Good afternoon. Thank you for attending today's SentinelOne Q3 Fiscal Year 2025 Earnings Conference Call. My name is Jaylin, and I will your moderator for today. [Operator Instructions] I'd now like to turn the conference over to our host, Doug Clark. Doug, you may proceed.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the third quarter of fiscal year '25, which ended October 31, 2024. With us today are Tomer Weingarten, CEO; and Barbara Larson, CFO. Our press release and the shareholder letter were issued earlier today and are posted on the Investor Relations section of our website. This call is being broadcast live via webcast, and an audio replay will be available on our website after the call concludes. Before we begin, I would like to remind you that during today's call, we'll be making forward-looking statements about future events and financial performance, including our guidance for the fourth fiscal quarter and full fiscal year '25 and as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our annual report on Form 10-K and our quarterly reports on Form 10-Q. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons actual results could differ materially from those anticipated in the forward-looking statements even if new information becomes available in the future. During this call, we will discuss non-GAAP financial measures unless otherwise stated. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our shareholder letter. These non-GAAP measures are not intended to be a substitute for our GAAP results. Our financial outlook excludes stock-based compensation expense employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges and gains on strategic investments, which cannot be determined at this time and are, therefore, not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fiscal third quarter earnings call. Our Q3 results demonstrate strong execution and business momentum. We exceeded our top line growth expectations and continue to deliver year-over-year margin improvement. Importantly, our net new ARR growth reaccelerated back to positive territory, driven by solid execution and a record number of customers with ARR of $100,000 or more. This momentum reflects a stronger competitive position and notable rise in customer interest for SentinelOne. We continue to bolster our position as a technology leader through constant innovation. Today, Singularity is a comprehensive cybersecurity platform that delivers best-in-class security and operational resilience. Singularity unifies data capabilities and AI-powered security across endpoint cloud identity as well as third-party integrations all in one single user interface. Enterprises are increasingly selecting SentinelOne for our ability to provide real-time autonomous security that adapts to the modern threat landscape while simplifying operations. In a world where cyber threats evolve rapidly, our platform proactive approach is designed to safeguard enterprises today and into the future. This Singularity platform empowers customers to bring advanced AI capabilities into their entire security stack from data to operations. This ability not only sets a new standard in the market but also establishes what we believe is a foundational pillar for the future of cybersecurity, streaming enterprise-wide security data to be processed and analyzed by advanced AI algorithms and agents that drive real-time autonomous outcomes. It is clearly a more effective and efficient way to do cybersecurity. The rapid adoption of our Purple AI suite, now our fastest-growing solution, further highlights the value and innovation we bring to our customers. Looking ahead, we're raising our full year revenue guidance. For fiscal year '25, we now expect to deliver revenue growth of 32% compared to last year, up…

Thank you, Tomer, and thanks to everyone for joining us today. I'm thrilled to be here. Stepping into this role has been an exciting journey, and it's a privilege to work alongside an incredible team dedicated to transforming cybersecurity. Over the past couple of months, I focused my time on listening, learning and exploring SentinelOne's unique strengths and opportunities. Our mission is to secure the future through cutting-edge technology. From a financial perspective, we're committed to delivering consistent value and building on the strong foundation already in place. I see clear potential for long-term growth, scale and operating leverage. Now let's review the details of our third quarter financial performance and our guidance for Q4 and fiscal year '25. As a reminder, all comparisons are year-over-year and financial measures discussed here are non-GAAP unless otherwise noted. We exceeded our third quarter revenue and ARR growth expectations. Revenue increased 28% to $211 million in the quarter with strong momentum across all geographies. Revenue from international markets also grew 28% and represented 37% of our quarterly revenue. In Q3, our total ARR grew 29% to $860 million. Net new ARR of $54 million exceeded our expectations and grew 22% sequentially, significantly outpacing our historical Q3 seasonality. Our Q3 net new ARR increased by 4% year-over-year, reflecting a 14 percentage point improvement from the growth rate in Q2. This reacceleration of new business growth marks a return to positive growth and demonstrates that we are well positioned to deliver stronger net new ARR growth in the second half of the year compared to the first half. This quarter, we added a record number of customers with ARR of $100,000 or more. This reflects our team's strong execution and improved competitive position and broad adoption of our platform solutions. The growth of our emerging…

[Operator Instructions] Our first question comes from Brad Zelnick with the company, Deutsche Bank. Brad, your line is now open.

Great. Thanks very much and good to see the ARR momentum continue to build. Tomer over the last few months, you've been very clear that the benefits you're seeing from market disruption and many of the newer growth levers, and execution improvements, wouldn't all show up immediately in your financials. And the trend is clearly positive from what we can see in Q3 results. But what is it that you see in terms of pipeline and the visibility that you have ahead that gives you confidence in acceleration? And then for Barbara, how does that inform how you might be thinking about next year at this point? Thank you.

Well, clearly, the July outage added to the strong momentum we're already experiencing. So, we're starting to see the benefits. And that includes more customer opportunities. Record pipeline, and we're still maintaining the same strong win rate. So that will translate over time. In Q3 alone, we've had a record number of wins against our closest competitor. We've added a record number of $100,000 plus customers. Our endpoint growth actually accelerated in Q3. So it really indicates the opportunity is improving not only across our growth lever with emerging products, but really within our core market of endpoint. I mean, the momentum on all these fronts drove some incremental upside to the ARR in the quarter, and we believe that's going to continue. Broadly, enterprises paying more attention to security performance and operational resilience. So I think SentinelOne is proving to be the superior platform offering. It is resulting in more consideration for SentinelOne. It is resulting in bigger deals in the pipeline. It is resulting in just more engagements, and it's on us to translate these engagements. It's very encouraging. The type of customers that we're seeing, the industries that we're serving, the ability to have these conversations, as we mentioned in the prepared remarks, these are conversations we have not had before. So this will be positive for us. It continues to be something we unlock, and it's going to translate into quarters and years to come.

And then, Brad, just in terms of FY '26, it's too early to discuss next year's forecast, right now. Our focus is really on executing, innovating and maximizing the opportunity that we have in front of us. But clearly we are pleased to see the net new ARR reaccelerate in Q3, and deliver stronger year-over-year growth in the second half, compared to the first half.

Okay. Thanks for taking my questions.

Next question comes from Gray Powell with the company, BTIG. Gray, your line is now open.

Oh great. Thanks for taking the questions. And yes, I'll echo Brad's comments. It's great to see the net new ARR get back into positive territory. Just in terms of seasonality, maybe I missed this, but what was it that actually drove the stronger quarter-over-quarter growth in Q3 this year that, was different than prior years? And then just like how should we think about the sustainability of - whatever that driver was?

It's a combination of two main factors, I'd say. One is just the leverage we're seeing with our emerging products. So I think you're seeing more capabilities for us come online, whether it's Purple AI with double detach rate from past quarter. So that's significant and cloud continues to grow, data is coming up online. These are all relatively new capabilities for us. So as they come online we expect bigger lens, we expect bigger deals and we see that evidence in our pipeline. It was the case going into Q3 and obviously the other factor, just the July 19 outage. Some of the upside that you're seeing, is definitely coming from these customer migrations. We've had more large enterprise displacements than we ever had in the past. So those two, I think just drove into a very different type of seasonality that we've seen from Q2 to Q3. And we believe that trend will continue. We believe according to the pipelines that we're seeing that, this is something that is sustainable. We will need to translate that. I will repeat that. But in terms of the pipeline, it's there and it's for us to work.

Operator, can we go to the next question please?

Absolutely. Our next question comes from Rob Owens with the company, Piper Sandler. Rob, your line is now open.

Yes. Great. Thank you for taking my question. Curious about what you're seeing upmarket and the success with larger customers and larger deals. Just from I guess a macro perspective, number one. And then the motion is you're selling multiple elements of the platform, and where you're seeing the most success there? Thanks.

Our playbook is definitely evolving. We're lending more with the entire platform or more components of the platform than a single capability than ever before. And I think that is something that is relatively new for us. I think we've always had that motion of Upselling and cross-selling and attaching more. But now it's really clear we're just lending with more, we're covering more, and that's incredibly important. The dialogue with the largest enterprises out there, is also very encouraging. You see that evidenced by the average deal sizes that are on the rise. You see that with the record number of $100,000 and $1 million customers. So our ability to now cater to that higher end of the enterprise, which I believe is gradually being unlocked away from some of these incumbents that were relatively dominant in that part of the market in the past. Is going to translate to more presence for SentinelOne in the Fortune 500. In the Fortune 100. The other capability that we have, which is AI SIEM or the data analytics capability we have, is one that is actually, a capability that thrives when the macro is what the macro is. And I would not say that customers have stopped scrutinizing, I would not say that customers are not very budget oriented. But that actually translates into a very good fit to what our data analytics and data solutions can provide, given the immense cost savings that we can create for some of these customers. And obviously cyber threats are not going away. So the need for best-of-breed security is structurally there. So those two things combined, even in this macro, which I still think is relatively on par with what we've seen in the past couple of years, it bodes well to our market motion.

Our next question comes from Saket Kalia with the company, Barclays. Saket, your line is now open.

Okay, great. Hi guys, thanks for taking my questions here. Barbara, maybe just to start with you, Tomer talked about broadening the market presence with the Lenovo partnership, and it sounds really interesting. Maybe the question is how do you think about Lenovo contributing to net new ARR? Specifically when does that kick in? And is this going to be something that ebbs and flows with Lenovo shipments, sort of on a quarterly basis? Or talk to us about how that layers into the model going forward?

Sure. Thanks so much for the question. In terms of Lenovo, it is a multiyear agreement. We're in the early innings. We're really excited about its long-term potential. This is a strategic partnership. It's designed to evolve over time. We're working closely with Lenovo to activate multiple routes - to market that includes, pre-installations as well as managed security offerings. It also builds on the fact that we have an existing reseller agreement today. So we're really extending, deepening our collaboration and we expect the contributions to pick up in the latter part of next year in terms of revenue. As Lenovo starts to ship pre-installed units, and as we ramp up co-sell through all of our regions. So not going to talk to specifics on deal and ARR, but that's how we're thinking about it in terms of the contribution to revenue latter half of next year.

Thank you.

Our next question comes from Shaul Eyal with the company, TD Cowen. Shaw, your line is now open.

Thank you. Hi, good afternoon, Tomer, Barbara. So I know you slightly raised your annual guidance. I know you guys do not guide or discuss RPO metrics. It was up, I believe, 24% year-over-year, which I think would imply maybe a deceleration from last year, and think just a 4% sequential growth. Can you talk to us about RPO trends maybe your thoughts on pricing and contract duration? Thank you.

Sure. Great. I'll take that. So for RPO in Q3, we delivered strong year-over-year growth of 25%. So that's relatively in line with our total ARR growth. Just to keep in mind, in Q3 of last year, we signed several large long-term contracts, including with several of our MSSPs, making this a more difficult year-over-year comparison. So our preferred metric is ARR as RPO can be impacted by contract duration, and ARR removes that variability.

And just in terms of pricing, I think the ability to sell a full platform right now really changes how you think about pricing. There's no longer a specific price point in the market. Our prices have held steady. You see that reflected in our gross margin, which is definitely best of breed in the market. We're seeing, and I think for the past few years, I've always seen a player or a number of players just go heavy on discounts. So I don't think there's anything out of the ordinary in the way that, this market has evolved over the years. I don't think there's anything too different right now. There's definitely more discounting by vendors who are maybe a bit more mindful of the need to preserve their customers and they're using deep discounts in order to do that. We, on the other hand, have always been flexible, transparent with our pricing and we continue to be that way. It doesn't stop us from making deals and in many cases, especially in the markets that we play in, price is not the dominant factor. And we always are incredibly focused on the value that we bring and the cost savings that we can extract. So all in all, we're focused on maintaining our pricing. It hasn't changed. Gross margin is very high. Is just the realities of the cybersecurity market when it comes down to the different discounting, by different vendors.

Our next question comes from Tal Liani with the company, Bank of America. Talking, your line is now open.

Yes, hi. How important is vendor financing in the market now? I'm asking it because we've seen Palo Alto doing it very aggressively. Now we're seeing CrowdStrike starting it. Is this something that is required? Or do you see higher requirement by customers? And the second question is just clarification. You noted a few times that you expect a strong net new ARR for 4Q. Is there any number that you have in mind, or any growth you have in mind for a net new ARR for 4Q? Thanks.

As for financing, we don't think that it's something that is showing any outside demand right now. Financing has been always very apparent in this space, typically done by channel partners. A lot of our channel partners are helping financing customers. We do it every now and then. I do believe that the focus for every subsequent vendor needs to be on the current capabilities that customers need today. A lot of these financing commitment deals that you're seeing out there are really dealing with futures. They really aiming toward the future possible consumption of capabilities that may or may not happen. For SentinelOne, we're very focused on giving customers what they need right now. If customers require any sort of financing, which I've not seen any uptick of we typically work with a set of partners that can facilitate that. So all in all, as a as you're flexible is obviously working with the customer desired ramp. I think there is no need to do anything out of the ordinary. As for net new ARR, we still maintain that we have great momentum. We still maintain that for the second half of the year, we are going to be growth positive. So all in all, that's what I can share on net new ARR for Q4.

Thank you.

The next question comes from Brian Essex with the company, JPMorgan. Brian, your line is now open.

Hi, good afternoon and thank you for taking the question. And great to see the reacceleration on ARR. I have two questions. I guess first one for Tomer. You've talked previously about a focus on new logo adds over expansion within the installed base. But maybe if you could help us understand where are you keeping your foot off the gas, so to speak, with regard to investing in expansion within the installed base, where there's cross-sell upsell, and how you think about prioritization, or what you're holding back on as you invest in new logo growth? And maybe the follow-up for Barbara, with regard to just the onetime legal settlement costs in the non-GAAP financials, maybe expand on that a little bit, help us understand what they're for? And maybe why those point back to non-GAAP? Thank you.

Sure. We're not really holding back on anything. I just think that we're letting certain things kind of come online at their own natural time. Obviously, we still want the majority of our sellers focused on adding new accounts to our estate. So if there is one piece where we're I would say, less focused on driving right now is that upsell and cross-sell within the customer base in, I would say, adjacent footprints. And that to us is something that will gradually start to unlock itself as we put more and more playbooks and frameworks into next year. So expect that at some point, becoming another growth lever for us. It's very clear that our customers' state is underpenetrated with our adjacent solutions, especially if you look at our core endpoint estate, and that represents an opportunity, revenue opportunity not only for end customers. But also for MSSP partners, OEM partners, many partners that resell our software will have the ability to expand into new markets. But with that, as I mentioned, the focus of our sellers is going after new accounts, it's going after competitive accounts with any capability. So we don't really discriminate I'd say, between endpoint or cloud or data analytics, whatever the customer needs and lever the account would prescribe. Is where we go in and where we try to usher more value. So that to us, and you see that evident in the quarter as well, has been the motion. The dominant part of ARR is coming from new accounts. It's what we want to see, but we are gradually starting to balance that with our desire to also become more efficient with our go-to-market motion. And obviously, selling into your own customer state is a more efficient go-to-market. So those two things will start showing more impact in the next couple of years.

And with regards to Q3 operating margin, as I noted in my prepared remarks, this was impacted by onetime legal settlement costs and legal fees of a few million dollars. Excluding these, our margin would have been negative 3%, so in line with our Q3 guidance. These legal costs were associated with past M&A activity. And during the quarter, we proactively made the decision to settle in order to avoid lengthy litigation, and also minimize the overall legal costs going forward.

Our next question comes from Joe Gallo with the company, Jefferies. Joe, your line is now open.

Hi guys, thanks for the question. Barbara, I know you're not giving guidance for next year yet, but can you just walk us through any changes to process you brought to SentinelOne or just your guidance methodology as a whole as we start to fine-tune our models for next year? And then as a part of that, Tomer, how are customers thinking about their calendar '25 budgets? Thanks

Yes. Sure, in terms of our guidance philosophy, I would just say, overall, it's to set clear and reasonable expectations that reflects the potential we see in the business, and we based that guidance on what we have line of sight to and what's in our control, things like pipeline activity, contributions from new products, and anticipated conversion and win rates.

And when we look at budgets, I think what customers are currently focused on is still very much cost savings. And I think that if you look at most prominent cybersecurity platform providers. It's very clear that it's not only about expanding their presence. It's also about creating cost synergies. Customers are looking for capabilities to fend off AI-based threats, which is a complete new threat vector from the past couple of years. Those capabilities are becoming mandatory. So customers are looking to invest into solutions that can not only fend off these threats, but really modernize infrastructure as they think about the speed of response and the need to become more resilient, more robust and fend off any type of disruption. So all in all, I would say customers are looking at spending much like they looked at it in the past couple of years. I think there is more emphasis on the ability for certain vendors, and certain technologies to actually create cost savings, and that we're also focused where we believe a cloud-native solution set, can create significant synergies versus some of the incumbent solutions that you have today, whether on-premise or converted into the cloud, they cannot perform as well as cloud native capabilities.

The next question comes from Matt Dezort with the company, Needham & Co. Matt, your line is now open.

All right, thanks for taking the question, and congrats on the results. Tomer, for you, I think you talked about more enterprise displacements than ever in the past this quarter. Can you talk about whether pipeline supports continued momentum there, maybe how pricing and discounting are behaving specifically in those conversations? And then on the flip side of that, how are you seeing your ability to win change, if at all, since July 19 in the 50% of the market that is still leveraging legacy AV? Thanks.

I mean we fully believe that the pipeline supports the continued upward trends into enterprise - into the enterprise market. There is no question that some of the dialogues that we're having are of a different magnitude of the dialogues we've been having in the past. I think that pricing for us has always been our strong suit. I think we were always able to play almost at any price point and specifically around endpoint protection. It's not an issue for us to match anybody in the market. It never has been. And you still see us operate throughout the years at around the 79% to 80% gross margin, which is obviously best-of-breed. So as we look into next year, we're going to continue to be aggressive. We're going to continue to sustain our gross margin, and we're going to continue having our average contract size be on the rise. I mean for us, that has been, and we've talked about it, that has been a point of focus. And we believe next year could be quite transformative in that regard. We mentioned in the prepared remarks, some of the largest financial institutions, some of the largest companies in the world are looking for ways to address some of the shortcomings that they see with other platforms. I think they look at SentinelOne, they see a technology leader, leading MITRE for four years in a row is no easy fit. And I think you're going to see that carry on into the future. So it's not only about pricing. It's not only about the July 19 outage. It's about crystallizing the technology leadership that SentinelOne has. Especially as it pertains to AI capabilities, and you see that evidence both in the acceleration with endpoint protection market share and both with the, attach with Purple AI, these are obviously pointing you in a certain direction of where we're seeing the most traction.

Our next question comes from Shrenik Kothari with the company, Baird. Shrenik, your line is now open.

Great. Thanks for taking my question. Again great execution on the net new ARR. Tomer, well as Barbara, mentioned ARR per customer, of course, hit a new high this quarter driven, of course, by success in large enterprise and highlighted cross-sell upsell. Could you help unpack how perhaps macro factors like the constrained IT budgets, and also the outage dynamic kind of influences sales cycles? Is there a dynamic of potentially larger deals affecting cycles getting a bit longer? Then I have a quick follow-up here?

I think largely, the macro factors are relatively similar. I don't think there's any meaningful or material change in the macro factors or how customers are thinking about those. I also would encourage everybody to kind of think about the July 19 outage is just another factor. I mean it's not what's driving business for SentinelOne. SentinelOne's momentum is what driving the business. The technology we have is what's driving the business. I think this is just more just more consideration that results in. The conversations we're having are ones that allow us to showcase our technology first and foremost. And I think that's the most important part. And as customers see what we can bring to the table, I think this is where you're starting to feel more at ease to move away from their incumbent solutions. Now to your point, larger deals do mean larger and longer sales cycles. And that, I think, is what we're looking at. This is not a new phenomenon for us. I mean we have been doing large deals in the past. We're just seeing more and more of those. But we're balancing all of those, I think, with the growth of the business, we're balancing all of those with our wins at any part of this market. So all in all, to me, this is a complete net positive for us. And while sales cycles will take time, we will translate those and we will consider those one of the most strategic elements of our plan going into next year is obviously, it accelerates and catapults our position in the large enterprise market.

Our next question comes from John DiFucci with the company, Guggenheim. John, your line is now open.

Thank you. Tomer, on that point, yes, it does take time, right? There's sales cycles and especially for the enterprise. But for the SMB and the mid-market, you talked a lot about the enterprise, those sales cycles are a lot shorter. Now the results this quarter indicate improving momentum for the business. Obviously, there's some investors, I guess, might have expected a little more, but it does indicate that. How - can you comment on how the SMB/mid-market performed this quarter?

Yes. It's performing well. I mean, I think that we're definitely seeing even increased momentum there. I think we're seeing our MSSP partners continue to grow in a very strong way. So I think it does contribute all across the board. I can't, I would say, pinpoint exactly what is outage-driven versus our own innate momentum. But at the end of the day, we are seeing benefits pretty much everywhere. I mean, both geographically and across the different verticals in the market, whether we want to see less or more, I think we always want to see more. But as I mentioned, our focus is really on extracting more in the enterprise. The MSSP ecosystem for us is one that's more self-driven. The same goes for kind of the SMB dynamics that we're seeing. But even there, I think we're just seeing better win rates and some acceleration. Again, endpoint is one of these very, I would say, core established markets. So when you see an acceleration in that market specifically, 10 years into this journey, I mean, that's very, very encouraging.

Our next question comes from Trevor Walsh with the company, Citizens JMP. Trevor, your line is now open.

Great. Hi team, thanks for taking my questions. Maybe, Tomer, just following up a little bit on the MSSP portion of your comments that you made, just a second ago. In the shareholder letter, you talked about kind of expanding the potential of products within the MSSP, specifically around CNAPP. Is there a reason or kind of can you help us understand maybe a little bit more detail, as to kind of why it's a more gradual release of products within that space? If it's more just not wanting those partners to get to over their skis in terms of the technical requirements and enablement, or some other kind of limiting factor and why not just, I guess, let them go kind of more just broadly all at once on the platform? Just help us kind of understand those dynamics that would be great? Thanks.

Of course. It's honestly, I mean, more in our hands. We just need to enable them more. We also need to make sure that these products adhere to that multi-tenanted approach that we've had over years in kind of the endpoint market. So we're adapting certain elements of our playbook, certain elements of our training to make sure that our products are the right fit for that part of the market. I mean, arguably, not every capability that we have is as prevalent in that segment of the market as endpoint was and is. So it's really about making sure that we give customers, the end customers and obviously, the partners themselves the capabilities that they need, but it's on us to enable them. It's on us to help them articulate the value proposition for these types of customers, and it will happen over time. We have expanded our MSSP team just this past quarter in a pretty significant way, and we're now working to extract more both from our data lake technology in the MSSP market as well as Purple AI. Both of those, we believe, are the best fit for that part of the market, even above and beyond, let's say, CNAPP capabilities. So it's really about what you feel is going to generate the most traction in that segment of the market. Which is obviously a bit different than selling to a large enterprise. Obviously, the amount of workloads they have is different, the amount of staff, they have a different - the amount of automation. They require is different. So all of those we are adjusting. We're making sure that we have the best fit possible in these markets, and then we will continue to enable these partners to succeed.

At this time, I would like to pass the conference back over to our hosting team for closing remarks.

Thank you, everybody, for joining us today.

That will conclude today's conference call. Thank you for your participation. Enjoy the rest of your day.