Good afternoon. Thank you for attending the SentinelOne Second Quarter Fiscal Year 2025 Earnings Conference Call. My name is Cameron, and I'll be your moderator for today. All lines will be muted during the presentation portion of the call with an opportunity for questions-and-answers at the end. I would now like to pass the conference over to your host, Doug Clark, Vice President of Investor Relations. You may proceed.

Good afternoon, everyone, and welcome to SentinelOne's Earnings Call for the Second Quarter of Fiscal Year 2025, which ended July 31, 2024. With us today are Tomer Weingarten, CEO, and Dave Bernhardt, CFO. Our press release and a shareholder letter were issued earlier today and are posted on the Investor Relations section of our website. This call is being broadcast live via webcast, and an audio replay will be available on our website after the call concludes. Before we begin, I would like to remind you that during today's call, we will be making forward-looking statements about future events and financial performance, including our guidance for the third fiscal quarter and full fiscal year 2025, as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our Annual Report on Form 10-K, and our Quarterly Reports on Form 10-Q. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons actual results could differ materially from those anticipated in the forward-looking statements, even if new information becomes available in the future. During this call, we will discuss non-GAAP financial measures unless otherwise stated. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our shareholder letter. These non-GAAP measures are not intended to be a substitute for GAAP results. Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges, and gains and losses on strategic investments, which cannot be determined at this time and are therefore not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fiscal second quarter earnings call. We reported strong results and exceeded our expectations on all key metrics, including ARR, revenue, gross margin, and operating margin. Our teams executed well during the quarter. We maintained our industry-leading revenue growth and set new company records for gross, operating, and net income margin. Importantly, we achieved a significant profitability milestone, our first-ever quarter of positive net income and earnings per share. This is a tremendous achievement, and I would like to congratulate all Sentinels who made this possible. In addition, our Q2 net new ARR outperformed our expectation by a double-digit percentage and we continue to expect new business growth trends to improve in the second half of the year. Based on our business and go-to-market momentum, we're also raising our revenue guidance for fiscal year '25. Superior technology is the cornerstone of how we empower our partners and customers to build more resilient enterprises. SentinelOne leads the industry with best-in-class AI-powered security and customer transparency. These are our guiding principles. Mission-critical businesses around the world rely on our technology, platform architecture, and engineering best practices. As I mentioned in a prior earnings call, bigger brands do not mean better security. Sub-standard platform architectures are extremely risky and can cause single points of failure. This is evidenced by the string of recent breaches at Microsoft and the largest IT outage in history caused by our direct competitor, CrowdStrike. The dependency on fragile software can rapidly disrupt our way of life and cause billions in damages to the businesses they're supposed to protect. Self-proclaimed industry leadership and overzealous marketing can create a false perception of reliability, eventually, the end user suffers, which is why we must focus on facts, not fiction. Operational hygiene and process…

Thank you, Tomer, and thank you, everyone, again for joining us. This afternoon, I'll discuss our quarterly financial performance and provide additional context regarding our guidance for Q3 and fiscal year '25. As a reminder, all comparisons are year-over-year and financial measures discussed here are non-GAAP unless otherwise noted. Once again, our second quarter results not only met but exceeded our revenue and margin expectations. We continue to lead the industry in terms of technology, revenue growth, and margin expansion. We also delivered our first-ever quarter of positive net income and earnings per share, another significant milestone on our path to sustained profitability. Revenue grew 33% to $199 million in the second quarter. Our growth was also balanced across geographies. Revenue from international markets grew 36%, representing 37% of our quarterly revenue. Our total ARR grew 32% to $806 million. We added $44 million in net new ARR in the quarter, which exceeded our expectations by a double-digit percentage. New customer logos and wins across endpoint, cloud, and data remain the key drivers of new business growth. We also maintained healthy expansion rates from existing customers. Consistent with the view we shared last quarter, we continue to expect better net new ARR growth trends in the second half of the year, driven by a strong pipeline, new product contributions, and expanding go-to-market. Compared to ARR, remaining purchase obligations once again grew at a strong pace, up 40% year-over-year as we continue to sign larger and longer-term contracts. This is important as it provides us with longer-term visibility and sustainable future growth. Looking beyond our top-line, gross margin also increased sequentially to a record-high of 80%. This was an increase of 3 percentage points year-over-year. Our best-in-class gross margin indicates healthy pricing and the success of our value-added approach. Our unified…

Thank you. We will now begin the question-and-answer session. [Operator Instructions] The first question is from the line of Gabriela Borges with Goldman Sachs. You may proceed.

Good afternoon. Thank you. Tomer, I wanted to follow-up on some of the architectural strengths that you highlighted in the prepared remarks, particularly the fewer updates and the lower level of keRnel access that you talked about, how are you able to maintain the same level of efficacy with mitigating the risk of keRnel your updates? And how is that architectural strength translating to some of the pipeline conversations you're having? Is there a way to think about what percentage of customers are thinking about dual sourcing versus single sourcing and where the industry might grow from a sole sourcing versus dual sourcing standpoint? Thank you.

So let's try to kind of be clear about what happened. I mean we're talking about the largest-ever IT outage systematically impacting millions of people, disrupting thousands of businesses, costing billions of dollars, and this was a global practically fleet-wide outage, totally unprecedented in reach and scale. And secondly, also the duration of the outage, I think was also quite unprecedented. Most modern technology services don't really take days to come back online and this has been days to weeks, required manual intervention and reboot of millions of affected devices. I've truly never seen anything like this in my lifetime. I think immediately you understand the level of uncertainty and concern amongst customers out there. It called into question the entire software development best practices of that vendor, and I think as a result, it goes back to your question, what does it mean for SentinelOne? And if you think about our architecture, I think what's immediately clear is that we don't require the same number of updates. We embed AI models into the endpoint agent and we have removed and moved away significantly from being keRnel dependent for about five or seven years to the point that on the Mac operating system, we're not at the KeRnel at all. On the Linux operating system, we're not touching the KeRnel at all, and even on Windows, we minimize what we do. So even when you download updates, they actually live in a different part of the system, and obviously, moving away from the KeRnel is incredibly beneficial to system stability. In the KeRnel, every small update, every small adjustment can result -- every small mistake results in a blue screen or instability, that's why most vendors try to minimize what they do at the KeRnel level. And I think that's…

Thank you for the detail.

The next question is from the line of Brian Essex with JPMorgan. You may proceed.

Great. Thank you. And thank you for taking the question. Tomer, I wanted to circle back on -- you called out in your shareholder letter and your prepared remarks about the interest in your platform, as you just mentioned has distinctly risen. Could you provide a little more color around conversations you're having with customers? How you might see the recent outage impacting your pipeline growth if you can quantify it at all? Any impact on pricing, win rates? And are you counting on deal leakage from CrowdStrike in order to hit like target growth numbers that you've implied in your guidance? Just trying to get a sense of impact and conservatism there. Thank you.

For Q2, obviously, the vast majority of what you see is just kind of the natural momentum of the business, double-digit overachievement on the net new ARR side of the house speaks for itself. And that to me, I would call it organic momentum. I think our pipeline generally looking forward is definitely getting stronger. If you think about the partner ecosystem, I think it's not far-fetched to say that a lot of the customers are revisiting their extension conversations, they are very, very least. I think on top of that, we've already seen customers choosing to move away. Some of them have moved away already to SentinelOne, some of them are in the process, some of them will take time to assert, but I think everybody is considering their next steps. And obviously, as you can imagine, that bodes well up to SentinelOne. With that, I would also be mindful that sales cycles take nine to 12 months. Nobody wants to rip off something immediately. Some folks do, but that's not the majority. I think for the rest of the customer base, just decisions -- they're going to play out over time. I think people are looking at us, obviously, the number one alternative. People are looking to diversify risk and not really concentrate more and more capabilities with one vendor. So as the partner ecosystem kind of spends those expansion opportunities, I think they are now looking to other sources to cover the lost expansion opportunities with other vendors and they're coming to us. And it comes to us in a good time, where we've been investing significantly in enablement of our workforce and our partner ecosystem. So we're now taking our entire platform to market. As you've seen with the adoption of Purple AI, such tremendous traction is just another evidence that we are able to now expand dramatically with our emerging products. So not only we're seeing, I think, core momentum in the endpoint space, we're also seeing the adjacencies now being revisited and SentinelOne being kind of a number one vendor for consideration across all these different opportunities.

The next question is from the line of Hamza Fodderwala with Morgan Stanley. You may proceed.

Great. Good evening. Thank you for taking my question. Tomer, thanks a lot for all the commentary on the increased pipeline, the new product attach rates with Purple, and a lot of the other things that you mentioned. I'm curious, given this opportunity in front of you, it seems like a lot more is coming SentinelOne's way. From a go-to-market execution standpoint, you feel like the go-to-market engine has significantly improved, especially in light of the CRO transition that SentinelOne had recently? Thank you.

I do. Absolutely. I think we've seen good evidence of that in Q2. And I think we're seeing more and more of that. And look, I mean, when we look at the remainder of this year, there's a couple of things that are in play. I mean, obviously, we're looking for just overall better trends in the second half of the year. I think we're also seeing even a departure from our seasonality between Q2 and Q3 and more sequential growth into Q3. And everything I'm saying now is really regardless of this outage, regardless of the downstream effect, this is just our own business, really improving our go-to-market cadence. So as I mentioned, I think this in some way has come in a relatively good time for us. We've been improving our execution. I think our sales force DNA has been, I think, amplified. We brought in new leaders. We're seeing better cadence. We're seeing better pipeline retention, better conversion rates, better win rates, all of that is trending positively again regardless of what happened. So all in all, we feel encouraged. We're trying to take a responsible approach for the remainder of the year. These are very early days. It's still very, very dynamic. I don't know that we can fully quantify what we're seeing now. And obviously, things can change here and there. We still want to make sure that we're giving an accurate projection for you all and that's why we're kind of sticking to the envelope that we know about and that's kind of what guides us forward.

The next question is from the line of Saket Kalia with Barclays. You may proceed.

Okay. Great, guys. Thanks for taking my question here. Maybe we'll change it up a little bit, and David, I've got a question for you. Very helpful commentary just on sort of directionally how to think about net new ARR here in the second-half, but just for everybody's benefit, I was wondering if you wanted to put a finer point on net new ARR. How should we be thinking about modeling net new ARR for this year? And is it fair to say that based on the commentary so far, is it fair to say that that doesn't include too much benefit from the CrowdStrike outage?

Yes, that's a great question, Saket, so thank you. When I think about ARR, I think we successfully stabilized net new ARR growth in Q2, which is what we said we would do last quarter. We outperformed our expectations by double-digits on the back, as Tomer said, of improved execution, strong underlying demand, and really our platform solutions, which have continued to have a positive response in the market. Like we said last quarter, the H2 growth trends were poised to improve and that was before any cyber event that happened with CrowdStrike. We've been driving better outcomes. We were already expecting better than typical Q2 to Q3 growth, which we've guided accordingly. We've had better execution. We've had better pipeline retention and I think what's probably most important on this is, if you just think about it kind of how our revenue increase has gone up as well. We've moved to the higher end of our range and I think that shows the positive growth we're expecting in the second half. That all being said, our outlook is -- there are benefits that may come from customers coming to us from CrowdStrike or from the events that have happened, but our guidance isn't dependent on it.

The next question is from the line of Shrenik Kothari with Baird. You may proceed.

Thanks for taking my question. So Tomer, I mean you highlighted the partnership with CISO, which delivers oral government-wide cyber defense and that seems to be pretty meaningful, so how does the platform capabilities firstly align with the requirements of the agencies? And can you elaborate on the significance of the partnership and the potential implications that would have on the growth opportunity in the federal market overall, if you can provide some more color? Thanks.

Of course. These types of deals, and I would say, in the same vein, the security -- cyber insurer coalition that we build, these are long-term very wide-reaching partnerships that we put out there. They unlock themselves gradually and over years. And same goes for the CISO partnership. The ability to deliver and secure private clouds, private environment, on-premise environment is quite unique for SentinelOne. I think that's why we also have this great fit with what the federal government actually needs. When you think about our Data solutions, these are just massive cost savers for these agencies, but I would encourage everybody to think about these partnerships as things that unlock themselves over time and gradually grow. There's no one shot to take everything. This is something again that spans millions and millions of endpoints and we unlock it over time. The way we look at it is just the ability to really lock down market share over years, and that goes towards our partnership with Google, transitioning away from the incumbent solution that they've been working with and into the next-generation solution with SentinelOne and same goes with our other IR partners, the cyber insurers, anybody from Aon to Chubb, all of them are providing their customers the option to go with SentinelOne and especially better premiums and better risk posture. So all in all, these are strategic partnerships that will unlock more market share and success for us in the years to come.

Next question comes from the line of John DiFucci with Guggenheim. You may proceed.

Thank you. Tomer, you were already in the process to change go-to-market, you have a new CRO, I guess, any thoughts on redirecting that due to the recent issues with the CrowdStrike outage? And on a related point, I think last quarter, you said you weren't in a chase to invest in marketing, but given what looks like opportunity for you, has that approach changed due to these events?

Not so much. We've been very aligned to go after net new business generation, which coincides really well with what happened. So the majority of what we do has always been focused on acquiring new customers and this is not very dissimilar from that. We are getting more honed in on our channel ecosystem. There's no question that this is where -- we've been very, very strong. We've had a very wide-reaching partner ecosystem and now we're there for them as they engage some of these customers that are rethinking their security decisions. So I think if anything, this is just more of an accelerant to a strategy that we already had in the past, but now we got the discipline to go after it. We got the systems, we got the processes, and that is obviously, incredibly helpful and very timely.

The next question is from the line of Rudy Kessinger with D.A. Davidson. You may proceed.

Hey, thanks for taking my question. I guess, Tomer, in the prepared remarks, I think you mentioned you had already maybe displaced a few CrowdStrike customers since the outage and then some different kind of comments throughout the call here. You said, look, sales cycles could take nine, 12 months, Dave, you said the second half outlook really isn't dependent on any boost from CrowdStrike. So I guess I'm just trying to get similar to Saket, kind of a -- somebody else who asked the question, not Saket, but just could you really quantify over the last five to six weeks have -- can you directly attribute any material piece of your new business to customers who ex that CrowdStrike outage would not have signed contracts with you? I'm just trying to get a better sense of what's been the impact to-date and your expectation for a potential positive impact the rest of this year.

Yes. Look, I'm not going to delve into how material and not material it is. We still have quite a lot of book of business regardless. That said, there have been customers that have been switching away. There have been customers that have decided and the switch to us, I hope, will happen quite soon. So it's all really work in progress, if you may. But these are marquee customers sometimes. So what the level of impact that would have and in what exact timeline? I mean, I'm not sure I can tell you right now. Customers need to test. Customers need to ensure interoperability. Customers need to come up with deployment plans. If anything, we've learned from this is that you just don't want to move too fast, especially not with such a important pieces of software for critical infrastructure. So all in all, I think I'm very encouraged by the conversations. We're not pushing towards any timeline. Once again, we work at the pace of customers. We're there to support them. We're not there to ambulance chase. If somebody shows up at my hospital, I'm darn well going to let them in, but we're doing this at the pace of customers.

The next question is from the line of Peter Weed with Bernstein. You may proceed.

Thank you. I think one of the things you've been emphasizing and for several quarters has been kind of the increasing proportion of growth coming from new customers, which is obviously, really exciting for potential of future growth. But can you help us, I guess, maybe on two dimensions? One is just give us some comfort that that's not just because of the continued deceleration in growth of existing customers. So where is that kind of trailing 12-month NRR sitting now and that kind of line-of-sight to potential expansion in the second half? And I guess the other side is, in those new customers, is that coming from like an increasing number of incremental lands? Is that coming from expansion and the size of those new customers? Maybe give us some color on the profile that's driving that really nice track record.

Sure. Look, expansion -- the expansion motion for us has been healthy since I can remember and it remains healthy. Consistent with last quarters, this is very much an expansionary territory. So I think we continue and grow our business with existing customers. Our customers are incredibly happy, just jump into Gartner Peer reviews and read what they say. So to me, that's an opportunity that's there. It's within our control. We're unlocking it at the pace that we determine. But as we mentioned, the focus is on new accounts. The focus is on adding more folks into our customer state and that's exactly what we're doing and it comes either with new accounts on endpoints. And mind you, there's still 50% of this market for endpoint protection that's up for grabs. So there's a lot of growth to be had in the endpoint market, but also with net new lens on cloud and net new lends on our AI-SIEM product. So all-in-all, you see emerging getting stronger, but not -- our emerging business getting stronger, but not just stronger because we cross-sell and upsell to existing customers, but also because we lend net new with some of these emerging capabilities, which is by design. And this is exactly the balance that we're trying to strike. I mean, we're trying to go and expand our customer state as much as possible while we continue and develop that motion for cross-sell and upsell. At the end-of-the-day, if you have a finite set of sellers and you can decide which opportunities they go after, right now, we're deciding that the dominant part goes after new account capture.

The next question comes from the line of Brad Zelnick with Deutsche Bank. You may proceed.

Great. Thanks so much for taking the question. Tomer, I wanted to follow-up on an earlier question about architecture, and specifically, what if anything you're expecting of Microsoft's upcoming Cyber Summit on September 10th, what changes do you envision that they might make so that the industry never sees, 8.5 million Windows endpoints go down again. And how might any of those changes impact SentinelOne and perhaps your competitive positioning? Thank you.

It's a good question. And I think what everybody needs to try and kind of keep in the back of their mind is that the KeRnel discussion is not a new discussion. Microsoft have been trying to move away from broad-based keRnel access for the past 10 years, if not more. There's actually been -- as far as I can recall, at least three different distinct initiatives to move away from the keRnel, all of them have failed. So on one end, I'm encouraged that this discussion is being revisited. On the other hand, I think the problem is so convoluted that there is a good degree where we find ourselves either in a multi-year transition best-case or again with something that might prove to be more complex to achieve and it will take even longer than that. But all in all, SentinelOne has always been an advocate of the best possible outcome for customers. If we can and we'll get the APIs that are needed and the channels that are needed to move away from the KeRnel and completely have the same level of visibility that we have today, we will absolutely do that. Much like we moved away from the KeRnel on Mac OS, much like we moved away from the KeRnel in Linux, and in the cloud, I think we would welcome if Microsoft had standardized the ability to monitor the system. But again, this is a much broader question than just security providers and their access to the KeRnel. Past attempts by Microsoft have revolved around trying to build an app ecosystem and permission-based controls on Windows, that has not really happened or transformed the way that the Windows operating system works. And generally, I think that the Windows operating system proves again and again that it is quite fragile, and I think that is the bigger issue at hand. And I think that when you think about it that way, the level of refactoring that might need to take place with the operating system, I think, is going to be substantial. And I also think that for some other vendors that have KeRnel access, if they need to get out of the KeRnel, given the kind of intrusive amount of code that they put into the KeRnel, they would also be facing significant refactors. So I think it's early days and time will tell. But I'm hopeful that there's going to be constructive discussion.

The next question comes from the line of Adam Tindle with Raymond James. You may proceed.

Okay. Thank you. Tomer, one of the highlights this quarter was you reached positive non-GAAP net income for the first time ever, and congrats on that. If I'm listening though to Dave's closing comments in his prepared remarks, it does sound like you're maybe beginning to reevaluate the trade-offs in growth and profitability certainly seems to make sense given the market is now more wide-open than ever. But I guess the question would be if you're potentially asking shareholders to go through an investment journey with you, be helpful to give visibility into your thought process on that, sort of the key factors that would go into your analysis on that decision, any parameters that you might put on the magnitude of potential investment? Thanks.

First of all, we have guidance and we follow guidance, and I think that kind of sits our entire philosophy, our entire constraint base, and how we think about the growth journey. Our comments are just in a world where you can choose to invest or not invest, we want to make sure people understand there is a massive opportunity. This is a $100 billion TAM. We got the leading technology in the market. So obviously, I don't think our shareholders want to see us back away or back down by any degree. With that, we have committed to an envelope and we're sticking to that envelope. I think that's all we're trying to say here. The opportunity is big. I think as we look at what we can potentially unlock in kind of the out years, that's always going to have to be balanced with our journey towards profitability. But I don't think you're going to see us veering away from the path that we've set. If anything, I think it's just on the pace of acceleration towards profitability. If you can imagine a world where we would invest less in growth and show more profitability, I think what we're just trying to let folks know is that this is the balance. What you're seeing from us is the balance is what we feel is responsible and is what we're following.

Yes. I would add to that. In the end, we're just weighing on long-term growth potential with delivering solid, responsible, and profitable financial profile. When you look at the annual guidance, it's 15 percentage points of year-over-year margin improvement, and we just -- all we really did was condense the range that we already had for EBIT. I think we went from negative 2 to negative 6 to negative 3 to negative 5. So we've honed in on a range, but we've maintained a range to preserve flexibility if there is investments that we feel will add to growth for next year. So that's really the message we wanted to deliver to everyone. There's a great opportunity and we may take advantage of that.

The next question is from the line of Gray Powell with BTIG. You may proceed.

Okay, great. Thanks for taking the question, and congratulations on the good results. So look, I know you've had a lot of questions on the CrowdStrike outage, if it's okay, I'd like to just ask one more. On the marketing side, just how aggressive are you being there following the incident? And do you have any specific programs in place to target Crowd customers who are potentially upset following the outage, like anything like a free six to 12-month limited trial period to ease the transition costs or just anything else that you're doing that could maybe help you leverage the situation? Thank you.

As I mentioned, we're just trying to be there for customers. Obviously, there's a lot of activity with our partner ecosystem, which is natural, but we have not devised any specific takeout programs. We don't feel like that's warranted or needed. We want to make sure that people understand the difference in architecture. So I think we put a lot of literature and collateral around the differences between the platforms. We're trying to educate folks. I think more than anything, we're just trying to make sure that people understand the kind of the ground truth of what happened. There's a lot of attempts to create alternative narratives. We've seen some appalling attempts to try and threaten customers publicly. We're, obviously, just trying to stay true to our North Star, which is no resilience marketing, staying true to facts and I think that we're doing it here once again.

That concludes the question-and-answer session. I would now like to turn the call over to Tomer Weingarten, CEO of SentinelOne, for closing remarks.

Thank you, everybody. Appreciate your time today.

That concludes the SentinelOne Second Quarter Fiscal Year 2025 earnings conference call. Thank you for your participation. You may now disconnect your line.