Description

Investment Thesis

Despite the recent bounce, SentinelOne (or the “Company) still offers a compelling risk-reward given: 1) superior technology in endpoint security software (win rates are still ~70%), 2) healthy growth at ~30%+ in a growing security market (endpoint, cloud, and data/SIEM), 3) attractive valuation (~5.5x ’25 consensus revenue) and healthy gross margins in the high 70s, and 4) the potential for a reacceleration into the back half driven by go-to-market (GTM) improvements and growth beyond endpoint (newer verticals of cloud and data/SIEM).  Execution challenges have created a buying opportunity following a deceleration in growth and an ARR miss, however, the company’s strong pipeline and strategic investments suggest upside in the second half of the year.  If NNARR growth can turn positive as management has alluded to, just on the size of the deal pipeline alone (GTM and execution improvements would be upside beyond that), the stock could approach ~$25-30 over the next few quarters (25-50% upside).  Downside in the stock is limited to the mid/high teens as the business is a strategic asset in a great end-market that has already fielded a host of offers from potential PE suitors willing to pay a HSD multiple of revenue. 

Recent Events

The stock sold off after the recent earnings release as the Company lowered the midpoint of its full year revenue (by ~1%), and net new ARR came in light in the quarter (net new ARR growth was down ~10% yoy).  The main culprits for this softness are a combination of go-to-market changes (Michael Cremen started as the new Chief Revenue Officer and President beginning in January), and the fact that Q1 is a seasonally smaller quarter so any execution missteps are exacerbated in percentage terms.  Given the 1H softness in ARR due to these changes, the Company needed to take down full year revenue slightly, but management simultaneously pointed to a second half reacceleration in net new ARR that sets up well into ’25 (ARR leads revenue).  Investors also fear macro weakness (in particular in the SMB space where SentinelOne historically focused), and that competition was heating up with CrowdStrike which has recently emphasized a ‘down market’ product.  Notwithstanding these dynamics, win rates are still strong, and it appears it’s more of an issue of ‘getting into more RFPs/conversations’ than actually losing deals.  The Company has also seen a lot of traction beyond endpoint in the cloud offering (CNAAP) as well as in the next gen SIEM market (data observability leveraging all of the endpoint telemetry).  Splunk, the leader in the legacy SIEM market, was recently acquired by Cisco and is a ripe target to win share.   

Quick Business/Industry Overview

Founded in 2013, SentinelOne has rapidly evolved into a leading player in the cybersecurity industry. The company specializes in endpoint protection, but its portfolio has expanded to include cloud security, data analytics, and SIEM solutions. SentinelOne's unique value proposition lies in its integration of AI and machine learning to deliver superior security outcomes, offering capabilities such as single-click remediation and rollback, which set it apart from competitors.

SentinelOne's innovative approach has garnered significant industry recognition. The company became a unicorn in 2020 and had the highest-valued cybersecurity IPO in history in 2021. Today, SentinelOne serves over 10,000 customers, including major government agencies and Fortune 500 companies, with its platform offering multi-tenancy and compatibility across diverse environments, including public, private, and hybrid clouds.  ​

The cybersecurity market is highly competitive and rapidly growing, driven by increasing cyber threats such as ransomware and the rise of generative AI technologies. SentinelOne operates in the endpoint security segment, which is estimated to be a $15 billion market. The company's foray into cloud security and data security further expands its TAM to approximately $50 billion. Despite the competitive pressure from established players like CrowdStrike, Microsoft, and Palo Alto Networks, SentinelOne's innovative technology and aggressive growth strategy position it well to capture market share.

Likelihood of a Sale

Despite the CEO saying at a recent investor event that SentinelOne will remain a public company, the potential for SentinelOne to be acquired remains a significant consideration. Given the strategic value of its technology and market position, possible acquirers include large tech companies like Google and Cisco which are expanding their cybersecurity portfolios. If SentinelOne achieves net new ARR inflection in the second half of the year, it could bolster its valuation and negotiating position. However, if growth targets are not met, the company might explore strategic deals more aggressively, consider restructuring to optimize for profitability, or selling to any number of private equity firms that would happily buy this asset.  Tomer knows that the CNAAP/endpoint market is consolidating fast and there is a finite window to capture it, so my sense is he will become a willing seller in a couple quarters if he doesn’t get the reacceleration the market demands.  Regardless of the outcome/path, SentinelOne's robust technology foundation in the endpoint market ensures that it remains an attractive asset in the cybersecurity landscape.

Investment Highlights

1. Superior Technology and Expanding TAM:

1. Best-in-Class Security: SentinelOne's technology, integrating machine learning and AI, offers superior performance and protection, distinguishing it from competitors like CrowdStrike (CRWD) and Microsoft (MSFT).
2. Diverse Product Portfolio: Beyond endpoint security, SentinelOne is expanding into cloud security, data analytics, and SIEM alternatives, significantly increasing its total addressable market (TAM).

2. Growth Potential:

1. New Products Scaling: Innovations in cloud and data security are gaining traction, expected to drive growth acceleration in 2H.
2. GTM Improvements: Strategic GTM enhancements, including new leadership and optimized sales processes, are anticipated to improve execution and conversion rates.

3. Underlying Financial Metrics:

1. Unit Economics: Strong gross margins (approaching ~80%) and efficient sales metrics justify reinvestment into growth.  While the focus will be on driving growth rather than margin improvement in the short term, the underlying unit economics remain robust.

4. Valuation:

1. Attractive Valuation: Trading at less than ~6x ’25 sales, SentinelOne is undervalued compared to peers with similar or worse growth profiles trading at 7-10x sales.
2. Risk-Reward Profile: Given the current valuation, the downside risk is limited, while the upside potential from executing on growth initiatives is significant.

Considerations

• Execution Risks: The company needs to demonstrate consistent execution, especially in GTM strategies, to realize its growth potential.
• Competitive Landscape: SentinelOne competes against dominant players like CRWD and MSFT, which poses ongoing competitive challenges.  CRWD has become more willing to discount and has put some effort behind it’s cheaper SMB product.  On the cloud/CNAAP side, there are a host of players including PANW, ZS, CRWD and others that are vying for a piece of this growing pie.
• Profitability:  Despite high gross margins, the company is not yet showing profitability, and the focus on growth investments may delay significant margin improvements (management may run the business closer to breakeven and re-invest profits back into growth).

APPENDIX:

Catalyst

Catalysts

• Investor Day: Potential investor day in October could provide clearer guidance on growth and profitability outlooks.
• ARR inflection: Management has pointed to an ARR inflection in 2H
• Strategic Deal: Although CEO Tomer Weingarten isn’t actively looking to sell, the company remains open to strategic deals if they arise.  The reality is that Tomer probably has one more shot at inflecting ARR positively and proving this asset can ‘go it alone’.  However, if the changes in go-to-market do not materialize in an inflection or if the acceleration is more anemic than what is warranted given the market growth, it’s likely that Tomer will concede SentinelOne needs to be part of a larger platform to compete (Maybe CSCO, GOOGL?).