SentinelOne

SentinelOne reported second-quarter results that included sales growing 21% to $292 million and adjusted operating margins expanding 800 basis points to 10%. The firm's annual recurring revenue, or ARR, grew 22% to $1.218 billion.

Why it matters: SentinelOne, despite being materially smaller than cyber platforms such as CrowdStrike and Palo Alto, is seeing success in its multisolution cyber strategy as enterprises invest more in cyber defense capabilities to offset artificial intelligence models becoming more capable in cyber offense. While we continue to view Sentinel as a sub-scale player in a cyber market defined by vendor consolidation, we see this renewed interest in cyber spending by enterprises as an opportunity for Sentinel to expand its wallet share by cross-selling its products to existing and new customers. To this end, we like the fact that more than 50% of the firm's ARR comes from nonendpoint solutions, underscoring Sentinel's continued push to diversify beyond endpoint.

The bottom line: We are raising our fair value estimate for no-moat Sentinel to $20 per share, from $16. With shares trading down after hours Aug. 27, we continue to view them as overvalued. Our fair value increase is primarily driven by increased confidence in the firm's momentum beyond endpoint, with AI security offerings growing strongly and both data and cloud security modules reaccelerating. For investors looking for undervalued security names, we'd point to narrow-moat Zscaler, a name that trades below our fair value estimate.

Our fair value estimate for SentinelOne is $20 per share, implying a fiscal 2027 enterprise value/sales multiple of 5 times.

We forecast SentinelOne’s revenue growing at a 18% compound annual growth rate over the next five years. We expect the firm to continually expand its client base while maintaining strong upselling performance with existing clients. In our view, endpoint security is a key area of enterprise security spend and we expect it to remain important for clients in the coming years. SentinelOne’s “land-and-expand” model has shown great success with the firm able to consistently expand sales from existing customers by selling them additional modules or protecting more endpoints per customer. We expect this upselling velocity to persist as the everchanging threat landscape provides strong momentum for SentinelOne’s sales.

SentinelOne’s gross margins have hovered between 60% and 70% over the last three years. However, as the company grows and software becomes a larger part of its top line, we expect margin expansion on the gross margin front. We see this phenomenon across our coverage as software firms can distribute their costs over an increasing revenue base, driving the cost of sales down as a fraction of sales. As a result, we are modeling GAAP gross margins to expand to the high-70s range over our 10-year explicit forecast.

SentinelOne has spent heavily on research and sales in the past. However, as the company scales, we expect these line items to decrease as a percentage of sales. We model SentinelOne hitting GAAP profitability in fiscal 2031 as the firm continues to focus on growth while sacrificing near-term profitability.

We assign SentinelOne a no-moat rating owing primarily to our belief that the firm will continue to generate hefty operating losses in the next few years that will likely prevent it from generating excess returns on invested capital, on the whole, over the next decade. While don’t believe SentinelOne merits an economic moat, we’d be remiss not to note the strong customer switching costs associated with Singularity, the firm’s extended detection and response, or XDR, platform.

The primary market in which SentinelOne competes is extended detection and response (XDR). XDR is a nascent subsector, coming into existence as an evolution from endpoint detection and response (EDR). While EDR focuses on monitoring an enterprise's endpoints for nefarious cyber activity, XDR expands the scope by providing detection and response across endpoints, IoT workloads, networks, and cloud processes. By monitoring more data across an enterprise, XDR can offer richer insights into an enterprise's security infrastructure.

The evolution of XDR has also been aided by the structural change in how enterprises define their security perimeter. Historically, there has been a "neat" picture of an enterprise's security infrastructure; think of a house with endpoint protection available at every entry point. However, this way of managing security is rapidly becoming obsolete as distributed workforces, multi/hybrid cloud configurations, and zero trust security apparatuses challenge the conception of an enterprise’s digital infrastructure as one consolidated entity. As more companies undergo digital transformations, the updated form of protection focuses on securing an enterprise from various attack vectors that did not previously exist (such as IoT instances and cloud workloads). Moreover, the complexity of the threat landscape is also on the rise, leading to XDR vendors such as SentinelOne adding value to their customers' business.

SentinelOne's primary product is its Singularity Platform. The cloud-based solution is a one-stop-shop for an enterprise's XDR needs with services ranging from threat intelligence, hunting, mitigation, and response. With pricing determined on a per-agent basis, Singularity allows clients to quickly scale up demand as their business grows, allowing SentinelOne to maintain solid upselling velocity. We think that Singularity's greatest value adds are the improvement in labor productivity it brings by reducing the workloads of IT security teams. By hunting, tracking, and attacking cyberthreats, SentinelOne's platform can enable IT security teams to free themselves of taxing threat detection and focus more on bigger-picture IT security issues. While the broader market SentinelOne is attempting to serve remains largely greenfield with XDR/EDR adoption only expected to grow, we believe that SentinelOne could face stiff competition from the likes of Crowdstrike, particularly with enterprise clients.

Looking at Singularity’s entrenchment into a client’s IT infrastructure, we think that high customer switching costs are likely. Humans and, by extension, enterprises exhibit loss aversion. This aversion, in our opinion, is particularly true in the IT security landscape. There is an operational risk when switching XDR vendors, including loss of analytics during the changeover, project execution, and operational disruption. The more critical the function and the more touchpoints across an organization a vendor has, the higher the switching costs. We believe that any security-related data loss, disruption, or lapse is a material cost associated with switching vendors.

Customers that adopt security solutions do so to take uncertainty off the table—switching vendors often brings uncertainty back into play. We estimate that SentinelOne's gross retention has remained above 95%, implying a customer lifetime of around 20 years. At the same time, by upselling its customers into buying more XDR modules and agent expansion, SentinelOne has a net retention rate of around 110%. While these metrics are in line with companies under our coverage that have been awarded economic moats, we remain unconvinced that these retention metrics, and the implied switching costs, will allow SentinelOne to out earn its cost of capital over the next decade. Sentinel’s customers appear to be sticky, but the company has incurred operating losses to build its business and capture these customers.

We think SentinelOne's AI models and proprietary database (Dataset) show signs of a budding network effect. As the firm's AI models ingest more raw data, they can iteratively improve their threat detection, hunting, and mitigation capabilities. This improvement results in customers having a lesser incentive to switch away from SentinelOne's XDR platform all while new customers are attracted to Singularity due to its improved functionality. The influx of new customers then provides SentinelOne’s AI models with more data to further enhance their capabilities. We suspect that as the company grows, and scales, its AI models, via the flywheel effect described above, could form a network-effect economic moat around the business.

While SentinelOne’s business demonstrates a strong qualitative argument for an economic moat, the firm’s profitability (both past and projected) is one filled with red ink. Fueled by massive investments in sales and research, SentinelOne has stacked up hefty economic losses over the last couple of years, a trend we expect to continue well into the future. Thus, we don’t foresee SentinelOne from generating excess returns on capital in the near-to-medium-term, which precludes us from assigning an economic moat rating to the firm.

SentinelOne has strong secular tailwinds as the endpoint security market is projected to grow rapidly.

SentinelOne’s Singularity platform iteratively improves itself over time, thereby making customer churn less likely over time.

Plenty of greenfield opportunities exist for SentinelOne to explore without running into competition against larger players.

Large public cloud vendors often offer their own cybersecurity solutions, which could hamper SentinelOne’s growth opportunities.

SentinelOne faces competition from vendors like Crowdstrike and Palo Alto Networks that are larger and more well-capitalized than SentinelOne.

As the firm ploughs more cash into its research and sales divisions, investors should not expect positive GAAP operating margins in the near-to-medium-term.