← All thesesSNeutralMedium convictionTuesday 6 October 2026עברית

SentinelOne

SentinelOne sells security software that sits on every computer a company runs, spots attacks and stops them, often without a person stepping in.

Our viewNeutral Medium conviction
The scores
The profile · 1-4
Growth3/4 ↓

ARR up 22% and revenue 21%, but the yearly amount added has stalled, and two acquisitions added to it.

Business quality2/4 ↓

Customers stay, but retention fell and stopped being filed; Microsoft bundles the job and CrowdStrike sells the same agent.

Financial position4/4 →

$813.2M of cash and investments, no debt, and free cash flow slightly positive before stock pay.

Execution record2/4 →

Three restructurings and three finance chiefs in two years, and the retention figure dropped from filings; recent guides were raised.

Per share capture2/4 →

Shares up about 16% in two and a half years from stock pay and share-funded deals; one buyback offset a year.

Potential2/4 →

About 5.3% of a $22.9B US base, but more needs share won from Microsoft and CrowdStrike, and nothing beyond contracts is signed.

Risk profile3/4 →

Two resellers carry 30% of revenue and the founder controls 29% of votes; no customer above 9% of ARR.

Valuation2/4 ↓

About 8 times sales needs stock pay halved and cash margins near 25%; it has never shown above 8%.

Evidence quality3/4 ↓

Filed revenue, ARR and stock pay; retention and AI security rest on spoken figures, and no independent detection test exists.

The Verdict

We rate SentinelOne neutral. It sells one piece of security software for every company computer, and the business is mixed: sales grow 21%, but the new subscriptions it adds each year have stopped growing, and it pays staff in shares worth 29% of sales. Microsoft and CrowdStrike sell the same job to the same buyers. The price is full: the shares nearly doubled since April, mostly because buyers now pay more for each dollar of sales, and today's price needs profit margins the company has never shown. The view hinges on whether new subscriptions start growing again while stock pay falls.

The long caseAI makes attacks faster and companies buy more security; SentinelOne grows new subscriptions again while stock pay falls, so sales turn into cash.

The evidence under this - 8 claims
C01facthigh confidence
Singularity is one software agent on each laptop, server and cloud workload, running detection models on the machine itself and in SentinelOne's cloud, with data, cloud and AI-security modules sold on the same agent and console.
current state · 2026-07-31written 2026-10-06
C02facthigh confidence
Revenue was $292.0M in the quarter to 31 July 2026, up 21%, and $1,098.7M over the trailing four quarters.
historical · Q2 FY2027written 2026-10-06
C04estimatehigh confidence
Net new annual recurring revenue was $195.7M in FY2025 and $199.0M in FY2026, 1.7% more; the first half of FY2027 added $99.0M against $81.3M.
derivedDifferences of the filed ARR in C03: 920.1 less 724.4; 1,119.1 less 920.1; 1,218.1 less 1,119.1; and 1,001.4 at 31 July 2025 less 920.1. The company calls the first-half growth 22%, which matches.
against this
  • The quarter itself added $56M, up 4%, and the Q4 FY2026 quarter added a record $64M, up 6%, so the recent quarters are growing even though the full year barely did.
  • ARR now counts consumption and usage-based agreements, so a year of data-lake usage can move net new ARR without a new contract being signed.
historical · FY2025 to H1 FY2027written 2026-10-06
C09facthigh confidence
Stock compensation was $322.1M over the four quarters to 31 July 2026, 29.3% of revenue, against 34.9% in FY2024 and 29.7% in FY2026.
against this

The Q2 figure of $92.1M includes $10.8M of awards accelerated in the May 2026 restructuring, so the underlying run rate is slightly lower than the quarter shows.

historical · trailing four quarters to Q2 FY2027written 2026-10-06
C15facthigh confidence
Over the 126 sessions to 5 October the price rose 88.2%: revenue per share rose 8.3% and the multiple 73.8%.
historical · 2026-04-06 to 2026-10-05written 2026-10-06
C38estimatemedium confidence
At $8.70B the price needs stock pay to fall toward 15% of revenue and cash margins before it to reach about 25%, on revenue near analysts' $1.66B for FY2029, for cash after stock pay of roughly $166M a year.
derivedC14's market value; consensus FY2029 revenue of $1.66B in the pack (S10); C09's 29.3% stock pay falling to 15%; C11's cash margin before stock pay rising from about 3% to 25%. 25% less 15% is 10% of $1.66B, or $166M, about 52 times.
against this
  • CrowdStrike and Palo Alto are paid far more for cash after stock pay, so a buyer at 52 times is paying less than the sector does for the same kind of cash.
  • The 25% cash margin before stock pay is CrowdStrike's level at about four times SentinelOne's revenue; SentinelOne has never shown more than 8% on a trailing year.
forwardwritten 2026-10-06
C18facthigh confidence
Microsoft sells endpoint protection inside its Defender Suite, with email, identity and software-as-a-service security, at a list price of $12.00 per user per month.
current state · 2026-10-06written 2026-10-06
C19facthigh confidence
CrowdStrike's 10-K describes the same product, a lightweight sensor on each endpoint and cloud workload, and files dollar-based net retention of 115% at 31 January 2026.
current state · 2026-01-31written 2026-10-06
01

The company

Every company computer is a door an attacker can use. SentinelOne puts one small program, an agent, on each laptop, server and cloud machine. It watches what runs, blocks ransomware on the spot and sends what it sees to one screen where a security team, or SentinelOne's own staff, investigates.

Buyers are companies and governments. They would otherwise use CrowdStrike, Palo Alto Networks, or the protection Microsoft includes with Windows licences. SentinelOne can also run fully on a customer's own servers, cut off from the internet, which few rivals offer.

The evidence under this - 4 claims
C01facthigh confidence
Singularity is one software agent on each laptop, server and cloud workload, running detection models on the machine itself and in SentinelOne's cloud, with data, cloud and AI-security modules sold on the same agent and console.
current state · 2026-07-31written 2026-10-06
C17facthigh confidence
SentinelOne's 10-K names CrowdStrike, Carbon Black, Trellix, Symantec, Microsoft, Palo Alto Networks, Cisco's Splunk, Elastic and Google's Wiz as competitors.
current state · 2026-01-31written 2026-10-06
C22factmedium confidence
IDC placed Singularity Endpoint among the Leaders in its 2026 worldwide assessment of modern endpoint security for enterprises.
against this

The assessment is reported by the company; IDC's own document is paywalled, and a Leader placement usually holds several vendors, CrowdStrike and Microsoft among them in past editions.

current state · 2026-09-30written 2026-10-06
C44management claimmedium confidence
The company lists its competitive basis as detection, breadth, automation and support for cloud, hybrid and on-premise deployment, and calls itself one of few able to run fully on-premise or air-gapped.
against this

No outside party in this manifest measures how much of the market needs an air-gapped deployment.

current state · 2026-08-27written 2026-10-06

How it makes money

Customers pay a yearly subscription for each computer protected, usually signed for one to three years, plus usage fees for storing and searching security data. Revenue was $292.0M in the quarter to July, up 21%. Contracts not yet turned into revenue total $1.7B. Most sales go through two big resellers, which carried 18% and 12% of last year's revenue, but no single end customer is above 9%.

The evidence under this - 4 claims
C02facthigh confidence
Revenue was $292.0M in the quarter to 31 July 2026, up 21%, and $1,098.7M over the trailing four quarters.
historical · Q2 FY2027written 2026-10-06
C03facthigh confidence
Annual recurring revenue was $724.4M at January 2024, $920.1M at January 2025, $1,119.1M at January 2026 and $1,218.1M at 31 July 2026, up 22%.
historical · FY2024 to Q2 FY2027written 2026-10-06
C28facthigh confidence
Remaining performance obligations were $1.7B at 31 July 2026, 79% due within 24 months, and the CFO puts the growth at 45%.
against this

The CFO says part of the growth is longer contracts, which lifts the obligation without adding yearly revenue.

current state · 2026-07-31written 2026-10-06
C29facthigh confidence
Two channel partners were 18% and 12% of FY2026 revenue; no end customer reached 10%, and none was above 9% of ARR at 31 July 2026.
current state · 2026-07-31written 2026-10-06
Where the money comes from, stream by stream
StreamShare of sales (FY2026)How it earns it
Subscriptions to the Singularity platformnot disclosedEndpoint, cloud and identity protection and the data lake, sold per endpoint or workload for one to three years.
Services and usagenot disclosedManaged detection by SentinelOne's own analysts, incident response, and data ingestion priced by use under the Flex licence.

Who runs it

Tomer Weingarten co-founded the company and has run it since 2013. He holds 29.2% of the votes through shares with extra voting rights, so outside shareholders cannot easily overrule him.

The finance chief, Sonalee Parekh, arrived in March 2026, the third in the role in about two years. Bonuses pay on sales, subscriptions and an adjusted margin that leaves out stock pay, and nothing pays on the share price.

The evidence under this - 3 claims
C32facthigh confidence
Co-founder Tomer Weingarten, chief executive since 2013, holds 29.2% of the votes through Class B shares; directors and officers together hold 35.8% of the votes and about 4% of the shares.
current state · 2026-04-30written 2026-10-06
C33facthigh confidence
Executive bonuses and performance shares pay on revenue, ARR and non-GAAP operating margin over one-year periods; the FY2026 tranche vested at about 90% of target.
current state · 2026-04-30written 2026-10-06
C34facthigh confidence
The chief financial officer since March 2026, Sonalee Parekh, is the third person in the role in about two years, after Barbara Larson's departure and an interim spell by Barry Padgett.
current state · 2026-04-30written 2026-10-06
02

Why it wins, and who could beat it

Why customers come back

Once the agent is on every machine and the security team has built its routines around the screen, leaving means reinstalling everywhere and retraining. So large customers stay: those paying over $100,000 a year kept 96% of their spending last year.

What has weakened is how much customers add. The share of last year's spending that existing customers paid again, plus what they added, fell from 114% to 110%, and the company then stopped filing it. CrowdStrike files 115%.

The evidence under this - 4 claims
C08management claimmedium confidence
Customers above $100,000 of ARR retained 96% gross and 109% net in Q4 FY2026, and the CFO says that cohort's net retention rose again in Q2 FY2027 without a figure.
against this

CrowdStrike files 115% for its whole base at the same date; SentinelOne's figure is for its best cohort only and is not in a filing.

current state · 2026-07-31written 2026-10-06
C07facthigh confidence
Dollar-based net retention was 114% at January 2024 and 110% at January 2025; the FY2026 10-K and the Q2 10-Q print no figure, only 'expansionary territory'.
against this

The Q4 FY2026 call gave 109% net and 96% gross for customers above $100,000, the largest part of the base, so a figure exists and is spoken rather than filed.

historical · FY2024 to Q2 FY2027written 2026-10-06
C37inferencemedium confidence
SentinelOne's retention evidence is weaker than its main rival's and no longer filed: 110% against 115%, then a word in place of a number.
derivedC07 and C19 set side by side; C08 is the spoken figure for the best cohort.
against this

A $100,000-plus cohort at 109% with 96% gross retention is close to CrowdStrike's whole-base figure, so the gap may sit in small customers, which matter less to the value.

current state · 2026-07-31written 2026-10-06
C19facthigh confidence
CrowdStrike's 10-K describes the same product, a lightweight sensor on each endpoint and cloud workload, and files dollar-based net retention of 115% at 31 January 2026.
current state · 2026-01-31written 2026-10-06

The threat

The attack comes from two incumbents, not a new kind of product. Microsoft bundles endpoint protection with email and identity security at $12.00 a user a month, in licences many customers already pay for. CrowdStrike sells a near-identical agent and is the leader. Palo Alto Networks sells the same detection beside its firewalls.

The evidence under this - 4 claims
C18facthigh confidence
Microsoft sells endpoint protection inside its Defender Suite, with email, identity and software-as-a-service security, at a list price of $12.00 per user per month.
current state · 2026-10-06written 2026-10-06
C19facthigh confidence
CrowdStrike's 10-K describes the same product, a lightweight sensor on each endpoint and cloud workload, and files dollar-based net retention of 115% at 31 January 2026.
current state · 2026-01-31written 2026-10-06
C20facthigh confidence
Palo Alto Networks' 10-K names CrowdStrike among the independent security vendors it competes with, and its Cortex line sells endpoint detection to the same buyer.
current state · 2026-07-31written 2026-10-06
C39inferencemedium confidence
Microsoft's bundle is the cheaper route for a Windows estate, and CrowdStrike sells the same agent; the attack on SentinelOne is two incumbents, not a new kind of product.
derivedC18, C19 and C20 against C01; C17 names both first.
against this

Management says win rates rose sequentially and year over year, and describes an aerospace customer replacing its primary competitor outright; the displacement runs both ways.

current state · 2026-10-06written 2026-10-06

The rivals: MSFT, CRWD, PANW, AVGO, CSCO, and 1 more that is private, in-house or listed abroad.

Who else does this, rival by rival
TickerRivalHow far alongPriced against it
MSFTMicrosoft Defender for Endpoint, in the Defender Suite and E5Priced against it: One segment onlyOn saleOne segment only
CRWDCrowdStrike FalconPriced against it: YesOn saleYes
PANWPalo Alto Networks Cortex XDR and XSIAMPriced against it: YesOn saleYes
PrivateTrellix (formerly McAfee Enterprise and FireEye)Priced against it: PrivateOn salePrivate
AVGOBroadcomPriced against it: One segment onlyOn saleOne segment only
CSCOCisco SystemsPriced against it: One segment onlyOn saleOne segment only
03

How big it could get

How big this could get

The United States had 159.0 million people on payrolls in September. Priced at Microsoft's own $144 a year, protecting every one of them is about $22.9B a year. SentinelOne's $1.218B of subscriptions is about 5.3% of that. Growing much past it means taking customers from Microsoft and CrowdStrike.

The evidence under this - 4 claims
C23facthigh confidence
United States nonfarm payrolls were 159.0 million in September 2026.
current state · 2026-09-01written 2026-10-06
C18facthigh confidence
Microsoft sells endpoint protection inside its Defender Suite, with email, identity and software-as-a-service security, at a list price of $12.00 per user per month.
current state · 2026-10-06written 2026-10-06
C24estimatemedium confidence
Every US worker at Microsoft's $144 a year is about $22.9B of endpoint-and-identity security; SentinelOne's $1.218B of ARR is 5.3% of it.
derivedC23 times C18: 159.0 million times $12.00 times twelve is $22.9B; C03's $1,218.1M divided by it is 5.3%.
against this

Not every worker has a protected machine and many machines have no worker: servers and cloud workloads are priced per sensor, so the seat count both overstates and understates the market.

current state · 2026-10-06written 2026-10-06
C03facthigh confidence
Annual recurring revenue was $724.4M at January 2024, $920.1M at January 2025, $1,119.1M at January 2026 and $1,218.1M at 31 July 2026, up 22%.
historical · FY2024 to Q2 FY2027written 2026-10-06
04

The results

The numbers

Is it growing?Steady

Sales grew 21% over the twelve months to Jul 2026, about the same pace as the 22% in the year to Jan 2026.

Jan 2022: $205MJan 2023: $422MJan 2024: $621MJan 2025: $821MJan 2026: $1.00B12 mo to Jul 2026: $1.10B$205M$1.10B
Is it profitable?Losing

Operating margin is −29%, up from −61% in the year to Jan 2024.

Jan 2022: −130%Jan 2023: −95%Jan 2024: −61%Jan 2025: −40%Jan 2026: −32%12 mo to Jul 2026: −29%−130%−29%
Does growth pay off?Pays off

Running costs take 102¢ of each sales dollar, down from 191¢ in the year to Jan 2022.

Jan 2022: 191¢Jan 2023: 161¢Jan 2024: 132¢Jan 2025: 114¢Jan 2026: 106¢12 mo to Jul 2026: 102¢191¢102¢
Does it earn good returns?Poor

Shareholders' money lost 23% a year, up from −41% in the year to Jan 2022.

Jan 2022: −41%Jan 2023: −23%Jan 2024: −21%Jan 2025: −18%Jan 2026: −29%12 mo to Jul 2026: −23%−41%−23%
Is it making cash?Solid

It turned 5.1% of sales into free cash, $56.5M over the last twelve months.

Jan 2022: −$99.2MJan 2023: −$198MJan 2024: −$69.7MJan 2025: $31.9MJan 2026: $75.9M12 mo to Jul 2026: $56.5M−$99.2M$56.5M
How steady is it?Swingy

Yearly sales growth has ranged from +22% to +120% over the last 5 years.

Jan 2022: +120%Jan 2023: +106%Jan 2024: +47%Jan 2025: +32%Jan 2026: +22%+120%+22%
Are shares being diluted?Diluting

The share count rose 96% in 4.5 years, and pay in shares costs 29% of sales.

Jan 2022: 174MJan 2023: 278MJan 2024: 295MJan 2025: 315MJan 2026: 330M12 mo to Jul 2026: 342M174M342M
All the numbers

Filed figures from the company's 10-K and 10-Q, read 2026-10-06. Fiscal years end in January.

Jan 2022Jan 2023Jan 2024Jan 2025Jan 202612 mo to Jul 2026
Size and growth
Sales$205M$422M$621M$821M$1.00B$1.10B
Sales growth+120%+106%+47%+32%+22%+21%
Profit
Gross margin60%66%71%74%74%73%
Operating margin−130%−95%−61%−40%−32%−29%
Net margin−132%−90%−55%−35%−45%−31%
What growth costs, per sales dollar
Research and development67%49%35%33%32%33%
Sales and marketing78%74%64%59%52%47%
General and admin46%39%32%23%20%19%
Pay in shares43%39%35%33%30%29%
Capital spending1.8%1.2%0.2%0.2%0.1%0.1%
Cash
Cash from operations−$95.6M−$193M−$68.4M$33.7M$76.6M$57.3M
Free cash flow−$99.2M−$198M−$69.7M$31.9M$75.9M$56.5M
Balance sheet
Cash and short-term investments$1.67B$624M$926M$722M$629M$655M
Debt$0-----
Net cash$1.67B-----
Returns and shares
Shares (diluted)174M278M295M315M330M342M

What growth costs

Growth gets cheaper each year. Selling and marketing fell from about three quarters of sales to about half, and the operating loss shrank with it. But counting stock pay the quarter still lost 31% of sales, so the costs have not yet fallen far enough to make money.

The evidence under this - 2 claims
C10facthigh confidence
The Q2 operating loss was $90.8M, 31% of revenue; the non-GAAP operating profit of $30.5M, 10%, adds back $92.1M of stock compensation and $29.2M of other items.
historical · Q2 FY2027written 2026-10-06
C09facthigh confidence
Stock compensation was $322.1M over the four quarters to 31 July 2026, 29.3% of revenue, against 34.9% in FY2024 and 29.7% in FY2026.
against this

The Q2 figure of $92.1M includes $10.8M of awards accelerated in the May 2026 restructuring, so the underlying run rate is slightly lower than the quarter shows.

historical · trailing four quarters to Q2 FY2027written 2026-10-06

The last report (27 Aug)

Quarter ended July 2026, filed figures.

21%
Sales growth
against the same quarter a year earlier
5.5%
Growth from the quarter before
against 2.0% the quarter before that
-31¢
Operating profit
per dollar of sales

In the quarter to 31 July 2026, sales grew 21% to $292.0M and the company added $56M of new subscriptions, 4% more than a year earlier. It raised its forecast for the year to $1.202B to $1.207B of sales.

Underneath, fewer new large customers arrived: those paying over $100,000 grew 13%, against 18% in January. The share of each sale kept after running costs fell from 75% to 72%. Counting stock pay, the quarter lost $90.8M.

What it did to the thesisIt showed the recent quarters adding more new subscriptions than a year ago, which argues against us, but the year's outlook still implies a slower second half, and profit kept less of each sale. The question of whether additions grow again stays open.

The quarter in detail

Sales growth from the previous quarter, filed figures.

Earnings per share $0.08 against $0.07 expected; $-0.27 as filed, the gap being what the company adds back.

The evidence under this - 7 claims
C02facthigh confidence
Revenue was $292.0M in the quarter to 31 July 2026, up 21%, and $1,098.7M over the trailing four quarters.
historical · Q2 FY2027written 2026-10-06
C03facthigh confidence
Annual recurring revenue was $724.4M at January 2024, $920.1M at January 2025, $1,119.1M at January 2026 and $1,218.1M at 31 July 2026, up 22%.
historical · FY2024 to Q2 FY2027written 2026-10-06
C04estimatehigh confidence
Net new annual recurring revenue was $195.7M in FY2025 and $199.0M in FY2026, 1.7% more; the first half of FY2027 added $99.0M against $81.3M.
derivedDifferences of the filed ARR in C03: 920.1 less 724.4; 1,119.1 less 920.1; 1,218.1 less 1,119.1; and 1,001.4 at 31 July 2025 less 920.1. The company calls the first-half growth 22%, which matches.
against this
  • The quarter itself added $56M, up 4%, and the Q4 FY2026 quarter added a record $64M, up 6%, so the recent quarters are growing even though the full year barely did.
  • ARR now counts consumption and usage-based agreements, so a year of data-lake usage can move net new ARR without a new contract being signed.
historical · FY2025 to H1 FY2027written 2026-10-06
C10facthigh confidence
The Q2 operating loss was $90.8M, 31% of revenue; the non-GAAP operating profit of $30.5M, 10%, adds back $92.1M of stock compensation and $29.2M of other items.
historical · Q2 FY2027written 2026-10-06
C30facthigh confidence
FY2027 guidance went from $1.195B-$1.205B of revenue and $110M-$120M of non-GAAP operating profit in March to $1.202B-$1.207B and $124M-$128M in August.
historical · FY2027 guidance, March to August 2026written 2026-10-06
C40facthigh confidence
Customers paying over $100,000 a year rose 13% to 1,715, slower than the 18% at January 2026, while ARR grew 22%.
against this

Management says it is landing larger deals on purpose, so fewer, bigger customers is the plan rather than a slowdown.

historical · Q2 FY2027written 2026-10-06
C41facthigh confidence
Gross margin fell to 72% from 75% on a reported basis and to 77% from 79% excluding stock pay and acquired-intangible amortisation.
against this

Amortisation of acquired intangibles in cost of revenue doubled to $8.2M with Prompt and Observo, which explains about one point of the reported fall.

historical · Q2 FY2027written 2026-10-06
What management did with the money

It spent $200M buying back 12.2M shares last year, but paid partly in 6.8M new shares for two acquisitions, Prompt and Observo, and kept issuing shares to staff. It has also cut costs in three restructurings in fifteen months.

Insiders in 2026Q3: 2 purchases and 19 sales, from their Form 4 filings.

The evidence under this - 2 claims
C13facthigh confidence
Weighted shares rose from 294.9M in FY2024 to 330.1M in FY2026 and 341.5M in Q2 FY2027; FY2026 repurchased 12.2M shares for $200M, and Prompt and Observo were paid partly in 6.8M new shares.
historical · FY2024 to Q2 FY2027written 2026-10-06
C31facthigh confidence
The company has run three restructurings in fifteen months, in March 2025, July 2025 and May 2026; the last cost $24.4M, $10.8M of it accelerated stock awards.
historical · March 2025 to July 2026written 2026-10-06
05

The price, and where we disagree

In short. Full. Cheap against its rivals per dollar of sales, but the price needs the company to turn far more of each sale into cash than it ever has.

Share price
$25.43
close,
Price for each $1 of sales
7.9
rivals' middle 41.6 · its 6-year normal 11.3

The shares closed at $11.94 in April and $25.43 on 5 October. Over that stretch sales per share rose 8.3%; the price per dollar of sales rose 73.8%. The whole security sector rallied in September on fears that AI makes attacks faster.

Analysts are cooling: the share rating it a buy fell from 64.9% to 55.9% since February. The next test is the Q3 FY2027 report, due 3 December, where the company expects sales of $309M to $311M.

The evidence under this - 4 claims
C14facthigh confidence
At $25.43 on 5 October 2026 the market value was $8.70B, 7.9 times trailing revenue; the shares closed at $11.94 on 10 April 2026, about 4 times the revenue then reported.
current state · 2026-10-05written 2026-10-06
C15facthigh confidence
Over the 126 sessions to 5 October the price rose 88.2%: revenue per share rose 8.3% and the multiple 73.8%.
historical · 2026-04-06 to 2026-10-05written 2026-10-06
C35facthigh confidence
The share of analysts rating it a buy fell from 64.9% of 37 in February to 55.9% of 34 on 1 October 2026.
historical · 2026-02-01 to 2026-10-01written 2026-10-06
C42management claimhigh confidence
Q3 FY2027 guidance is $309M-$311M of revenue and $38M-$40M of non-GAAP operating profit on 370M diluted shares.
against this

The quarter's diluted count of 370M is 14M above Q2's 356M, so per-share profit grows more slowly than profit.

forwardwritten 2026-10-06
How we read the multiple

Counting staff paid in shares, the business makes no cash, so sales is the only positive base.

  1. The company is worth $8.70B, about 8 times its sales over the last year.
  2. Analysts expect sales of about $1.66B in the year to January 2029.
  3. If stock pay falls from 29% to 15% of sales and cash margins reach 25%, that leaves about $166M a year.
  4. That is about 52 times the cash. It has never kept more than 8% of sales as cash over a year.

Against its own history. Buyers pay far more per dollar of sales than they did in April, because the whole sector rose, not because the business changed.

The evidence under this - 5 claims
C14facthigh confidence
At $25.43 on 5 October 2026 the market value was $8.70B, 7.9 times trailing revenue; the shares closed at $11.94 on 10 April 2026, about 4 times the revenue then reported.
current state · 2026-10-05written 2026-10-06
C38estimatemedium confidence
At $8.70B the price needs stock pay to fall toward 15% of revenue and cash margins before it to reach about 25%, on revenue near analysts' $1.66B for FY2029, for cash after stock pay of roughly $166M a year.
derivedC14's market value; consensus FY2029 revenue of $1.66B in the pack (S10); C09's 29.3% stock pay falling to 15%; C11's cash margin before stock pay rising from about 3% to 25%. 25% less 15% is 10% of $1.66B, or $166M, about 52 times.
against this
  • CrowdStrike and Palo Alto are paid far more for cash after stock pay, so a buyer at 52 times is paying less than the sector does for the same kind of cash.
  • The 25% cash margin before stock pay is CrowdStrike's level at about four times SentinelOne's revenue; SentinelOne has never shown more than 8% on a trailing year.
forwardwritten 2026-10-06
C09facthigh confidence
Stock compensation was $322.1M over the four quarters to 31 July 2026, 29.3% of revenue, against 34.9% in FY2024 and 29.7% in FY2026.
against this

The Q2 figure of $92.1M includes $10.8M of awards accelerated in the May 2026 restructuring, so the underlying run rate is slightly lower than the quarter shows.

historical · trailing four quarters to Q2 FY2027written 2026-10-06
C11estimatehigh confidence
Free cash flow over the four quarters to 31 July 2026 was about $31M, after a $30.7M Israeli tax payment; less stock compensation it was about minus $291M.
derivedFY2026 free cash flow of $51.9M (S05), less the first half of FY2026's $38.3M, plus the first half of FY2027's $17.5M (S02), is $31.1M; less C09's $322.1M is minus $291.0M.
against this

The company's adjusted figure excludes the tax payment and gives 6% of revenue over the year, so the operating cash engine is about twice what the raw figure shows.

historical · trailing four quarters to Q2 FY2027written 2026-10-06
C16facthigh confidence
Its filed rivals CrowdStrike and Palo Alto Networks trade at 52.4 and 30.0 times enterprise value to sales, growing 24.3% and 24.5%, against SentinelOne's 7.7 times on 21.1%.
against this

Both rivals report an operating margin near zero on a GAAP basis too, yet earn much higher non-GAAP margins; the gap in price is partly a gap in what the business keeps, not only a discount.

current state · 2026-10-06written 2026-10-06
Priced against its rivals

The competitors its own annual report names, each confirmed against the rival's filing. Measured on price for each $1 of sales, cheapest first:

TickerCompanyprice for each $1 of sales
SSentinelOne7.9×
PANWPalo Alto Networks30.0×
CRWDCrowdStrike Holdings53.2×

The middle of the other 2 is 41.6. SentinelOne, Inc. is cheapest of 3.

Rivals' figures come from a data provider, so read the spread of the group rather than any single pair.

Its two closest rivals sell for many times more per dollar of sales, but each keeps far more of every sale as cash, so the gap is not a bargain.

Also checked and set aside: Elastic (a substitute, not the same product).

Private or foreign rivals that cannot be priced: Trellix, Wiz.

Where we disagree with the market

The market believes

A cheap third player behind CrowdStrike and Microsoft, worth buying as AI makes security spending feel urgent.

We believe

Growth is slowing toward about 18% because the new subscriptions added each year have stopped growing, and stock pay falls slowly.

The market prices it partly like its rivals. We read its own numbers: flat yearly additions, a retention figure that fell and then went unprinted, and a share count still rising.

The case against us: the last two quarters added more than a year earlier, the last by 4%, and the forecast was raised. If additions grow 10% this year, slowing growth was a pause, not a trend.

What analysts say, and the evidence
Analysts positive
56%
of 34, 1 Oct
Four months earlier
62%
of 37, 1 Jun
The evidence under this - 7 claims
C35facthigh confidence
The share of analysts rating it a buy fell from 64.9% of 37 in February to 55.9% of 34 on 1 October 2026.
historical · 2026-02-01 to 2026-10-01written 2026-10-06
C15facthigh confidence
Over the 126 sessions to 5 October the price rose 88.2%: revenue per share rose 8.3% and the multiple 73.8%.
historical · 2026-04-06 to 2026-10-05written 2026-10-06
C16facthigh confidence
Its filed rivals CrowdStrike and Palo Alto Networks trade at 52.4 and 30.0 times enterprise value to sales, growing 24.3% and 24.5%, against SentinelOne's 7.7 times on 21.1%.
against this

Both rivals report an operating margin near zero on a GAAP basis too, yet earn much higher non-GAAP margins; the gap in price is partly a gap in what the business keeps, not only a discount.

current state · 2026-10-06written 2026-10-06
C04estimatehigh confidence
Net new annual recurring revenue was $195.7M in FY2025 and $199.0M in FY2026, 1.7% more; the first half of FY2027 added $99.0M against $81.3M.
derivedDifferences of the filed ARR in C03: 920.1 less 724.4; 1,119.1 less 920.1; 1,218.1 less 1,119.1; and 1,001.4 at 31 July 2025 less 920.1. The company calls the first-half growth 22%, which matches.
against this
  • The quarter itself added $56M, up 4%, and the Q4 FY2026 quarter added a record $64M, up 6%, so the recent quarters are growing even though the full year barely did.
  • ARR now counts consumption and usage-based agreements, so a year of data-lake usage can move net new ARR without a new contract being signed.
historical · FY2025 to H1 FY2027written 2026-10-06
C06estimatemedium confidence
If FY2027 net new ARR grows 3% to 5%, year-end ARR is about $1.32B to $1.33B, growth near 18.5% against 22% today, and second-half net new ARR falls 6% to 10%.
derivedC04 and C05: 199.0 times 1.03 to 1.05 is 205 to 209; added to 1,119.1 that is 1,324 to 1,328, or 18.3% to 18.7% growth; less the first half's 99.0 leaves 106 to 110 for the second half against FY2026's 117.7.
against this
  • If the guardrail is conservative and the second half merely matches last year's $117.7M, the year adds about $217M, 9% more, and ARR growth holds near 19.4%.
  • A large multi-year contract can land in one quarter and move a half-year comparison by more than the whole gap.
forwardwritten 2026-10-06
C07facthigh confidence
Dollar-based net retention was 114% at January 2024 and 110% at January 2025; the FY2026 10-K and the Q2 10-Q print no figure, only 'expansionary territory'.
against this

The Q4 FY2026 call gave 109% net and 96% gross for customers above $100,000, the largest part of the base, so a figure exists and is spoken rather than filed.

historical · FY2024 to Q2 FY2027written 2026-10-06
C36facthigh confidence
The shares fell 11% to 17% the session after four of the last ten prints, last on 5 December 2025, and rose 10.7% on the August 2026 print.
against this

The pack dates the August move to the 27th, the day of the release after the close; the bar may be offset by one session, which does not change its size.

historical · March 2024 to August 2026written 2026-10-06
06

What could go wrong, and how we would know

The risks

  • Microsoft's bundle. Microsoft includes the same protection in licences customers already own, at $12.00 a user a month, making a second vendor an extra cost.
  • Stock pay dilutes owners. Stock pay is 29% of sales, and the share count rose from 294.9M to 341.5M in two and a half years.
  • Retention went unprinted. It stopped filing how much existing customers expand after the figure fell from 114% to 110%.
  • No independent test. It left the one public head-to-head detection test in 2025, so buyers cannot compare it against rivals in public.
  • Left out of AI partnerships. Anthropic's AI security project named CrowdStrike, Microsoft and Palo Alto Networks as launch partners, and not SentinelOne.
  • Two resellers carry 30%. Two resellers carried 18% and 12% of last year's revenue; losing either would disrupt sales.
The evidence under this - 8 claims
C18facthigh confidence
Microsoft sells endpoint protection inside its Defender Suite, with email, identity and software-as-a-service security, at a list price of $12.00 per user per month.
current state · 2026-10-06written 2026-10-06
C19facthigh confidence
CrowdStrike's 10-K describes the same product, a lightweight sensor on each endpoint and cloud workload, and files dollar-based net retention of 115% at 31 January 2026.
current state · 2026-01-31written 2026-10-06
C09facthigh confidence
Stock compensation was $322.1M over the four quarters to 31 July 2026, 29.3% of revenue, against 34.9% in FY2024 and 29.7% in FY2026.
against this

The Q2 figure of $92.1M includes $10.8M of awards accelerated in the May 2026 restructuring, so the underlying run rate is slightly lower than the quarter shows.

historical · trailing four quarters to Q2 FY2027written 2026-10-06
C13facthigh confidence
Weighted shares rose from 294.9M in FY2024 to 330.1M in FY2026 and 341.5M in Q2 FY2027; FY2026 repurchased 12.2M shares for $200M, and Prompt and Observo were paid partly in 6.8M new shares.
historical · FY2024 to Q2 FY2027written 2026-10-06
C07facthigh confidence
Dollar-based net retention was 114% at January 2024 and 110% at January 2025; the FY2026 10-K and the Q2 10-Q print no figure, only 'expansionary territory'.
against this

The Q4 FY2026 call gave 109% net and 96% gross for customers above $100,000, the largest part of the base, so a figure exists and is spoken rather than filed.

historical · FY2024 to Q2 FY2027written 2026-10-06
C21facthigh confidence
SentinelOne, Microsoft and Palo Alto Networks withdrew from MITRE's 2025 ATT&CK enterprise evaluation, the one public head-to-head detection test.
against this

MITRE's own chief technology officer told the same reporter the 2025 test may have been too complex, so the withdrawal is not by itself a sign the product scored badly.

historical · 2025 evaluation cyclewritten 2026-10-06
C27facthigh confidence
Anthropic's Project Glasswing names twelve launch partners, CrowdStrike, Microsoft and Palo Alto Networks among them, and not SentinelOne.
against this

SentinelOne says on its August call that it serves as a security partner in Glasswing; Anthropic extended access to over 40 further organisations it does not name.

historical · April 2026written 2026-10-06
C29facthigh confidence
Two channel partners were 18% and 12% of FY2026 revenue; no end customer reached 10%, and none was above 9% of ARR at 31 July 2026.
current state · 2026-07-31written 2026-10-06
What we still do not know
  • How much existing customers expand across the whole base today; the last filed figure is from January 2025.
  • How large the fast-growing AI security business is in dollars; management says only that it tripled.
  • Whether the new subscriptions added this year grow, as management hopes, or fall in the second half, as its own outlook implies.
The evidence under this - 4 claims
C07facthigh confidence
Dollar-based net retention was 114% at January 2024 and 110% at January 2025; the FY2026 10-K and the Q2 10-Q print no figure, only 'expansionary territory'.
against this

The Q4 FY2026 call gave 109% net and 96% gross for customers above $100,000, the largest part of the base, so a figure exists and is spoken rather than filed.

historical · FY2024 to Q2 FY2027written 2026-10-06
C26management claimmedium confidence
Management says AI-security ARR from Prompt Security and Purple AI tripled year over year in Q2, and that the Flex commitment licence passed 10% of ARR.
against this
  • No dollar figure is given for either, and the CFO said the categories grow 'off of a smaller base'; tripling a small number does not move a $1.2B total much.
  • Prompt was bought in September 2025, so some of the tripling is the acquired business's first full year.
current state · 2026-07-31written 2026-10-06
C21facthigh confidence
SentinelOne, Microsoft and Palo Alto Networks withdrew from MITRE's 2025 ATT&CK enterprise evaluation, the one public head-to-head detection test.
against this

MITRE's own chief technology officer told the same reporter the 2025 test may have been too complex, so the withdrawal is not by itself a sign the product scored badly.

historical · 2025 evaluation cyclewritten 2026-10-06
C05management claimmedium confidence
Management expects FY2027 net new ARR to grow year over year; an analyst on the August call put the guardrail at low-to-mid single digits and the CFO did not dispute it.
against this
  • The same call spoke of acceleration in data, cloud and AI security, and first-half net new ARR grew 22%; a guardrail left unchanged after that half may be conservative rather than a forecast.
  • In March the chief executive called about $200M of net new ARR for the year 'probably a slight improvement', which is the same low bar in other words.
forwardwritten 2026-10-06

What would change our view

  1. Neutral→AttractiveNew subscriptions grow again while stock pay falls

    It needs all of:

    • ○The new subscription value added in the year to January 2027 grows 10% or more on last year's $199.0M.checked at the next results, due by 3 Dec
    • ○Stock pay falls below 22% of sales over four quarters.checked at the next results, due by 3 Dec
  2. Neutral→AttractiveBack to the April price on the same business

    It needs:

    • ○The shares fall back to about 4 times the last year's sales, where they were in April.about $13.06 today, 49% below the last close
  3. Neutral→UnattractiveGrowth stalls outright

    It needs any of:

    • ○The new subscription value added in the year to January 2027 falls below last year's $199.0M.checked at the next results, due by 3 Dec
    • ○Retention, when next disclosed, is below 105%.checked at the next results, due by 3 Dec

What is coming

  • 3 December 2026 Q3 FY2027 results: Whether net new ARR grows on the prior year's quarter and whether stock pay falls below 27% of revenue.
Every dated event ahead
  • 3 December 2026 Q3 FY2027 results: Whether net new ARR grows on the prior year's quarter and whether stock pay falls below 27% of revenue.
  • March 2027 Q4 FY2027 results and FY2028 guidance: FY2027 net new ARR against $199.0M, the guide for FY2028, and whether the 10-K prints a retention figure again.
Since we wrote this
Written
6 Oct
Price the thesis read
$25.43
5 Oct
  • 14 OctNewsSentinelOne proposed, then priced, $1.25B of 0% convertible notes due 2031. View held$1.25B 0% convertible senior notes due 2031: proposed 13 October, priced overnight.
  • 6 OctThesis writtenNeutral, medium convictionWritten two months before Q3 FY2027 results, after the shares nearly doubled from April on a higher multiple.

Also checked 1 time with nothing new to act on.

Sources 19

Where this came from

Sources - 19

Every claim above cites one of these, or states the reasoning that derived it. The quote is frozen at the date it was read: a link can rot, and an agent fetch returns a reading of a page rather than the page. Backs counts the whole claim ledger, so it can name a claim this page does not surface.

  1. S01primarycompany filing2026-08-28
    ARR, the $100,000 customers, the retention wording, remaining performance obligations, the May 2026 restructuring, the Israeli tax agreement and its change-of-control acceleration, the share count and the no-buyback half
    backsC01C02C03C07C09C12C13C14C15C28C29C31C40
  2. S02primarycompany release2026-08-27
    the quarter's statements, the non-GAAP reconciliation, free cash flow and the raised FY2027 guidance
    backsC02C10C14C15C30C41C42
  3. S03primarytranscript2026-08-27
    net new ARR of $56M up 4%, AI security ARR tripling, Flex above 10% of ARR, the net new ARR guardrail as an analyst put it and the CFO's answer; eight analysts' questions
    ARR from our AI security offerings, Prompt and Purple AI, continues to be in hyper growth, tripling year-over-year in Q2.
    backsC05C08C26C28C44
  4. S04primarycompany filing2026-03-19
    Item 1 and the Competition section, ARR for three years, retention described without a figure, channel partner concentration, the buyback, the Prompt and Observo consideration
    backsC01C03C07C09C13C17C29C40C44
  5. S05primarycompany release2026-03-12
    FY2026 free cash flow of $51.9M and the first FY2027 guidance
    backsC30
  6. S06primarytranscript2026-03-12
    the only retention figures since the 10-K stopped printing one: 96% gross and 109% net for customers above $100,000; record Q4 net new ARR of $64M up 6%; management's 'slight improvement' on about $200M of net new ARR for FY2027
    For customers with $100,000 or more in ARR, our gross retention rate was 96% in Q4, and our dollar-based net retention rate for these customers was 109%
    backsC05C08
  7. S07primarycompany filing2025-03-26
    dollar-based net retention of 110% at 31 January 2025
    backsC07
  8. S08primarycompany filing2024-03-27
    dollar-based net retention of 114% at 31 January 2024
    backsC07
  9. S09primarycompany filing2026-05-13
    the executive officers and their start dates, beneficial ownership and voting power, and what the bonus and the performance shares pay on
    backsC32C33C34
  10. S10secondaryvendor data2026-10-06
    Research pack, frozen beside this thesis
    content/S/research-pack.json
    price, market value, the price history and the 126-day move split into business and multiple, the analyst panel and its drift, the filed competitor cohort and its multiples, consensus revenue, short interest and the insider roster
    backsC14C15C16C35C36
  11. S11primarycompany filing2026-03-05
    the main rival's own description of the same one-sensor product, and its dollar-based net retention of 115% at the same date SentinelOne stopped printing its own
    backsC19
  12. S12primarycompany filing2026-09-10
    a rival's Competition section naming the endpoint specialist CrowdStrike among the independent security vendors it competes with
    backsC20
  13. S13primaryindustry data2026-10-06
    the price of the bundle a buyer weighs Singularity against, which no filing carries, and the price factor in the prize
    Get Microsoft Defender endpoint protection capabilities as part of the Defender Suite, along with email and collaboration, identity, and SaaS protection for comprehensive threat protection. Microsoft Defender Suite $12.00 user/month, paid yearly
    backsC18
  14. S14primarygovernment data2026-09-01
    the countable base for the prize, measured by the statistical agency rather than a security vendor
    All Employees, Total Nonfarm; 2026-09-01; 159044.0; Thousands of Persons, Seasonally Adjusted
    backsC23
  15. S15secondarynews2025-09-22
    that the one public head-to-head test of detection no longer contains SentinelOne, with MITRE's chief technology officer interviewed on why
    After Microsoft announced it would not participate in MITRE Engenuity ATT&CK Evaluations: Enterprise 2025 in June, SentinelOne and Palo Alto Networks confirmed on September 12 they were also pulling out of the test for this year.
    backsC21
  16. S16primaryindustry data2026-04-07
    the event the call calls the Mythos moment, from the model's maker, and its list of twelve launch partners, which names CrowdStrike, Microsoft and Palo Alto Networks and not SentinelOne
    Mythos Preview has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser.
    backsC27
  17. S17secondaryindustry data2026-07-06
    the outside rate for endpoint spending and the size of the securing-AI segment; Gartner's own newsroom answered 403, so this is a named reader of the forecast file rather than Gartner
    Endpoint protection platforms hold the top category spot through 2028 at $27.3 billion. In 2029, the securing AI segment passes them, $31.2 billion versus $30.1 billion.
    backsC25
  18. S18primarycompany filing2026-09-15
    which sales were under a Rule 10b5-1 plan and which were discretionary, and the one open-market purchase in the year
    backsC43
  19. S19secondarycompany release2026-10-01
    an analyst firm's placement, reported by the company; the assessment itself is behind IDC's paywall
    today announced it has been named a Leader in the IDC MarketScape: Worldwide Modern Endpoint Security for Enterprises 2026 Vendor Assessment (#US54123526, September, 2026).
    backsC22
Rendered from content/S/thesis.json · thesis reviewed 2026-10-06. This page explains a company; it does not say what to pay, when to buy or how much.