SentinelOne, Inc. (S) Q2 2027 Earnings Report, Transcript and Summary

Hello, and welcome to the SentinelOne Q2 FY 2027 Earnings Conference Call. [Operator Instructions] Also, as a reminder, this conference is being recorded today. If you have any objections, please disconnect your call. I will now turn the call over to Saad Nazir, Vice President of Investor Relations.

Good afternoon, everyone, and welcome to SentinelOne's Earnings Call for the Second Quarter of Fiscal Year 2027, which ended July 31, 2026. With us today are Tomer Weingarten, CEO; and Sonalee Parekh, CFO. Our press release and earnings presentation were issued earlier today and are posted on the Investor Relations section of our website. This call and accompanying slides are being broadcast live via webcast, and a replay will be available on our website after the call. Before we begin, I would like to remind you that during today's call, we will be making forward-looking statements about financial performance and future events, including our guidance for fiscal third quarter and full fiscal year 2027, as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual results or events could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our quarterly reports on Form 10-Q and Annual Report on Form 10-K. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons why actual results may differ materially from those anticipated even if new information becomes available in the future. During this call, we will discuss non-GAAP financial measures, and all comparisons made are year-over-year unless otherwise noted. Those non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our earnings presentation. These non-GAAP measures are not intended to be a substitute for our GAAP results. Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges, gains on strategic investments, and income tax provision, which cannot be determined at this time and are, therefore, not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our second quarter earnings call. Q2 was an outstanding quarter for SentinelOne. We exceeded our top and bottom line guidance, delivered record second quarter net new ARR, and record operating margin. Building on this momentum, we are raising our revenue operating income outlook for the year. Q2 marks our fifth consecutive quarter of positive net new ARR growth and outperforming expectations. These results reflect what increasingly defines SentinelOne: top-tier growth, expanding margins and undisputed technology leadership. Cybersecurity is at a fork in the road. AI is transforming the way software is built, businesses operate, and adversaries attack. The speed, scale and sophistication of AI models are making the threat landscape increasingly complex. At the same time, AI also gives defenders the power to transform security outcomes through accelerated response times and unmatched efficiency. The approach of bundling fragmented products or marketing disjointed platforms is not the answer. The strategy repackages complexity, it doesn't remove it. Enterprises today do not need another point solution, a feature product, or a bigger bundle. They need real-time connected intelligence that operates at machine speed. This requires a unified architecture, a single control plane, purpose-built to defend the modern infrastructure in the age of AI. This is the vision we founded SentinelOne on, an AI-native approach to cybersecurity long before the Mythos moment. Singularity is the autonomous security platform of the future. Our technology differentiation lies in a clear architectural advantage. Every platform solution we offer, from endpoint, Cloud and Data to AI SOC, AI EDR and ADR is the best-in-class capability on its own, unified by our industry-leading autonomous runtime engine, and delivered via a single pane of glass. Machine speed runtime protection is fundamental to our platform architecture, and our AI security growth and contribution already indicate we are leading in this fast-moving category. This quarter provided a clear validation across 4 fronts for SentinelOne: one, market-leading wins with the world's most discerning organizations; two, growth acceleration of our AI security, data and cloud solutions; three, sustained displacements of legacy endpoint vendors; and four, our distinct architectural advantage in securing modern AI infrastructure. First, let's start with how the most discerning buyers in the world are choosing SentinelOne. Our competitive win rates increased sequentially and year-over-year, anchored by growing platform momentum and consolidation wins. Net revenue retention among our largest customers expanded again in the quarter. 7- and 8-figure customer wins are becoming consistent. And cross-platform adoption drove a record ARR per customer, growing double digits year-over-year. Enterprises are increasingly consolidating multiple point products with the Singularity platform. The clearest example, a leading aerospace and defense enterprise, chose Singularity to execute a complete rip and replace of our primary competitor, consolidating endpoint, Data, Cloud as well as AI Security with SentinelOne. And our AI Security capabilities widened the gap as the competitive alternative was not good enough to help this enterprise accelerate AI adoption. Facing sophisticated nation-state threats, this customer had extremely stringent security requirements. During an intensive proof of concept, SentinelOne delivered a step change improvement in analyst workflows and security efficacy over the incumbent. Second, we are seeing strong contributions across the board from our AI, Data, Cloud, Wayfinder and endpoint solutions. We had another exceptional quarter for Prompt Security, which remains our fastest-growing platform solution. As organizations move AI models and autonomous agents into live production, robust security is mandatory. We are capturing this wave, driving strong demand across model security, agentic guardrails, and enterprise AI usage. Prompt Security is leading this category as the definitive AI security solution for the enterprise. Demonstrating this momentum, Bell Canada selected Prompt Security to secure one of the nation's most critical networks. They required real-time visibility, automated guardrails, and strict compliance for their workforce, and SentinelOne delivered it. This win validates that enterprise-grade AI security is a prerequisite for safe AI adoption, and our momentum in this category continues to accelerate. The telecom sector continues to be an area of competitive edge for us. We protect operators across 5 continents, including several of the largest carriers in their respective markets. These are among the most demanding security environments anywhere, massive distributed infrastructure, persistent nation-state threat exposure, and stringent regulatory requirements. Our scale and expansion in that environment demonstrates the breadth and the resiliency of the Singularity platform. We continue to win stand-alone AI security deals from our direct competitors. This is serving as a strategic entry point for broader platform expansion. As AI adoption scales, enterprises are confronting an unprecedented threat landscape. They need to protect AI tools and sensitive data while enforcing strict run time controls over autonomous agents. Our increasing AI security innovations address these challenges, now offering agentic security, AI red teaming capabilities, and enhanced AI entitlement management. This is enabling enterprises to adopt AI rapidly without compromising security, privacy, or trust. Building upon our technology leadership in EDR, we are on track to establish similar leadership in agentic as well as AI detection and response. Next, Purple AI continues to redefine the AI SOC, serving as our core engine for autonomous security operations. An increasing number of new customers are landing with Purple AI from day 1, while our existing customer base continues to expand its usage. With our recently launched agentic investigations, Purple AI autonomously analyzes alerts across complex environments, producing definitive assessments in seconds rather than hours. IDC independently validated a 338% 3-year ROI for Purple AI customers. Purple AI's accuracy relative to human-led workflows further underscores its disruptive potential. As Security operations evolve towards continuous agentic defense with human oversight, SentinelOne sits at the forefront of this paradigm shift. By continuously advancing Purple AI, we empower customers to accelerate detection, automated investigations and execute remediation at machine speed. ARR from our AI security offerings, Prompt and Purple AI, continues to be in hyper growth, tripling year-over-year in Q2. We expect this to become our next 9-figure ARR category, following endpoint, Cloud, Data and Wayfinder. This momentum highlights our technology differentiation and market leadership in defining the next generation of AI cybersecurity. For data solutions, Q2 marked our fifth consecutive quarter of ARR growth acceleration. We believe the future SOC will be hybrid. Enterprises will continue to operate across diverse security tools and data sources while increasingly adopting AI-driven investigation and automation. Our security data lake is built for that transition, from intelligent data pipelines and AI SIEM to Purple AI and hyper automation. We help customers consolidate and optimize security data and turn it into faster detection, investigation, and response from pipeline to SIEM to autonomous SOC. SentinelOne covers the full security data life cycle. This is evident in our accelerating momentum with AI SIEM. Among new customer wins, a global services firm selected SentinelOne's AI SIEM over both legacy and next-gen alternatives to unify telemetry, improve operational visibility, and accelerate incident response. By establishing the Singularity platform as their centralized security data foundation, the customer unlocked petabyte-scale telemetry control, and laid the groundwork for AI-driven automation. Demonstrating our expansion momentum, a major international retailer expanded its deployment with SentinelOne. This win fully displaces a legacy endpoint vendor while expanding this customer's data footprint. By unifying endpoint protection and security data analytics on the Singularity platform, this customer is establishing a foundation to scale their data volumes by several terabytes in future phases. External validation continues to highlight our competitive edge. According to an IDC business value study, SentinelOne's AI SIEM delivers a 331%, 3-year ROI, 70% faster queries, 75% faster investigations, and 4x the threat coverage. For cloud security, Q2 marked the third consecutive quarter of ARR growth acceleration. This momentum is driven by strong adoption of our best-in-breed runtime cloud security, covering both cloud and on-prem environments. The massive AI infrastructure build-out is driving accelerated demand for us, making real-time run-time protection an absolute imperative as enterprise cloud footprints expand and AI workloads multiply. Among cloud security wins, a major American tech giant significantly expanded its SentinelOne deployment, choosing Singularity Cloud over a close competitor. The customer cited our superior platform performance and operational ease of use as the decisive factors. As their cloud infrastructure rapidly scales, this expanded partnership creates a natural compounding growth opportunity for Singularity across their environment. Among new customer wins, a leading global financial institution standardized on the Singularity platform following a rigorous competitive evaluation against both legacy incumbents and next-gen contenders. Given strict regulatory requirements and the operational complexity of a distributed cloud environment, this enterprise selected SentinelOne for a unified autonomous cloud security. Modern cloud environments are dynamic, distributed, and directly connected to mission-critical AI workflows. Static posture management and periodic vulnerability scans are simply not enough. Organizations need runtime cloud security to detect and neutralize active threats at execution. Underscoring our cloud security leadership, Frost & Sullivan named SentinelOne a visionary leader in its 2026 Frost Radar for cloud workload protection platforms, recognizing our innovation and growth against the field of more than 45 qualified vendors. Third, we continue to grow our endpoint footprint, particularly through large-scale consolidation deals. Through our strategic partnerships with MSSPs, we are consolidating multiple incumbent endpoint states onto the Singularity platform. Singularity endpoint delivers the most autonomous EDR technology, which combines industry-leading efficacy, performance and user experience. The secular shift towards infrastructure modernization continues to provide a powerful long-term tailwind. Nearly half of the sector still relies on legacy antivirus, creating a massive displacement opportunity. This transition is backed by proven economic value, with IDC Research demonstrating that Singularity endpoint delivers a 301%, 3-year ROI. Highlighting our traction for endpoint security, a major government agency administering national public services standardized on Singularity EDR. This agency selected SentinelOne following a rigorous evaluation that demonstrated our platform's real-time speed, autonomous response, and superior total cost of ownership. Validated by existing reference deployments across major public institutions, this win underscores our trusted position in securing mission-critical government infrastructure. Fourth, we have a distinct architectural advantage in securing the modern AI infrastructure. As AI agents gain autonomy, real-time runtime security becomes paramount. Behavioral detection and continuous validation at machine speed are essential to intercept unauthorized actions before harm occurs. Governance defines what an AI agent is permitted to do, but runtime is where the actions are executed. Securing AI requires deep visibility directly at the point of execution across endpoints, cloud workloads, and the underlying infrastructure where agents operate. This plays directly to SentinelOne's core strengths. Our AI native EDR foundation combines years of technology leadership in behavioral detection and autonomous response. As cybersecurity shifts from detecting threats to governing autonomous agents, EDR naturally evolves into AI detection and response. This positions SentinelOne as the premier platform to defend both traditional endpoints and the emerging AI stack. We are also capturing a structural tailwind in sovereign defense, a major differentiator for SentinelOne. As public and private institutions deploy private AI stacks to maintain data residency, sovereign AI security becomes an operational imperative. Organizations simply cannot rely on architectures that export sensitive telemetry off site. We are the only modern security platform that can be deployed to cloud, on-premises, and air-gapped environments. Our platform's on-premises deployment capability delivers high velocity runtime protection wherever the AI workload resides. This magnifies our competitive advantage. When sovereignty, control, and machine speed defense matter most, the world's most security-conscious organizations select SentinelOne. Demonstrating our sovereign deployment differentiation, an aerospace and defense giant selected SentinelOne after rigorous multi-vendor proof of concept in an air-gapped, highly restricted environment. SentinelOne was the sole provider to pass every requirement, delivering a seamless deployment and operational capabilities that legacy and next-gen competitors simply cannot offer. On the distribution front, our partner ecosystem continues to serve as a force multiplier. We are expanding our global reach, accelerating platform adoption and driving efficient scale. Singularity's multi-tenant architecture, centralized management and native automation empower service providers to efficiently manage vast customer states. A great example of this momentum is LevelBlue, the world's largest managed security provider who selected SentinelOne to scale its managed security service offerings. In Q2, we expanded our partnership by naming LevelBlue as a premier remediation partner for Wayfinder Frontier AI Services to bridge the gap between threat discovery and resolution. SentinelOne customers leveraging Wayfinder Frontier AI Services can now connect directly with LevelBlue experts to develop and execute prioritized remediation programs. This capability empowers security teams to eliminate software vulnerabilities faster, improving overall application resilience. Simultaneously, we are scaling our hyperscaler alliances as cloud and AI infrastructure converge. We expanded our AWS collaboration around unified AI governance, integrating our AI security capabilities directly with Amazon Bedrock AgentCore to deliver real-time run-time guardrails for autonomous agents. On SentinelOne Flex. It's becoming an increasingly important driver of platform adoption that gives customers a streamlined way to adopt and expand across the Singularity platform. Within a year of its launch, SentinelOne Flex has now exceeded 10% of total ARR. We are seeing strong traction with both new and existing customers, larger strategic commitments and a strong pipeline of Flex opportunities. Our Flex offering aligns purchasing with evolving security priorities and reduces the friction associated with adding new capabilities over time. Overall, the Flex model is creating a stronger foundation for consolidation, expansion, and long-term partnership. Across the broader industry, SentinelOne is emerging as a clear winner of the AI security era. And that is because we spent a decade building toward it. Offensive AI capabilities are compressing the time between vulnerability discovery and weaponization. What was theoretical quarters ago is now an operational reality. Frontier models are advancing from basic vulnerability discovery to reasoning through multi-stage attack paths and executing autonomous cyberattacks. For instance, Anthropic recently demonstrated models executing end-to-end attacks across complex networks, while OpenAI noted that emerging model capabilities are rapidly approaching critical cybersecurity thresholds. By serving as a security partner in initiatives like Glasswing and Daybreak, we are helping establish SentinelOne as a trusted runtime security layer for emerging AI-native software. As AI tools become more capable, security must evolve in parallel, detecting and stopping threats at machine speed autonomously. The implication is undeniable. The window between vulnerability discovery and exploitation has effectively collapsed. Autonomous agents introduced unprecedented operational risk. Agents don't just generate text, they execute code, call APIs, handle credentials, and interact with infrastructure, often finding execution paths their developers never intended. A stark example occurred recently at Hugging Face, where an autonomous agent system executed thousands of actions at machine speed, escaped its sandbox, crossed boundaries, and compromised external infrastructure. For defenders, the lesson is clear: you cannot assume an agent will remain confined or behave as intended. While governance defines what an agent should do, runtime security governs what it actually does. This is our foundational vision and our moat. We are a pioneer in modern runtime security. Our technology sits precisely where AI agents execute across data, endpoints, cloud workloads, and applications. Our proprietary behavioral AI engine was built to analyze anomalies and intercept malicious execution in real time. As cybersecurity evolves to governing autonomous software or agents, our runtime foundation gives us the unique ability to map behavior through action, making SentinelOne the essential platform for the AI era. As AI compresses the attackers' time line from discovery to exploit, SentinelOne is helping defenders compress the time line from detection to remediation. We are leading this paradigm shift on both fronts, delivering AI for Security and Security for AI. Singularity is the autonomous security platform of the future. Reflecting on the overall performance, we made exceptional progress across every dimension of our business, sustaining top-tier revenue growth, accelerating profitability and extending our technology leadership across the highest growth categories in cybersecurity. We outperformed expectations, delivered our fifth consecutive quarter of positive year-over-year net new ARR growth, achieved a company record double-digit operating margin and drove expanding customer adoption across data, cloud, AI security, Purple AI and Flex, and we are pairing all of this with a stronger growth and operating income outlook for the year. SentinelOne is built by innovators with a relentless commitment to technology leadership, and our performance demonstrates the talent and execution of our teams. As we enter the second half of fiscal year '27 we are well positioned to build on this momentum and lead the AI security landscape while delivering durable, profitable growth and long-term shareholder value. In closing, I want to recognize all Sentinels for their dedication, as well as our customers, partners, and shareholders for their continued support. Our mission to be a Force for Good remains paramount as we work to ensure AI itself remains a force for good. Thank you again for joining us today. I'll now hand the call over to our CFO, Sonalee Parekh.

Thank you, Tomer, and thanks, everyone, for joining us today. Our Q2 results reinforce our strong business momentum and solid execution. We exceeded all top and bottom line guided metrics, achieved record profitability and are raising our fiscal year '27 revenue and operating income outlook. Now let's review the details of our Q2 fiscal '27 financial performance and our guidance for Q3 and the full fiscal year '27. As a reminder, all comparisons are year-over-year and financial measures discussed here are non-GAAP unless otherwise noted. Q2 was a solid quarter for SentinelOne. Our revenue grew 21% year-over-year to $292 million, exceeding the top end of our guidance range. International markets represented 39% of total revenue, demonstrating a growing global footprint. In Q2, our total ARR grew 22%, and we added a record second quarter net new ARR of $56 million, growing 4% year-over-year. This was driven by both strong new logo acquisition and broader platform adoption within our existing customer base. Our move upmarket continues to yield excellent results. Our ARR per customer reached a new company record, led by strong momentum at the top end of the market. We're increasingly landing premier logos, providing us with a highly durable runway for long-term growth. For customers spending $100,000 or more in ARR, our dollar-based net retention rate, or NRR, was up year-over-year and expanded sequentially for the third consecutive quarter. This improvement is driven by continued success in multiproduct adoption and a growing contribution from our AI products. We are also beginning to see the benefits from the investments we have made in automation, particularly in our renewal process. Overall, we are sustaining a healthy balance between acquiring new logos and expanding existing customer accounts. Given our expanding scale and market presence, this strategy allows us to capture incremental market share while unlocking substantial future growth potential. This performance reinforces the clear value customers are realizing from our Singularity platform and our proven ability to cross-sell into emerging product categories. Now turning to profitability. We continue to maintain a strong gross margin profile, highlighting healthy platform unit economics and scale efficiencies. A standout achievement this quarter was reaching 34% in sales and marketing expense as a percentage of revenue, a 900-plus basis point year-over-year improvement. Achieving this milestone while simultaneously growing net new ARR for a fifth consecutive quarter is a definitive validation of an increasingly productive and efficient go-to-market strategy. In Q2, we delivered a record 10% operating margin, representing 820 basis points of expansion year-over-year, above the high end of our guidance range and a clear demonstration of the operating leverage inherent in our business. Our earnings per share of $0.08 also exceeded our expectations and doubled year-over-year. We continue to drive a top-tier growth profile while delivering significant margin expansion and creating the capacity to invest in AI innovation and technology leadership. On a trailing 12-month basis, our adjusted free cash flow margin reached 6%, an improvement of roughly 400 basis points year-over-year. We remain on a consistent path towards sustainable free cash flow growth, underscoring our commitment to delivering durable profitable growth at scale. Complementing this strong performance, our remaining performance obligations, or RPO growth accelerated to 45% in Q2. Our total RPO reached a record $1.7 billion in Q2, a direct reflection of the mission-critical trust customers place in the Singularity platform. We ended the quarter with a robust balance sheet, including $813 million in cash, cash equivalents and investments and no debt. We will continue to employ a measured and dynamic capital allocation policy. Our approach strikes a disciplined balance between investing in our highest conviction growth opportunities organically and inorganically and returning cash to shareholders via opportunistic share buybacks. Our balance sheet gives us the flexibility to do both. Turning to our guidance for Q3 and fiscal year '27. For the full fiscal year '27, we are raising our revenue outlook to a range of $1.202 billion to $1.207 billion, representing 20% year-over-year growth at the midpoint. For Q3, we expect revenue in the range of $309 million to $311 million, representing 20% year-over-year growth at the midpoint. Our improved revenue outlook for the year is grounded in the business trends we see today, a solid pipeline and demand environment, expanding platform adoption and improving retention rates. Recent market shifts, or what many are calling cybersecurity's Mythos moment, are refocusing enterprise boardrooms on systemic AI security. While these structural shifts create tailwinds for our business, it's important to note that modernizing cybersecurity infrastructure and enterprise budget deployments are multi-quarter and multi-year shifts that materialize over time. Turning to our outlook for profitability. For fiscal '27, we are again raising our operating income outlook to a range of $124 million to $128 million, representing an operating margin of approximately 10% at the midpoint, an improvement of approximately 700 basis points over fiscal year '26. For Q3, we expect operating income in the range of $38 million to $40 million, representing an operating margin of approximately 13% at the midpoint. For full year fiscal '27, we expect fully diluted earnings per share in the range of $0.30 to $0.32. For Q3, we expect earnings per share in the range of $0.08 to $0.09. Our EPS outlook reflects the impact of a higher expected diluted share count driven by stock price appreciation as well as nonoperating FX impact related to international assets and liabilities. We continue to expect a non-GAAP tax rate of approximately 17% for the fiscal year '27. And we expect our weighted average diluted share count to be approximately 370 million for Q3 and 361 million for the full year. Taking a step back, the opportunity in front of us has never been stronger. We are scaling with discipline, driving significant operating leverage and seeing accelerating momentum across our AI products and the Singularity platform. Our AI security leadership and deepening platform adoption give us a clear line of sight to durable profitable growth, and we are executing against that opportunity with conviction. As security transforms from a protective safeguard into an essential enabler of enterprise AI, SentinelOne is uniquely positioned at the center of AI, data, and cybersecurity. Security is no longer just a defensive measure. It is a key strategic enabler of AI innovation with a strong financial foundation, a leading cybersecurity platform, and significant market tailwinds, we remain focused on creating outsized shareholder value. And with that, operator, we are ready for questions.

[Operator Instructions] Our first question today will come from the line of Patrick Colville with Scotiabank.

This one is for both Tomer and Sonalee. There's been a lot of noise about this advanced AI preparedness. You guys talked both extensively about this in your prepared remarks. But I wanted to just double click on a kind of a subtle nuance. Is advanced AI preparedness at SentinelOne more of an accelerant for the core endpoint business? Or is it more of an accelerant for newer product areas in data, AI and cloud? And then maybe another kind of subtle down which I want to touch on is, is it starting in SentinelOne's enterprise customers and flowing down to the mid-market? Or is it actually more the other way around?

Yes. Thank you for the question. I think it's really broad-based, and I'll try and maybe expand here a bit. I mean what we're talking a lot about Mythos, obviously, but it's not only Mythos. I mean we've had a significant incidence with Hugging Face and OpenAI. We're seeing open-source models become de facto at -- for tier performance. I think there's a broad-based understanding that AI is something that you have to regulate, you have to govern and you have to make sure it's being adopted in a safe way. And I think what's becoming even more clear that the only way to do it is through monitoring it at runtime when it's actually executing, when it's actually exhibiting behavior and doing what it's supposed to do. And when you think about how you do that, that really touches pretty much every aspect of our platform. You want modern endpoint protection to be able to see all AI workloads, whether they're on employee endpoint or on a cloud workload AI, or an on-premise server, you need the visibility that modern endpoint protection brings. But at the same time, obviously, to respond to AI-based attacks and AI-assisted attacks, you need to shrink down the time it takes you to actually see and then react to these actions that you see out there. And that goes all the way to how do you accelerate data ingestion and response to attacks with touches our data platform. So we're seeing an acceleration in our data platform. We're seeing an acceleration in our cloud workload security. And obviously, we're seeing an acceleration with our AI security products with both Prompt Security and Purple AI. It's really, really clear that right now, the best way to regulate AI, the best way to deal with AI borne attacks is a modern cybersecurity solution and especially a platform that's completely autonomous, which right now in the market, if you're looking for broad-based cybersecurity platform that's both autonomous and can be deployed in any given environment from air-gapped environments and all the way to cloud native, SentinelOne is basically the only option you have, and that's just driving broad-based performance for us, which is very evident in the numbers here. It was evident last quarter as well. The entire first half for us have shown more than 20% net new ARR growth. I think some of it is what we're showing also in our race to the year.

Yes. And Patrick, if I could just add to that. I mean, obviously, modern endpoint is our largest installed base of customers. But Data, AI, and Cloud are where we're really seeing a significant mix shift and strong, strong acceleration. And those categories are obviously accelerating off of a smaller base. So the percentage growth is much more dramatic in those categories. And that's where I'd expect to see the durable multiyear tailwind that we talked about in our prepared remarks to our ARR composition over time.

And to touch a bit on the market segments, you mentioned the enterprise demand. That's obviously there. We're doing more and more larger deals, more 7-figure deals, more 8-figure deals than any time before. But at the same time, it's clear that everybody and anybody needs protection. And the way to scale protection for our nation is not through a coalition of consultants, it's through autonomous products that can actually deliver protection in real time in a complete scalable way. I think we're doing some of that also through our MSSP ecosystem, enabling in a complete distributed way, the deployment of our products across many, many segments all across from mid-market to SMB and federal, SLED, every segment right now requires modern protection. And the MSSP ecosystem we have is one of the best ways to actually scale that entire market motion. And we've seen that even evident in this quarter, where our top MSSP partners have actually doubled down and expanded their contract in this quarter.

Thank you, both. I mean, monumental moment in cybersec. And really good to hear both you, Tomer and Sonalee, kind of sounding so positive about the ability to capture the opportunity.

Your next question comes from the line of Meta Marshall with Morgan Stanley.

Great. And congrats on the quarter. Tomer, maybe to start with you, just in terms of -- you have a rapidly expanding product portfolio, customers are clearly interested in a wide array of products. Just -- how are you working with the sales force to kind of develop kind of the best playbooks in order for -- what's the best order of trying to sell the products to not kind of elongate sales cycles and get the customers kind of the greatest near-term traction? And then Sonalee, just in terms of with now having almost 6 months under your belt, just how are you kind of balancing out this showing continued leverage with balancing a lot of growth opportunities?

Thank you. I think the best recipe for us is meeting customers where they are and being flexible with them. It's very clear that solutions like Prompt Security are kind of the #1 go-to when customers are thinking, how do I regulate AI for my workforce, and that's what we see time and time again. Now with that, it's very, very clear that once you deploy these solutions, there are going to be derivative questions and derivative challenges that then our platform is there to solve. How do you then make sense of all the data? How do you string response in real time? Is it through hyper-automation and more data aggregation? So a lot of the components in our platform are actually very synergistic. And that shows up in the way that we sell, and that shows up in the way that our platform is deployed. I would say we're seeing more and more compression of our sales cycles just with that dynamic. We're seeing larger duration of contracts. We're seeing more efficiency with our sales force. So all of those are really showing the strength of the platform to rise up to this moment and deploy protection that actually matters. And I think that is beyond any single feature or capability is what SentinelOne delivers. We deliver peace of mind for these customers. We deliver an ability to fend off the most advanced attacks in the market today. And we're seeing them all. We're seeing them come from foreign adversaries. We're seeing them come from cyber criminals. The entire attack landscape has been negatively democratized with AI, and we're seeing an acceleration of attacks. It's very, very clear that if you're not deploying modern solutions, the gap is only going to become wider and wider for you.

Thanks, Meta, for the question. So the fact is we don't really see growth and margin expansion as a trade-off from where we sit today, just given the inherent operating leverage in the platform strategy. So the areas that are really driving the durable growth that Tomer referred to in his prepared remarks around AI security, data and cloud, all of which accelerated significantly in Q2, are exactly where we're seeing opportunities to reinvest. The last few quarters, we removed quite a bit of organizational complexity that was actually slowing us down, and we redeployed it where we see the highest conviction opportunities to grow. And also in some of our highest performing sales motions. So I think the evidence we can do both is playing out in the numbers. If you look at the first half, we delivered 22% net new ARR growth while simultaneously significantly expanding operating margins by over 800 basis points this quarter. And we are raising both our revenue and operating income outlook. I think that's really a validation that the platform model is working at scale. So when I look forward and when we thought about raising the guide, the demand signals gave us real confidence. So RPO, again, at a record $1.7 billion, accelerating to 45% growth, net retention expanding in our $100,000-plus cohort, that's both sequentially and year-over-year. So that's several quarters. It's now a trend. And the products like AI security that are tripling ARR year-over-year, these are all leading indicators of durable growth. So we're really committed to both delivering consistent growth and multi-quarter, multiyear operating margin expansion. And we really feel like we can and will execute on both.

Your next question comes from the line of Joseph Gallo with Jefferies.

It was great to see the net new ARR growth even in a really tough comp. And congrats on doing that for 5 straight quarters. My first question is certainly as net new ARR comps get easier, is it fair to expect continued net new ARR growth into the second half of the year? And then just as a follow-up to that, Tomer, you said acceleration a lot on the call. Like I can hear the excitement. What would it take for overall ARR growth to accelerate? I mean, we're starting to see that inflection with some other cyber vendors. So just wondering if it's more of a pipeline timing thing, mix shift? Like what would it take for the overall business to accelerate?

Yes. So I'll start with that. And you're absolutely right. We had a great quarter of net new ARR and off a very tough comp for Q2. And we did beat our internal expectations. And the growth was driven by both strong new logos but also strong expansion in our largest customers. And I think a consistent theme you've heard from us is just this acceleration in contribution from our emerging products, again, the platform strategy really working and coming to life. So data, cloud and AI security all accelerated in the quarter. We don't guide specifically on net new ARR, but we do expect for the full year for net new ARR to grow year-over-year.

Yes. And to your question on acceleration, let me just say that I fully believe that this is just the beginning. I think what we're seeing in front of us is a significant opportunity. And we're seeing ourselves operate better to capture that opportunity. Again, you can see that through our sales efficiency improving. You can see that through the evolution of our go-to-market, which will continue. We're putting more and more capabilities directly into the platform for customers to consume completely by themselves. That's a complete new motion for us. And we're kind of adding more and more layers to the way that we go to market. So all in all, our eyes are set into the future. There's increasing demand to what we do. We're one of the only platforms on the market today. We're leading with an autonomous mode of operation, that is exactly what this moment calls for. So we're feeling pretty confident in our ability to continue and grow.

Your next question will come from the line of Mike Cikos with Needham.

I'll echo congratulations on the quarter. I'll ask both questions up front here. But for Tomer, for Prompt Security, at least our CISO checks have indicated overwhelming support and enthusiasm for Prompt, just given it's not tied to a specific model, really allowing customers to adapt in real time to an increasingly -- what seems to be a polyglot model environment. So my question is more of a sales and strategy question, but how do you ensure SentinelOne is investing enough in support of growing AI security adoption, just given this massive greenfield opportunity in front of you? And I'll just ask the other upfront, but for Sonalee, if I could just unpack the net new ARR through a different lens from the earlier question from Joe. It's great to see the emerging products continuing to climb higher. But if I look at the 4% year-on-year growth, I just wanted to double check, is there anything we need to be thinking about as far as what's happening with the endpoint ARR or other parts of SentinelOne's ARR base when thinking about the total composition there?

I'll take the AI security question quickly. As you can imagine, I mean, that is our #1 priority. And not only this is an emerging capability for us, it is actually one that augments the classic endpoint motion in a very nice way. And not only we are scaling that motion, and we're seeing it grow quarter after quarter. We're seeing record pipeline for our AI security product. We're seeing record pipeline for Purple. Purple is an agentic investigation tool. So all these -- like key points for us that really are in the intersection of AI are the things that we pay attention to the most. And moreover, the majority of our innovation is going towards these products. Again, this is just the beginning. We are envisioning a world in which agentic endpoint protection is something that every AI workload will need. And AI workloads -- and we were seeing that today already -- are going to be by masses more than employees that are using endpoints. So the opportunity in front of us is unbounded. Our technology is leading the market, and we want to push that innovation all the way to being able to secure every single AI workload that our customers need to secure. And there is no world in which you deploy an AI workload without security. So as you can imagine, we're scaling our go-to-market. We're putting more innovation. We're putting more marketing into it. And even naturally, that's the pull that we're getting from our customers. So it aligns really, really well.

Yes. And in terms of the unpacking the net new for Q2, one other thing I would just call out that you didn't mention is just we did see improved net retention as well, which obviously is helpful in the net new. As far as endpoint is concerned, we continue to see healthy growth there and continue to be a technology and IP leader there. In fact, we see it as a very large opportunity for legacy replacement, as we always have. So we're actually seeing ARR acceleration with some of our MSSP ecosystem there and continued success in endpoint with our large enterprise customers and upmarket.

Your next question comes from the line of Roger Boyd with UBS.

Can you hear me okay?

Yes, Roger, we can.

Awesome. Sonalee, just two questions on the margin side. I think the rough cut was guidance implies a little bit of acceleration in expenses for the back half of the year. Can you just talk about what you're expecting on the OpEx side? And you've been very clear about kind of your ability to progress on both growth initiatives and margin expansion. But is that framework at all tilting a little more towards growth after a pretty good first half and the excitement the team clearly has for the opportunity in front of you? And then second question was just, any comments on how you're thinking about hiring after the reset earlier this year?

Yes, of course. So firstly, we're really thrilled with the progress we've made on margins. And one thing I would specifically I'd like to call out is the progress we've made on sales and marketing as a percentage of revenue. The progress there has been above 900 basis points of year-over-year improvement, and that's an acceleration on what we did last quarter. So we're really pleased with that. And in fact, we're actually seeing better trends amongst our go-to-market motion, larger lands, compression in deal cycle times. We're seeing better attainment, better productivity. So again, really thrilled with what we've delivered there and how we're executing. As you think about the second half of the year, what I would say is we will -- you will continue to see margins expand, and we did raise the full year on operating income outlook as well. However, you're not going to see margin expansion at the same rate. So we will see an improvement in Q3 sequentially and an improvement in Q4. And if you look at how I guided for the full year, the 10% implies a much higher exit rate on Q4. So significantly higher than where we are today and actually quite a bit higher than what I guided for Q3. So you will continue to see that expansion. However, we are seeing lots of great opportunities to invest so we've given ourselves some cushion for that reinvestment. And again, it's all the products that we're talking about and big opportunities just even around some of our go-to-market motions, partner channels. And we want to make sure that we have plenty of room to be able to invest there. And that is fully contemplated in how I've guided, including in the raise guide.

Your next question comes from the line of Shaul Eyal with TD Cowen.

Two quick questions on mind. Let me try and bundle those. 42% year-over-year growth in RPO, that looks very solid. Is it -- what's driving kind of this growth? Do customers sign longer-term commitments and contracts, or do ACV actually go higher? That's my first one. And my second one, maybe, that the $100,000 customers actually grew 13% versus 17% last quarter. And again, good job on the ARR, which grew 22%. Can you reconcile that? Are you seeing substantially more expansion within the largest customers? Or what's the thinking of large customers versus new logos?

Yes, sure. So why don't I kick off on RPO. I'm going to correct you, it was 45%, not 42%. And that is an acceleration on last quarter. Last quarter, we were at $1.5 billion, this quarter, we did $1.7 billion. And yes, we are seeing larger lands, and we specifically talked about larger lands with upmarket with some of our customers signing 7 and 8 quarter -- 8-figure deals. And that's something we've seen now for a couple of quarters and again in Q2. And we're also seeing increased duration of contract life, which is contributing to the overall RPO acceleration.

And I think that -- I mean, it's kind of the same question asked in a couple of different ways. We're landing larger. We want to go upmarket. We've said that for a few quarters. We're executing on that. But obviously, as you grow the average deal size per customer, you're just ending up adding a little less customers every quarter. But that's a dynamic that we've been looking for. That's exactly what we want to see. And we're just landing bigger and bigger. I think the opportunity in front of us, again, when you look at the incumbent endpoint base, there's still 50% of the market that's completely up for disruption. We want to go after that. We want to make sure that we can address every type of deployment there. And a lot of those are actually very discerning customers that are running their deployments on air gapped or on-premise environments. We're one of the only vendors out there that are applicable to those environments. And obviously, that is a very lucrative opportunity for us. So we are driving our average deal size higher and higher, and that's also kind of what you see as the inverse dynamic on our overall customer additions. But it's just healthier for us and it's more efficient for us, and it's what we're going to continue and do.

Your next question comes from the line of Josh Tilton with Wolfe Research LLC.

Can you hear me?

Yes.

Awesome. Thanks for sneaking me at the end, I'll keep it to one. I think that, at least from our perspective, like we see all the goodness in the quarter. We heard the word acceleration, like we get it's the Mythos moment. Like everything seems great, like all the words, all the numbers. And I know that you guys don't guide to it, but I think what some people are trying to understand is we do have this guardrail for net new ARR for the full year, and it's calling for low to mid-single-digit growth. And I think we're trying to understand why we're not hearing a message around how come that guardrail isn't coming up. It doesn't feel like that low to mid-single-digit growth for the year kind of reconciles with all the strength that you've seen in the second half and all the positivity that you're talking to in the environment. And again, understand it's not guided to, but it is an important metric for us. So is there anything you can just help us to better understand how we should think about that net new ARR guardrail for the full year, given the great first half and everything you're seeing in the market?

Yes. I mean, I think what I would point to is some of the trends that we're seeing. As you say, with our emerging products, we're seeing really nice acceleration. We're also seeing great -- I called out a trend in net retention. I think last quarter, we saw it expand and we saw an uptick, but it was too early to call it a trend. We're now seeing that trend. We're talking about the trend in the demand environment, a very, very solid pipe. Also talking about larger lands and deal sizes and compression in cycle times. So I think all of this together gave us the confidence to raise our revenue guide by more than what we beat this quarter. So it's taking all of those trends into account. And again, like something that I said earlier in the call is we still do absolutely expect our net new ARR to grow year-over-year. And if you look at the first half, for example, we beat our own internal targets and we grew net new by 22% year-over-year. So I think everything we're seeing in the demand environment and the trends that are in front of us right now in the business have given us the confidence to be able to raise what we do guide on.

Your final question will come from the line of Brian Essex with JPMorgan.

John, on behalf of Brian. Just a quick one on -- you've mentioned sovereign AI security as a structural tailwind and it sounds like SentinelOne is well positioned as a modern platform in that sense. Could you just talk more about the market opportunity there as public and private institutions build their private AI stacks?

Absolutely. I think what's very clear is that organizations out there and countries want to control their own data. To do that, you can't just ship data to the cloud. You can't really even think about the data outside of your own data center or AI factory. And when you think about how you deploy security in a complete sovereign way that's controlled and confounded within the walls of your data center or AI factory, that's where SentinelOne self-hosted on-premise capability comes into play. And it's an incredibly unique proposition in the market today. There is no next-gen endpoint provider that can deliver that in every single environment, with complete independence of any cloud out there. So when you think about what we can provide to those building their own data centers, their own data stores, for those wanting control on their own data without shipping it to any third-party cloud, SentinelOne becomes the only security stack that they can deploy and fully control.

We have no further questions at this time. I will now turn the call back over to Mr. Weingarten for closing remarks.

Thank you all for joining us today.