SentinelOne, Inc. 2027 Q2 Earnings Call

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the second quarter of fiscal year 2027, which ended July 31st, 2026. With us today are Tomer Weingarten, CEO, and Sonali Parekh, CFO. Our press release and earnings presentation were issued earlier today and are posted on the investor relations section of our website. This call and accompanying slides are being broadcast live via webcast, and a replay will be available on our website after the call. Before we begin, I would like to remind you that during today's call, we will be making forward-looking statements about financial performance and future events, including our guidance for fiscal third quarter and full fiscal year 2027, as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us, and that our actual results or events could differ materially.

Please refer to the documents we file from time to time with the SEC, in particular, our quarterly reports on Form 10-Q and annual report on Form 10-K. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons why actual results may differ materially from those anticipated, even if new information becomes available in the future. During this call, we will discuss non-GAAP financial measures, and all comparisons made are year-over-year unless otherwise noted.

Those non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results, other than with respect to our non-GAAP financial outlook, is provided in today's press release and in our earnings presentation. These non-GAAP measures are not intended to be a substitute for our GAAP results. Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges, gains on strategic investments, and income tax provision, which cannot be determined at this time and are therefore not reconciled in today's press release. With that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our second quarter earnings call. Q2 was an outstanding quarter for SentinelOne. We exceeded our top and bottom line guidance, delivered record second quarter net new ARR, and record operating margin. Building on this momentum, we are raising our revenue operating income outlook for the year. Q2 marks our fifth consecutive quarter of positive net new ARR growth and outperforming expectations. These results reflect what increasingly defines SentinelOne: top-tier growth, expanding margins, and undisputed technology leadership. Cybersecurity is at a fork in the road. AI is transforming the way software is built, businesses operate, and adversaries attack. The speed, scale, and sophistication of AI models are making the threat landscape increasingly complex. At the same time, AI also gives defenders the power to transform security outcomes through accelerated response times and unmatched efficiency.

The approach of bundling fragmented products or marketing disjointed platforms is not the answer. This strategy repackages complexity, it doesn't remove it. Enterprises today do not need another point solution, a feature product, or a bigger bundle. They need real-time, connected intelligence that operates at machine speed. This requires a unified architecture, a single control plane, purpose-built to defend the modern infrastructure in the age of AI. This is the vision we founded SentinelOne on, an AI-native approach to cybersecurity, long before the Mythos moment. Singularity is the autonomous security platform of the future. Our technology differentiation lies in a clear architectural advantage. Every platform solution we offer, from endpoint, cloud, and data, to AI SOC, AI DR, and ADR, is a best-in-class capability on its own, unified by our industry-leading autonomous runtime engine and delivered via a single pane of glass.

Machine speed runtime protection is fundamental to our platform architecture, and our AI security growth and contribution already indicate we are leading in this fast-moving category. This quarter provided clear validation across four fronts for SentinelOne. One, market-leading wins with the world's most discerning organizations. Two, growth acceleration of our AI security data and cloud solutions. Three, sustained displacements of legacy endpoint vendors. Four, our distinct architectural advantage in securing modern AI infrastructure. First, let's start with how the most discerning buyers in the world are choosing SentinelOne. Our competitive win rates increased sequentially and year over year, anchored by growing platform momentum and consolidation wins. Net revenue retention among our largest customers expanded again in the quarter. Seven and eight-figure customer wins are becoming consistent, and cross-platform adoption drove a record ARR per customer, growing double digits year over year.

Enterprises are increasingly consolidating multiple point products with the Singularity Platform. The clearest example, a leading aerospace and defense enterprise chose Singularity to execute a complete rip and replace of our primary competitor, consolidating endpoint, data, cloud, as well as AI security with SentinelOne. Our AI security capabilities widened the gap as the competitive alternative was not good enough to help this enterprise accelerate AI adoption. Facing sophisticated nation-state threats, this customer had extremely stringent security requirements. During an intensive proof of concept, SentinelOne delivered a step-change improvement in analyst workflows and security efficacy over the incumbent. Second, we are seeing strong contributions across the board from our AI, data, cloud, Wayfinder, and endpoint solutions. We had another exceptional quarter for Prompt Security, which remains our fastest-growing platform solution. As organizations move AI models and autonomous agents into live production, robust security is mandatory.

We are capturing this wave, driving strong demand across model security, agentic guardrails, and enterprise AI usage. Prompt Security is leading this category as the definitive AI security solution for the enterprise. Demonstrating this momentum, Bell Canada selected Prompt Security to secure one of the nation's most critical networks. They required real-time visibility, automated guardrails, and strict compliance for their workforce, and SentinelOne delivered it. This win validates that enterprise-grade AI security is a prerequisite for safe AI adoption, and our momentum in this category continues to accelerate. The telecom sector continues to be an area of competitive edge for us. We protect operators across five continents, including several of the largest carriers in their respective markets. These are among the most demanding security environments anywhere.

Massive distributed infrastructure, persistent nation-state threat exposure, and stringent regulatory requirements are scale, and expansion in that environment demonstrates the breadth and the resiliency of the Singularity Platform. We continue to win standalone AI security deals from our direct competitors. This is serving as a strategic entry point for broader platform expansion. As AI adoption scales, enterprises are confronting an unprecedented threat landscape. They need to protect AI tools and sensitive data while enforcing strict runtime controls over autonomous agents. Our increasing AI security innovations address these challenges, now offering agentic security, AI red teaming capabilities, and enhanced AI entitlement management. This is enabling enterprises to adopt AI rapidly without compromising security, privacy, or trust. Building upon our technology leadership in EDR, we are on track to establish similar leadership in agentic as well as AI detection and response.

Next, Purple AI continues to redefine the AI SOC, serving as our core engine for autonomous security operations. An increasing number of new customers are landing with Purple AI from day one while our existing customer base continues to expand its usage. With our recently launched agentic investigations, Purple AI autonomously analyzes alerts across complex environments, producing definitive assessments in seconds rather than hours. IDC independently validated a 338% three-year ROI for Purple AI customers. Purple AI's accuracy relative to human-led workflows further underscores its disruptive potential. As security operations evolve towards continuous agentic defense with human oversight, SentinelOne sits at the forefront of this paradigm shift. By continuously advancing Purple AI, we empower customers to accelerate detection, automate investigations, and execute remediation at machine speed. ARR from our AI security offerings, Prompt and Purple AI, continues to be in hypergrowth, tripling year over year in Q2.

We expect this to become our next nine-figure ARR category following endpoint, cloud, data, and Wayfinder. This momentum highlights our technology differentiation and market leadership in defining the next generation of AI cybersecurity. For data solutions, Q2 marked our fifth consecutive quarter of ARR growth acceleration. We believe the future SOC will be hybrid. Enterprises will continue to operate across diverse security tools and data sources while increasingly adopting AI-driven investigation and automation. Our security data lake is built for that transition. From intelligent data pipelines and AI SIEM to Purple AI and Hyperautomation, we help customers consolidate and optimize security data and turn it into faster detection, investigation, and response. From pipeline to SIEM to autonomous SOC, SentinelOne covers the full security data life cycle. This is evident in our accelerating momentum with AI SIEM.

Among new customer wins, a global services firm selected SentinelOne's AI SIEM over both legacy and next-gen alternatives to unify telemetry, improve operational visibility, and accelerate incident response. By establishing the Singularity Platform as their centralized security data foundation, the customer unlocked petabyte-scale telemetry control and laid the groundwork for AI-driven automation. Demonstrating our expansion momentum, a major international retailer expanded its deployment with SentinelOne. This win fully displaces a legacy endpoint vendor while expanding this customer's data footprint. By unifying endpoint protection and security data analytics on the Singularity Platform, this customer is establishing a foundation to scale their data volumes by several terabytes in future phases. External validation continues to highlight our competitive edge. According to an IDC Business Value Study, SentinelOne's AI SIEM delivers a 331% three-year ROI, 70% faster queries, 75% faster investigations, and four times the threat coverage.

For cloud security, Q2 marked the third consecutive quarter of ARR growth acceleration. This momentum is driven by strong adoption of our best-in-breed runtime cloud security, covering both cloud and on-prem environments. The massive AI infrastructure build-out is driving accelerated demand for us, making real-time runtime protection an absolute imperative as enterprise cloud footprints expand and AI workloads multiply. Among cloud security wins, a major American tech giant significantly expanded its SentinelOne deployment, choosing Singularity Cloud over a close competitor. The customer cited our superior platform performance and operational ease of use as the decisive factors. As their cloud infrastructure rapidly scales, this expanded partnership creates a natural compounding growth opportunity for Singularity across their environment. Among new customer wins, a leading global financial institution standardized on the Singularity Platform following a rigorous competitive evaluation against both legacy incumbents and next-gen contenders.