Good evening. Thank you for attending today's SentinelOne Q4 2022 Earnings Call. My name is Hannah, and I will be your moderator for today's call. [Operator Instructions]. I would now like to pass the conference over to our host, Doug Clark, Investor Relations of SentinelOne. Please go ahead.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the fourth quarter and fiscal year 2022 ended January 31. With us today are Tomer Weingarten, CEO; Nicholas Warner, COO; and Dave Bernhardt, CFO. Our press release and a shareholder letter were issued earlier today and are posted on our website. This call is being broadcast live via webcast, and following the call, an audio replay will be available on the Investor Relations section of our website. Before we begin, I would like to remind you that during today's call, we will be making forward-looking statements regarding future events and financial performance, including our guidance for the first fiscal quarter and full fiscal year 2023 as well as certain long-term financial targets. In connection with our recently announced definitive agreement to acquire Attivo, management will provide additional information as to the benefits of the acquisition. However, we'll not factor the planned acquisition into our fiscal '23 guidance at this time. We caution you that such statements reflect our best judgment based on factors currently known to us and that actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our S-1, our quarterly report on Form 10-Q and our annual report on Form 10-K that we filed. These documents contain and identify important risk factors and other information that can cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during this call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons actual results differ materially from those anticipated in the forward-looking statements, even if new information becomes available in the future. During this call, unless otherwise stated, we will discuss non-GAAP financial measures. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in today's press release and in our shareholder letter. These non-GAAP measures are not intended to be a substitute for our GAAP results. The financial outlook that we provided today excludes stock-based compensation expense, employer payroll tax on employee stock transactions and amortization expense of acquired intangible assets, which cannot be determined at this time and are, therefore, not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fiscal fourth quarter earnings call. This was another excellent quarter, and I'm extremely proud of the entire SentinelOne team. Our ARR grew 123% year-over-year in the fourth quarter, making the fourth consecutive quarter of triple-digit growth. In today's digital world, cybersecurity is mission-critical infrastructure in every geography, industry vertical and organization size. The demand environment remains incredibly strong. We continue to scale our business as a result of our cutting-edge autonomous XDR platform and our powerful partner-supported go-to-market strategy. We've built an AI-driven security platform that spans endpoint, cloud, IoT, data and now also identity. I'm thrilled that today, we announced our plan to acquire Attivo Networks. Attivo is a premier and highly differentiated solution that will enable us to provide cybersecurity in one of the most critical and dynamic parts of enterprise security today, the identity parameter. With Attivo's user-centric identity capabilities, we will be able to support an even more comprehensive zero trust framework. I'd also encourage everyone to read our shareholder letter we published on our Investor Relations website, which provides a lot more detail. Let's take a look back at our fiscal '22. It was a groundbreaking year for SentinelOne. We started the year as a private company, delivered a triple-digit revenue and ARR growth rate through all 4 quarters and ended the year as one of the fastest-growing technology companies in public markets with outstanding growth in ARR rapidly approaching $300 million. Throughout the year, we celebrated accomplishments that highlight our product market fit, innovation and superb customer experience, such as a Leader in the 2021 Gartner Magic Quadrant for Endpoint Protection, highest scores in Gartner Critical Capabilities use cases and being the only vendor with 100% visibility and no misdetection in the latest MITRE evaluation.…

Thank you, Tomer, and welcome, everyone. We delivered an outstanding fourth quarter across every geography, driven by our go-to-market flywheel of sales, marketing, channel and technology partners. More large enterprises are selecting SentinelOne than ever before because of our industry-leading efficacy, automation, ease of use and differentiated XDR capabilities. I'm also excited to welcome the Attivo team. Listening to customers and following many of the largest incidents in cybersecurity over the past few years, identity is a critical vector in delivering the most complete XDR platform. Not only is it a natural fit within our platform. It will complement our network of strategic service providers extremely well. In Q4, we reported impressive ARR growth of 123%, reaching $292 million. This growth was driven by a healthy mix of new customer additions, renewals and upsells. Our momentum with large enterprises was particularly strong this quarter. We added a record number of customers with ARR over $100,000 and a record number of million dollar-plus ARR customers. All of this is extraordinary and reflects the success of our sales and marketing organizations. Let me share more on this. Our customers with ARR over $100,000 grew 137% year-over-year to 520. And let me give you an example. In Q4, we closed the largest new customer deal in our history with one of the most influential and leading global Internet companies. This win came after an intensive evaluation process, including other next-gen security providers. I'd like to highlight one additional win, which is emblematic of what we're seeing in the market. Like most Fortune 500 companies, this enterprise was using multiple operating systems. They lacked true security parity across all surfaces. Their existing next-gen EDR vendor failed to quickly deploy and left critical Mac and Linux attack surfaces unprotected. They terminated their existing 3-year subscription…

Nick, Tomer, thank you, and let me also thank everyone for joining us today. I'll discuss our quarterly financial highlights and provide additional context around our guidance for Q1 and full fiscal year 2023. I'll also touch on the financial highlights for Attivo and the full year implications. Afterwards, we will open the call to your questions. We delivered another strong quarter of revenue and ARR growth, both well into the triple digits. We achieved year-over-year revenue growth of 120%, reaching $66 million, and ARR growth of 123%, exceeding $292 million. We added net new ARR of $56 million in the quarter, a new record for the company. We saw strong momentum and a robust demand environment for our platform. The strength of our performance was broad-based, coming from a healthy mix of new customer additions, existing customer renewals and upsells. All of this was further magnified by the strong underlying seasonality of our fourth quarter. Our business expanded nicely across all geographies. Revenue from international markets grew 140% and represented 31% of revenue. Turning to our cost and margins. Our non-GAAP gross margin in Q4 was 66%, reflecting a double-digit increase of 12% year-over-year. We're seeing the benefits from our increasing economies of scale and business expansion, including strong module attach, platform upsell and data processing efficiencies. This was partially offset by the temporary costs we discussed last quarter associated with the migration of existing customers to our DataSet back end. We've made excellent progress on this front. All of our new customers are already using the DataSet back end, plus we've already migrated many of our largest existing customers. These customers are enjoying up to 10x performance improvements. We remain on track for our migration plan, and these temporary duplicative costs should be behind us after the first…

[Operator Instructions]. The first question is from the line of Brian Essex with Goldman Sachs.

Congrats on a solid quarter. Really nice set of results. So if I'm keeping it to one question, I guess I'll keep it to a rather upfront and obvious one. I guess, Dave, if you could help us understand, I know you're not giving explicit guidance around operating margin impact of Attivo. It's nice to see it will be accretive to gross margins. But how should we think about how you anticipate the impact that's going to have on your model, both this year and next year as maybe it gets a little bit of scale on top of your platform?

Sure. So obviously, we have stated that it is accretive to our gross margin. From an operating margin standpoint, I think this current year, while we take into account our expected integration costs, the margin profile will be very similar to ours. If you take out those costs on a go-forward basis, it would be accretive to ours on an operating margin basis. And we'll have that guidance, obviously, when we specifically guide next quarter.

Got it. Is there a way to think about the overall accretion and overlap on your platform and how that maybe accelerated as you kind of integrate it with your platform?

Yes. I mean on a combined basis, we've got plenty of opportunities to scale, both operationally and with our products as we have this in the go-to-market. It really doesn't change our long-term margin targets right now, but we will have better guidance as we complete the transaction.

The next question is from the line of Gray Powell with BTIG.

I know it's probably a little bit early, but what kind of upsell are you expecting identity security to be relative to your typical customers' core EDR build?

Nick, go ahead.

I think what we're going to see is broad-based demand, especially across our enterprise customers. And as you folks know, enterprise business is our largest part of our revenue contribution. In addition, it's growing even faster than our overall growth rates. So the demand is going to be high, and it's only going to get higher.

Yes. Maybe one small thing to add to that. We've been partnering with Attivo more than a year now, so we kind of see already the demand that's being generated jointly by the companies. So that just gives us a lot of confidence in our ability to go ahead and really make it an incredibly successful module for us.

I think the one last thing I would mention as well is we've seen an incredible level of interest from our incident response partnerships. And I think we're going to experience a ton of demand coming out of that motion as well.

Got it. That's really helpful. And then just one quick follow-up. If I look at your sales and marketing efficiencies, they improved every quarter this year. What's driving that? And how should we think about the potential for additional gains in fiscal '23?

Well, I think first and foremost, it's getting the right operational pieces in place over the last several quarters, which we worked really hard on in terms of onboarding, training, enablement. But that also extends out to our partner ecosystem as well because a new sales rep is going to be a lot more productive when they're dropped in a region that has mature, veteran, up-to-speed partnerships in place. And that's the state of the union today with our go-to-market.

The next question is from the line of Patrick Colville with Deutsche Bank.

Let me echo the congrats of others on closing out a great first year. Just on Attivo, I mean, I met with the company quite a few times. And their messaging to me is much more on deception and kind of honeypots and full slags and kind of that domain. What you've been kind of mentioning to us today is much more about identity. So just trying to understand, has the business shifted quite a lot recently to kind of more focus more on identity? Is that how you're kind of trying to pivot the business? Just help me understand kind of that aspect and whether, I guess, deception is going to be part of the kind of go forward with Attivo.

Yes, yes. It's a good question. And the business definitely shifted significantly in the past few quarters. They expanded what they're doing. And they really leveraged their expertise in understanding Active Directory structure, which is really the vote for our identity to build complete new offerings, which are now -- if you look at the revenue mix, are the fastest growing and are definitely showing the biggest traction that they have as a company. It's kind of a threefold type of product portfolio today between what we define as kind of legacy deception, which is still very much needed in today's world, especially as we focus on preventing lateral movement that is not always machine-driven but more user-driven, but then on top of that, the ability to assess risk within Active Directory not just on a go-forward basis but also on a look-back basis, allow you to eliminate configuration mismatches or any type of vulnerabilities you already have preexisting in your environment. That becomes a big deal for customers out there today with the sheer complexity of managing identities in kind of on-prem situations. But then the entire identity protection layer, credential protection, all of that, these are new modules that they have built over the last few quarters and are showing meaningful traction for that company. So to us, it's just a great multi-layered approach that really addresses in the most comprehensive way today everything in and around identity. And we feel it's just a great way for our customers to reduce risk once again in the most profound way that you can when you're looking at the user perspective, including insider threat, which is, to us, maybe an overlooked part of what's happening today in the enterprise landscape, but remains a big pain point for enterprises today.

The next question is from the line of Fatima Boolani with Citi.

This is Mark on for Fatima. Maybe just a quick one on Attivo as well. On the -- I guess like going forward, how do you expect Attivo to be sold? Should we think about this as a feature or a new modular capability similar to the ones we've seen with cloud security and IoT SKUs? Or should we expect, I guess, like a different approach here?

Yes. I mean I think what you're seeing in our business is also a complete shift to really platform selling. So when you look at our cloud portion, it's a complete separate module or module package. Identity will be the same. It's basically an identity suite of capabilities. It will be sold on top of the platform. So it will be included in any bundle. To us, I mean, that's the way that we today see success with our existing modules. Like RSO as an example, it's a complete endpoint management suite, cloud suite and our identity suite. To us, I mean, it's just -- it's a great way to re-expand what we do, but at the same time, make sure that we're not just continuing and selling just one core endpoint -- or into just one core endpoint TAM, but with every sale, we expand across TAMs.

The next question is from the line of Saket Kalia with Barclays.

Okay. Great. Tomer, maybe for you, just maybe zeroing in on the core endpoint part of the business. Can you just talk a little bit about how the base looked at the end of the year just around across different Singularity bundles, Core, Control and Complete? And maybe talk to us how you think about that mix sort of going forward. Does that make sense?

Yes, yes. Absolutely. And I think in kind of a quick follow-up to what I just said, we've really shifted in the past couple of quarters to more of kind of an overarching platform selling approach, which really means that we're really focused on just selling Complete right now. It's kind of the one and only package you can buy at the enterprise level. And then on top of that, the expansion modules that we've built to date, both towards surfaces, data retention and now obviously identify in the user perspective. So to us, Complete really becomes kind of the base of what we sell to the enterprise market. I think it accounts for about 75% of our enterprise sales to date. The vast majority of what we don't sell -- where we don't sell Complete is really through the MSSP channel and in other parts of the market that might not need the fully fledged functionality that comes with our Complete package. But definitely, going forward, the focus here is selling Complete as the base package for our platform and then on top of that, the expansion modules, the expansion suite that, again, today span cloud, IoT, data and with Attivo identity as well.

And I think all of that really is against the backdrop of our growing success in the enterprise. And when we're selling into the enterprise, they're buying more products, more modules.

The next question is from the line of Trevor Walsh with JMP Securities.

Maybe best for Dave. I was wondering if you could speak a little bit to net customer adds on a quarter-over-quarter basis. It looks like from what I'm seeing, around 500 to 700, 700 kind of being kind of more recent record of a net add within any given quarter. Is that kind of how you would expect it to kind of go in this -- throughout this year and into next? Or do you have kind of plans from either kind of how your go-to-market teams are getting segmented, et cetera, to maybe boost that number up considerably? And if you could just provide some color on that, that would be great.

Well, you're right. Q4 was a record quarter, and it wasn't just a record quarter for a number of customers added. It's a record quarter for ARR per customer. It was a record quarter for customers over $100,000 in ARR. It was a record quarter for customers over $1 million in ARR. And lastly, it was also a record quarter for module contribution. So we are seeing absolute positive momentum in the business, and we expect that to continue.

The next question is from the line of Hamza Fodderwala with Morgan Stanley.

I had a question on DataSet for Tomer and for Nick. Tomer, if you could just talk a little bit about how the pipeline is trending for that DataSet product? I know you rebranded it recently off the acquisition of Scalyr. And to what extent this is a one-to-one replacement for some of the existing SIEM and logging solutions out there? And then for Nick, how are you thinking about building the go-to-market engine for DataSet? Is this something that you see that can be sold separate from the Singularity platform? And how are you ramping the reps around that sales motion?

Yes. So again, a record quarter pipeline for DataSet. I mean obviously, in the back of the launch, I mean, it just generated a lot of customer interest. But at the same time, I think what's important to understand is that when you're talking about the DataSet brand, we're really more addressing the known security use cases. Where you find the SIEM replacement opportunities, to us, this is going to come on the back of Singularity XDR. DataSet is the backbone technology behind the scenes for Singularity XDR. But our way to address security use cases is with Singularity, with the Singularity brand, with the SentinelOne brand and with XDR. So head-to-head SIEM replacements, these are ones that we're addressing with our XDR platform. When you talk about logging platforms, search capabilities, real-time event data monitoring, that's what we do with DataSet, and that's where we're seeing a ton of traction right now. So to us, DataSet is really focused on addressing all use cases above and beyond security. And we're leaving the SIEM replacements to our XDR approach, which we truly believe is just the next incarnation of the SIEM. It's much more of an active solution to aggregate security events. We're going to be opening up ingestion at scale from every product that you have in your enterprise ecosystem and into the XDR platform. So XDR is the answer for SIEM. DataSet is our ability to now go and expand on the foundation that Scalyr was built upon and really tailor not into just logging environment and production environment but also even business data, where we see some of our existing customers are ingesting unstructured data from every source, not only production, not only logging, and are deriving insights from the data that they put into the platform.

And our go-to-market data set is really twofold. We have a specialized sales force for data analytics, but we've also incented our entire sales force to be able to cross-sell DataSet. And this approach is working great. In Q4, we closed large 7-figure deals like a new business deal with Copart. And then we also grew customers like DoorDash well into the 7 figures from an ARR perspective.

Maybe if I could just follow up, Nick. Are these being sold to different buyers almost? Because it seems like data and analytics on the DataSet side is an almost entirely different use case versus secure. So are you selling them both to the CISO? Or is one being sold to maybe another part of the organization?

We're selling into the CIO.

The next question is from the line of Rob Owens with Piper Sandler.

I was wondering if you could unpack some of the trends you're seeing in your sales and marketing line, which has been somewhat flattish over the last couple of quarters relative to forward thinking around capacity additions, where you're at and what a return to office might look like for that line.

I can start a bit from the financial standpoint. I think what we're seeing is we're just continuing to see more efficiencies and productivity gains. When I think about the time of marketing expense, obviously, with it being our IPO year, they were more heavily weighted to the front of the year. We're continuing to invest in sales and marketing to support the growth of the business. And this was -- the past year has been a huge year of growth for us, whether it's the IPO, the meaningful jump in scale, the growth of the platform or just bringing us a little further up in the mindset of buyers. This has just been a really important year for SentinelOne. And Nick, I don't know if you want to expand a bit just in terms of how the sales force is -- how they're ramping.

Well, we doubled our sales force last year. We're going to continue to aggressively hire as we get into the end of the year. As I mentioned before, we're really pleased with the productivity and performance of our teams. And again, I want to stress again, so much of that is a benefit of our channel ecosystem. And so what we have out there is the ability to punch well above our weight. Instead of having a few hundred sellers out there, we have thousands of sellers out there that are interacting at all different life cycle stages and parts of the organization. So when I -- the question I just answered around DataSet, that's a conversation with the CIO. That really up-levels our brand and visibility outside of just having CISO conversations. So when you think about scaling and building out a team, what they're inheriting now is a great brand, incredible momentum and a huge channel ecosystem. And what that makes us really confident about is forward hiring, increasing our scale and capacity and being able to do so very successfully.

Yes. Just a quick add to that. Like a great way to look at that is our magic number, and it's been over 1, and it's continuing to expand. So to us, I mean, we obviously track efficiently very, very closely, and we're very pleased with the progression. That gives us more confidence to kind of continue and scale the business, of course. Couple that with win rates that are consistently strong, and you just get a good recipe for growth.

The next question is from the line of Roger Boyd with UBS Securities.

Just a comment on the partner channel. You noted 20% cost of business now coming through. Given the success you're seeing here and the work you've done in the last 18 months to go and partner with the largest ones, how big could this get as a percent of your business? And as you continue to add end users through these partners, how are you thinking about customer additions in fiscal '23 versus the 3,000 you added in fiscal '22?

I mean I think the growth environment on the partner side is really unbounded. If you think about what we've done, it's not just partnering with security resellers. If you think about partnering with MDRs, with MSSPs, with incident response partners, each on their own, those macro ecosystems are growing massively, especially if you look at the MDR and MSSP space. So as we're growing and adding more of those partners, their own business is really growing super rapidly. And that's why if you see contribution, it's accelerating, and it will continue to accelerate. And I think what really is great about it is it just gives us exposure to a broad set of customers, especially with MSSPs that we wouldn't normally touch. And so we're doing all those things. And then in addition, we are continuing to totally focus on enterprise selling. And so selling that platform motion, selling modules, totally focusing on selling Complete into enterprise customers with this amazing collection of modules that we have as well. And that's why, frankly, we're so excited about the Attivo acquisition. We feel like it gives us several more important arrows in our quiver that we can go out and execute against.

The next question is from the line of Brent Thill with Jefferies.

Tomer, you guys mentioned your large customers are growing 2x your smaller customers. Many are asking what's easing the enterprise friction for you going forward.

I think it's a combination of things, right? I mean I think I wouldn't -- I'd be remiss if I didn't say our brand and our ability to show incredibly well every time the platform is put to the test. I think that's a big driver for us. I think our Ranger capability, which you might look at just a capability, but it also allows for rapid deployment, and it allows for discovery of more surfaces in the enterprise. And that just speaks to the simplicity of use that our platform really carries. If you take that with the ability to join these enterprises in their journey to the cloud with a best-of-breed runtime protection, we're becoming really a one-stop shop for a lot of these enterprises to look at every surface that they currently have. And I think that just unlocks more and more traction for us. If you kind of look even at our data capabilities, once again, the ability to provide up to a year of data retention out of the box, no customization, just something that you tick off is something that is unique to us in this space. And I think that a lot of the large enterprises out there are looking at that because otherwise, if they're going with a different EDR vendor, they suddenly need to figure how are they going to retain data on the back of maybe a different platform. And that's sometimes going to be just incredibly costly. With us, it comes on the back of a single platform. It's the benefit of DataSet that is now the back end of our entire XDR platform. So obviously, I mean, that is becoming something that's very, very tempting to a lot of enterprises there to solve both for security but also for data and log retention in one fell swoop.

The next question is from the line of Andrew Nowinski with Wells Fargo.

Can you give us any color on that large deal that you mentioned that was the largest in company history? And was there any significant pricing pressure on that deal and whether we should normalize for that deal when we think about billings growth for Q4 of this year?

Yes. I mean I don't think it's something that we think is completely out of whack in many regards. I mean we do have the pipeline that shows that our large new progression is here to stay, and it's going to expand and hopefully be more meaningful if you kind of progress towards the next quarters. All in all, we think it's just a great win for us. No notable pricing pressure outside of the obvious competitive environment. So to us, it's just another great indicator for our ability to just progress upwards and upwards in our large deal velocity trajectory.

The next question is from the line of Joshua Tilton with Wolfe Research.

Just a quick one for me. On the gross margin guidance, would it be possible to kind of give us a sense of what it would have been if you were not digesting costs associated with migrating customers to DataSet in the first half of the year?

Yes. I mean in the past, we've said it was around 4% so I would say it's in that ballpark. When I think about what it would be if we weren't having a duplicative cost, we're expecting this to continue through the first half of the year. And then obviously, it's going to dissipate over that time. But we expect that the rest of customers will be migrated by the end of Q2. I think you'll see the continued scale on us. As we're looking at how we're going to exit the year, if you look at what our guidance is with these suppressed margins in the first half, I think what your -- what you could perceive from that is that we'd be in the high 60s by year-end.

The next question is from the line of Rudy Kessinger with D.A. Davidson.

On Attivo, it would appear the customer base certainly much more tilted towards enterprise customers, ARR per customer a bit over double your guys'. How much customer overlap is there? And what kind of opportunities do you have within the Attivo customer base to cross-sell your solutions into those enterprise customers?

There's some overlap, but it's actually quite small. And so that is an incredibly compelling cross-sell opportunity because what's also even more rare is that there isn't much overlap, but we're ultimately trying to solve the same problems together as a joint solution. And we're still selling into the same parts of the organization, especially as it's focused around security. So when you think about the Attivo customer base, it's dozens of Fortune 500, several Fortune 10s, really great customers like Aflac and others and a real strength in federal and public sector and also a real strength in the Middle East as well. And so these are all areas that are going to be highly complementary to our existing business.

That concludes the question-and-answer session, so I will pass the conference over to the management team for any closing remarks.

Thanks, everybody. We appreciate your time and attention today and looking forward to the next one. Thank you.

That concludes today's conference call. Thank you for your participation. You may now disconnect your lines.