stockrowWhat it does
SentinelOne sells cybersecurity software and services to businesses, government organizations and security service providers. Founded in 2013 and headquartered in Mountain View, the company is led by chief executive Tomer Weingarten.
Its Singularity Platform is designed to prevent, detect and respond to cyberattacks. It protects endpoints—devices such as computers and servers—as well as cloud workloads, user identities and connected devices. Customers can deploy the platform in public, private or hybrid clouds, or in their own data centers.
The platform collects and connects security data from different sources. Its AI models run on protected devices and cloud workloads as well as on SentinelOne’s cloud platform. The software is designed to take action when it identifies a threat; customers can also investigate incidents and reverse unauthorized changes through the platform.
SentinelOne’s Storyline technology links activity into a record that security teams can use to understand an incident. Purple AI adds generative AI tools for investigation and threat hunting. SentinelOne has launched agentic investigations in Purple AI to analyze alerts across complex environments.
The company also offers managed detection and response services, in which security specialists monitor and help customers respond to threats. Its Prompt Security offering addresses security for enterprise AI deployments, while its data products help customers collect and analyze security information.
How it makes money
SentinelOne generates most of its revenue from subscriptions to the Singularity Platform. It generally prices subscriptions and modules per agent, with an agent generally corresponding to an endpoint, server, virtual machine or container. Customers can buy platform tiers and add modules to extend functionality or coverage.
Subscription contracts typically run for one to three years, and SentinelOne recognizes subscription revenue evenly over the contract term. Most contracts are in annual increments and generally come up for renewal in the same period in subsequent years. The timing of large multiyear contracts can cause subscription orders to vary between periods, although revenue recognition is spread over the contract term.
The company sells through its own enterprise and inside sales teams, supported by solutions engineers and a network of partners. Channel partners fulfill its software sales. Once customers have adopted the platform, they can expand subscriptions, add licenses or activate other modules. The company also offers managed detection and response and threat-hunting services.
SentinelOne Flex gives customers a way to adopt and expand across the platform as their security priorities change. Flex exceeded 10% of total annualized recurring revenue within a year of its launch. Annualized recurring revenue, or ARR, is the annualized run rate of subscription, consumption and usage-based agreements at a reporting date, assuming existing contracts renew on their current terms; it is not a revenue forecast.
Revenue was $1,001.3 million for fiscal 2026 and $292 million for the second quarter of fiscal 2027.
Customers and how it sells
SentinelOne serves large enterprises, small and medium-sized businesses, government organizations and security service providers. Customers used the platform in approximately 100 countries as of January 31, 2026. Bell Canada selected Prompt Security, and an unnamed government agency standardized on Singularity’s endpoint detection and response product.
The company had 1,667 customers with ARR of $100,000 or more as of January 31, 2026, up from 1,411 as of January 31, 2025. For this count, a managed service provider or similar partner buying on behalf of multiple companies is counted as one customer; resellers and distributors are not counted as customers. No single end customer accounted for more than 3% of ARR as of January 31, 2026 and 2025.
Sales are fulfilled through channel partners, including distributors, resellers, managed security providers, equipment manufacturers and incident response firms. In fiscal 2026, channel partner A represented 18.0% of revenue and channel partner B represented 12.0%.
U.S. revenue was $610.0 million, or 60.9% of fiscal 2026 revenue. International revenue was $391.3 million, or 39.1%. SentinelOne intends to expand its international customer base, including through investment in Asia-Pacific, Europe, the Middle East, Africa and Latin America.
| Region | Revenue, FY2026 | Share | Change on the year |
|---|---|---|---|
| U.S. | $610.0 million | 60.9% | 17.3% |
| International | $391.3 million | 39.1% | 29.8% |
Suppliers and costs
SentinelOne’s platform is primarily hosted in Amazon Web Services regions across North America, Europe and Asia Pacific, including AWS GovCloud. It can also be hosted in Google Cloud, customers’ own data centers, and private or hybrid cloud environments. SentinelOne’s future capital requirements depend partly on the price it can obtain for third-party cloud infrastructure.
The company expects to incur significant research and development, sales and marketing, and general and administrative expenses over the next several years as it develops and expands the business. Its proprietary data stack stores and processes security data, while its partner network supports sales and distribution.
SentinelOne reported a fiscal 2026 net loss of $450.7 million, compared with $288.4 million in fiscal 2025. It expects operating losses to continue for the foreseeable future. Its fiscal 2026 results included $180.9 million of tax expense, inclusive of interest, related to an agreement resolving disputed intercompany transfer-pricing and intellectual-property valuation matters. Required installment payments under that agreement will affect cash flow over several years.
For the second quarter of fiscal 2027, sales and marketing expense was 34% of revenue, and operating margin was 10% on a non-GAAP basis.
- Revenue$1.0B
- Cost of revenue−$259.2M
- Research and development−$323.9M
- Selling, general and administrative−$727.3M
- Other operating costs−$12.3M
- Operating income−$321.3M
Competitive position
SentinelOne competes in a changing security market against established and emerging vendors. In endpoint security, it names CrowdStrike and Carbon Black, which is within Broadcom. It also competes with legacy antivirus providers Trellix, Symantec and Microsoft; Symantec is a Broadcom subsidiary.
Other competitors include Palo Alto Networks in broad network security, Cisco and Elastic in security information and event management, and Wiz in cloud security. Some competitors have greater brand recognition, deeper customer relationships and larger existing customer bases. SentinelOne competes on factors including threat detection, automation, product breadth, deployment options, integrations and partner relationships.
Its platform combines data analytics, distributed AI models and Storyline technology. SentinelOne also integrates third-party applications through APIs and its marketplace, supports multiple cloud and on-premises environments, and uses partners to reach customers.
Our reading: The combination of security data, AI models and automated response is a potential product advantage, but its strength depends on maintaining effective protection as competitors improve their offerings. Our reading: Integrations and a platform spanning several security functions can make SentinelOne more embedded in customer workflows, although the evidence does not establish how difficult customers find it to switch. Our reading: Channel relationships extend distribution, but reliance on partners also exposes the company to disruption in those relationships.
| Competitor | Where they compete | Threat (our reading) |
|---|---|---|
| CrowdStrike | Endpoint security | High |
| Broadcom | Endpoint security and antivirus through Carbon Black and Symantec | High |
| Trellix | Antivirus and endpoint protection | Medium |
| Microsoft | Antivirus and endpoint protection | High |
| Palo Alto Networks | Network security products and services | High |
| Cisco | Security information and event management | Medium |
| Elastic | Security information and event management | Medium |
| Wiz | Cloud security | Medium |
Growth opportunities
SentinelOne’s strategy is to acquire customers and expand within existing accounts. It plans to add platform modules and use cases, increase adoption of adjacent solutions, build channel relationships and invest in international operations. It also intends to grow its U.S. federal government footprint and evaluate acquisitions that complement the platform.
Customers can expand by deploying additional licenses and adopting more Singularity modules. The company identifies cloud security, data and Purple AI as areas of platform adoption. Its September 2025 acquisitions of Prompt Security and Observo AI added technology for enterprise AI security and data pipelines, respectively.
Revenue grew 22% year over year in fiscal 2026. ARR grew 22% year over year to $1,119.1 million for fiscal 2026, driven primarily by new customers and existing customers adopting adjacent solutions. In the second quarter of fiscal 2027, revenue grew 21% year over year to $292 million.
ARR from Prompt and Purple AI grew year over year in the second quarter. SentinelOne also reported that data and cloud solutions had consecutive quarters of ARR growth acceleration. It says its endpoint installation is its largest customer base, while data, AI and cloud are growing from a smaller base.
SentinelOne raised its fiscal 2027 revenue outlook to a range of 1.202 to 1.207 billion. It expects net new ARR to grow year over year for the full year.
- $204.8MFY2022
- $422.2MFY2023
- $621.2MFY2024
- $821.5MFY2025
- $1.0BFY2026
- $1.2BFY2027 guidance
Structural risks
- Competition and customer spending: SentinelOne faces established vendors with larger customer bases. Customer budget cycles, slower technology spending, changes in competitors’ products or pricing, and decisions to buy from larger vendors can affect its results. The company has experienced longer sales cycles and deal downsizing, particularly among larger enterprises.
- Platform security and reliability: Significant security breaches, technical difficulties or interruptions affecting the platform could lead to lost customers, delayed revenue, claims and other costs. Errors or vulnerabilities can require financial and research resources to correct.
- Growth and distribution: Results depend on attracting and retaining customers, selling additional products to existing customers and expanding distribution channels. Disruption in relationships with channel partners and service providers could affect the business.
- Losses and funding: SentinelOne expects operating losses to continue for the foreseeable future. Its future capital requirements depend on revenue growth, customer payments, infrastructure costs and investment needs; additional financing may not be available on acceptable terms.
- Regulation and intellectual property: Privacy, data protection, AI and other laws can increase compliance costs or affect operations. Proprietary rights may also be difficult to enforce, potentially allowing others to copy or use aspects of the platform without payment.
- Tax payments: Installments under the agreement resolving disputed tax matters will adversely affect cash flows over several years. Unpaid amounts and specified interest would accelerate if there were a change in control.
Bottom line
Our reading
Our reading: SentinelOne is a subscription-led cybersecurity business seeking to expand from endpoint protection into a broader set of security and data tools. [item7, item1] Its opportunity rests on winning new customers and selling more to existing ones, while competition, reliance on channels and continued operating losses remain important exposures. [item1, item1a, item7] Recent growth in AI security and the improved non-GAAP operating margin show changes in its business, but do not remove those exposures. [call_prepared]