SentinelOne’s Q3’2024 earnings report (yesterday) exceeded expectations, beating estimates by 5.3% and showing a 10% increase QoQ. Management raised its FY revenue by 2%, projecting $625 million for FY24, a 48% YoY growth. Financial indicators, including gross margins and operating margins, have all been raised, showcasing a commitment to profitability.
Despite a challenging macro environment, they added 350 customers (3.1% QoQ), with a strategic focus on larger enterprises (+66) leading to a 6.6% QoQ increase.
Management anticipates positive Free Cash Flow (FCF) in H2 FY25, signaling a strong outlook for the next fiscal year. They continue to gain market share against both next-gen and legacy providers.
Acknowledging the challenging threat landscape, SentinelOne plans to transition Singularity Cloud to CNAPP next year. They announced a new Chief Revenue Officer (CRO) from Elastic.
Despite a high dilution at 5.7% YoY, the pace has slowed to 1.2% QoQ. management maintained a confident tone, and analysts have congratulated its performance.
Overall, the Q3’2024 earnings report positions SentinelOne as a strong player in the cybersecurity market, reflecting continuous growth and financial resilience, with shares up by 20% and up 70% during the past 6 months.
With $1.1 billion in cash and no debt, SentinelOne stands on a solid financial foundation. I’ll continue monitoring the customer additions.
I’m relieved that holding onto S, as discussed in my June summary, has proven to be a wise decision. It’s great to see things turning out positively after years of suffering in a complex market environment.
Moreover, statements such as the one below by Palo Alto CEO Nikesh Arora, further reinforce my conviction that there is enough space and runway in the cybersecurity landscape for multiple players.
I am trying to figure out how and when to be patient vs. pull the trigger. S was in the low teens a few months ago and seemed stalled. I bailed with many others and lookee here, back up over 20 now. Is it feel, is it science or is it just the way it is; win some, lose some?
I held after it dropped because I still believed in them, and I waited a painful 6 months until now. They are solid and growing again, with a good year ahead, perhaps aided by an election year. I’m holding a 10% position.
Great question and let me share my perspective on it: Investing is all about probabilities, no one knows everything - even the CEOs don’t. That’s why portfolio allocation sizes have to be appropriate. If I had been 100% sure about the development, I’d have allocated 100% in S but I haven’t (and never will).
In my evolving investment strategy, I’ve begun giving major props to the people running the show at a company – the management, leadership, culture, and the vibe they bring to the table. Before I invest my first $ into a new business, I’ve got to have this gut feeling that I can trust them. If I can’t, I won’t invest, regardless of how great the raw numbers look. If I trust them, I consider them as my team.
So, I started listening much more to what management is saying and how they say it. If their talk makes sense to me, I’m sticking with my team, maybe making some tweaks here and there. Take Sentinel, for instance, after going through the numbersandlistening to management, I convinced myself there wasn’t some major screw-up happening with them, so I rode it out, and it paid off (laid it out in that old post).
For sure, in my next 30 years of investing, there’ll be moments when I pull a similar move and maybe goof up. Hopefully, I’ll be more right than wrong.
First I want to say congrats and I want to say I’m happy that you made some money on the recent uptick. However, SentinelOne has been a terrible investment for me, and I made exactly the opposite decision to you after their Q1 results. I was furious, and I was of the opinion then that I left it way too late to exit. I.e. that I should have gotten out way earlier when Bear, Gaucho and others were making quite the convincing bearish case.
So your post had me wondering what the success you’ve described above is all about. Whether I’ve in fact missed something.
For me it was always a question of how S was doing vs competitors: relative outperformance. I switched from CRWD to S, and the core of why I preferred S over CRWD was that they were growing faster - both ARR and revenue, and they said they were taking significant market share. I thought this was a mini-CRWD successfully following the game-plan that CRWD laid. Problem is, they couldn’t grow fast enough while at the same time digging themselves out of the hole of unprofitability. And they were competing with CRWD. On top of that, S didn’t know how to calculate ARR and overstated that number which misled me. I was absolutely furious because that was a core part of my investment thesis.
Stock performance this year
The objective for me is always to own stocks that go up. And, if presented with the option of buying competitor A or competitor B in a space, that I make the right decision to achieve that. Fastly vs Cloudflare way back in 2020 comes to mind. So looking back, the question for me now is whether I should have continued my very successful investment in CRWD or whether I should have switched horses to S when I did. And I think the overwhelming answer of the past years is that owning CRWD has been a much, much better investment.
In fact you have to pick a very specific date to have S outperforming CRWD in the last year. I found two such dates: 3/6/2023 - just after S’s disastrous Q1 results, and in the last month - starting from 1 November. Starting 3 June 2023 S returned 88% vs 57% for CRWD. And starting 1 November 2023 S returned 54% vs 36% for CRWD. But that is market timing with a capital T.
In the last 3, 4, 10 months and YTD CRWD outperformed S.
YTD move
Move from 1/3
Move from 1/6
Move from 1/9
S
65%
57%
16%
39%
CRWD
135%
102%
54%
50%
So how about last year?
In July 2022 I wrote a bullish piece on S, here’s me quoting myself (in order to teach me some humility):
So how did those stocks do from 1/6/2022 to today?
CRWD: +50.2%
NET: +40.7%
ZS: +33.5%
S: -2.6%
→ S did the worst of the ones that I listed. S was the cheapest then and got way cheaper thereafter. In my defence I did say “if multiples remain roughly where they are (i.e. the big re-rating is behind us)” - which wasn’t exactly the case, and in addition S well and truly fumbled the ball.
And on a relative basis, starting in Sept last year vs a wider set of competitors, incl Palo Alto?
Source: ycharts
→ The worst of the lot.
So I dunno, but I don’t think S has been a good investment in the last two years or so, and I’m glad I exited when I did. And if I had held on, it would only have been a good decision when measured from quite a narrow number of starting dates. At least that’s my conclusion.
But that’s in the past. What about the current performance and the future?
Review of some metrics in the quarter
I haven’t looked at the numbers in 2 quarters, since the Q1 call in which the tone of management could not have been worse.
Alas, I again found some stuff that I really dislike:
This is their NRR graph from Q1 - note the dotted “target” line:
→ That dotted line looks exactly the same in the two graphs, but the one now suddenly says “100%” after they dropped below that 120% target of theirs. Small, but irritating.
And while I take your point that many software companies saw NRR contract (not all, mind you @mooo - Axon actually increased their NRR, for example), I dislike how they describe it for us. Contrast the commentary of S with CRWD for the most recent quarter - both describing the same thing:
S: “Retention and expansion remained resilient across our customer base, reflecting an NRR of more than 115% in Q3.”
CRWD: “Our gross retention rate remained high and our dollar-based net retention rate was slightly below our benchmark in Q3”
Customers with >100k ARR
Everything to do with historical ARR irks me. They only restated ARR numbers going back to Q2 last year afaik and their customers with >100k ARR is only shown for the current and year ago quarters, meaning we now only have 6 numbers for this metric: Q1, Q2 and Q3 of this year and last. We don’t know how many >100k ARR customers they had in Q4 (or at least I couldn’t find it). Which means I can’t see how the additions in that metric has really trended over time.
On why this is so important, and for a great discussion about S back in December 2022, here is a post from Bear, again, in which he says that ARR added has stagnated at around/below $50m per quarter:
Relative to that discussion which focused on Net new ARR, what has the most recent numbers been?
2024 Q1: 41.6m
Q2: 48.6m
Q3: 51.8m
→ Less ARR added than Q4 FY 2022 (assuming that ARR added in Q4 2022 was actually $55m as they haven’t given us the full set of historical correct ARR numbers - back to my general irritation with their ARR numbers). In the link above Bear said in Dec 2022: “Seems like they’ve kind of stagnated the last 4 or 5 quarters.”. I think that can now read 8 or 9 quarters.
Market share
So, we only have a limited number of quarters for ARR added. Using those quarters, what has the ARR added been as a % of the total ARR which CRWD and S added in that quarter?
Ok, so in the spirit of being generous I will say that they are “gaining market share”. But not much, and because the ARR numbers only go back so far, I really cannot guage whether this is true over a longer period of time. Vs the share of net new ARR of “the market” (narrowly defined for this purpose as them and CRWD) that they had to last quarter, they have gained an additional $2m of ARR which would have gone CRWD’s way. So if they had not increased their share from 19.9% to 20.7% they would have had $49.8 in stead of $51.8m of new ARR and CRWD would have had $200m in stead of $198m. Not sure that qualifies as strong market share gains.
Margins
These look very good. Gotta give them their due, and this is the main reason why I will continue to watch them.
Gross profit margin is up to 79% vs 71% a year ago and 77% a quarter ago. This has really stepped up. Three years ago this was only 58%. This really is great.
And the key one for me - operating margin - is now at -11% of revenue. Three years ago this was -102%. Again, really good progress.
But, SBC and dilution.
Their non-GAAP Op margin is -11% of revenue vs GAAP op margin of -50%, so 39% of revenue is SBC and some other funnies. And share dilution was ±5.7% based on the WA fully diluted share count. That’s a lot of dilution for a stock that’s been going down for the last couple years.
My own conclusion
Thanks for prodding me to look at S again - it brought back some memories
It’s also interesting to look at S vs CRWD from the point of view of market dominance. This is a great post by Saul about this, in which he said the following (I’m going to quote the whole thing as it’s part of the Knowledgebase I think, but it bears thinking through a bit more - he wrote this in 2018 and therefore came to his conclusion in May 2017):
I think, upon reflection, S does not fit in any one of those categories, although I initially thought it was a Disruptor or a Rapidly growing company in a new market. In the end the “new” thing they did was not that new or disruptive as other, larger companies now offer the same or similar, and the rapid growth has really come to a bit of a stagnation, if not a halt.
I think, therefore, that I will wait this one out until at least another couple quarters. If I miss some upside, so be it. #zerofomo.
Thanks for such a thorough breakdown @wsm007. I am one of those who exited S but kept CRWD and ZS. Since my decision was more execution-based, I hadn’t really tracked comparisons so appreciate the perspective.
This was a bigger factor for me in that I came to the exact opposite conclusion when deciding to exit (December 2022 Portfolio Review - TheStockNovice). At the time management had in my opinion made two major errors in the prior 3 quarters. First, it botched the messaging on the combined guide after acquiring Attivo. Next, management totally whiffed on its Q4 net new ARR projection, which a quarter or two later turned into an admission it had been miscalculating ARR the entire time.
Do I believe management intentionally misled us? No. However, I do believe it came off as unprepared and inexperienced in a market environment with little patience for either of those traits. I also had plenty of alternatives which were easier to trust (see @wsm007’s NRR comments as well).
In addition to CRWD, NET, and ZS, PANW is another cybersecurity firm S must contend with. While all are benefitting from a sector tailwind, I see the others as at least one level of execution above S. That’s not to dissuade anyone who believes in S, especially coming from someone who chose to avoid S for BILL and AEHR in recent months (). It’s simply that my perspective on management hasn’t changed a great deal from the initial reasons which caused me to exit in the first place.
But dropping the target line on the NRR graph from 120% to 100% without telling anyone that their 115% was below the previous target, sure sounds like intentional misleading, but who knows?
Saul
Good point, which @wsm007 supported with the way S’s management framed its NRR performance during Q3 comments.
I haven’t followed closely enough to know if S addressed the internal target elsewhere. However, I do know for comparison’s sake CRWD, DDOG, and ZS have all professionally and honestly acknowledged the recent NRR pressure in this environment (with @wsm007 giving us CRWD’s example).
I wanted to add another discrepancy I’ve ran across in Letter to Sharedholder in Q1 and Q2
In Q1 Letter they told us they added 700 new customers ending at 10680
In Q2 Letter they told us they added 700 new customers ending with over 11000
It looks to me that the math is off because the diff is over 320. Does that mean they added 700 and LOST over 300 ? If they added 700 and lost none they should’ve been about 11320. I remain skeptical.
Great observations. I’ll concentrate my thoughts on the key areas:
NRR
Agreed, I also dislike how they silently changed the display of the NRR line and removed the “target” line. They could have handled it better. Thanks for bringing that to our attention (not thesis-breaking though).
Additional context:
Their recent Net Revenue Retention (NRR) is also being negatively affected by their acquired company, Attivo. Attivo added 350 customers in Q2 2023, but there’s also churn from Attivo:
Tomer Weingarten: “Attivo legacy product, as you can imagine, with any acquisition, there’s some degree of customer churn and that happens typically for the kind of older product lines, Identity security, obviously, is the shining spot.”
Important part: Organic Net Revenue Retention remains at 120%, as announced in Q1’24.CFO in Q1 call: “We’re expecting 120-plus percent kind of as a floor for us, and we see that for the foreseeable future.”
Also from their Q2 earnings call: “Our platform approach continues to be a source of growth through expansion, driving a net retention rate of more than 115%. As a reminder, our NRR now includes legacy products from the acquisition of Attivo networks a year ago. The inclusion of Attivo and macro-driven budgetary constraints are impacting our near-term expansion rate. We believe this is temporary.”
CFO: “Our NRR on an organic basis would have been 120%. So it’s still at the expectations that we’ve set forth in prior earnings calls. So the 5% decrement was purely Attivo.”
Customer inconsistency (shareholder letter)
Good catch (and I have an idea)! But would like to get that answer officially from IR. Waiting for it.
Historical ARR-related metrics due to change in ARR methodology:
These can be found transparently in their Q1’24 Q-10 filing (updated until Q1’23):
Reminder: Due to the change in methodology, ARR no longer includes consumption-based revenue, which is increasingly significant.
Bert Hochfeld touches on that topic in his newest article:
"Currently, most analysts look at ARR growth as the key metric in reviewing quarters for cybersecurity companies. Over time, with the introduction of Purple and the rapid growth of Lake and Cloud, more revenue will come from usage. Usage can be an exceptionally lucrative business model for a software company, albeit with some cyclicality. "
Additionally, the net new ARR guide for the year has been raised to $200M, up from $195M. If they achieve this target, the net new ARR will be approximately $58M, which is the same as the net new ARR in Q4’23 (last year). I believe they are being cautious and anticipate that the net new ARR will be slightly higher than Q4’23, which was $58.21M.
CFO: “We’re expecting Q4 net new ARR to be essentially flat to what it was in Q4 of last year. We don’t expect a budget flush.”
Still, part of my hypothesis for durable, or even accelerating revenue growth is based on their consumption offerings, which are growing at a “triple-digit” rate. However, these offerings may still face some challenges due to macroeconomic factors. It remains to be seen if that hypothesis plays out.
On market share
I believe that limiting the market primarily to S and CRWD might not be the best idea and part of my investment thesis states that the market is large enough to accommodate both SentinelOne and Crowdstrike without direct competition.
There are thousands of competing cybersecurity businesses, with most of them not being public. Currently, only 18 pure-play cybersecurity companies are listed on the US stock exchange. If you look at it from that perspective, investing in that space may not be advisable.
But in the cybersecurity industry, no single leader holds a double-digit market share. For example, Microsoft, the largest player, had approximately $15B in revenue in 2022, which is still less than 10% of the total market. Palo Alto represents roughly 3%, while CrowdStrike holds about 1.5% etc.
Gartner predicts the information security and risk management market will reach $267.3 billion in 2026 with a CAGR of 11% until 2026.
NightDragon, a cyber-focused VC firm, notes that with $6 trillion in losses from cyberattacks, the market opportunity for innovators is $400B - making it the largest asymmetric theater ever.
Also, note that SentinelOne is not just an endpoint company. It is a platform company that offers an increasing number of adjacent cybersecurity products, such as data lake and cloud security.
Overall, I’d like to see more consistency in SentinelOne’s communication style to avoid these unnecessary question marks, but it doesn’t impact my investment thesis. That doesn’t mean I’m right and, as usual, everyone please do your own due diligence.
Thanks for your thoughtful response. I was wondering whether I was perhaps being unfairly harsh with my analysis of SentinelOne. I admire Bert H’s analysis and he is bullish and so are you, and as you rightly point out they did provide some historical ARR numbers which I missed in the 10-Q.
So I set out to find evidence of the growing consumption revenue in SentinelOne’s numbers - fully looking for a reason to be more bullish on the stock.
Alas, I still haven’t found what I’m looking for.
They gave us seven historical quarters of ARR.
In a pure fast-growing subscription business, ARR divided by four should be higher than revenue. The reason is that ARR is a forward looking metric whereas revenue is backwards. There is of course cases where the two could be equal. But because S is growing fast that will only happen if they happen to sign lots of business at the beginning of the quarter and very little at the end. But if you are growing it should never be lower.
So if revenue is higher than ARR divided by 4 in a growing/not shrinking company, the difference must be from non-recurring business.
The case that both you and Bert make is that the consumption/non-recurring business is gaining steam and will soon contribute meaningfully to revenue, right?
So what I did is I calculated the difference between ARR divided by four and revenue for the last 7 quarters and for guided Q4.
ARR/4 - Rev $m
Q1
Q2
Q3
Q4
2023
2.2
1.8
0.5
4.4
2024
7.5
3.7
2.0
11.5
In all quarters ARR/4 is higher than revenue - so ARR is the main contributor to revenue. But if the consumption part of the business has been growing in the last quarters, that difference should be shrinking in the last quarters. And so it has, but the numbers are still very small (7.5 → 3.7 → 2.0). But look at guidance: they are saying that they will add $58m in ARR in Q4 i.e. $722m of ARR and have revenues of $164m, so the same metric has ARR driving an even larger part of revenue (ARR/4 is higher than revenues by $11.5m). It also shows that the difference between ARR divided by four and revenue is very small - indicating that the consumption part of the business is not that big yet.
And going forward in Q4 they are not guiding for it to contribute proportionally more - in fact recurring business is expected to be disproportionately strong.
I therefore struggle to see the case where there is a fast-growing consumption business lurking under the surface because I can’t find evidence of it in their numbers.
I am in awe with respect to this entire thread. The depth and insightfulness of several of these posts is truly beyond anything I’ve ever seen from any Wall Street analyst.
As for me, after the ARR fiasco and the debacle of an earnings report I exited S at a significant loss and have not been enticed to take a second look. At least not until I read the posts in this thread. After having done so, I’m still not interested in putting any of my money in this company.
I also just re-looked at it and also really thought the thread was excellent, but also still decided that I have better places for my money. The ARR “mistake” and the NRR graph that didn’t mention that they removed the line that was their target level were enough for me.
). It’s simply that my perspective on management hasn’t changed a great deal from the initial reasons which caused me to exit in the first place.
