SentinelOne had an excellent earnings report. There are a few things to unpack, yet the 10,000-foot view is that the company has continually proven its capable of growth during a time of uncertainty for other cloud peers.
Key metrics accelerated including customers with ARR over $100,000 and dollar-based retention rate. The most notable positive surprise was the company’s dollar-based net retention rate of 137%. This is a record for the company and marks an acceleration from 131% last quarter and from 125% in the year ago quarter.
You can reference our product overview on SentinelOne from a year ago here on Forbes and updated in January here on the premium site.
Financials:
SentinelOne reported revenue growth of 124% for $102.5 million compared to a consensus of 109% growth based on revenue of $95.7 million. The company raised Q3 guidance to 98% growth for $111 million compared to a consensus of 93% growth based on $108 million consensus. The full year guide was also raised to $416 million, up from $406.4 million previously. This represents growth of 103% for FY2023 ending in January, up from guidance of 98% growth for the full year.
The Attivo acquisition adds ARR of $35 million to the numbers stated above and SentinelOne is not breaking out the numbers any further now or in the future. Management stated the growth outlined above does not come from Attivo, rather came from growth in the organic business. They do feel identity will grow in the future but did not in the immediate quarter.
Remaining performance obligations for SentinelOne, which includes deferred revenue and other non-cancelable contract revenue was $444.7 million with 84% recognized as revenue over the next 24 months.
The margins are where the rubber meets the road with SentinelOne. The GAAP gross margin of 65% is improving from the GAAP gross margin of 59% in the year ago quarter. The adjusted gross margin of 72% also shows significant improvement from the 62% adjusted gross margin a year ago.
We’ve previously covered in detail how the company operating expenses in sales and marketing, R&D and also stock-based compensation contribute to a weak operating margin. This has resulted in an GAAP operating margin of (106%) and adjusted operating margin of (57%). This is an improvement from a GAAP operating margin of (147%) and an adjusted operating margin of (98%) in the year ago quarter. This is also an improvement from the previous quarter at (115%) GAAP operating margin.
This was a beat for Q2 as operating margin was previously guided to be (75%) to (73%). We noted this would make meeting the FY2023 guide a bit tough so it’s good to see this in line with the FY2023 guide on operating margin.
Notably, the company has doubled its spend in sales and marketing, research and development and G&A from the year ago quarter. Stock based compensation was 40% of revenue in Q1 at $31.6 million and is still roughly 40% of revenue in Q2 at $41 million in the current quarter.
However, the management team has delivered on its promise to greatly improve its margins. At the onset of the year, it was stated the company would reach Non-GAAP operating margin in FY2023 of (60%) to (55%). The company is now stating: “we're improving our full year range to negative 58% to 55%, a one-point improvement at the midpoint from our prior range.”
Management is guiding for the same margins next quarter in Q3 which is 71% adjusted GM and (57%) OM.
The company has stated its goal is to become cash flow positive by 2025. The company’s free cash flow was ($66) million. If we assume the company spends $250 million in cash per year with $1.2 billion in cash, cash equivalents and short-term investments, there shouldn’t be a capital raise unless there are more unforeseen acquisitions. The Attivo acquisition cost $351.5 million in cash and 6.032 million shares of Class A stock for an aggregate value of $185.9 million and 379K assumed options to purchase shares of Class A stock.
The company’s adjusted net loss per share is ($0.20) compared to ($0.38) for the same period last year. It beat the analysts’ consensus estimates by $0.05.
The company’s valuation is 17 forward P/S. Bottom line valuations don’t work well in cloud due to how few companies are profitable. With that said, SentinelOne’s valuation is in line with Crowdstrike and is between cybersecurity companies such as Cloudflare and Zscaler.
Key Metrics:
The company provided ARR of $438 million for growth of 122%. It was unclear if Attivo’s $35 million was included in the ARR provided. If it was, then organic ARR for the quarter was $403 million for growth of 103%. I’m assuming it’s the 103% as total customer count combined both organic and acquired. This marks a deceleration from 110% in the previous quarter.
Regardless of the ARR growth, the customer segment with ARR above $100K grew 117% to 755 total customers, up from 348 in Q2 of last year, and this is unlikely to have been affected by Attivo. Total customer count was 8,600 with 750 organic adds and 350 acquired from Attivo, up from 5,400 in Q2 of last year. According to the SEC Filing, no customer accounts for more than 4% of revenue and 33% of revenue is from outside the United States.
“Our financials now incorporate the acquisition of Attivo, which performed in line with our expectations and is on track for our full year ARR target of $45 million or more. We do not intend to break out Attivo financials going forward as it becomes part of our broader platform offering as our identity suite.”
Note: Attivo’s current ARR is $35 million with a target of $45 million for the full year.
Dollar-based net retention rate was 137%, up from 131% in the previous quarter and up from 125% in the year ago quarter. This is record DBNRR for the company. The company noted it fits the Rule of 60 and has plans to continue fitting the Rule of 40. SentinelOne’s Magic Number is above 1.3.
According to management, the fastest growing module is Singularity Cloud, followed by data retention and Ranger. The company mentions that even in cases where companies are using a competing security company on endpoint, they will use SentinelOne for cloud run time protection.
When asked if SentinelOne has had success in replacing the endpoint provider by leveraging it’s best-of-breed cloud protection, the company responded it provides a back door yet the bigger opportunity is in protecting the cloud architectures. “But to be honest, I mean, when we look at how these cloud opportunities, especially with the cloud-native companies, they're probably 4x, 5x, sometimes 10x the size of the endpoint footprint and the endpoint opportunity.”
We covered from the Q4 earnings call that management expects cloud to be equal or greater than the endpoint opportunity. We also covered that “Cloud is a Growth Lever” in our full length premium report.
The company has recently expanded its platform to include data ingestion on the backend that is now seamless with the user interface on the front end. When we discussed the differences between SentinelOne and competitors, we pointed toward the company’s data-forward approach. The company reiterated this in the recent earnings call, stating the platform runs petabytes of data everyday while “competitors can handle only a fraction” of this scale. The company also points towards data retention, which helps to reduce storage costs while maintaining critical information.
Data retention is important because it drives down costs. Per management: “So our ability to process more data for customers, our ability to retain it for longer and really be a cost saver for customers. Obviously, in this macro environment, that's fixed volumes.”
From the Q4 call, we discussed that by going with a different EDR vendor, customers have to then figure out how they are going to retain data on the backend of a different platform, which can be costly.
In addition to the data retention, the new platform product is the DataSet, or the ingestion of data from the backend that is now seamless with the front end.
Here is what the company stated about this new platform development:
“We completed the migration of our back-end DataSet, which was a meaningful undertaking that we completed in just over a year [..] It positions us extremely well in the future of XDR, a unified, scalable and efficient data back end, gives us a significant competitive advantage. And evident by our Q2 gross margin, it's already supporting our path towards our long-term gross margin targets.”
We’ve covered the Ranger product in the past, which is the product that helps to identify unsecured endpoints through a fingerprinting engine that runs an inventory of IP-enabled devices. Ranger and Ranger Pro detects and notifies IT teams of unsecured endpoints.
Overview of Earnings Call:
We’ve referenced how management teams in cloud are hesitant to pull forward the Q2 beats to an equal or greater full year fiscal guide. Rather than these management teams becoming bold macro economists who feel they can predict with certainty Q3 and Q4, they are instead playing it safe.
SentinelOne beat Q2 by $6.8 million and guided for a Q3 beat of $3 million. The company carried this entirely through to the full year guide but did not go any further to raise Q4 at this time. This is marginally better its cloud peers who did not pull the Q2 beat forward, in some cases.
Additionally, this is what management said about the current macro environment:
Demand is strong, and we remain extremely well positioned. At the same time, enterprises across all sectors of the economy are being impacted in different ways by evolving macro conditions. Like other software companies, we've seen some signs of cost consciousness and prudence around IT budgets. This has resulted in marginally longer sales cycle and more budgetary approvals.”
The company was asked again in the call about macro and any impact it may have had on visibility around demand, and the CEO stated: “We still feel pretty good about demand. I think what you see reflected in our guidance is the level that we feel we need to be conservative and prudent. And all in all, again, things remain incredibly strong.”
The analysts on the call believe that part of SentinelOne’s success in the face of global budgetary slowdowns partly rests on the company’s channel partner strategy, which includes resellers and distributors, managed service providers (MSPs) and managed security service providers (MSSPs).
Whether customers are direct or through the channel partner network, customers adopt the Complete product first and then upgrade across any combination of 15 modules. The modules upgrade is helping to drive a higher DBNRR as customers stay to spend more on the platform with the CEO stating 30% of revenue comes from the modules. They feel this is where the expansion opportunity remains.
When asked about the high net retention rate, management responded with the following:
“I think one of the very most exciting things about our business is the incredible demand that we're seeing from MSPs, MSSPs and – investments partners, many of which have become MDRs or managed detect and response providers themselves. And I think there's a couple of fascinating elements to this part of the business. One, it really lets us, in a very efficient way, cover a tremendous part of the market. Two, it absolutely fits amazingly well in today's macro environment where folks are looking to efficiently protect their networks, efficiently protect their data and their users and expand their security prowess without having to make a lot of capital investments. And managed services do exactly that. Third is incredible velocity in terms of deal cycles.”
Later, the CFO emphasized the channel partners by saying:
“As we've gone through an evolution of MDR and other more sophisticated security service providers, we're starting to see small, medium and large enterprises go with a managed service. And so, we've seen from an overall global trend perspective, I think the scrutiny around spend has lent itself to an upsell in that type of business.”
Another reason SentinelOne has performed well in the current macro backdrop is because it’s best-of-breed across many attack surfaces, including cloud and now identity with Attivo. The company also allows now data to be ingested for a stronger, singular platform and drives down costs with data retention.
Conclusion:
I agree that SentinelOne is best-of-breed and is combining modules to accelerate DBNRR – this is one of the best indicators we have in tech as to a product’s strength. It also helps to illustrate that growth is not at any cost as this typically includes a high churn rate and lower retention if S&M is bringing in lower quality leads. Since its IPO, SentinelOne has illustrated its competitive prowess, whether it’s through product development and R&D or an impressive acceleration in key metrics. For example, ARR accelerated in January of 2021 and continued to accelerate for many quarters. We are seeing this again with DBNRR.
SentinelOne’s stock price hinges on the company keeping its word to improve its margins. There are ample catalysts to sustain the company’s growth, primarily Singularity Cloud and data retention. Both emphasize SentinelOne’s strength in automation which now includes data ingestion on the backend.
Investors will want to see a clearer path toward profitability next year as SentinelOne will need to assuage any concerns it’s a “growth at any cost” company. Additionally, acquisitions will need to remain limited until the company is free cash flow positive as the company has enough cash until 2025 barring any new acquisitions. Analyst consensus has SentinelOne with positive EPS in January 2025 in a predictable path; if SentinelOne can deliver on this then I believe it will be one of the better performing cybersecurity stocks on the market.