【SentinelOne (S) Q1 FY2027】 Revenue re-acceleration is not yet visible. Still, here is why the composition of ARR has begun to change
SentinelOne (S) reported its Q1 FY2027 earnings.
In the previous earnings report, we looked at whether the Cloudflare deal was an exception or the beginning of a trend.
However, the main story this time is not the Cloudflare deal.
The Cloudflare deal was a symbolic case in the previous earnings report. I believe it was a deal that demonstrated that if SentinelOne can bring a case to a rigorous comparative verification stage, it has the potential to beat its competitors.
But that is not what we should be looking at in this Q1.
What we should look at this time is whether SentinelOne is beginning to move from being a mere device protection company to an integrated security platform that bundles AI Security, Data, Cloud, and SOC automation.
When looking only at EDR—that is, endpoint protection that monitors, detects, and responds to attacks on corporate PCs and servers—SentinelOne is easily seen as following in CrowdStrike's footsteps.
In fact, CrowdStrike's scale, brand, and existing customer base are strong. It cannot yet be said that SentinelOne is winning head-to-head on this playing field.
However, a slightly different perspective emerged in this earnings report.
It is not an earnings report that clearly proves a re-acceleration of revenue.
But the composition of ARR, or Annual Recurring Revenue, is beginning to change.
I think this is the biggest point of discussion this time.
Q2 FY2026 → Q3 FY2026 → Q4 FY2026 → Q1 FY2027
・Revenue: $242.2M → $258.9M → $271.2M → $276.7M
YoY: +21.7% → +22.9% → +20.3% → +20.8%
QoQ: +5.7% → +6.9% → +4.8% → +2.0%
Revenue for Q1 FY2027 was $276.7M. YoY +20.8%, QoQ +2.0%.
Revenue continues to grow in the low 20% range.
However, it is hard to say that a clear revenue re-acceleration has occurred. Even QoQ, it remains at +2.0%. Considering the seasonality from Q4 to Q1, this is not a major problem, but I do not think it is correct to view this as an "earnings report where revenue accelerated rapidly."
Looking at this earnings report solely in terms of revenue, it is somewhat underwhelming.
However, if you look at the composition of ARR, the assessment changes slightly.
・ARR: $1.001B → $1.055B → $1.119B → $1.163B
YoY: +24.2% → +22.8% → +21.6% → +22.6%
QoQ: +5.6% → +5.4% → +6.0% → +3.9%
This is slightly better than revenue. The ARR growth rate in Q4 FY2026 was +21.6% YoY, but this time in Q1, it has slightly re-accelerated to +22.6%.
ARR is the foundation of recurring revenue based on current contracts annualized. It is a leading indicator compared to revenue.
・net new ARR: $53.3M → $54.0M → $63.8M → $43.5M
YoY: >+20% → roughly flat to slight increase → +6% → +55%
QoQ: around +12% → +1.3% → +18.2% → -31.8%
QoQ, it has decreased from the $64M in Q4. However, Q4 is a strong quarter for cyber companies, and Q1 is seasonally prone to weakness. Therefore, I think this should be viewed year-over-year rather than just QoQ.
A +55% year-over-year increase is quite strong.
The best figure in this Q1 was not revenue, but net new ARR.
Revenue has not yet jumped significantly. However, the net increase in ARR, which will become the foundation for future revenue, has clearly improved.
・$100K+ ARR customers: 1,513 → 1,572 → 1,667 → 1,702
YoY: +22.7% → +20.0% → +18.1% → +16.7%
QoQ: +3.7% → +3.9% → +6.0% → +2.1%
While this could be called a natural slowdown accompanying scale expansion, the growth in the number of large customers is not re-accelerating.
However, in this call, the company explained that the NRR for $100K+ customers—that is, the revenue retention and expansion rate from existing large customers—improved both year-over-year and quarter-over-quarter.
As of Q4, the GRR for $100K+ customers, which is the total retention rate before churn and contraction, was 96%, and the NRR was 109%. While there is no specific numerical disclosure for this Q1, the CFO explained that the NRR for $100K+ customers exceeded 110%.
・Revenue composition by business: Not disclosed
・Single segment: The company discloses as a single business segment
・Revenue composition by region: Q1 FY2027 was 61% US, 39% international
SentinelOne does not disclose revenue composition by business or product. It is disclosed as a single business segment on the 10-Q, and revenue by product cannot be confirmed.
・GAAP gross margin: 75% → 74% → 73% → 72%
Year-over-year difference: ±0pt → -1pt → -2pt → -3pt
QoQ difference: ±0pt → -1pt → -1pt → -1pt
Revenue is growing. ARR is also growing. The composition of Data, AI, and Cloud is also increasing.
However, the GAAP gross margin has declined from 75% to 72%.
In the 10-Q, factors for the cost increase include increased cloud hosting usage fees accompanying business expansion, customer support expenses, amortization of intangible assets from acquisitions, and amortization of capitalized internally developed software.
In other words, it is strategically good that Data, AI SIEM, and Cloud are growing.
However, that does not immediately lead to gross margin improvement, and if data volume and cloud usage increase, costs will also increase in the short term.
・non-GAAP gross margin: 79% → 79% → 78% → 77%
Year-over-year difference: -1pt → -1pt → -1pt → -2pt
QoQ difference: ±0pt → ±0pt → -1pt → -1pt
The non-GAAP gross margin is also declining. It was 77% in Q1 FY2027.
One should not simply look at this and think, "It's good because AI Security and Data are growing."
AI SIEM and Data Lake handle large amounts of customer logs and security data. While customer value is high, cloud costs are also prone to becoming heavy.
・GAAP operating margin: -33% → -28% → -29% → -29%
Year-over-year difference: +7pt → +14pt → +7pt → +9pt
QoQ difference: +5pt → +5pt → -1pt → ±0pt
It is profitable on a non-GAAP basis. However, it remains in the red on a GAAP basis. There is a large difference between the figures excluding SBC, acquisition-related expenses, and amortization of intangible assets, and the actual accounting figures.
・non-GAAP operating margin: 2% → 7% → 6% → 4%
Year-over-year difference: +5pt → +12pt → +5pt → +6pt
QoQ difference: +4pt → +5pt → -1pt → -2pt
The non-GAAP operating margin was 4% in Q1 FY2027.
Looking only at the 4% in Q1, it is still far from the Rule of 40.
The Rule of 40 is a benchmark used when looking at SaaS companies, which considers whether the sum of the revenue growth rate and the profit margin exceeds 40%.
The revenue growth rate for Q1 was approximately 21%, and the non-GAAP operating margin was 4%. The total is around 25%.
・GAAP EPS: -$0.22 → -$0.18 → -$0.33 → -$0.23
・non-GAAP EPS: $0.04 → $0.07 → $0.07 → $0.04
Here too, if you look only at non-GAAP, it is positive, but looking at GAAP, there is still a distance.
・Operating CF: -$1.0M → $21.0M → $4.4M → $38.5M
YoY: Deterioration → Turn to profit → Turn to profit → -26.4%
QoQ: Significant deterioration → Improvement → -79.2% → +780.8%
Operating CF margin: 0% → 8% → 2% → 14%
It improved significantly from the $4.4M in Q4. However, since it was $52.3M in the same quarter of the previous year, Q1 FY2026, it has decreased year-over-year.
The operating CF for Q1 is not bad.
However, it is weak compared to the same period last year.
Also, S's quarterly operating CF is prone to fluctuation due to billing timing and the linearity of large contracts.
Therefore, one should not judge based on a single quarter, but also look at the TTM, or trailing 12-month FCF margin.
・Capital expenditure: $6.1M → $5.1M → $6.7M → $7.8M
Capital expenditure / Revenue ratio: 2.5% → 2.0% → 2.5% → 2.8%
Capital expenditure here is viewed as the sum of PPE, or purchases of property, plant, and equipment, and capitalized internally developed software costs.
As S's Data, AI SIEM, and Cloud grow, the investment burden related to cloud hosting and software development increases.
Capital expenditure for Q1 was $7.8M, and the revenue ratio was 2.8%. It is not overly heavy, but it is slightly high over the past four quarters.
・FCF: -$7.1M → $15.9M → -$2.3M → $30.7M
FCF margin: -3% → 6% → -1% → 11%
FCF was negative in Q4, but it returned to positive in Q1. I want to view this positively.
However, the adjusted FCF emphasized by the company is $61.4M, with a margin of 22%. This is a figure that adds back the $30.7M temporary tax payment based on an agreement with the Israeli tax authorities.
Therefore, I think we should look at normal FCF and adjusted FCF separately this time.
Normal FCF is $30.7M, margin 11%.
Adjusted FCF is $61.4M, margin 22%.
Looking only at adjusted FCF, it appears to have approached the Rule of 40, but it is not yet that strong on an operating margin basis.
・SBC: $73.9M → $75.3M → $79.7M → $74.9M
YoY: +14.2% → +7.3% → +7.5% → +9.1%
QoQ: +7.6% → +2.0% → +5.8% → -6.0%
SBC / Revenue ratio: 30.5% → 29.1% → 29.4% → 27.1%
SBC, or stock-based compensation expense, was $74.9M in Q1 FY2027. The revenue ratio was 27.1%.
It is gradually decreasing, but it is heavy.
SBC is excluded from non-GAAP profit, but it acts as dilution for shareholders. For S to say it has truly begun to create shareholder value, the SBC / Revenue ratio needs to decrease further, and the increase in the number of shares needs to settle down.
・GAAP weighted average shares: 330.9M → 332.7M → approx. 334.8M → 337.0M
QoQ: +0.9% → +0.5% → +0.6% → +0.7%
It is not rapid dilution, but the increase continues. As long as SBC is heavy, even if they buy back their own shares, much of it may go toward offsetting dilution.
・Cash, cash equivalents, and investments: $1.2B → $873.6M → $769.6M → $812M
The company has no debt. The balance sheet is not bad. Rather, it still has plenty of room.
However, in Q1, there was also a $100M investment in the Knight JV, and we need to continue to watch how strategic investments are used.
・Q2 FY2027 guidance: Revenue $289M - $291M
Median: $290M
YoY: approx. +19.8%
QoQ: approx. +4.8%
It is not a bad figure, but it is not a prospect where revenue growth rate will re-accelerate significantly.
・FY2027 guidance: Revenue $1.195B - $1.205B
Median: $1.200B
YoY: approx. +19.8%
The full-year FY2027 revenue guidance was maintained.
On the other hand, the non-GAAP operating profit guidance was revised upward from $110M - $120M to $115M - $125M. In terms of the median, it has been raised from $115M to $120M.
In other words, this earnings report was not one that raised revenue guidance, but one that raised profit guidance.
This S earnings report is not one that proved revenue re-acceleration.
The revenue growth rate is stable in the low 20% range, but there is no intense acceleration.
The FY2027 revenue guidance is also maintained.
On the other hand, the composition changes in ARR, net new ARR, and Emerging solutions are clearly good.
In other words, I think this earnings report is not "an earnings report where revenue jumped," but "an earnings report where the composition of ARR has begun to change."
■ From 50% of Bookings to 50% of ARR
This is the main point this time.
In the previous Q4, the company explained that Emerging Products accounted for over 50% of annual Bookings.
This was important, but it was only about Bookings.
Bookings is the acquisition of contracts. While it is a leading indicator of future revenue, it does not immediately turn into revenue or ARR.
This time in Q1, Emerging solutions reached half of the total company ARR.
This has a different meaning.
Over 50% of Bookings is a story that "new product groups are selling."
50% of ARR is a story that "the composition of the company's recurring revenue is changing."
In other words, S is ceasing to be a mere device protection company.
Endpoint, or device protection, remains important. Management also emphasizes that even in the AI era, the endpoint is an important control plane, or management aspect of the execution point.
However, S's growth story is not just endpoint.
Visualization and control of AI usage by Prompt Security.
Automatic investigation of SOC by Purple AI.
Integration of security data by AI SIEM.
Runtime protection of cloud workloads by Cloud runtime security.
Services that combine AI and human supervision by Wayfinder.
This combination has the potential to push S from a mere EDR company to an integrated security platform.
However, the company does not disclose revenue by product.
The absolute amount of Prompt Security ARR is also not disclosed.
Data ARR and Cloud ARR also have milestones as of Q4, but the absolute amount for Q1 is not disclosed.
So, we can confirm that "the content is changing."
However, we cannot go so far as to say that "it has been completely proven as revenue re-acceleration."
■ Will Prompt Security become a new entry point?
Prompt Security is also important this time.
Prompt Security is an AI Security product that visualizes generative AI usage within companies and controls data leakage and inappropriate AI usage.
The company explains that Prompt Security's ARR almost doubled QoQ in Q1 as well. Since it also doubled in Q4, at least the current growth is very strong.
What is interesting here is that Prompt is becoming an entry point not only for upselling to existing customers but also to competitor customers.
If you compete only on device protection, CrowdStrike's and Microsoft's existing bases are strong.
However, for the new pain point of visualization and control of AI usage, customers do not yet have a standard solution.
If S can get in there first, there is room to expand to Endpoint, Cloud, AI SIEM, and Purple AI afterward.
In other words, Prompt Security is not just an additional product.
For S, it has the potential to become a new sales entry point.
However, I repeat, the absolute ARR is not disclosed.
"Doubling" is strong.
But if the original scale is small, even if it doubles, the contribution to the company as a whole is limited.
From next time onward, I want to see how much Prompt Security is contributing to the company's overall net new ARR and NRR improvement.
In addition, I would also like to touch on Purple AI.
In its materials, the company organizes the evolution of cyber defense into three stages: old antivirus like McAfee and Symantec, next-generation defense led by cloud monitoring and humans like CrowdStrike and Microsoft, and autonomous security by SentinelOne + Purple AI.
In other words, the company is showing itself not as a follower of CrowdStrike or Microsoft, but as the AI-native security platform that comes next.
However, as an investor, there is no need to believe this as is. Purple AI's standalone ARR and revenue contribution are not disclosed.
Therefore, what we should look at is not the story, but how much Purple AI is contributing to the expansion of non-Endpoint ARR, NRR, net new ARR, and AI SIEM adoption.
■ Can AI SIEM and Data become S's upper layer?
Another important thing is Data and AI SIEM.
SIEM is a mechanism for security information and event management, a platform that collects and analyzes logs and security events within a company. It is also an area where Splunk was strong.
S is trying to enter here as AI SIEM.
This is quite an important point of discussion.
Device protection is important, but the upper layer of cybersecurity eventually leans toward data and operations. Where did what happen? Which alerts should be prioritized? Which logs should be correlated and analyzed? How much should be investigated automatically, and from where should humans make judgments?
A company that holds this is strong.
If S can hold customer security operation data through AI SIEM and Data Lake, it will approach the SOC's data and operation platform, not just defense software.
This is important from the perspective of a moat.
However, the Data business also has a point of caution regarding gross margin.
Handling large amounts of logs costs cloud money. In this 10-Q, the increase in cloud hosting usage fees is also indicated as a factor for cost increase.
In other words, while Data and AI SIEM are strategically attractive, it still needs to be confirmed whether they can be grown while maintaining gross margin.
■ Is the profit margin improvement real?
This time, the company revised upward its FY2027 non-GAAP operating profit guidance.
This is good.
Revenue guidance is maintained, but profit guidance was raised. Q1 non-GAAP operating profit also exceeded guidance.
S is moving in the direction of not only growth but also profitability improvement.
However, I don't want to get the perspective wrong here either.
The 8% workforce reduction announced this time will contribute to profit margin improvement in the short term. The company expects an annual cost reduction effect of $45M. On the other hand, restructuring expenses of approximately $25M are expected to occur in Q2.
Management explains that this is not a defensive restructuring, but an organizational simplification to reallocate resources to AI, Data, Cloud, and Endpoint.
This explanation is understandable.
However, as an investor, confirmation is necessary.
Are they really cutting low-ROI departments and shifting them to high-ROI areas?
Or are they cutting expenses because revenue growth is weak?
I think the answer will appear in the net new ARR for the next 2-3 quarters.
If net new ARR continues to grow even after the workforce reduction, this is sales efficiency improvement.
Conversely, if net new ARR slows down, there is a possibility that growth power has been cut.
■ The wall of SBC still remains
Following the last time, I will view SBC as heavy.
SBC for Q1 FY2027 is $74.9M. The revenue ratio is 27.1%.
It is improving. Q2 was 30.5%, Q3 was 29.1%, Q4 was 29.4%, and Q1 is 27.1%.
However, it is still high.
Even if the non-GAAP operating margin is 4%, it is hard to simply call a company where SBC is 27% of revenue "a company that has begun to make a profit."
SBC is not an accounting cash expenditure. But for shareholders, it acts as dilution. In other words, it dilutes the value per share of existing shareholders.
For S to become a company that truly creates shareholder value, at the very least, the SBC / Revenue ratio needs to decrease continuously, and the increase in the number of shares needs to settle down.
I think this is a quite important condition for raising S from a mere watch list stock to an investment candidate.
■ Is the moat expanding?
In this earnings report, I think the moat is in an expanding direction.
There are three reasons.
The first is the expansion of products.
S is no longer just a device protection company. Prompt Security, Purple AI, AI SIEM, Cloud, and Wayfinder are combined, approaching an integrated security platform.
The second is the content of ARR.
In the previous Q4, Emerging Products were over 50% of Bookings. This time in Q1, Emerging solutions reached half of ARR. This is significant in the sense that the company's recurring revenue structure itself is changing.
The third is the entry into operations.
If it were only Endpoint, replacement could happen.
However, when Data, AI SIEM, Purple AI, and Prompt Security are combined, it enters into the customer's security operations themselves. Once it gets this far, switching costs become high.
However, I will not go so far as to call it an "overwhelming moat company" yet.
The reason is that the competition is too strong.
CrowdStrike is strong with Endpoint and the Falcon platform. Microsoft is strong with bundles and an existing customer base. Palo Alto has the comprehensive power of integrated security. Zscaler is strong in the Zero Trust area. There are also data and monitoring side players like Splunk and Datadog.
S is in a good position.
However, it is not yet a winner.
I think the current S is a company in the middle of moving from a "good company" to a "strong integrated security platform."
■ How to view the stock price reaction this time
I can understand why the market did not evaluate this earnings report without reservation, with the stock price down 8% after the earnings.
Revenue was within guidance.
FY2027 revenue guidance did not go up.
Q2 revenue guidance is also not a major acceleration.
And an 8% workforce reduction was also announced.
Looking only at this, I think it is natural that the market judged that "revenue re-acceleration is not yet visible."
On the other hand, what the market may be overlooking in the short term is the content of ARR.
This earnings report is not one that proved revenue re-acceleration.
However, the fact that non-Endpoint ARR has reached about half is quite important as a structural change of the company.
If you are looking at S, I think you should look carefully at the point that "it has not yet appeared in revenue, but the content of ARR is changing," rather than judging only by the stock price reaction.
■ The possibility that this view is wrong
There is also a possibility that this view is wrong.
The first is the possibility that Prompt Security and AI SIEM are smaller than expected.
Even if ARR is doubling, the absolute amount is not disclosed. If it is just a doubling from a small scale, it will still take time to re-accelerate the company's overall growth.
The second is the possibility that Data and AI SIEM will cut into gross margin.
While customer value is high, businesses that handle large amounts of logs and data have heavy cloud costs. The point that the non-GAAP gross margin has dropped to 77% is something that needs to be confirmed from next time onward.
The third is the possibility that the workforce reduction will cut growth power.
The company explains that it is efficiency and reallocation. However, there is a possibility that sales organization reduction or organizational restructuring will have a negative impact on net new ARR.
The fourth is the possibility that competitors will catch up with AI Security immediately.
CrowdStrike, Microsoft, and Palo Alto have strong development and sales capabilities. Even if S is ahead with Prompt Security or Purple AI, it is not yet known how long that advantage will last.
The fifth is the possibility that SBC improvement will be slow.
The SBC / Revenue ratio is improving, but it is still in the 27% range. As long as this does not go down, it is difficult to evaluate in terms of value creation per share.
■ Provisional investment judgment
With this earnings report, my view on S has improved slightly.
However, it is not enough to significantly change my investment decision.
Last time, through the Cloudflare deal, I saw the possibility that S could win in competitive comparisons.
This time, I confirmed that S's revenue structure is expanding from being Endpoint-centric to AI Security, Data, Cloud, and SOC automation.
In particular, the fact that Emerging solutions have reached half of ARR is significant.
This is not just a story about revenue composition.
It is a story about where S's moat can be built.
If it were only about endpoint defense, it would be easy to see them as just following CrowdStrike.
However, if they bundle AI usage control, security data, cloud runtime defense, and SOC automation, S has the potential to create a different playing field.
That said, it is not yet a core holding or a primary satellite candidate.
Revenue guidance has not been raised.
GAAP losses continue.
Non-GAAP gross margins are declining.
SBC remains heavy.
The absolute scale of Prompt Security and AI SIEM is also not visible.
Therefore, I believe the current S is not a 'stock to buy,' but rather an 'important watch-list stock that has become difficult to ignore when mapping out the cyber landscape.'
If you are looking at CRWD, PANW, ZS, RBRK, and NET, you should also follow S as a comparative axis.
However, to include it in my portfolio, further confirmation is needed.
What we should look at in the next earnings report is not revenue, but the quality of ARR.
■ Next Checkpoints
・Can they raise FY2027 revenue guidance?
・Can they exceed the Q2 revenue guidance of $290M?
・Will net new ARR continue to grow year-over-year?
・Will NRR for $100K+ customers stabilize at over 110%?
・Can they maintain a GRR level of 96%?
・Will the absolute ARR amount for Prompt Security, or a more concrete sense of its scale, be provided?
・Will the absolute ARR amount for AI SIEM / Data be updated?
・Will the non-Endpoint ARR ratio exceed 50% and continue to rise?
・Will non-GAAP gross margins stop falling from 77%?
・Will the increase in cloud hosting costs stop putting pressure on gross margins?
・Will the SBC / Revenue ratio clearly fall below 25%?
・Will the GAAP operating loss shrink?
・Will sales productivity and net new ARR avoid deterioration after the 8% workforce reduction?
・Will Flex deals connect to improvements in RPO, ARR, and NRR?
・Will competitor replacement deals be replicated outside of Cloudflare?
Thank you for reading to the end. If you found this helpful, I would appreciate it if you could 'like' and follow.
(Disclaimer) The content of this writing is published for the purpose of organizing and recording the author's personal decision-making, and involves hesitation, reconsideration, revision, and hypothesis updating. Furthermore, the information provided through this writing does not guarantee accuracy or the like. Therefore, as it may not necessarily be appropriate for all readers, please recognize that investing in stocks involves significant risk, and make investment decisions based on your own judgment and responsibility. This does not constitute an solicitation to invest in any financial product or individual stock, nor does it recommend any specific investment method.