SentinelOne Inc

NYSE:S

Earnings Call Analysis

SentinelOne Reports Strong Growth with Revised Revenue Guidance for FY25

SentinelOne's Q3 results reflected robust performance, achieving 28% revenue growth and a 29% increase in ARR, totaling $860 million. The addition of numerous customers with over $100,000 in ARR and a net new ARR of $54 million demonstrated reaccelerated growth. Looking ahead, FY25 revenue guidance was raised to approximately $818 million, reflecting a 32% growth, up from 31%. Additionally, Q4 revenue is projected around $222 million, reflecting 27% yearly growth. Gross margin remains strong at approximately 79%. Despite navigating a challenging macro environment, the company's innovative platform continues to gain momentum, positioning SentinelOne for sustainable future growth.

Solid Q3 Performance Highlights Strong Business Momentum

SentinelOne reported a remarkable fiscal Q3, showcasing an impressive 28% year-over-year revenue growth, bringing total revenue to $211 million. The company noted a significant increase in total Annual Recurring Revenue (ARR), rising by 29% to $860 million, underscoring robust business execution and customer engagement. Excitingly, SentinelOne saw a resurgence in net new ARR growth, hitting $54 million for the quarter, and marking a strong 4% year-over-year increase, a notable turnaround from previous results. This momentum was bolstered by adding a record number of customers generating more than $100,000 ARR, reflecting the growing market interest in their cutting-edge cybersecurity solutions.

Improved Margins and Financial Health

The company's margin profile continues to strengthen, with a gross margin of 80%, reiterating the attractive unit economics of its Singularity platform. Operating margin improved by a substantial 6 percentage points year-over-year, although it remained negative at -5%. This margin reflects onetime legal costs; excluding these, operating margin would stand at approximately -3%. Positive net income for the second consecutive quarter, alongside achieving positive free cash flow for the first time in the company's history, illustrates SentinelOne's ongoing path toward profitability.

Optimistic Updated Guidance Reflects Strong Pipeline

Due to solid growth trends and a strong pipeline, SentinelOne raised its full-year revenue guidance for fiscal year 2025 to $818 million, expecting a growth rate of 32%, up from the prior forecast of 31%. The guidance for Q4 specifically anticipates revenue of approximately $222 million, reflecting a year-over-year increase of 27%. This outlook captures the positive momentum in net new ARR, anticipated to outpace the first half of the fiscal year, highlighting the company's strategic positioning and emerging growth opportunities.

Innovative Offerings Driving Customer Engagement

SentinelOne's technological advancements are pivotal as they expand their cybersecurity offerings. The Singularity platform, a robust integration of AI capabilities across various security facets—endpoint, cloud, and identity—is recognized for its leadership in the market. Notably, the introduction of the Purple AI suite has emerged as the company's fastest-growing solution, significantly enhancing their value proposition to customers. This sophisticated platform continues to attract attention from large enterprises, aiding in converting customers from legacy solutions to modern, autonomous security systems.

Navigating a Competitive and Challenging Landscape

Despite operating in a challenging macroeconomic environment, where organizations are tightening their budgets, SentinelOne has capitalized on this challenge by emphasizing cost efficiency and operational resilience in its solutions. The ongoing rise in cyber threats drives demand for enhanced security, with the company positioned as a key player in providing effective solutions. Through strategic partnerships, such as with Lenovo and AWS, as well as expanding its footprint in the federal sector by achieving FedRAMP High certification, SentinelOne is well-equipped to grow its market presence.

Future Opportunities and Strategic Focus

As SentinelOne approaches the critical milestone of crossing $1 billion in ARR, its long-term vision remains focused on maximizing growth opportunities while maintaining financial prudence. The commitment to sustainable growth alongside improving operational efficiency is evident, with a targeted long-term goal of achieving a 20% operating margin. The continued investment in innovative solutions, alongside efforts in customer engagement, positions the company favorably for future performance as they aim for resilience amid ongoing market volatility.

Earnings Call Transcript 2025-Q3

[Operator]

Good afternoon. Thank you for attending today's SentinelOne Q3 Fiscal Year 2025 Earnings Conference Call. My name is Jaylin, and I will your moderator for today. [Operator Instructions] I'd now like to turn the conference over to our host, Doug Clark. Doug, you may proceed.

[Douglas Clark, executive]

Good afternoon, everyone, and welcome to SentinelOne's Earnings Call for the Third Quarter of Fiscal Year '25, which ended October 31, 2024. With us today are Tomer Weingarten, CEO; and Barbara Larson, CFO. Our press release and the shareholder letter were issued earlier today and are posted on the Investor Relations section of our website. This call is being broadcast live via webcast, and an audio replay will be available on our website after the call concludes.

Before we begin, I would like to remind you that during today's call, we'll be making forward-looking statements about future events and financial performance, including our guidance for the fourth fiscal quarter and full fiscal year '25 and as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our annual report on Form 10-K and our quarterly reports on Form 10-Q. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements.

Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons actual results could differ materially from those anticipated in the forward-looking statements even if new information becomes available in the future.

During this call, we will discuss non-GAAP financial measures unless otherwise stated. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our shareholder letter. These non-GAAP measures are not intended to be a substitute for our GAAP results.

Our financial outlook excludes stock-based compensation expense employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges and gains on strategic investments, which cannot be determined at this time and are, therefore, not reconciled in today's press release.

And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

[Tomer Weingarten, executive]

Good afternoon, everyone, and thank you for joining our fiscal third quarter earnings call. Our Q3 results demonstrate strong execution and business momentum. We exceeded our top line growth expectations and continue to deliver year-over-year margin improvement. Importantly, our net new ARR growth reaccelerated back to positive territory, driven by solid execution and a record number of customers with ARR of $100,000 or more. This momentum reflects a stronger competitive position and notable rise in customer interest for SentinelOne.

We continue to bolster our position as a technology leader through constant innovation. Today, Singularity is a comprehensive cybersecurity platform that delivers best-in-class security and operational resilience. Singularity unifies data capabilities and AI-powered security across endpoint cloud identity as well as third-party integrations all in one single user interface.

Enterprises are increasingly selecting SentinelOne for our ability to provide real-time autonomous security that adapts to the modern threat landscape while simplifying operations. In a world where cyber threats evolve rapidly, our platform proactive approach is designed to safeguard enterprises today and into the future.

This Singularity platform empowers customers to bring advanced AI capabilities into their entire security stack from data to operations. This ability not only sets a new standard in the market but also establishes what we believe is a foundational pillar for the future of cybersecurity, streaming enterprise-wide security data to be processed and analyzed by advanced AI algorithms and agents that drive real-time autonomous outcomes. It is clearly a more effective and efficient way to do cybersecurity. The rapid adoption of our Purple AI suite, now our fastest-growing solution, further highlights the value and innovation we bring to our customers.

Looking ahead, we're raising our full year revenue guidance. For fiscal year '25, we now expect to deliver revenue growth of 32% compared to last year, up from our prior guidance of 31% growth. Our confidence stems from a strong pipeline, successful emerging solutions and an expanding opportunity set driven by increasing customer and partner engagements. I want to thank our customers and partners for their trust and collaboration and all sentinels who worked tirelessly to protect our ways of life from cyber threats and disruption. As always, please read our shareholder letter published on the Investor Relations website, which provides more detail.

Let's review the details of our quarterly performance. In Q3, total ARR grew 29% and revenue grew 28% year-over-year. Net new ARR of $54 million increased over 20% sequentially, well above our historical third quarter seasonality. Importantly, our net new ARR growth accelerated to 4% year-over-year. This return to positive growth is a strong indication of our business momentum and improving market position. While we continue to operate in a challenging macroeconomic landscape, the strength of our Q3 performance was broad-based across geographies and platform solutions.

Once again, we delivered best-in-class gross margin of 80%. Operating margin improved by more than 6 percentage points compared to last year. And for a second consecutive quarter, we delivered positive net income. With an improving margin profile and a solid balance sheet, we have the opportunity to be dynamic and flexible, positioning ourselves for long-term share gains across diverse growth opportunities.

As I mentioned on our last earnings call, the increasing sophistication and intensity of modern cyber threats are exposing the growing shortcomings of incumbent security solutions, even so-called modern technologies are aging faster than ever. As a result, customer awareness and interest in our platform in AI-based security have risen.

We're beginning to see notable strength with new and large customer additions. In Q3, we added a record number of $100,000 plus ARR customers, which grew 24% year-over-year. Our customers with more than $1 million in ARR grew even faster. Overall, our success with large enterprises and platform adoption continues to drive higher ARR per customer, which reached a new record in Q3 as well. In parallel, we continue to maintain healthy expansion rates with our existing customer base. We continue to see substantial growth potential with our installed base over the long term.

In October, we hosted our first Investor Day at our OneCon Customer Conference. It was a terrific event with record attendance, plenty of excitement and great customer conversations. A central point of the discussions was the evolution and expansion of Singularity from an endpoint-centric solution to now one of the broadest, most performant and reliable enterprise security platforms in the market. Regardless of the size or industry, our customers benefit from our modern data analytics architecture, cutting-edge AI security models and broad coverage across endpoint, cloud identity and more.

The Singularity platform has earned prominent recognitions across the industry including being named a leader in Gartner's Magic Quadrant for Endpoint Protection for the fourth consecutive year; leading MITRE evaluations also for 4 years in a row, a clear demonstration of Singularity's undisputed security efficacy; CyberScoop Innovation Award for Purple AI, receiving SC Media's top honors for best enterprise security solution and best endpoint security solution. And just yesterday, Singularity Cloud Security was recognized as the overall winner for CRN's cloud security product of the year. These recognitions are a testament to our innovation leadership and platform differentiation.

We're delivering larger platform wins and expansions among both new and existing customers. These are powerful security and data capabilities. Each of our platform solutions delivers functionality equivalent to deploying multiple modules from competing vendors. We sell solutions, not an endless list of modules and point features.

Our platform coverage positions SentinelOne as a strategic cybersecurity partner for enterprises. Among many platform wins in Q3, a major international retailer adopted endpoint, cloud and identity security, Purple AI and threat hunting services. This broad platform deal was a multimillion-dollar expansion that doubled the ARR of the customer. In another example, a leading technology provider selected endpoint and cloud security, network visibility and AI SIEM for a multiyear and multimillion-dollar deal. Purple AI was a "must have." With the Singularity platform, we help enterprises seamlessly aggregate data and leverage industry-leading AI.

We continue to see outsized growth from our cloud, data and AI solutions. At OneCon, we detailed the rising scale and opportunity with cloud and data, exceeding $100 million and $70 million in ARR, respectively. These solutions continue to drive premium growth for our business and represent unbounded opportunities in massive target markets.

As one of our newer capabilities, Purple AI remains a true source of platform depreciation and growth. The market response and interest in Purple has been extremely positive. In Q3, the attach rate of Purple AI across all eligible endpoints doubled compared to Q2. Purple is one of the fastest-growing solutions in SentinelOne's history and will continue to drive meaningful growth into the future.

GenAI for security use cases is a force multiplier for security analysts. Customers using Purple AI enjoy real gains in productivity to streamline workflows and more automation. And Purple is continuously getting better. We recently announced auto alert triage, threat hunting and investigation capabilities. We're giving security analysts the tools they need to manage hundreds and thousands of alerts in just minutes, giving them the upper hand against threats. Importantly, we are committed to ensuring that our AI capabilities are used ethically, safely and securely. Our AI models provide transparency and ensure that customers maintain complete control of their data within our platform, keeping sensitive information in the hands of its rightful owners.

Also at OneCon, we introduced AI SIEM, a foundation for real-time autonomous cybersecurity for the future. AI SIEM is so much more than just next-gen SIEM. By ingesting and synthesizing data from across the security ecosystem, our AI SIEM provides full visibility, real-time detection and streaming data, exciting investigation, and autonomous responses. We're empowering enterprises to supercharge security operations and fight AI with AI.

Our technology and vision are resonating with customers and partners. As an example, a major federal agency selected both endpoint and AI SIEM for unified threat visibility in a single platform, proactive threat hunting and automated rollback capabilities. We're also seeing MSSPs expand their platform adoption with emerging solutions like Purple AI and Singularity Data Lake to reduce costs and improve visibility and security for their customer base.

In addition to Purple AI, we're pairing AI SIEM with our recently announced hyper-automation capabilities. SentinelOne is bringing more automation use cases with next-gen SOAR and making it faster and easier to use, all without code. It's unlike any other data or SIEM solution on the market and will further unlock the legacy SIEM opportunity.

In Cloud Security, we continue to see strong adoption of our leading cloud workload protection solution and the combination of agent-based and agentless capabilities offers a comprehensive approach to securing the cloud. Building on our industry-leading CNAPP capabilities, we recently announced AI Security Posture Management to protect and secure the use of GenAI services in the workplace. Singularity AI-SPM gives enterprises visibility into AI services, detecting misconfigurations and vulnerabilities in AI applications and determining potential attack paths. AI-SPM was designed from the ground up to safeguard AI models and pipelines deployed on managed AI services such as Amazon SageMaker, Amazon Bedrock, Azure OpenAI and Google Vertex AI. We're enabling enterprises to securely adopt modern AI technologies. SentinelOne customers can confidently embrace AI transformative benefits and competitive advantages while protecting and securing AI data and applications.

Rounding out the discussion of our platform, endpoint remains a cornerstone of enterprise security and a key driver of our business. In light of the unprecedented IT outage on July 19, enterprises are distinctly more focused on the combination of security performance and reliability. We're engaging with an increasing number of large enterprises. Many of them are getting a chance to evaluate and experience our technology and platform breadth for the first time, and they're pleased with what they're seeing.

As a result, we achieved a record number of customer wins against our closest competitor in Q3, more opportunities equating to more wins. In one example, a Fortune 50 company switched to SentinelOne due to the superior platform architecture and efficacy, integration capabilities and productivity enhancements with Purple AI. We also had a number of federal and local government entities switch to SentinelOne after testing our platform against their existing solution. In all of those evaluations, they found the Singularity platform was easier to use and improved their security posture. Many of these customers are already considering enhancing their performance and experience with Singularity Data Lake and Purple AI, which are unique capabilities absent from other alternatives.

Taking a step back, the shortcomings of incumbent solutions are becoming more apparent than ever before. Siloed solutions, close platform architectures and human-dependent security solutions simply cannot keep pace with modern threats. We had one customer that utilized SentinelOne to protect servers and Microsoft for endpoints. After endpoints covered by Microsoft Defender were breached twice in just the past 12 months, this customer turned to SentinelOne for incidence response and recovery and ultimately, decided to secure their endpoint footprint with SentinelOne as well.

Overall, there is more awareness, consideration and interest in SentinelOne than ever before. We're now engaging in opportunities that weren't available to us in the past. This includes some of the largest financial institutions in the world and other strategic opportunities as well as more channel engagements. This will play out in quarters and years to come, as enterprises evaluate, test and come to renew their incumbent solutions over time.

The road is open. To maximize our long-term success and scale, we're strategically expanding our market presence. Let me provide a few examples. First, we partnered with Lenovo, the world's largest PC manufacturer. Together, Lenovo will bundle the Singularity platform and Purple AI on new enterprise PC shipments to enhance security and autonomous protection to millions of endpoints across the world in the coming years. The agreement showcases how SentinelOne can truly partner and not compete with other industry participants. We believe partnering with OEMs like Lenovo can drastically increase the reach and scale of Singularity.

Second, we're expanding our presence in the federal arena, and we recently achieved FedRAMP High for both endpoint security and AI-SIEM. Going through rigorous testing over multiple years, this designation is a testament of our performance and ability to meet the most demanding security requirements.

Third, we've expanded our partnership with AWS. AWS customers that choose SentinelOne can now run Purple AI on Amazon Bedrock. We will continue to deepen our relationship with Amazon, enabling customers to choose and deploy Singularity to one of the largest cloud providers in the world.

Finally, as I mentioned earlier, we're enabling our MSSP partners to adopt more of the Singularity platform, like Singularity Data Lake and Purple AI. This helps them improve efficiency, enhance security and expand their business potential. We also recently launched our suite of agentless CNAPP solutions for MSSPs, including CSPM, CIEM and more.

All in all, our improving execution, expanding market presence and leading platform capabilities are driving more customer engagement and interest in SentinelOne than ever before. It's on us to execute well and convert these tailwinds into customer wins over time. We're working hand-in-hand with customers and partners to test, trial and deploy the Singularity platform. We're focused on building long-lasting relationships and enduring security infrastructure, helping organizations stay ahead of the evolving threat landscape.

Security solutions are strategic and mission critical for enterprises. We're constantly innovating in building intelligent autonomous cybersecurity for the future. Just this week, we were named to Fortune's Future 50 list, recognized as a company most likely to adapt, drive and grow. We have the right strategy, people and technology. I'm encouraged by the growth and momentum we delivered in Q3. While early, the investments we're making in expanding our market presence and mine share are fueling one of the highest growth rates in all of software. In this quarter alone, we achieved record contributions across Platform Solutions, returned to positive new business growth and continued expanding margins. We are positioning the company for long-term share gains across diverse growth opportunities.

With that, I would like to welcome and turn the call over to Barbara Larson, our Chief Financial Officer.

[Barbara Larson, executive]

Thank you, Tomer, and thanks to everyone for joining us today. I'm thrilled to be here. Stepping into this role has been an exciting journey, and it's a privilege to work alongside an incredible team dedicated to transforming cybersecurity. Over the past couple of months, I focused my time on listening, learning and exploring SentinelOne's unique strengths and opportunities.

Our mission is to secure the future through cutting-edge technology. From a financial perspective, we're committed to delivering consistent value and building on the strong foundation already in place. I see clear potential for long-term growth, scale and operating leverage.

Now let's review the details of our third quarter financial performance and our guidance for Q4 and fiscal year '25. As a reminder, all comparisons are year-over-year and financial measures discussed here are non-GAAP unless otherwise noted. We exceeded our third quarter revenue and ARR growth expectations. Revenue increased 28% to $211 million in the quarter with strong momentum across all geographies. Revenue from international markets also grew 28% and represented 37% of our quarterly revenue.

In Q3, our total ARR grew 29% to $860 million. Net new ARR of $54 million exceeded our expectations and grew 22% sequentially, significantly outpacing our historical Q3 seasonality. Our Q3 net new ARR increased by 4% year-over-year, reflecting a 14 percentage point improvement from the growth rate in Q2. This reacceleration of new business growth marks a return to positive growth and demonstrates that we are well positioned to deliver stronger net new ARR growth in the second half of the year compared to the first half.

This quarter, we added a record number of customers with ARR of $100,000 or more. This reflects our team's strong execution and improved competitive position and broad adoption of our platform solutions. The growth of our emerging solutions and success with large enterprises continues to drive higher ARR per customer, which increased by a double-digit percentage year-over-year and to a new high in Q3. Consistent with prior quarters, we continue to maintain healthy expansion rates across our existing customer base.

Beyond top line growth, our Q3 gross margin of 80% highlights the strong unit economics of our Singularity platform and disciplined pricing. In Q3, our operating margin was negative 5%, reflecting a 6 percentage point improvement compared to the last year. In Q3, we incurred onetime legal settlement costs and legal fees that are included in our non-GAAP financials. Excluding these onetime expenses, our operating margin would have been approximately negative 3%, consistent with our Q3 guidance.

For the second consecutive quarter, we delivered positive net income. We also achieved positive free cash flow on a trailing 12-month basis for the first time in company history. Importantly, we're on track to achieve positive free cash flow for fiscal year '25. Our steady progress towards sustained profitability is driven by increasing scale, improved operational efficiencies and disciplined cost management.

Overall, we've significantly improved our margin and cash flow profile. At the same time, we are strategically investing to expand our market presence and position ourselves for durable growth. These investments are already yielding early results, including increased adoption of our new platform solutions, record wins against our closest competitor and reacceleration of new business growth. Our unit economics and financial position remains strong with more than $1 billion in cash, cash equivalents and investments and no debt.

Moving to our guidance for Q4 and fiscal year '25. Given strong net new ARR in Q3 and solid business momentum, we're raising our full year revenue guidance. We now expect full year revenue of approximately $818 million and growth of 32%, an increase from our prior guidance of $815 million and 31% growth. For Q4, we expect revenue of approximately $222 million, reflecting a year-over-year increase of 27%. We continue to expect stronger net new ARR growth in the second half of fiscal '25 compared to the first half. This outlook is supported by positive trends in new customer acquisition, a healthy pipeline, a solid competitive position and increasing momentum with our data, cloud and AI solutions.

It's also important to note that we're still navigating a challenging macroeconomic environment. Organizations continue to focus on cost and efficiency, and we expect these dynamics to continue. At the same time, the threat landscape remains intense, with frequent headlines about new breaches and evolving cyber threats.

Now turning to the outlook for margins. For the full year, we continue to expect gross margin of approximately 79%, reflecting an improvement of over 150 basis points compared to last year. In Q4, gross margin is also expected to be approximately 79%, an increase of about 100 basis points year-over-year.

For fiscal year '25, we expect operating margin of approximately negative 4%, consistent with the midpoint of our prior guidance and reflecting an improvement of about 15 percentage points compared to fiscal year '24. In Q4, we expect operating margin to be about negative 3%, and an improvement of approximately 6 percentage points year-over-year and an increase of 2 percentage points sequentially.

Reflecting on my past few months. It's clear we built a solid foundation to take SentinelOne to new heights from an industry-leading AI security platform to a diverse customer base and robust partner ecosystem. I'm constantly impressed by our talented teams and their dedication to SentinelOne's success.

We're nearing the milestone of crossing $1 billion in ARR, a significant achievement for any company. As we expand our reach and strengthen our market presence, SentinelOne is well positioned to protect millions more endpoints and secure tens of thousands of additional businesses across the globe. We remain committed to delivering ongoing leverage in the business as we execute our growth strategy. Our investment approach strikes a thoughtful balance between maximizing long-term growth opportunities and maintaining a strong, responsible and profitable financial profile, a strategy that's key to scaling SentinelOne to a multibillion-dollar business.

At the same time, we're instilling operational discipline by identifying ways to enhance efficiency and productivity. Ultimately, our goal is sustainable growth while progressing toward our long-term target of achieving a 20% operating margin over time. One thing remains certain. Our unwavering focus on customers, partners and security has always been and will continue to be the backbone of our success.

I'm incredibly proud of the dedication shown by our team and the progress we've made so far. While we've already accomplished a great deal, I'm confident that even greater opportunities lie ahead. Thank you for joining us today. I look forward to connecting with our analysts, shareholders and the broader investment community in the days and months to come.

With that, we'll now take questions. Operator, please open up the line.

[Operator]

[Operator Instructions] Our first question comes from Brad Zelnick with the company Deutsche Bank.

[Brad Zelnick, analyst]

Great. Good to see the ARR momentum continue to build. Tomer, over the last few months, you've been very clear that the benefits you're seeing from market disruption and many of the newer growth levers and execution improvements wouldn't all show up immediately in your financials. And the trend is clearly positive from what we can see in Q3 results. But what is it that you see in terms of pipeline and the visibility that you have ahead that gives you confidence in acceleration? And then for Barbara, how does that inform how you might be thinking about next year at this point?

[Tomer Weingarten, executive]

Well, clearly, the July outage added to the strong momentum we're already experiencing. So we're starting to see the benefits and that includes more customer opportunities, record pipeline. And we're still maintaining the same strong win rates, so that will translate over time. In Q3 alone, we've had a record number of wins against our closest competitor. We've added a record number of $100,000 plus customers. Our endpoint growth actually accelerated in Q3.

So it really indicates the opportunity is improving not only across our growth lever with emerging products but really within our core market of endpoint. I mean the momentum on all these fronts drove some incremental upside to the ARR in the quarter, and we believe that's going to continue. Broadly, enterprise is paying more attention to security performance and operational resilience, so I think SentinelOne is proving to be the superior platform offering.

It is resulting in more consideration for SentinelOne. It is resulting in bigger deals in the pipeline. It is resulting in just more engagements, and it's on us to translate these engagements. It's very encouraging. The type of customers that we're seeing, the industries that we're serving, the ability to have these conversations, as we mentioned in the prepared remarks, these are conversations we have not had before. So this will be positive for us. It continues to be something we unlock and it's going to translate in the quarters and years to come.

[Barbara Larson, executive]

And then, Brad, just in terms of FY '26, it's too early to discuss next year's forecast right now. Our focus is really on executing, innovating and maximizing the opportunity that we have in front of us. But clearly, we are pleased to see the net new ARR reaccelerate in Q3 and deliver a stronger year-over-year growth in the second half compared to the first half.

[Operator]

The next question comes from Gray Powell with the company BTIG.

[Gray Powell, analyst]

Great. And yes, I'll echo Brad's comments. It's great to see the net new ARR get back into positive territory. Just in terms of seasonality, maybe I missed this, but what was it that actually drove the stronger quarter-over-quarter growth in Q3 this year that was different than prior years? And then just like how should we think about the sustainability of whatever that driver was?

[Tomer Weingarten, executive]

It's a combination of 2 main factors, I'd say. One is just the leverage we're seeing with our emerging products. So I think you're seeing more capabilities for us come online, whether it's Purple AI with double the attach rate from past quarters. So that's significant. Cloud continues to grow. Data is coming up online. These are all relatively new capabilities for us. So as they come online, we expect bigger lands, we expect bigger deals, and we see that evidence in our pipeline.

It was the case going into Q3. And obviously, the other factor is just the July '19 outage. Some of the upside that you're seeing is definitely coming from these customer migrations. We've had more large enterprise displacements than we ever had in the past. So those 2, I think, just drove into a very different type of seasonality that we've seen from Q2 to Q3. And we believe that trend will continue. We believe, according to the pipeline, that we're seeing that this is something that is sustainable. We will need to translate that. I will repeat that. But in terms of the pipeline, it's there and it's for us to work.

[Operator]

Our next question comes from Rob Owens with the company Piper Sandler.

[Robbie Owens, analyst]

Yes. Great. Curious about what you're seeing up market and the success with larger customers and larger deals just from, I guess, a macro perspective, number one. And then the motion is you're selling the multiple elements of the platform and where you're seeing the most success there.

[Tomer Weingarten, executive]

Our playbook is definitely evolving. We're landing more with the entire platform or more components of the platform than a single capability than ever before. And I think that is something that is relatively new for us. I think we've always had that motion of upselling and cross-selling and attaching more. But now it's really clear we're just landing with more. We're covering more, and that's incredibly important.

The dialogue with the largest enterprises out there is also very encouraging. You see that evidenced by the average deal sizes that are on the rise. You see that with a record number of $100,000 and $1 million customers. So our ability to now cater to that higher end of the enterprise, which I believe is gradually being unlocked away from some of these incumbents that were relatively dominant in that part of the market in the past, is going to translate to more presence for SentinelOne in the Fortune 500, in the Fortune 100.

The other capability that we have, which is AI SIEM or the data analytics capability we have, is one that is actually a capability that thrives when the macro is what the macro is. And I would not say that customers have stopped scrutinizing. I would not say that customers are not very budget oriented, but that actually translates into a very good fit to what our data analytics and data solutions can provide given the immense cost savings that we can create for some of these customers.

And obviously, cyber threats are not going away. So the need for best-of-breed security is structurally there. So those 2 things combined, even in this macro, which I still think is relatively on par with what we've seen in the past couple of years, it bodes well to our market motion.

[Operator]

Our next question comes from Saket Kalia with the company Barclays.

[Saket Kalia, analyst]

Barbara, maybe just to start with you, Tomer talked about broadening the market presence with the Lenovo partnership. And it sounds really interesting. Maybe the question is how do you think about Lenovo contributing to net new ARR. Specifically, when does that sort of kick in? And is this going to be something that ebbs and flows with Lenovo shipments sort of on a quarterly basis? Or talk to us about sort of how that layers into the model going forward.

[Barbara Larson, executive]

Sure. Thanks so much for the question. In terms of Lenovo, it is a multiyear agreement. We're in the early innings. We're really excited about its long-term potential. This is a strategic partnership. It's designed to evolve over time. We're working closely with Lenovo to activate multiple routes to market. That includes pre-installations as well as managed security offerings.

It also builds on the fact that we have an existing reseller agreement today. So we're really extending, deepening our collaboration, and we expect the contribution to pick up in the latter part of next year in terms of revenue as Lenovo starts to ship pre-installed units and as we ramp up co-sell through all of our regions. So I'm not going to talk to specifics on deal and ARR, but that's how we're thinking about it in terms of the contribution to revenue, latter half of next year.

[Operator]

Our next question comes from Shaul Eyal with the company TD Cowen.

[Shaul Eyal, analyst]

Tomer, Barbara, so I know you slightly raised your annual guidance. I know you guys do not guide or discuss RPO metrics. It was up, I believe, 24% year-over-year, which I think would imply maybe a deceleration from last year and think just a 4% sequential growth. Can you talk to us about RPO trends maybe your thoughts on pricing and contract duration?

[Barbara Larson, executive]

Sure. Great. I'll take that. So for RPO in Q3, we delivered strong year-over-year growth of 25%. So that's relatively in line with our total ARR growth. Just to keep in mind, in Q3 of last year, we signed several large long-term contracts, including with several of our MSSPs, making this a more difficult year-over-year comparison. So our preferred metric is ARR, as RPO can be impacted by contract duration and ARR removes that variability.

[Tomer Weingarten, executive]

And just in terms of pricing, I think the ability to sell a full platform right now really changes how you think about pricing. There's no longer a specific price point in the market. Our prices have held steady. You see that reflected in our gross margin, which is definitely best of breed in the market. We're seeing, and I think for the past few years, I've always seen a player or a number of players just go heavy on discounts, so I don't think there's anything too out of the ordinary in the way that this market has evolved over the years.

I don't think there's anything too different right now. There's definitely more discounting by vendors who are maybe a bit more mindful of the need to preserve their customers and be using deep discounts in order to do that. We, on the other hand, have always been flexible, transparent with our pricing, and we continue to be that way. It doesn't stop us from making deals, and in many cases, especially in the markets that we play in, price is not the dominant factor. And we always are incredibly focused on the value that we bring and the cost savings that we can extract.

So all in all, we're focused on maintaining our pricing. It hasn't changed. Gross margin is very high. And it's just the realities of the cybersecurity market when it comes down to the different discounting by different vendors.

[Operator]

Our next question comes from Tal Liani with the company Bank of America.

[Tal Liani, analyst]

How important is vendor financing in the market now? I'm asking it because we've seen Palo Alto doing it very aggressively. Now we're seeing CrowdStrike starting it. Is this something that is required? Or do you see higher requirement by customers? And the second question is just clarification. You noted a few times that you expect a strong net new ARR for 4Q. Is there any number that you have in mind or any growth you have in mind for a net new ARR for 4Q?

[Tomer Weingarten, executive]

As for financing, we don't think that it's something that is showing any outside demand right now. Financing has been always very apparent in this space, typically done by channel partners. A lot of our channel partners are helping financing customers. We do it every now and then. I do believe that the focus for every cybersecurity vendor needs to be on the current capabilities that customers need today. A lot of these financing commitment deals that you're seeing out there are really dealing with futures. They're really aiming toward the future possible consumption of capabilities that may or may not happen.

For SentinelOne, we're very focused on giving customers what they need right now. If customers require any sort of financing, which I've not seen any uptick of, we typically work with a set of partners that can facilitate that. So all in all, as long as you're flexible, as long as you're working with the customer desired ramp, I think there is no need to do anything out of the ordinary.

As for net new ARR, we still maintain that we have great momentum. We still maintain that, for the second half of the year, we are going to be growth positive. So all in all, that's what I can share on net new ARR for Q4.

[Operator]

The next question comes from Brian Essex with the company JPMorgan.

[Brian Essex, analyst]

Great to see the reacceleration on ARR. I have 2 questions. I guess first one for Tomer. You've talked previously about a focus on new logo adds over expansion within the installed base. But maybe if you could help us understand where are you keeping your foot off the gas, so to speak, with regard to investing in expansion within the installed base where there's cross-sell, upsell and how you think about prioritization or what you're holding back on as you invest in new logo growth.

And maybe the follow-up for Barbara, with regard to just the onetime legal settlement costs in the non-GAAP financials, maybe expand on that a little bit. Help us understand what they're for and maybe why those [ went back out of the ] non-GAAP.

[Tomer Weingarten, executive]

Sure. We're not really holding back on anything. I just think that we're letting certain things kind of come online at their own natural time. Obviously, we still want the majority of our sellers focused on adding new accounts to our estate. So if there is one piece where we're, I would say, less focused on driving right now is that upsell and cross-sell within the customer base in, I would say, adjacent footprints. And that to us is something that will gradually start to unlock itself as we put more and more playbooks and frameworks into next year.

So expect that, at some point, becoming another growth lever for us. It's very clear that our customer estate is underpenetrated with our adjacent solutions, especially if you look at our core endpoint estate, and that represents an opportunity. It represents an opportunity not only for end customers but also for MSSP partners, OEM partners. Many partners that resell our software will have the ability to expand into new markets.

But with that, as I mentioned, the focus of our sellers is going after new accounts. It's going after competitive accounts with any capability, so we don't really discriminate, I'd say, between end point or cloud or data analytics. Whatever the customer needs and whatever the account would prescribe is where we go in and where we try to usher more value. So that to us, and you see that evident in the quarter as well, has been the motion.

The dominant part of ARR is coming from new accounts. It's what we want to see, but we are gradually starting to balance that with our desire to also become more efficient with our go-to-market motion. And obviously, selling into your own customer estate is a more efficient go to market. So those 2 things will start showing more impact in the next couple of years.

[Barbara Larson, executive]

And with regards to Q3 operating margin, as I noted in my prepared remarks, this was impacted by onetime legal settlement costs and legal fees of a few million dollars. Excluding these, our margin would have been negative 3%, so in line with our Q3 guidance. These legal costs were associated with past M&A activity. And during the quarter, we proactively made the decision to settle in order to avoid lengthy litigation and also minimize the overall legal costs going forward.

[Operator]

Our next question comes from Joe Gallo with the company, Jefferies.

[Joseph Gallo, analyst]

Barbara, I know you're not giving guidance for next year yet. But can you just walk us through any changes to process you brought to SentinelOne or just your guidance methodology as a whole as we start to fine-tune our models for next year? And then as a part of that, Tomer, how are customers thinking about their calendar '25 budgets?

[Barbara Larson, executive]

Yes. Sure, in terms of our guidance philosophy, I would just say, overall, it's to set clear and reasonable expectations that reflect the potential we see in the business, and we based that guidance on what we have line of sight to and what's in our control, things like pipeline activity, contributions from new products and anticipated conversion and win rates.

[Tomer Weingarten, executive]

And when we look at budgets, I think what customers are currently focused on is still very much cost savings. And I think that if you look at most prominent cybersecurity platform providers, it's very clear that it's not only about expanding their presence. It's also about creating cost synergies. Customers are looking for capabilities to fend off AI-based threats, which is a complete new threat vector from the past couple of years.

Those capabilities are becoming mandatory. So customers are looking to invest into solutions that can not only fend off these threats but really modernize infrastructure as they think about the speed of response and the need to become more resilient, more robust and fend off any type of disruption.

So all in all, I would say customers are looking at spending much like they looked at it in the past couple of years. I think there is more emphasis on the ability for certain vendors and certain technologies to actually create cost savings. And that's where we're also focused, where we believe a cloud-native solution set can create significant synergies versus some of the incumbent solutions that you have today, whether on-premise or converted into the cloud. They cannot perform as well as cloud native capabilities.

[Operator]

The next question comes from Matt Dezort with the company Needham & Company.

[Matt Dezort, analyst]

Congrats on the results. Tomer, for you, I think you talked about more enterprise displacements than ever in the past this quarter. Can you talk about whether pipeline supports continued momentum there, maybe how pricing and discounting are behaving specifically in those conversations? And then on the flip side of that, how are you seeing your ability to win change, if at all, since July 19 in the 50% of the market that is still leveraging legacy AV?

[Tomer Weingarten, executive]

I mean we fully believe that the pipeline supports the continued upwards trends into enterprise market. There is no question that some of the dialogues that we're having are of a different magnitude of the dialogues we've been having in the past. I think that pricing for us has always been our strong suit. I think we were always able to play almost at any price point. And specifically around endpoint protection, it's not an issue for us to match anybody in the market. It never has been. And you still see us operate throughout the years at around the 79% to 80% gross margin, which is obviously best of breed.

So as we look into next year, we're going to continue to be aggressive. We're going to continue to sustain our gross margin, and we're going to continue having our average contract size be on the rise. I mean, for us, that has been, and we've talked about it, that has been a point of focus. And we believe next year could be quite transformative in that regard. We mentioned in the prepared remarks some of the largest financial institutions, some of the largest companies in the world are looking for ways to address some of the shortcomings that they see with other platforms. I think they look at SentinelOne, they see a technology leader. Leading MITRE for 4 years in a row is no easy feat. And I think you're going to see that carry on into the future.

So it's not only about pricing. It's not only about the July 19 outage. It's about crystallizing the technology leadership that SentinelOne has, especially as it pertains to AI capabilities, and you see that evidenced both in the acceleration with endpoint protection market share and both with the attach with Purple AI. These are obviously pointing you in a certain direction of where we're seeing the most traction.

[Operator]

Our next question comes from Shrenik Kothari with the company Baird.

[Shrenik Kothari, analyst]

Great. Again, great execution on the net new ARR. Tomer as well as Barbara, mentioned ARR per customer, of course, hit a new high this quarter driven, of course, by success in large enterprise and highlighted cross-sell, upsell. Could you help unpack how perhaps macro factors like the constrained IT budgets and also the outage dynamic kind of influences sales cycles? Is there a dynamic of potentially larger deals affecting sales cycles getting a bit longer? Then I have a quick follow-up here.

[Tomer Weingarten, executive]

I think largely, the macro factors are relatively similar. I don't think there's any meaningful or material change in the macro factors or how customers are thinking about those. I also would encourage everybody to kind of think about the July 19 outage as just another factor. I mean it's not what's driving business for SentinelOne. SentinelOne's momentum is what's driving the business. The technology we have is what's driving the business. I think this is just more just more consideration that, that results in.

The conversations we're having are ones that allow us to showcase our technology first and foremost. And I think that's the most important part. And as customers see what we can bring to the table, I think this is where you're starting to feel more at ease to move away from their incumbent solutions.

Now to your point, larger deals do mean larger and longer sales cycles. And that, I think, is what we're looking at. This is not a new phenomenon for us. I mean we have been doing large deals in the past. We're just seeing more and more of those. But we're balancing all of those, I think, with the growth of the business. We're balancing all of those with our wins at any part of this market. So all in all, to me, this is a complete net positive for us. And while sales cycles will take time, we will translate those, and we will consider those. One of the most strategic elements of our plan going into next year is obviously it accelerates and catapults our position in the large enterprise market.

[Operator]

Our next question comes from John DiFucci with the company Guggenheim.

[John DiFucci, analyst]

Tomer, on that point, yes, it does take time, right? There's sales cycles and especially for the enterprise. But for the SMB and the mid-market, you talked a lot about the enterprise. Those sales cycles are a lot shorter. Now the results this quarter indicate improving momentum for the business. Obviously there's some investors, I guess, might have expected a little more, but it does indicate that. How -- Can you comment on how the SMB/mid-market performed this quarter?

[Tomer Weingarten, executive]

Yes. It's performing well. I mean I think that we're definitely seeing even increased momentum there. I think we're seeing our MSSP partners continue to grow in a very strong way. So I think it does contribute all across the board. I can't, I would say, pinpoint exactly what is outage-driven versus our own innate momentum. But at the end of the day, we are seeing benefits pretty much everywhere. I mean, both geographically and across the different verticals in the market, whether we want to see less or more, I think we always want to see more.

But as I mentioned, our focus is really on extracting more in the enterprise. The MSSP ecosystem for us is one that's more self-driven. The same goes for kind of the SMB dynamics that we're seeing. But even there, I think we're just seeing better win rates and some acceleration. Again, endpoint is one of these very, I would say, core established markets. So when you see an acceleration in that market specifically, 10 years into this journey, I mean, that's very, very encouraging.

[Operator]

Our next question comes from Trevor Walsh with the company Citizens JMP.

[Trevor Walsh, analyst]

Maybe, Tomer, just following up a little bit on the MSSP portion of your comments that you made just a second ago. In the shareholder letter, you talked about kind of expanding the potential of products within the MSSP, specifically around CNAPP. Is there a reason or kind of can you help us understand maybe a little bit more detail as to kind of why it's a more gradual release of products within that space, if it's more just not wanting those partners to get too over their skis in terms of the technical requirements and enablement or some other kind of limiting factor and why not just, I guess, let them go kind of more just broadly all at once on the platform? Just help us kind of understand those dynamics. That would be great.

[Tomer Weingarten, executive]

Of course. It's honestly, I mean, more in our hands. We just need to enable them more. We also need to make sure that these products adhere to that multi-tenanted approach that we've had over years in kind of the endpoint market. So we're adapting certain elements of our playbook, certain elements of our training to make sure that our products are the right fit for that part of the market. I mean, arguably, not every capability that we have is as prevalent in that segment of the market as endpoint was and is.

So it's really about making sure that we give customers, the end customers and obviously, the partners themselves the capabilities that they need, but it's on us to enable them. It's on us to help them articulate the value proposition for these types of customers, and it will happen over time. We have expanded our MSSP team just this past quarter in a pretty significant way, and we're now working to extract more both from our data lake technology in the MSSP market as well as Purple AI. Both of those, we believe, are the best fit for that part of the market, even above and beyond, let's say, CNAPP capabilities.

So it's really about what you feel is going to generate the most traction in that segment of the market, which is obviously a bit different than selling to a large enterprise. Obviously the amount of workloads they have is different. The amount of staff they have is different. The amount of automation they require is different. So all of those, we are adjusting. We're making sure that we have the best fit possible in these markets, and then we will continue to enable these partners to succeed.

[Operator]

At this time, I would like to pass the conference back over to our hosting team for closing remarks.

[Tomer Weingarten, executive]

Thank you, everybody, for joining us today.

[Operator]

That will conclude today's conference call. Thank you for your participation, and enjoy the rest of your day.