SentinelOne: follow the numbers

Investment Analysis Clubs Saul’s Investing Discussions
1 

          Q2-21   Q3-21   Q4-21   Q1-22   Q2-22   Q3-22
REVENUE   20.7    24.6    29.9    37.4    45.8    56.0
QoQ       15.1%   18.8%   21.6%   25.2%   22.3%   22.4%
YoY       95.9%   102.6%  96.3%   **108.2%  121.3%  128.1%**

GM***     64      58      54      **53      62      67**
Op mar**  -101%   -102%   -104%   **-127%   -98%    -69%**
FCF       -14.5   -19.8   -25.6   -32.6   -44.7   -20.7
DBNRR     121%    115%    117%    **124%    125%    130%**
DBGRR                     97%     **97%     97%     97%**

CUSTOMERS         3400            4700    5400    6000
YoY                               74%     ~58%*   75%

ARR>100K  145     173     219     277     345     416
QoQ       18.9%   19.3%   26.6%   26.5%   24.6%   20.6%
YoY       137.7%  124.7%  110.6%  **127.1%  137.9%  140.5%**

***NonGAAP GM
**NonGAAP operating margin
*my estimated YoY customer count growth from a conference call snippet

          Q1-21   Q2-21   Q3-21   Q4-21   Q1-22   Q2-22   Q3-22
ARR>1M    6                               17
YoY                                       __183%    225%    >300%*__

ARR/cust  27720           30195           **34324   36666   39500**

*Inferred from Barclays webcast
**Mentioned on Q2 call

Note: Unfortunately, there are gaps in the table where customer counts are not broken out in the S1, quarterly releases, or conference calls. Unless anyone has that info, I couldn’t find them.

COMMENTARY:
If I bolded a section of a row in the table above, it means I’d like to highlight something positively. And wow, is there a lot of things bolded.
Revenue and ARR growth YoY is accelerating.
Customers >100K ARR is acclerating.
Customer >1M ARR is accelerating!
ARR per customer has been increasing nonstop!!
Gross margins moving up nicely.
Operating margins are improving.
DBNRR continues to tick up significantly.
Gross retention rates remain 97%! [The numbers speak for itself. Crowdstrike CEO’s attempts to beat down on Sentinel One with their talk of a case where they stole a SentinelOne customer is clearly an edge case and is overblown]

Their guide for Q4-22 is $60.5M revenue at the midpoint. I bet they will hit 67M (12% beat and about 20% QoQ growth). They beat Q3-22 at 12% and have only positive commentary in their conference calls/fireside chat.

Q2 2022 CONFERENCE CALL HIGHLIGHTS
Growth
-“Enterprises represent about two thirds of our business today. In Q2, we added the highest number of customers with ARR over $1 million compared to prior quarters.”
-“Just looking at our modules that cover IoT, cloud and data, these grew more than 6x year-over-year in Q2 and represent over 10% of the quarters’ new business.”

Competition
-“we win more than 70% of POCs against the competition. We added the highest number of million dollar ARR customers this past quarter. In the past year, we’ve more than tripled (225% YoY) the number of customers with ARR over 1 million.”

Business highlights
-“In Q2, we added Storyline Active Response, or STAR. The chief information security officer of a Fortune 500 oil company captured it well saying SentinelOne’s storyline technology fundamentally changes EDR.”
-“We also expanded our marketplace ecosystem through new partnerships with Zscaler and Cloudflare, partnering with other zero trust leaders strengthens our customers’ security postures.”
-“Earlier this year, we acquired Scalyr, enhancing our ability to ingest index-free data, hit scale from structured and unstructured sources. Our goal is to optimize for scale performance and cost.”

Differentiation
-“our platform is a 100% cloud native. I mean we started in the cloud. We just, turns out to be a much more efficient model than the platforms that they’ve been using in the past which obviously, were more on-prem down. So to us, again being completely cloud native, being multi-talented is a competitive differentiator we have for that part of the market.”

Q3 2022 CONFERENCE CALL HIGHLIGHTS:
International
-“Revenue from international markets grew 159% year-over-year. International markets now represent 33% of our total revenue, up from 29% a year ago. As an example, in Q3, we secured a European conglomerate by replacing over 20 different antivirus products.”

Seasonality
-“Q4 is our [seasonally] strongest quarter.” An analyst also said “I would assume, somewhat weaker fiscal first quarter….It looks like over the past few years, 3Q has been a lighter – a seasonally lighter quarter for new logo adds.”

Gross margin
-“you beat the Q3 gross margin guidance by a little over 8 points. Is it fair to say that roughly 4 points of that beat was due to the timing of the Scalyr migration?” “Yes”
-gross margins: “long-term goal, which is in the 75% to 80%-plus range”

Pricing
-“The vast majority of what we sold this quarter was the Complete package [the highest priced tier].”
-“year-over-year, our prices – our land prices are rising. with enterprise buyers, no customer selects a security vendor based solely on pricing. That just doesn’t happen.”
-“when you went public, some distributors or resellers were saying that your price level is lower than that of CrowdStrike. Is this still the case?” “I think it was never the case. I don’t know if it’s no longer the case. As a whole, again, if you look at our entire business, PPN is on the rise. in certain cases, you’ll see it’s more expensive than the competition. In some cases, you’ll see the competition actually coming in and discounting deeply to try and win against us.”

Business highlights
-“So I think one thing that constantly delights our customers is that they’re able to get automated technology that doesn’t require heavy handed services to deploy and maintain”
-“we have unique capabilities like true multi-tenancy. And that’s incredibly important if you think about the way a managed service platform works with hundreds or thousands of customers under one central tenant…pretty much every deal that we closed this quarter and in past quarters, always had an incumbent vendor in the mix…if we take a very conservative view at the overall TAM, I think it’s safe to assume that about over 50% of it is still in the hands of the incumbents”
-“Last quarter, we introduced Storyline Active Response, or STAR, for customized dynamic detection and response rules. This quarter, we began offering remote script orchestration, or RSO, to instantly investigate and triage threats on multiple endpoints across the entire organizations remotely. Together, these two capabilities deliver increased level of automation…”

Competition
-“It’s telling that we’re getting so much attention by our competitors [Crowdstrike], which speaks to the traction we’re having in the market.”
-“We do not compete with our partners. Instead, we equip them with industry-leading capabilities like multi-tenancy and open APIs.”
-"in our third fiscal quarter, ARR from our MSSP channel increased by 300% year-over-year."

MY SUMMARY:
SentinelOne is a simple case of ‘follow the numbers’ to me. I did not buy SentinelOne prior to their Q3 Dec 7 report as the company only had one earnings report under its belt, but its hypergrowth nature kept the ticker on my watchlist [note, it is why I do not own AMPL like others on this board. They have a ridiculously low/bad guidance for the next quarter…without a track record, I’d rather wait for more data than jump in with fingers crossed and hoping that they will have a monster beat].

The December 7 report showed S was accelerating growth, increasing DBNRR, strong customer adds, improving GM, DBGRR 97%, improving op margin, expanding the TAM, etc.
I’ve seen plenty of comments about CRWD vs SentinelOne expressed in places - well, sure, competition with CRWD is always there, definitely, but the numbers show they are executing regardless. And CRWD CEO’s constant talk of SentinelOne smells of fear and is a good sign. (Not saying that CRWD won’t do well, they still will grow, and of course the recent CISA selecting CRWD is going to be a nice tailwind for them.)

Anyway, with lockup expiry date done (December 9) and recent crashing share price already pulled down their market cap to $13B, I had no excuse why not to make S a full position. I bought last Thursday and Friday. And then added a little more today which oversized my position a bit.

Also, there’s been a notable lack of insider selling(Insight Partners and THird Point are 10%+ owners who would have to file Form 4 sales, and so far they have sold nothing since lockup expiry).

And, there was actually a board director purchase on the open market, which has only added more confidence for me. Board director Mark Peek filed Form 4 today showing he bought $1.4mil worth (30000 shares) on open market at $48/share on transaction date December 13. Correlates well with Third Point buying more shares on open market at $44 in July. Seems like the mid $40 share price range is an agreed upon ‘undervaluation’ among insiders/supporting venture capitalists.

141 Likes
2

I had written a reply to your writeup earlier but for some reason it didn’t get posted.
Anyway, I found your post extremely interesting, especially where he says that comparing S to CRWD in its earlier quarters does not make much sense as back then there was no competition, whereas today the space is more crowded.
The only thing that gives me pause a little is the fact that the founder and CEO doesn’t own much stock - 1.8% according to the source I got this info from (S&P Capital IQ).
Also, I see that Dan Loeb’s Third Point owns a big chunk: 16.8% based on the last 13D filed on December 12th.
I will research the company a little more but I think I’ll start a small, trial position.
Thanks for your post.
Silvio

1 Like
3

So the big gorilla in this space is Palo Alto Networks. Both Crowdstrike and SentinelOne are small compared to them, so I found it interesting to see how Palo Alto positioned their XDR solution vs competitors.

This may be old news for some but I found it extremely interesting to see. They tout the great performance of Cortex XDR, their solution, in the MITRE ATT&CK Round 3 Results. They say that these results show that Cortex is the best solution, here:

https://www.paloaltonetworks.com/blog/2021/04/mitre-round-3-…

The link has graphs which cannot be reproduced here, so do have a look at the link.

The big take-out for me is how well tiny SentinelOne does. On:

  • The main graph on combined visibility and protection, Palo Alto is first, and SentinelOne second. Crowdstrike is 12th.

  • Protection efficacy, Palo Alto is in a group of companies who score 100%, SentinelOne in the second-highest group scoring above 80%, and Crowdstrike in the 4th group, scoring under 75%.

  • Visibility, SentinelOne is first, Palo Alto second, Crowdstrike 12th.

  • Technique detections, SentinelOne is first, Palo Alto second, Crowdstrike 27th; very close to last.

Of course S also touts this on their own website in the comparisons with the key competitors. But this is on Palo Alto’s site, not Crowdstrike’s or SentinelOne’s. And seeing the full graph of all competitors and noting the position of both Crowdstrike and SentinelOne on those tell me that SentinelOne has an XDR product that is as good, or better, than the leader in this space’s product. And that Crowdstrike is way down on the list.

Given the weight Palo Alto seem to attach to these results, it strikes me as validation of SentinelOne’s capabilities. Crowdstrike, obviously do not tout these results as they score poorly.

-WSM

(Long S)

49 Likes
4

SentinelOne vs Crowdstrike
Their are many layers to security and I’m sure Palo Alto and Sentinel One have advantages in some.
I would argue, as Rafe did over a year ago, Crowstrike will continue to win market share because of how they are using all of the aggregated data with a learning model to provide a better product. A simple lightweight install gives you coverage powered by their entire threat detection network and the response to new threats is super fast compared to the old model where you’d have to wait for a software update to make your local agent smarter. If a distributed attack is launched, the old model could provide protection for the next time it happens but with Crowdstrike you can be protected during the current attack because who ever in the network gets hit first would provide information for the rest of the network right away. The added intelligence means an even faster, potentially automatic, even potentially predictive/preventative, response. …at least that is my understanding. I’m not a security expert.

Regarding all the excellent analysis on the board, regarding SentinelOne, thanks. Since I would only consider selling Crowdstrike to gather the money to buy SentinelOne, keep this in mind when reading the following.
Assuming the current trend in the SentinelOne numbers maybe as fleeting as were the change in Lightspeed numbers this quarter. For me, I’m not investing in SentinelOne over Crowdstrike when SentinelOne GMs are relatively low and Operating margin just three quarters ago went the wrong way and so could easily go the wrong way again. Crowdstrike has vastly ramped their profit generation while they’ve recently steadily slowed Rev growth some. I see predictability in Crowdstrike.
When I read the SentinelOne CC, their describing Crowdstrike as just endpoint protection just smelled bad. Yes, SentinelOne utilizing their AI installed on the end point is differentiating; however, I see use of AI this way as potentially increasing false positives and preventing SentinelOne from scaling, as was pointed out in the CRWD CC. I definitely don’t see a large agent as advantageous with endpoints that may not support any agent (eg Workloads). Crowdstrike Horizon requires no agent.
Pure speculation here, if SentinelOne does get that 70% POC win rate that they claim, perhaps it’s due to their superior dashboard. Unlike others here, I don’t give IT department heads high marks for their technical chops.
I’m banking on Crowdstrike, under the hood, being far superior (see Crowdrike’s industry wins) and the slickness of the Crowdstrike dashboard will improve now all the pieces are in place for their platform.
I invest in Cloud Category Crushers. I believe, that for Crowdstrike, with Federal just getting started, their expanding their product line and partnerships more with XDR, Identity Protection and Humio now moving the revenue growth needle, and soon the same with Data Protection, CrowdStrike will continue their efficient execution towards their vision of becoming The Security Cloud.

53 Likes
5

A few points just for the sake of precision.

First, somebody from the industry explained that “70% POC win rate” is actually not good. I recall the explanation was that you enter this kind of competition only if you are nearly guaranteed to win. It was on this forum, probably in an early S thread.

Second, on comparing S to CRWD, hopefully somebody from the industry will chime in, but I don’t see how it can be argued that CRWD had no competition. This assumes that everyone in 2018 was thinking “Next Gen!” and ditching legacy vendors. Obviously, this has not been true. While end-point may have been easier to explain than ZT, ZS offers a good insight at how hard it can be to get going with Next Gen products. When Chaudhry was asked about NET on the second-to-last call, he dismissed NET as a factor altogether but pointed out to the great difficulty ZS is facing in educating customers about what ZT is: convincing them that what legacy vendors is not really ZT is ZS’s main problem and legacy is their main competition. So lacking industry knowledge, I would not assume that CRWD was seen as Must Have/No Competition in 2018. Its revenue numbers are exact match for S’s so it is certainly an interesting parallel.

Third, as a general rule of thumb, there seems to be a tendency in investing circles to exaggerate New Anything vs Old Anything and especially the short-term investing implications of New vs Old. Although from a long-term perspective, changes happen ever faster, they can still take longer than investors may like. One recent anecdote is about my own employer, which is a large entity and a prime Zoom user. We recently went Cisco for security and also for phone. I really expected ZM phone considering how critical ZM video has been for us. I think I read somewhere that CSCO bundles the two and we are surely cost sensitive. Legacy vendors are very much alive and a very real competition to the companies we like to look at.

All that said, the fact that S greatly beat its non-Gaap operating margin guidance makes me more comfortable. S scores very highly across many metrics. In my comparison of 26 companies, it scored 2nd in QoQ sequential growth, 2nd in YoY revenue growth, 8th in guided seq growth, and very importantly to me considering how early it is and how comparatively poor its operating numbers are, S scored 7th in cash to LTD net balance at over 1.5B. It is already relevant to me through my etf-only 401k (#10 overall) but I also took a tiny starter directly yesterday. I am considering selling some AFRM and building S into a small direct position. I am not selling any CRWD, that’s for sure.

Speaking of legacy, if you look at cybersecurity ETFs, they have done much better against WCLD in 2021 even though they bundle Next Gen vendors with traditional companies:

Over 52 weeks:
WCLD -1%
vs
BUG +26%
CIBR +25.5%

18 Likes
6

on comparing S to CRWD, hopefully somebody from the industry will chime in, but I don’t see how it can be argued that CRWD had no competition.

Hey MAS4R, I’m not in the industry, but that ridiculous narrative - that CRWD had no competition - came from SentinelOne’s CEO in a recent Barclays’s conference. jonwayne highlighted it in another thread…

“When Crowdstrike went through the period of growth we’re going through now, it didn’t have competitors!..”

The period of SentinelOne’s Growth that the CEO is referring is right now - post-IPO. Crowdstrike IPO’d only two years years ago in June 2019, almost exactly two years before SentinelOne (IPO’d June 2021)

So, Crowdstrike had no competition two years ago?

Here’s a few other companies that you may have heard of that were in the marketplace two years ago: Microsoft, VMware, Symantec, McAfee, etc. etc. Oh, can’t forget one more: SentinelOne.

I agree that you should follow the numbers if you want to invest in a company. If following a CEO was the top priority for choosing investments, I’d probably hesitate after reading false and misleading comments like the one above.

Brian

12 Likes
7

What a lot of misinformation here. The CEO never said that Crowdstrike didn’t have any competition…

This is the exact question and answr:

Analyst

Yes. Absolutely. I have so many more questions for you, Nick and for Tomer, but I’ve only got limited time. So, I want to ask one more question. And that’s for you Tomer. And it’s a bit of a philosophical one. I’m actually really excited to ask it. But I think many investors have looked at SentinelOne and compared it, right, let’s put the competitive dynamic aside. I think a lot of investors have looked at SentinelOne comparative to the success of CrowdStrike. When I think we all might probably acknowledge the CrowdStrike has been a successful story?
The question is, if you have to think about SentinelOne story three years from today, three, five years, pick a timeframe. How will be similar or different than CrowdStrike? You can answer that from any angle but you’d like, open-ended. But I’m just kind of curious how you sort of think about the parallels and the how you want to think about the differences going forward?

Tomer Weingarten
Yes. Look, I think that, by definition, it’s going to be different because; one, a very simple fact, when CrowdStrike went through the period of growth that we’re going through right now, they didn’t have CrowdStrike to compete against. And we’re showing just unbelievable growth, while you have as you mentioned, a pretty successful company, like CrowdStrike in the market.
So I think that just gives us even more confidence in what we’re able to do. I mean, if you think about it, it’s not just the incumbents that were fighting here, when they went through that period, the landscape was incredibly different. So to us, I mean, it just gives us the ability, not only to compete and really control our own destiny, we truly don’t feel any one or two competitors are impacting what we do in any given manner.

Our growth was incredibly linear, that has to do with our strategically different go-to-market. Our ability to go and cater to many different parts of the TAM, I think it’s a reach that they never had, some others never had that helps catapult growth and underwrite growth for the years to come.
I truly believe that there are so many different growth vectors in our business, and they’re all starting to pick-up pace at a very early stage. So, unlike many other public companies in history, which you know went through a period of growth mostly to one product line, then added more capabilities to continue and find growth in later stages, our strategy is very different.

And we planted multiple seeds in the very early stages, and they’re all starting to pick up, and they’re all starting to accelerate and that is to me the way we sustain growth into the future. And hopefully, in a three CAGR – three-year CAGR view or five-year CAGR view, there might be a different winner in this market or a bigger company in this market. We’re going to just have to wait and see. But I don’t think that’s going to be taken away from their success, right?
I think the market is big. The market is sustainable. The contribution to our revenue from multiple different TAMs really dictates that there’s not going to be a single winner that’s dominant in one given market, but the winners are going to be one that would be able to play multiple different TAMs and be successful in multiple different TAMs. I don’t see any degree of a one vendor world dominance in any one of these given TAMs. So, a lot of it is again, just focus on delivering value to customers and success will follow.

25 Likes
8

If following a CEO was the top priority for choosing investments, I’d probably hesitate after reading false and misleading comments like the one above.

I don’t think there was anything misleading. SentinelOne’s CEO was pointing out that ‘2019 CRWD’ at the time did not face a competitor that was already as successful as a ‘2021 version CRWD’.
SentinelOne in 2019 was definitely not the size of a ‘2021 version CRWD’, competing against ‘2019 CRWD’ at the time.
There was nothing falsely stated.

Here is word for word, the CEO’s statement:

“Yes. Look, I think that, by definition, it’s going to be different because; one, a very simple fact, when CrowdStrike went through the period of growth that we’re going through right now, they didn’t have CrowdStrike to compete against. And we’re showing just unbelievable growth, while you have as you mentioned, a pretty successful company, like CrowdStrike in the market.

So I think that just gives us even more confidence in what we’re able to do. I mean, if you think about it, it’s not just the incumbents that were fighting here, when they went through that period, the landscape was incredibly different. So to us, I mean, it just gives us the ability, not only to compete and really control our own destiny, we truly don’t feel any one or two competitors are impacting what we do in any given manner.

Our growth was incredibly linear, that has to do with our strategically different go-to-market. Our ability to go and cater to many different parts of the TAM, I think it’s a reach that they never had, some others never had that helps catapult growth and underwrite growth for the years to come.

I truly believe that there are so many different growth vectors in our business, and they’re all starting to pick-up pace at a very early stage. So, unlike many other public companies in history, which you know went through a period of growth mostly to one product line, then added more capabilities to continue and find growth in later stages, our strategy is very different.

And we planted multiple seeds in the very early stages, and they’re all starting to pick up, and they’re all starting to accelerate and that is to me the way we sustain growth into the future. And hopefully, in a three CAGR – three-year CAGR view or five-year CAGR view, there might be a different winner in this market or a bigger company in this market. We’re going to just have to wait and see. But I don’t think that’s going to be taken away from their success, right?

I think the market is big. The market is sustainable. The contribution to our revenue from multiple different TAMs really dictates that there’s not going to be a single winner that’s dominant in one given market, but the winners are going to be one that would be able to play multiple different TAMs and be successful in multiple different TAMs. I don’t see any degree of a one vendor world dominance in any one of these given TAMs. So, a lot of it is again, just focus on delivering value to customers and success will follow.”

Now, I’m to blame for attempting to paraphrase the webcast here.

I was trying to make it easier and save time for others on this board with paraphrasing these things, but I can see it was probably not ever a good idea!

I want to emphasize, if there is something that seems strange or contentious in whatever anyone highlights from a past webcast, it really is best to just take the time to go and listen to these talks yourselves.

Moving forward I won’t post these things as this is not the first time that some people believe word for word, that what I wrote, is exactly a quote of what was said on a webcast - this has also been an issue with UPST webcasts I’ve written up

33 Likes