I almost scrolled past the number. Twenty-one percent revenue growth, in a market that has spent two years punishing anything that still spends like a startup, should not feel ordinary. Then I noticed the other figure sitting right beside it: operating margin, on a non-GAAP basis, jumping from 2 percent to 10 percent in a single year. That pairing is rarer than the headline growth. Plenty of security vendors can still print a double-digit top line. Fewer of them can do it while the incremental dollar starts to stick.
That is the tension I keep coming back to with SentinelOne stock. The California company built its name on endpoint protection, the unglamorous job of watching laptops, servers, and the odd forgotten device that nobody in IT wants to admit is still on the network. Lately the story has widened into cloud, identity, data, and AI security. A portfolio I follow recently opened a position near $23. By the time the note landed, the shares were closer to $25. A two-dollar move is not a thesis. The thesis, if there is one, is whether a 20-percent grower can become a durable profit machine without giving the growth back.
Why The Financial Inflection Matters More Than The AI Slogan
AI is the easy sentence. Every security pitch deck now has a model somewhere in the middle. I have found that the more interesting question is colder: what happens to the next dollar of revenue once the company is no longer tiny? If that dollar mostly funds more salespeople and more cloud bills, you own a growth story with a leak. If it starts dropping to the operating line, you own something that can compound.
SentinelOne, in its latest fiscal second quarter, reported revenue of $292 million, up 21 percent. Annual recurring revenue reached $1.218 billion, up 22 percent. Customers generating at least $100,000 of ARR numbered 1,715, up 13 percent. Non-GAAP earnings per share doubled to 8 cents from 4 cents. Management also lifted its full-year outlook for revenue and operating income. None of that is a victory lap. It is a snapshot of a business that has not yet traded growth for optics.
Growth that survives contact with a profit target is the only growth I trust for more than a quarter.
A portfolio manager who has sat through too many software resets
Perhaps the most interesting aspect is how ordinary the product story sounds until you stack it against the margin move. An eight-point improvement in non-GAAP operating margin, while revenue still grew 21 percent, is the kind of operating leverage software investors claim to want and then forget to measure. I would rather own that pattern than a prettier narrative with flat margins.
What 20 Percent Growth Actually Looks Like At This Scale
A billion dollars of recurring revenue is not early-stage anymore. At that size, 22 percent ARR growth means the company has to add a serious chunk of new contracted business every year just to stand still on the growth rate. Some of that comes from new logos. A growing slice, if management is telling it straight, comes from selling more to people who already pay.
The large-customer count is the tell I watch. A 13 percent rise in accounts above $100,000 of ARR is slower than the overall ARR growth. That gap can mean two things. Either smaller customers are expanding faster, which is fine if they stick, or the big deals are getting harder to land. I do not have the cohort data in front of me, so I will not pretend the split is clean. What I will say is that a platform story lives or dies on expansion inside the base. New logos are expensive. Extra modules on an existing contract are where software margins are born.
Here is a rough way I frame it when I am reading a print like this.
- Top-line growth still above 20 percent means the category has not gone stale.
- ARR slightly ahead of revenue growth hints that the book of contracted business is still filling in.
- Large-customer growth lagging ARR is a yellow flag, not a red one, until retention figures say otherwise.
- A doubled non-GAAP earnings figure on a small base is encouraging, and also easy to overread.
Short version: the engine is still turning. The question is whether the fuel economy is real.
The Margin Jump, And The Gross-Margin Slip Nobody Should Ignore
Operating margin getting to 10 percent from 2 percent is the headline investors will quote at dinner. I care about it. I also care about the line above it. Non-GAAP gross margin eased to 77 percent from 79 percent a year earlier. Two points does not sound like much until you remember that gross margin is the ceiling on everything else. You cannot operate your way past a structural cost problem forever.
Why would gross margin dip while operating margin leaps? A few ordinary reasons show up in security software. Cloud hosting for detection workloads can get heavier as customers turn on more modules. Mix can shift toward services, threat hunting, or newer products that are not yet as efficient as the core endpoint agent. Discounts to win larger platform deals can nick the reported rate even when the long-term contract looks fine. I have seen all three. None of them is fatal on its own. All of them deserve a second look next quarter.
In my experience, the cleanest software inflections show gross margin stable or rising while operating margin expands. SentinelOne does not have that clean version yet. It has the more awkward version: operating leverage arriving while the gross line softens a touch. That is still progress. It is not permission to stop watching.
| Metric | Latest Quarter | Year-Ago Comparison | What I Make Of It |
| Revenue | $292 million | Up 21 percent | Growth intact at scale |
| Annual recurring revenue | $1.218 billion | Up 22 percent | Contracted book still expanding |
| Customers above $100,000 ARR | 1,715 | Up 13 percent | Large accounts growing, slower than ARR |
| Non-GAAP operating margin | 10 percent | 2 percent | Real operating leverage |
| Non-GAAP gross margin | 77 percent | 79 percent | A soft spot worth tracking |
| Non-GAAP EPS | 8 cents | 4 cents | Small base, doubled, still early |
Tables like that are useful precisely because they refuse to pick a single hero number. If you only remember the 10 percent margin, you will be surprised later. If you only remember the gross-margin dip, you will miss the operating story. Both can be true in the same quarter. Markets hate that. I do not.
From Endpoint Specialist To Something Wider
Endpoint security is a brutal neighborhood. Buyers know the category. Incumbents have muscle memory. Differentiation often collapses into a demo about detection speed and a argument about agent weight. SentinelOne earned its reputation there. The more interesting commercial claim, made earlier this year, is that emerging solutions had grown to roughly half of total ARR. Half. If that mix holds, this is no longer a single-product company wearing a platform costume.
Cloud, identity, data, and AI security are not side quests. They are where budget is migrating, because that is where the mess is. A laptop agent does not see a misconfigured storage bucket. It does not catch a stolen token hopping between cloud accounts. It does not explain why a model endpoint just started answering questions it should never have seen. Buyers who already trust an endpoint vendor will sometimes extend the contract rather than add a fifth console. Sometimes they will not. The half-of-ARR figure is the evidence that, so far, a meaningful share of them will.
In September the company extended its Wayfinder threat-hunting service across the three major public clouds, covering endpoints, identities, and cloud environments in one motion. I read that less as a product launch and more as a distribution clue. Threat hunting is a service wrapped around software. It gets humans into accounts that software alone has not fully won. If those engagements convert into platform seats, the margin story improves later. If they stay as labor, gross margin has a reason to stay heavy. That is the trade.
The AI Angle, Without The Confetti
Attackers are using automation to probe faster. Defenders need automation to answer at something close to the same speed. That sentence has been true, in slower form, since the first script kiddie learned to loop. What changed is the cost of a convincing lure, a plausible identity, a flood of variants. A human analyst queue does not scale against that. A rules engine from 2016 does not either.
So yes, AI belongs in the SentinelOne conversation. I just refuse to let it do all the work. The company already sells detection and response. The AI layer is an accelerant on a product set that has to stand up on renewal rates, gross margin, and the ability to land a second and third module. If the AI story is real, it should show up as higher attach, stickier large accounts, and a gross margin that stops slipping. If it is mostly language, the financials will look ordinary within a few quarters and the multiple will follow.
There is a second, quieter AI effect that investors underweight. Security budgets are not infinite. Boards are being asked to fund model security, data-loss controls around training sets, and identity hardening at the same time as the old endpoint renewal. Vendors that can bundle those asks into one platform conversation have a shot at taking share of a budget that is being rearranged, not simply expanded. That is a better setup than hoping every CISO gets a blank check.
Do not chase the AI sentence. Chase the point where growth and profit stop fighting each other.
I keep that line taped above the part of my notes where the slogans usually go. It has saved me from more than one expensive enthusiasm.
Why A Buyer Might Step In Around These Levels
A position initiated near $23, with the shares later around $25, is not a deep-value entry. It is a bet that the inflection continues. The appeal, as I see it, sits in three places.
- Growth has not been sacrificed. Revenue and ARR are both still north of 20 percent.
- Profitability is no longer theoretical. A 10 percent non-GAAP operating margin is a different company than a 2 percent one.
- The product surface is wider than the original endpoint franchise, with emerging solutions described as roughly half of ARR.
Add a raised full-year outlook and you have a management team willing to put a slightly higher bar in public. I like that more than a cautious guide that exists only to be beaten. Raised guides can still be missed. They at least tell you the internal view improved.
Would I call it cheap? Not from the facts in front of me. Cybersecurity names with 20 percent growth and expanding margins rarely screen as bargains on backward earnings, because the earnings are still small. Eight cents a quarter, doubled, is progress. It is not a mature earnings power. Anyone buying here is paying for the path, not the trailing print. That is fine if you size it like a path. It is a problem if you size it like a bond.
What Could Break The Story
I am not interested in a bull case that has no exits. A few things would make me walk the position back, even if the AI commentary stayed loud.
First, growth rolling under the high teens without a clear mix explanation. At a billion-plus of ARR, deceleration happens. The issue is whether it happens because the platform is saturating or because execution slipped. Second, gross margin drifting further while management calls it investment. One quarter at 77 percent is a note. A trend toward the low 70s, without a matching rise in long-term contract value, is a different business. Third, large-customer growth stalling. If the $100,000-plus cohort stops expanding, the land-and-expand claim gets thin fast.
Competition belongs on the list too, though I will not turn this into a scoreboard of logos. Endpoint and cloud security are crowded. Buyers consolidate vendors when budgets tighten and add point tools when a breach scares them. SentinelOne has to win both moods. A platform that is half emerging solutions is more exposed to execution risk than a pure endpoint renewal machine, and also more exposed to upside if the new modules stick. That is the bargain you accept.
A simple watchlist I actually use: ARR growth staying near 20 percent Gross margin stabilizing around the high 70s Operating margin holding the recent gain Large-customer count still rising Emerging products remaining a large share of ARR
None of those are heroic targets. They are the minimum evidence that the inflection is a process and not a quarter.
How Platform Adoption Changes The Math
Single-product security companies live on replacement cycles. Platform companies live on seat expansion and module attach. The math feels different in the model, and it should. A customer who buys endpoint and then adds identity and cloud coverage raises ARR without a full new sales cycle. Sales cost as a percent of that incremental ARR should fall. That is the operating-leverage dream in one sentence.
The nightmare version is just as simple. The second module is discounted so hard that it fills ARR and empties margin. Or the customer buys a pilot, counts in the emerging bucket for a quarter, and churns. Emerging solutions at roughly half of ARR is a strong claim only if retention on those products looks like retention on the core. I have not seen a clean public split of net retention by module in the figures I am working from, so I treat the mix shift as promising and unproven at the same time. Both adjectives can share a sentence.
Wayfinder’s reach across the major clouds is a practical test of that claim. Hunting across endpoints, identities, and cloud in one service is exactly the workflow a stretched security team says it wants. Workflows that match the complaint tend to renew. Workflows that match the slide tend to get cut in the next budget review. We will know which one this is by whether services revenue pulls product with it, or sits beside it like a separate business.
Reading The Raised Outlook Without Getting Cute
Management raised full-year expectations for revenue and operating income. I like raised guides when they arrive with stable or better margins, and I get suspicious when they arrive with a kitchen-sink quarter behind them. This one arrived with growth intact and operating margin sharply better, gross margin a bit worse. That is a mixed but legitimate raise.
A guide is a promise about the next few quarters, not a valuation. The useful habit is to write down what would make the raise look early. A slip in large deals. A cloud-cost surprise. A renewal cohort that was pulled forward. If none of those show up and the company still clears the higher bar, the inflection earns another quarter of trust. Trust, in this kind of stock, is the asset. The multiple is just the price of it.
Position Size, Because Enthusiasm Is Not A Risk System
The portfolio that opened this name already held a full position in a larger cybersecurity platform. Adding SentinelOne was a choice to increase exposure to the theme, not to bet the book on one ticker. That framing matters more than the $23 entry. Cybersecurity spending is a real secular pull. It is also cyclical around breach headlines, budget seasons, and whatever the Federal Reserve is doing to software multiples that week.
I would treat a name at this stage of profitability as a satellite, not a core holding, until gross margin steadies and the earnings base is less tiny. Satellites can be meaningful. They should not be the thing that decides whether the year works. If the operating margin march continues and ARR holds the low-20s, there is room to add. If the gross-margin slip becomes a trend, the add never comes and the starter can be cut without drama.
That sounds dull. Dull is how you stay in a growth stock long enough for the inflection to matter.
The Incremental Dollar, Which Is The Whole Argument
Investors are often told they must choose between growth and profitability. I have never found that choice honest. The honest version is about sequence. A company proves it can grow. Then it proves the growth throws off cash operating profit. Then, if you are lucky, it proves it can do both at once for long enough that the multiple stops being a debate and starts being a habit.
SentinelOne is somewhere in the middle of that sequence. Revenue up 21 percent. ARR up 22 percent. Operating margin up eight points. Gross margin down two. EPS doubled off a small base. Emerging products around half of ARR. A share price a couple of dollars above a recent initiation. None of those facts, alone, is a buy or a sell. Together they describe a business that has started to convert growth into profit and has not finished the job.
The incremental dollar is the character in this story I actually want to follow. If the next dollar of revenue costs less to deliver than the last one, the 10 percent operating margin is a floor. If the next dollar costs more, because cloud detection is heavier or discounts are wider, the 10 percent is a ceiling with good lighting. Quarterly reports will tell us which. Commentary about AI will not.
Inflection check: growth held + operating margin up + gross margin stable = stay interested. Break any two, and reread the position.What A Patient Buyer Might Do Next
I am not going to dress this up as a trade alert. The useful next step is boring on purpose. Read the following quarter for four things only: revenue and ARR growth versus the raised guide, gross margin direction, operating margin holding near or above 10 percent on a non-GAAP basis, and whether the large-customer count keeps climbing. If three of the four cooperate, the initiation near $23 looks early rather than lucky. If two fail, the $25 area is just a price, not a signal.
There is also a sector context worth keeping in the same notebook. Security spending tends to hold up better than discretionary software when budgets tighten, because the alternative is a headline nobody wants. It does not hold up perfectly. Deals slip. Pilots stretch. Multi-year commits get shaved. A company growing above 20 percent inside that weather is doing something right. A company whose gross margin is softening in that weather needs to explain the mix before I give it the benefit of the doubt twice.
One more personal bias, since I am not pretending this is a lab report. I prefer platform stories that already have a profitable core to platform stories that promise the core will appear once the new modules scale. SentinelOne is closer to the first description than it was a year ago. Closer is not the same as arrived. That gap is where the return lives, and also where the disappointment lives. Anyone who cannot hold both ideas at once should pick a different stock.
A Clearer Way To Think About The Next Year
Strip the ticker off for a moment and the pattern is familiar. A software firm crosses a billion in recurring revenue. Growth cools from the hyper phase into the 20s. Investors who wanted 40 percent leave. Investors who wanted profits arrive and immediately argue about the multiple. The company, if it is competent, uses the cooler growth to widen the product and tighten the cost line. Some do it. Some talk about it while gross margin quietly erodes.
SentinelOne’s latest quarter sits on the competent side of that fork, with an asterisk on gross margin. The asterisk is not a footnote. It is the thing that decides whether this becomes a stock you can own through a dull tape or a stock you rent between prints. I would rather be early to a real inflection than late to a finished one, and I would rather be wrong small. That is not a slogan. It is just how the downside stays survivable when the AI paragraph in the shareholder letter outruns the cash.
If you take nothing else from the move off $23 toward $25, take this: the price already noticed. The work now is deciding whether the financial turn is a quarter or a habit. Habits show up in the next print, and the one after that, in the same four lines. Growth. Gross margin. Operating margin. The customers who spend real money. Everything else is atmosphere.
I will be reading those lines. The AI boost can wait its turn.
