.28B | ~-$0.25B | slow improvement |

*FY2026 (ended Jan 2026): Revenue $1B+ (+22% YoY); ARR $1B+; non-GAAP operating margin 3.5% — first full year of non-GAAP profitability; expanding 600 bps annually. Q2 FY2026: revenue $242M (+22% YoY), non-GAAP operating margin 2%, non-GAAP gross margin 79%. FCF positive on TTM basis for first time. International revenue +34% YoY.*

#### Cash Flow & Balance Sheet (FY2025)

| Metric | Value |
|--------|-------|
| Operating Cash Flow | ~$50–80M |
| Free Cash Flow | ~$20–50M (first TTM-positive milestone) |
| Capital Expenditures | ~$25M |
| Cash & Equivalents | ~$1.5B |
| Total Debt | ~$0 (effectively debt-free) |

*Debt-free with $1.5B+ cash — exceptional financial position for a growth company. FCF turned positive on TTM basis in FY2025/FY2026 — a key milestone. GAAP losses persist from SBC (~35% of revenue), but declining rapidly as SBC grows slower than revenue. Non-GAAP profitability achieved FY2026 with 600bps annual margin expansion trajectory.*

#### Key Ratios (approximate)
- P/E: N/A (GAAP losses) | EV/Sales: ~4x | FCF Yield: ~1%
- Revenue Growth (TTM): ~22% | Non-GAAP Operating Margin: ~3.5%

#### Growth Profile
SentinelOne grew from $422M (FY2023) to $1B+ (FY2026) — 2.4x in 3 years — but growth decelerated from 106% (FY2023) to 22% (FY2026) as the business matures. The CrowdStrike BSOD outage (July 2024) provided a major displacement catalyst. ARR $1B+ achieved; non-GAAP profitability achieved; FCF positive — three milestone simultaneously. Trades at ~4x EV/Sales vs. CrowdStrike's ~22x, representing the most significant valuation discount in cybersecurity.

#### Forward Estimates
- FY2027: Revenue ~$1.2–1.3B (+20–25% YoY); non-GAAP operating margin 8–10%
- ARR: tracking from $1B toward $1.3B as Purple AI upsell and cloud security expansion continue
- International: +34% growth; government authorizations expanding market
- FCF margin: targeting 8–12% as non-GAAP margins expand beyond 10%
- Analyst consensus PT: ~$24.83 (+34–50% from ~$16–18)

## Recent Catalysts

---
ticker: S
step: 12
generated: 2026-05-13
source: quick-research
---

### SentinelOne, Inc. (S) — Investment Catalysts & Risks

#### Bull Case Drivers

1. **CrowdStrike BSOD Displacement + 4x EV/Sales vs. Peers = Asymmetric Value** — The July 2024 CrowdStrike BSOD outage (the largest IT outage in history) caused a global wave of enterprise customers to reevaluate their EDR vendor. SentinelOne was the primary beneficiary, winning displacement deals throughout H2 FY2025 and FY2026. Meanwhile, SentinelOne trades at ~4x EV/Sales while CrowdStrike trades at ~22x — a 5x valuation gap for companies in the same market with similar growth rates. If the market re-rates SentinelOne to 8–10x EV/Sales as profitability solidifies (which would still be a 50%+ discount to CrowdStrike), the stock would double from current levels. The combination of a structural displacement catalyst (CrowdStrike trust damage) and extreme valuation discount creates the asymmetric setup that "ultra-deep value opportunity" analysts have flagged.

2. **AI-Native Platform + Purple AI + GenAI Security = Next-Generation Cybersecurity** — SentinelOne was built AI-native from inception — every threat detection is behavioral AI, not signatures. Purple AI (conversational security analyst) allows any analyst to query the entire security data lake in natural language — democratizing threat hunting that previously required expert SIEM analysts. The Prompt Security acquisition adds GenAI governance (protecting enterprises from AI application data leakage and prompt injection attacks) — a new TAM that is entirely new with no incumbent. Wayfinder Frontier AI Services extends SentinelOne's AI capabilities further. As enterprises deploy AI agents that generate new security risks, SentinelOne's AI security platform is the most direct beneficiary — securing the AI layer itself.

3. **Non-GAAP Profitability + $1.5B Cash + 600bps/Year Margin Expansion = Path to Premium Valuation** — SentinelOne achieved its first full year of non-GAAP profitability in FY2026 with 3.5% operating margins expanding 600 basis points annually. At the current expansion rate, SentinelOne reaches 15%+ non-GAAP operating margins by FY2028–2029 on $1.5–2B+ revenue — generating $225–300M in non-GAAP operating income. With zero debt and $1.5B+ in cash, the balance sheet is a fortress. As profitability solidifies and investors gain confidence in the margin trajectory, the re-rating from 4x EV/Sales toward 8–12x becomes increasingly justified. "SentinelOne Strikes Gold: Options Surge as AI-native Security Firm Hits Profitability Milestone" (March 2026) reflects the market beginning to recognize this transition.

#### Bear Case Risks

1. **CrowdStrike Recovery + Microsoft Defender Bundling = Market Share Pressure from Both Sides** — CrowdStrike is not sitting still — the company has been aggressively discounting, offering credits, and improving its platform stability narrative post-BSOD. Many enterprises that considered switching ultimately stayed with CrowdStrike given switching costs and the improved reliability track record. Meanwhile, Microsoft Defender for Endpoint is bundled with E5 licenses that enterprises already pay for — making "free good enough security" the path of least resistance for cost-conscious IT buyers. SentinelOne is squeezed between a recovering premium competitor (CrowdStrike) and a free enterprise offering (Microsoft). Growing the $100K+ ARR customer count from 1,310 at 24% YoY requires consistently winning against these entrenched alternatives.

2. **Heavy SBC + GAAP Losses + Slower Growth = Multiple Compression Risk** — SentinelOne's SBC is ~35% of revenue — among the highest ratios in large-cap software. GAAP net losses persist at ~$250M/year despite $822M revenue. While non-GAAP profitability is positive and improving, the 35% SBC ratio means shareholders are bearing significant dilution costs that GAAP accounts for but non-GAAP ignores. Revenue growth deceleration from 106% (FY2023) to 32% (FY2025) to 22% (FY2026) raises the question: what's the floor? If growth settles in the 15–18% range (as security budgets mature), the current 4x EV/Sales while appropriate given peers, doesn't represent a screaming value — just fair value for a mid-growth security company with modest FCF.

3. **Execution Risk on Multi-Module Expansion + Profitability Timeline** — SentinelOne's bull case requires successful expansion from endpoint into cloud (CNAPP), identity, SIEM, and AI security — all simultaneously. Each expansion has a well-resourced competitor: Palo Alto for CNAPP, CrowdStrike Identity, Splunk/Microsoft for SIEM, and no incumbent for AI security (but new entrants are moving fast). Multi-product execution at scale is difficult — the company must build out enterprise sales capability for each new product category while maintaining growth in the core endpoint business. If any major product expansion stumbles (poor adoption, integration issues, or customer confusion about an expanding product surface area), the multi-module thesis delays and the profitability timeline slips.

#### Upcoming Events
- **Q1 FY2027 earnings** (June 2026): Revenue vs. $1.2B FY2027 trajectory; ARR growth sustaining above $1B
- **Purple AI adoption**: Customer penetration rate; ARPU uplift from AI security analyst upsell
- **Prompt Security integration**: GenAI governance becoming a billable product line
- **International government authorizations**: New FedRAMP/CATO certifications expanding government TAM
- **Non-GAAP margin expansion**: Whether 600bps/year trajectory holds toward 10%+ in FY2027
- **CrowdStrike displacement velocity**: Ongoing win rate data from field sales teams

#### Analyst Sentiment
Moderate Buy with significant upside: analyst consensus PT ~$24.83 (+34–50% from ~$16–18). Multiple analysts have highlighted SentinelOne as an "ultra-deep value opportunity" in cybersecurity — citing the 4x EV/Sales vs. CrowdStrike's 22x as the central mispricing. The profitability milestone (FY2026 non-GAAP profitable, FCF positive) has begun shifting the narrative from "loss-making challenger" to "profitable AI-native cybersecurity platform." Government sector expansion and Purple AI upsell are near-term catalysts analysts are watching most closely.

#### Research Date
Generated: 2026-05-13

## Full Research Available

This primer covers steps 1–3 of 19. The full deep dive (moat analysis, DCF, bull/bear,
management quality, earnings transcript analysis) is available via:

- Investment memo: /memo/s
- Full research API: GET /api/v1/research/S/memo
- Coverage universe: /stocks