To The Moon

Summary

• There seems to be a lot of expectation that SentinelOne will benefit from customers who switch away from CrowdStrike.
• However, buying habits may be changing with the "platformization" of cybersecurity services.
• Also, a lot will depend on management updates concerning ARR during the second quarter of 2025 (FQ2) earnings call.
• The company is also leveraging its Singularity AI-driven platform to sell bundled solutions in a way that is more profitable and generates more cash.
• There is potential but I have a Hold position till there is concrete evidence that it is managing to gain more recurring revenues in a rapidly changing cybersecurity landscape.

baranozdemir/iStock via Getty Images

Since I last covered cybersecurity play SentinelOne (NYSE:S) on February 20, the stock lost 5% while the S&P 500 gained 12%. At that time emphasized the strength of its Singularity platform which protects against cybersecurity threats in real-time together with the progress on profitability. However, I had a hold position based on the opportunities having already been priced in given it was trading at a forward price-to-sales of 13x.

Now, it could profit from CrowdStrike’s (NASDAQ:CRWD) miseries after its security update resulted in 8.5 million devices running Microsoft’s Windows operating system crashing resulting in outages for several companies throughout the world. This may be the reason why SentinelOne enjoyed a 13.72% upside since July 19 or the date of the outage as shown below.

However, this thesis aims to show this is unlikely unless the management provides solid arguments it is benefiting from its competitor's pains during the second quarter of 2025 (FQ2) earnings call around August 27. For this purpose, I highlight what to watch out for and will also provide an update on the company's profitable growth strategy.

At the same time, as competition in the cybersecurity industry heats after Palo Alto (PANW) announced its "platformization" strategy, I will emphasize how SentinelOne is leveraging its own platform to drive bundled products.

I start by providing insights into financial results for the first quarter of 2025 (FQ1) which ended in April.

Growing Rapidly With a Competitively Strong Product

The company delivered revenue growth of 39.7% which is far less than the 70.46% recorded during the same period last year. Along the same lines, the free cash flow margin of 18% appears on the low side considering what software companies are normally capable of.

Still, when juxtaposing the revenue and FCF growth in the context of the wider IT sector, a different picture emerges below.

seekingalpha.com

This depicts a company expanding sales at a fast pace when considering the sector median of only 3.33% while the fact that it is generating such a high level of cash after accounting for capital expenses shows that to grow revenues, relatively fewer investments are necessitated.

Moreover, it made significant progress in normalized earnings per share which came out at -$0.01 after it beat what analysts were expecting by $0.04. This progress has been achieved despite the fiercely competitive environment and one where SentinelOne's military-grade protection includes a dose of behavioral science ((AI)) that enables security admins to seamlessly through the high number of alerts without being overwhelmed by too many false positives. Thus, as per an update by SentinelOne, more customers are opting for its Singularity XDR compared to Palo Alto's Cortex XDR.

www.sentinelone.com

However, technical superiority is not the only selling argument as buying habits are changing because of the platformization strategy championed by Palo Alto since April this year.

Platformization Is Changing Buying Habits and Assessing Potential Benefits from CrowdStrike

This whole platformization concept consists of Palo Alto leveraging its wide portfolio of products and for example, encouraging customers who already use its firewalls to subscribe to additional ones like endpoint protection. This is done through incentives and encourages customers to source cybersecurity from a single supplier instead of choosing “best of breed” point solutions from several vendors.

www.paloaltonetworks.com

Now, in addition to providing a more integrated approach to cybersecurity, platformization also makes economic sense as it enables companies to consolidate their security functions while reducing the need to spend money for their employees to be trained on products of multiple vendors. Moreover, the company’s upbeat performance during its most recent financial year and upgraded guidance shows the platformization strategy is delivering, which could be to the detriment of competitors like SentinelOne.

In addition to Palo Alto, SentinelOne's Singularity platform competes with CrowdStrike Flacon according to Gartner, but scores slightly less when it comes to product features. Coming back to the incident and as I recently elaborated in a recent thesis, it is important to differentiate between the Falcon product itself which, noteworthily, was not compromised by hackers, and the security update process which was done without any preliminary testing and resulted in the outage.

Also, enterprises tend to sign contracts lasting three to five years which means that customers are not likely to outrightly cancel their subscriptions to switch to the competition which is why I do not believe Sentinel One should see a sudden surge in revenues in the short term. To this end, analysts have increased their consensus topline projections for FQ2-2025 but only by $0.13 million or a meager 0.07%. Even expectations for the medium-term (FY-25) and long-term (FY-26) have not seen any meaningful upgrades.

SentinelOne is Leveraging its AI-Driven Singularity Platform

On the other hand, it is possible that SentinelOne's sales team witnessed more customer conversations about Singularity for threat detection and response in instances where potential CrowdStrike customers are having second thoughts.

However, these conversations have to be translated into ARR or Average Recurring Revenues. This key metric increased by 35% to $762 million in FQ1, but this represents a deceleration compared to the 39% and 43% in the fourth and third quarters of fiscal 2024 respectively. This may be the main reason for analysts remaining cautious when reviewing topline expectations. Moreover, despite coming down, its forward P/S is overpriced by more than 200% relative to the IT sector as shown below. In these circumstances, I have a hold position.

seekingalpha.com

Its non-GAAP price-to-earnings ratio is even more overvalued showing that investors have higher expectations as to profitability.

In this connection, the progress on the profitability front is likely to be sustained, judging by the way analysts have doubled the consensus EPS estimate of FY-25 from $0.02 to $0.04. Now, one can argue that this could be because of higher pricing power but the fact that this increase in earnings has not been accompanied by higher sales expectations suggests that it is more due to the "charge toward profitability" than SentinelOne experiencing surging demand for its products.

Pursuing further with profitability in mind, while SentinelOne may not have a formal platformization strategy in the same way as Palo Alto, its Singularity platform also enables cross-selling of products, but is centered more on artificial intelligence. In this context, as more CEOs ride the AI wave, it has enjoyed more demand for its Purple AI forms part of a premium offering on top of the standard Singularity platform, which means that cybersecurity, data analytics, and AI can purchased together as a comprehensive enterprise-wide solution. Thus, SentinelOne also leverages its platform and it may not have the wide product portfolio of Palo Alto which has its roots in computer networking but can build on its cloud security background to offer bundled products that are closely integrated.

Coming to the profitability rationale, leveraging its platform makes sense as the threat landscape changes over time while uncertain macros and higher borrowing costs continue to shape buying behavior. Also, considering that it is cheaper to upsell or sell new products to existing customers than to spend marketing dollars to expand the customer base, the platformization strategy helps in alleviating operating expenses. Thus, the company could beat bottom-line expectations during FQ2, as it continues to build on the profitable growth momentum, one which consists of steadily increasing its gross margins while decreasing operating losses as charted below.

Charts were prepared using data from (seekingalpha.com)

What to Look for During FQ2's Earnings Call

Therefore, going forward, it is more likely for SentinelOne to improve its bottomline in the medium term. Now, to get more assurance of this happening, it is important to either deliver on or beat the EPS expectation of $0.00 for FQ2, which was upgraded from the previous value of $-0.01 on June 1.

In addition to earnings, one metric to indicate whether platformization is translating into sales is ARR. This grew at a pace of 30% YoY in the first quarter for enterprises spending above $100K, and any sign of this being exceeded in FQ2 should indicate that SentinelOne is managing to bundle more Purple AI subscriptions into Singularity.

Along the same lines, together with other emerging solutions, Singularity Data Lake which functions like an advanced SIEM (Security information and event management) experienced triple growth digits in FQ1 constituting 40% of bookings during FQ1. Such a performance in a highly competitive environment where it faces an array of legacy SIEM vendors is due to Purple AI which comes integrated with the Singularity platform and acts like an intelligent assistant to the security admin by mimicking different threat detection and response strategies. Now, more deals in this product category could again pave the way for broader platform adoption.

Looking specifically at potentially attracting CrowdStrike’s customer base, this is not likely to result in additional sales this year as I elaborated upon earlier. Also, SentinelOne's profitable growth strategy reduces the chances of its sales force offering aggressive product discounts to attract clients. On the other hand, any signs of customers switching to SentinelOne should increase its ARR for enterprises spending over $1 million as CrowdStrike's clients are primarily large corporations with 1,000 to 4,999 employees.

In conclusion, the stock has potential but a lot will depend on the guidance for the rest of the fiscal year. Thus, I have a Hold position, also because of the high level of expectation built into the share price as per the introductory chart which may not be justified.

Furthermore, this is a company that prioritizes profitability while continuing to grow at double-digit figures in a highly competitive market. Therefore, viewed from this angle, it is not likely for SentinelOne to aggressively market its products in a way that increases its operating expenses. Instead, it will more probably continue its strategy of upselling high-premium products to those already subscribed to the Singularity platform in a way that the FCF continues to grow rapidly for a company with $752 million of cash after accounting for debt.