SentinelOne: Exceptional Product at a Decent Valuation
At time of writing, SentinelOne is trading very close to its IPO opening price of $46.00 when the stock opened for trading on June 30th. We outlined how this price included a large 900% premium from its last private valuation round. Now that SentinelOne has more trading history and is doubling its revenue every year, the stock is catching up to its public market premium. By posting 128% revenue growth or more, the valuation has come down quite a bit. We are in the last quarter for fiscal 2022 and for fiscal year 2023, SentinelOne is trading at 33X expected revenue for 2023. We think this is a reasonable buy zone for a company with this level of growth that is expected to continue.
I’ll review the product which was first covered here in my Forbes write-up. Below, Bradley also discusses the operating losses and other key points regarding the financials losses that are being front-loaded from customer acquisitions as it captures market share. However, he outlines in more detail below that there are signs of leverage in its model. Customer growth is especially strong with SentinelOne and the net retention rate is healthy. We also discuss SentinelOne’s products and why cloud is a key area of strength.
SentinelOne Product Overview: Fight Machine-with-Machine
SentinelOne is an AI-powered cybersecurity company at the forefront of autonomous threat detection and prevention. The company is one of the first to introduce autonomous threat detection and prevention. It has developed an AI-powered XDR platform to make cybersecurity protection truly autonomous from the endpoint and beyond. Endpoint security refers to protecting the endpoints or entry points of the end-user devices such as desktop PCs, laptops, mobile devices, and servers from being exploited. SentinelOne expands this definition (hence XDR for “extended” instead of EDR) to include more data points.
Overview of SentinelOne
The product differentiation is best summed up by the fact other vendors require data to be sent to the cloud for analysis and often have many humans monitoring the alerts to take action. Meanwhile, SentinelOne uses automation to find the threat which reduces the number of false positives. Instead of getting every piece of telemetry that requires the security team to investigate, SentinelOne’s endpoint detection and response solution eliminates the noise so that the security team is only responding to those that have the potential to be critical.
According to SentinelOne’s S1, “Cyberattacks have become the output of military-grade, highly resourced, and automated nation-state and cybercrime operations. We envisioned a revolutionary data and artificial intelligence paradigm where technology alone could autonomously prevent, detect, and respond to cyberattacks. It is time to fight machine with machine.”
They emphasize that legacy antivirus powered by human-generated signatures still remains a widely used security technology. This is in spite of the fact that they are ineffective and reactive. Human-powered endpoint detection and response, or EDR, emerged as an alternative where people became the detection and response crew.
This approach led to the “1-10-60” rule which claims the best achievable cybersecurity outcome was capped at one minute to detect an attack, 10 minutes to investigate, and 60 minutes to respond. Recent ransomware attacks have proved that it only takes milliseconds to breach an organization and cause damage.
SentinelOne: Singularity XDR Platform
SentinelOne launched the XDR solution in the first half of 2020 prior to going public in 2021. This platform offers Active EDR, which allows for more visibility and automated responses for Endpoint Detection and Response (EDR). SentinelOne has many competitors in the EDR space while XDR extends the definition of “endpoint” to not only include devices and workstations, but to also include other data points on the network, such as containers and cloud-native applications, and also across the entire stack, such as email, the network, and identity. Extended detection and response (XDR) is cross-layered detection and response. XDR collects and automatically correlates data across multiple security layers – email, server, cloud workloads, and network – so threats are detected faster and security analysts improve investigation and response times.
SentinelOne uses many data sources to create a data lake. The single pool of raw data is built across a wide range of sources, including other vendors or internal data sources. Automation works best with a lot of data and SentinelOne is compatible with AWS, Azure or Okta, Splunk, Zendesk, and Slack. What matters to customers is that every threat is detected very quickly, and SentinelOne proposes a solution that is able to do both because automation and AI is best done at the data level rather than managing thousands of user endpoints to mitigate attacks.
The company’s Singularity Platform ingests, correlates, and queries petabytes of structured and unstructured data from ever-expanding disparate external and internal sources in real-time. It builds rich context and delivers greater visibility by constructing a dynamic representation of data across an organization. As a result, the company’s AI models are highly accurate. The company’s distributed AI models run both locally on every endpoint and every cloud workload, as well as on the company’s cloud platform and the AI models predict threats in milliseconds. The behavioral AI model maps and links all behaviors on the endpoint to create Storylines. When an activity is deemed to be a threat, the system automatically takes action to kill the attack.
Although SentinelOne and the XDR Platform is listed behind Crowdstrike and Microsoft on Gartner’s Magic Quadrant, SentinelOne leads on peer reviews. This was discussed in the earnings call with 97% of reviewers saying they would recommend SentinelOne in the 2021 Gartner Voice of the Customer Report. We had also noted the company’s strength on peer reviews in our first write-up. The company also scores high on the highly respected MITRE ATT&CK evaluations with 100% visibility and zero missed detections.
Cloud is a Growth Lever for SentinelOne
Cloud is a growth lever for SentinelOne as the company leverages a microservices architecture for rapid and frequent updates. The company offers support for Kubernetes workloads with additional runtime protection and simplified deployment. Kubernetes is automation orchestration for containers and allows for scaling of a container rather than an entire application. Kubernetes was created by Google and is used by 78% of companies managing containers with this open-source system.
This was probably the most important thing said on the call: “Cloud still remains our fastest-growing module. About 10% of endpoints are covered by cloud and servers. It has been our fastest-growing module for some time. Cloud is a piece of the business, I think that we think will expand greatly in the future. We anticipate that at some point, it will be the similar size to the endpoint market.”
According to the earnings call, cloud was the fastest growing segment: “In particular, our cloud workload protection product delivered the highest growth during the quarter, a testament to the demand for our real-time run-time protection for cloud workloads and containerized environments.” This was expanded on later to say: “The vast majority of what we sold this quarter was the Complete package. I think that we’re seeing just overall standardization on the Complete platform. People are opting for our complete EDR package. I think what I can also say on top of that is just increased adoption of our cloud modules. We’re just seeing increased demand for cloud workload protection.”
In terms of cloud being a growth driver competitively speaking, the company stated the following: “And obviously, if you look at our mix today, also going into the cloud security opportunity, kind of further compounds it, and it’s something that the incumbent vendors never had to offer.”
The company stated its biggest competitor here is Palo Alto Networks and a few startups.
Last February, SentinelOne acquired Scalyr, a leading cloud-native data analytics platform that serves as a big data engine for the XDR platform. This helps SentinelOne ingest “massive amounts” of data real-time for the XDR platform by eliminating data schema requirements and also reduces index limitations. This speeds up the process and drives down costs by ingesting and correlating terabytes of data at machine speed. This also makes SentinelOne more competitive against SIEM tactics for data correlation and response.
In August, the company released SentinelOne Storyline Active Response (STAR) which is a cloud-based automation engine that allows security teams to create custom detection and response rules. STAR requires security teams to turn queries into rules for detection, and this challenges legacy providers. SentinelOne’s platform aggregates Storylines, which is essentially behavioral AI. The textbook definition of behavioral AI is to track behavior on a device to reveal insights. SentinelOne leverages behavioral AI to make a decision without relying on sending signals to the cloud or to security engineers before a decision is made. Instead, SentinelOne uses ActiveEDR to sift through alerts and anomalies and to form storylines. The machine helps to identify the threat and then automates a response. This is differentiated from other EDR products that are only used to detect rather than to respond.
Ranger for Agent Deployment and IoT
SentinelOne is able to find any device connected to a network through a ML device fingerprinting engine (FPE) by running an inventory of IP-enabled devices. This helps to identify unsecured endpoints and to close the security gap in agent deployment. This is what is meant by “limited visibility” or lacking full visibility of every device where just one unknown device can run malware or host ransomware and compromise a network. Other cases of unsecured endpoints could be a new server that doesn’t have an agent or new employees who are onboarded without protection yet installed. Ranger and Ranger Pro detect and notify IT teams of these unsecured endpoints. This is especially important for the internet of things (IoT) where the number of devices connected to the internet proliferates and is hard to track. For example, hospitals are becoming smart hospitals where there are thousands of devices connected to the internet. In this example, Ranger would notify the IT department if one device was unprotected.
In the earnings call, it was stated that Ranger grew triple-digits and that “In Q3, two of our Fortune 10 customers renewed with multiyear deals, and both expanded their use of the Singularity platform, adding modules such as Ranger and remote script orchestration.” Adding modules like Ranger help to keep net retention rate strong, which reached a record 130% in Q3.
Remote Script Orchestration (RSO)
RSO is a new product released this past quarter. The goal is to increase the speed in response to cyberattacks. This is done by executing scripts and commands remotely across thousands of endpoints. The company provides a script library to run scripts for all platforms from a console to find single endpoints or multiple endpoints that are compromised. This allows security teams to collect whatever is needed from remote machines. This allows the security team to terminate processes, remove files, delete directories and other responses very quickly. With STAR, this can also be automated and RSO is built for users of all technical abilities due to the script library.
SentinelOne also supports Zero Trust which eliminates the need for perimeter-based security for better protection in remote work scenarios.
Product Differentiation
Cybercrime will cost companies $10.5 trillion annually by 2025 with the cybersecurity market worth $345 billion-$400 billion. SentinelOne’s addressable market is expected to reach $40.2 billion in 2024 with $12 billion from endpoint security and $17 billion in analytics, intelligence and response.
According to SentinelOne, using their products can produce cost savings can be up to 353% – granted this number is a marketing department, however, the point is that any company increasing ROI in cybersecurity has a real chance of taking market share if their product improves the results. The savings quoted is achieved by reducing the amount of cybersecurity tools a company needs by standardizing endpoint security across more data types. The consolidation in this case saves up to $3 million over a three-year period and the enhanced threat detection saves $671K over three years. Due to automation, $1.2 million can be saved over three years by reducing time and employee hours across the IT team.
This breakdown is important to look at because SentinelOne’s main value proposition is actually consolidation of cybersecurity tools, and secondly, its automation/reduced hours. This is a different argument then relying only on enhanced threat detection alone, which is the main argument for many of the competitors (debate on whose product is better).
We see real evidence of this in the financials with 4 quarters of revenue acceleration. Here’s how the company compares to other high growth cybersecurity names in terms of acceleration.
The product differentiation is best summed up by the fact other vendors are on the endpoint and require data to be sent to the cloud for analysis and often have many humans monitoring the alerts to take action. Meanwhile, SentinelOne uses automation to find the threat which reduces the number of false positives by leveraging a data lake. Instead of getting every piece of telemetry that requires the security team to investigate, SentinelOne’s endpoint detection and response solution eliminates the noise so that the security team is only responding to those that have the potential to be critical. Per SentinelOne: “What enterprises need is automated security, not repackaged legacy AV and crowd-powered protection.”
SentinelOne is not breaking ground in a new market rather its goal is be a superior product to take business away from legacy vendors. Here’s a quote from management: “I think it’s safe to assume that about over 50% of it is still in the hands of the incumbents. Looking at our pipeline for Q4 and the out quarters, that doesn’t seem to change. So to us, that cycle is still ongoing. It’s a pretty big TAM that we’re serving. And obviously, if you look at our mix today, also going into the cloud security opportunity, kind of further compounds it, and it’s something that the incumbent vendors never had to offer. So that makes the entire buying cycle really more sticky, more inclusive and just overall more important for the enterprise. So it becomes part of the picture. But again, in almost every account that we go into, call it high 90s, we see an incumbent vendor. So we don’t see that tapering away anytime soon.”
Financial Overview:
By Bradley Cipriano
SentinelOne has pioneered a new approach to endpoint cybersecurity and the company is quickly capturing market share.
We can see this in recent results, as annualized recurring revenue (ARR) has accelerated for four consecutive quarters. Furthermore, the acceleration in ARR helps explain the large losses incurred by SentinelOne, as customer acquisition costs are front loaded. However, as these new customers renew their contracts, the firm’s topline will continue to grow but expenses will normalize, leading to strong profitability in the future. I outline why in more detail below.
Accelerating growth drives large losses but losses are temporary
SentinelOne has reported four consecutive quarters of accelerating ARR growth. Specifically, ARR most recently increased 131% YoY in Q3 FY2022, an acceleration from the 127%, 116% and 96% YoY increase in Q2 FY2022, Q1 FY2022 and Q4 2 FY2021, respectively. As of the most recent quarter, ARR increased $37 million QoQ to $237 million, which marked the 10th consecutive quarter of QoQ increases in ARR (there are only 10 quarters disclosed). It is noteworthy that the most recent sequential increase in SentinelOne’s ARR was as large as the firm’s entire ARR metric in Q1 FY2020.
It is also notable that the acceleration in ARR started after the October 2020 quarter. In December 2020, the high-profile SolarWinds cyberattack was identified, which had exploited key vulnerabilities in numerous service providers such as SolarWinds, Microsoft products (Office 365) and VMware. SentinelOne outperformed the competition during this period and disclosed in its S-1 that none of its customers were impacted by the SolarWinds cyberattack. This event may have been a catalyst that identified SentinelOne as a leading cybersecurity platform. Furthermore, the company launched its XDR platform in early 2020 and covid lead to a general acceleration in software and cybersecurity usage during this period, each of which likely contributed to the acceleration in ARR shown below.
The growth in ARR also flowed to the income statement, as Q3 sales increased 128% YoY to $56 million, which marked the fourth consecutive quarter of accelerating YoY growth. Growth was driven by new customers, as SentinelOne disclosed in its 10Q that new customers accounted for 46% of its topline expansion in the most recent quarter, while existing customers contributed 37% and channel partners accounted for the remaining 17%. Acquisitions provided $4 million in sales, and absent the impact of M&A, organic sales increased 113% YoY.
During the quarter, revenue from international markets grew 159% year-over-year to $19 million, and represented 33% of total revenue, up from 29% a year ago. International markets will be a key area of growth for the company going forward. Furthermore, SentinelOne’s international growth was similar to CrowdStrike’s international growth when it was a similar size as SentinelOne (~$56 million in quarterly sales in FY2019). Specifically, CrowdStrike’s international sales increased 196% YoY to 23% of sales in FY2019, highlighting the similar path that SentinelOne is following. I compare SentinelOne and CrowdStrike in more detail further below.
Gross margin improved from 58% in the year-ago quarter to 64%, which represented an all-time high (10 quarters of public information). However, despite the improvement in gross margins, operating margins remained deeply negative. For instance, Q3 operating margin was -120%, a slight improvement from the year-ago quarter of -121% and an improvement from the 10-quarter average of -141%.
While it is concerning to see operating losses larger than sales, this is due to the rapid growth in new customers. As mentioned above, new customers accounted for the majority of topline growth, a favorable trend. Furthermore, acquiring customers front-loads expenses in the early years, but SentinelOne recognizes sales ratably, which makes losses appear outsized. As customers renew their contracts, these one-time customer acquisition expenses will decline, while the topline will expand as customers adopt more products. This trend will lead to an improvement in SentinelOne’s bottom-line going forward.
Evidence of leverage in SentinelOne’s business
What is critical for SentinelOne’s story going forward is that there are signs that its subscription service is sticky, and that customers are increasing their spending. This would provide a light at the end of the tunnel that losses will turn into profits and cashflows. While SentinelOne is still a few years out from breaking even, there are positive signs that customers are both sticky and expanding their usage of its products.
We can see this with net retention ratio (NRR), which improved to 130% in Q3, an all-time high, and was up from 115% in the year ago quarter. The improvement in NRR showcases that customers are expanding the amount of products they use each year, highlighting the success of SentinelOne’s ‘land-and-expand’ model. Furthermore, gross retention ratio, which only considers customer attrition, was 97% as of Q3, signaling that SentinelOne’s customers are sticking with the platform beyond one year.
Furthermore, SentinelOne’s customer metrics are also high quality. For instance, no single customer accounted for more than 3% of sales in the most recent quarter and the company disclosed that it has over 6,000 customers as of Q3, up 79% YoY. Furthermore, SentinelOne counts three Fortune 10 companies as customers, two of which recently renewed with multiyear deals in Q3. In its S-1, SentinelOne disclosed that it also counted 37 out of the Fortune 500 companies as customers, highlighting the large opportunity in front of it as there are still a plethora of enterprise customers yet to sign on.
Moreover, customers with ARR over $100,00 grew 141% YoY to 416, an acceleration from the 140% and 127% YoY growth rates in Q2 and Q1, respectively. SentinelOne’s success with enterprise customers suggests that the firm is rapidly capturing market share in the cybersecurity market.
Another example that highlights the leverage in SentinelOne’s model is the improvement in sales and marketing (S&M) expense. S&M expense increased just 1% QoQ in Q3, while Q3 sales increased 22% QoQ. This drove S&M margin down from 90% in Q2 to 74% in Q3, an all-time low. The improvement in S&M margin highlights that SeninelOne is spending less to attract customers, which is impressive considering that sales have been accelerating. As adoption grows, the company’s ability to expand the amount of products customers use will drive S&M margin lower, further improving its bottom-line in the future.
SentinelOne relative to CrowdStrike
SentinelOne’s metrics appear in-line when viewed relative to other cybersecurity platforms such as CrowdStrike. For instance, CrowdStrike’s S&M margin was 70% when its quarterly sales were around $56 million, This compares to SentinelOne’s S&M margin of 74% with $56 million in sales. Furthermore, SentinelOne’s sales grew 22% QoQ, which was faster than CrowdStrike’s 18% QoQ growth when its quarterly sales were $56 million. The faster growth rate helps explain the higher S&M margin.
However, SentinelOne has reported a steeper operating loss relative to Crowdstrike at $56 million in quarterly sales. This is likely due to timing, as SentinelOne went public with a rich valuation, which increases stock-based compensation expense. Expense items such as G&A expense may be inflated relative to historical periods for other tech stocks (like Crowdstrike), when tech valuations were lower. Nonetheless, we expect the outsized SBC expense to normalize going forward. This will also improve SentinelOne’s bottom-line and bring it more in-line with peers in the future.
As shown below, SentinelOne and CrowdStrike had similar S&M margins when they were the similar sizes. However, CrowdStrike’s ARR was growing faster, as was its customer base. SentinelOne’s ARR per customer grew faster and its NRR was more robust. However, SentinelOne’s operating margin was considerably lower than CrowdStrike’s was. It should be noted that CrowdStrike was not public in 2018, so unrecognized SBC was not included in operating expenses. As mentioned above, we expect that SentinelOne’s earnings will improve as SBC from its recent IPO normalizes.
Outlook and Valuation
Looking forward, management expects Q4 sales to increase 103% at the midpoint to $61 million and raised their full-year guide for sales to $200 million, which increased the implied growth rate from 103% to 115% at the midpoint. Gross margin is expected to be 62%, up from the prior guide of 59% and an improvement of 100 bps YoY from FY2021. Finally, operating margin is expected to be -81% at the mid-point in Q4, demonstrating continued leverage in SentinelOne’s business model.
Analysts expect growth to remain robust for the foreseeable future and FY2024 sales are forecasted to rise 185% from FY2022 levels to $570 million. Losses are also expected to persist throughout this time period, but are anticipated to materially improve by 2024. We are still early in SentinelOne’s growth story, but the opportunity in front of the company is large as its total addressable market was estimated to be around $30 billion in FY2021 and is expected to grow to $50 billion by 2024 (S-1).
The company’s market cap is below $12 billion and it currently trades at a 53x P/S multiple and a fwd (1-yr) P/S multiple of 33x. This is a premium relative to other cybersecurity competitors listed in its S-1, such as CRWD, which trade at a fwd P/S multiple of 22x. However, the company is clearly capturing market share from competitors, evident in its accelerating ARR metric discussed above, which warrants a premium valuation.
Furthermore, SentinelOne is unique in its growth as sales have accelerated for four consecutive quarters and the firm’s topline is growing over 100% YoY. Relative to other rapidly growing SaaS firms such as Snowflake, SentinelOne’s FY2023 fwd P/S ratio of 33x appears more in-line. There is also room for share price appreciation at this valuation. For instance, if SentinelOne’s sales grow to $570 million in FY2024 as expected and its fwd P/S multiple contracts to 30x (similar to CrowdStrike’s fwd P/S multiple when annual sales were at ~$500 million), the company’s share price will appreciate by 49% (assuming a constant share count).
Risks and Conclusions
There are some key risks going forward. SentinelOne’s approach to endpoint security is new and the market may not fully accept its approach of utilizing A.I. to combat cyber threats. Furthermore, the company has also reported large losses and these losses are expected to persist for the next few years. This may require SentinelOne to issue more shares, diluting shareholders. However, the company currently has $1.7 billion in cash on balance, which provides ample liquidity in the near term. Moreover, SentinelOne has limited financial information, which makes it difficult to thoroughly analyze the company’s financials and identify anomalies.
Despite the risks and limited financial history, SentinelOne appears to be well positioned in the cybersecurity market. ARR has accelerated for four consecutive quarters and it appears that the company is capturing market share, especially after demonstrating its success during the major SolarWinds hack in late 2020.
While losses are steep, there are signs of leverage in its business as S&M margin is improving. Furthermore, new customers are driving topline growth, which is favorable but also front loads customer acquisition costs. There is also evidence that SentinelOne’s customers are sticky, which suggests that the losses today are setting the company up well to report profits in the future. The company has a premium valuation relative to peers, which is warranted due to its elevated growth rate. Lastly, there is still room for capital appreciation even if the company’s multiple declines and mimics peers in the future. SentinelOne is early in its growth story and the market in front of it is massive, if it can continue to rapidly capture market share, it will likely reach profitability sooner than the Street currently expects.
