SentinelOne Stock: A High-Risk, High-Reward Opportunity For Aggressive Investors (NYSE:S)

SentinelOne (NYSE:S) is an up-and-coming company that uses data, sophisticated analytics, and artificial intelligence (“AI”) to protect an organization’s digital assets against hackers and other bad actors on the internet. Since using the internet has become indispensable to how organizations conduct business in the modern era, especially as more management teams transform their companies digitally, having a quality cybersecurity platform has become a massive need. Companies can’t afford many of the repercussions of data breaches or the interruption of services for their digital assets or information technology (“IT”) infrastructure. According to Statista:

As of 2023, the average cost of a data breach in the United States amounted to 9.48 million U.S. dollars, up from 9.44 million U.S. dollars in the previous year. The global average cost per data breach was 4.45 million U.S. dollars in 2023.

SentinelOne is one of the most rapidly growing players in a large market with secular tailwinds for further growth. The company’s FY 2024 10-K stated, “Our revenue was $621.2 million, $422.2 million, and $204.8 million for fiscal 2024, 2023, and 2022, respectively, representing year-over-year growth of 47% and 106%, respectively.” However, despite the company’s rapid revenue growth, the stock price has gained little traction. The chart below shows that the stock is down almost 20% as of April 10, 2024.

This article will discuss the company’s services, explain its differences and similarities to one of its main competitors, discuss its competitive advantages, explain why the stock price has yet to gain much traction, discuss a few risks, its valuation, and why aggressive growth investors willing to speculate should consider buying the stock.

What the company does

SentinelOne’s platform protects the IT infrastructure of its customers, which includes servers, desktops, laptops, tablets, smartphones, Internet of Things (“IoT”) devices, network security, containers, cloud applications, virtual machines, user activity logs, and more. In cybersecurity, the technical word for the company’s services is Extended Detection and Response (“XDR”). The company claims in its FY 2024 10-K that it was one of the first companies with an AI-enabled XDR platform:

We pioneered the world’s first purpose-built AI-powered Extended Detection and Response (XDR) platform to make cybersecurity defense truly autonomous, from the endpoint and beyond. By leveraging AI and our fully unified security data lake for analytics, our Singularity Platform instantly defends against cyberattacks—performing at a faster speed, greater scale, and higher accuracy than otherwise possible from any single human or even a crowd.

SentinelOne’s cybersecurity strategy places an AI-based agent on each protected device or computer resource to perform two functions. The first is to look for and respond to cybersecurity threats. The second is to collect and transmit data back to a “security data lake,” or central data repository, which holds the data for deeper analysis of complex threats using the Singularity Platform’s cloud-based analytics and AI programs.

Competition from a similar company

SentinelOne has multiple cybersecurity competitors. However, I want to focus on CrowdStrike (CRWD) as a competitive factor in this portion of the article because it can be difficult to distinguish the differences between the two companies. Suppose you only lightly read how both companies describe their security platform. In that case, you might think that either SentinelOne cloned CrowdStrike’s cybersecurity business or that because CrowdStrike started its business first and introduced its platform first, it is light years ahead of SentinelOne. Both assumptions are false.

Earlier this year, I wrote an article discussing how CrowdStrike launched the Falcon Platform in 2013 to address modern-day cybersecurity threats. However, CrowdStrike designed its original Falcon platform as an Endpoint Detection and Response (“EDR”) solution, meaning that the original Falcon platform only protected the endpoint devices like laptops, desktops, and mobile devices and not areas like cloud applications or virtual machines.

The SentinelOne platform called Singularity, launched in early 2020, has some similarities to Falcon, except it was an XDR platform, meaning when it first launched, it protected more than the original Falcon platform. CrowdStrike only upgraded its platform with XDR capabilities in late 2021. SentinelOne’s press release at the time it released Singularity stated, “SentinelOne is the first security offering to expand from cloud-native yet autonomous protection to a full cybersecurity platform — with the same single codebase and deployment model — and the first to incorporate IoT and CWPP [Cloud Workload Protection Platform] into an XDR platform.” So, while CrowdStrike may have had Falcon on the market long before Singularity when SentinelOne first introduced Singularity, it initially offered more cybersecurity coverage.

There are also some fundamental differences in both platforms’ architecture. SentinelOne emphasizes using Singularity’s local agent to act far more independently or “autonomously” than CrowdStrike’s local agent. For most things, Singularity doesn’t need an internet connection to work. In contrast, CrowdStrike’s Falcon platform’s lightweight agent may have some limited offline capabilities for basic threat detection and response on the endpoint but is far more reliant on using its lightweight agent to collect data and send it to CrowdStrike’s analytics platform in the cloud to perform all the threat detection and analysis and corrective action.

The following table shows some of each platform’s advantages and disadvantages but is not a comprehensive list. SentinelOne’s website lists some more advantages of Singularity over Falcon. In contrast, CrowdStrike’s website lists more of Falcon’s advantages over Singularity.

Platform	Advantage	Disadvantage
Singularity	Rapid response. Works without an internet connection.	Resource intensive on local devices, less scalable. Hard to deploy and maintain.
Falcon	Scalable and flexible. Easy to deploy	Possible slower response times to threats. Cloud-dependent

Click to enlarge

The biggest advantage of Singularity is that it may respond much faster to threats than Falcon because it has a more active presence on a protected device with its local agent. It may take Falcon’s lightweight agent more time to send information over the internet to a cloud and receive a response. In contrast, the biggest advantage of Falcon is that its higher reliance on the cloud is far more scalable, meaning customers can more easily add additional devices to the platform without needing to install extra software or worry about resource limitations on individual devices. These differences are vital to remember because although CrowdStrike and SentinelOne are technically competitors in areas like XDR, each company’s platform may have different use cases. For instance, if a company has only a few large devices that need a security platform that can rapidly respond, that company may choose SentinelOne as the best for its needs. However, if a company has thousands of tiny devices and is constantly adding more devices, CrowdStrike may be the better option.

I included these conflicting views of SentinelOne and CrowdStrike in the article, so readers don’t automatically assume SentinelOne’s offering is simply a copycat product that CrowdStrike’s numerous competitive advantages can easily crush. SentinelOne has legitimate use cases that it is suited to address, and also has competitive advantages.

SentinelOne’s Competitive advantages

SentinelOne’s platform is very sticky, partially due to high customer satisfaction. According to Comparably, the company has a Net Promoter Score of 93, a top-of-the-line number indicating that it has very loyal customers who are willing to promote SentinelOne to others. The company has rapidly grown its customer base in around 80 countries globally.

SentinelOne sells its services to companies using a software-as-a-service (“SaaS”) business model. One of the best ways to measure the sales effectiveness of a SaaS business is through a metric called ARR (Annual Recurring Revenue), which is the revenue a company expects to generate annually from subscriptions. The company grew its FY 2024 ARR 39% over FY 2023 to $724.4 million, which is excellent growth. SentinelOne’s FY 2024 10-K attributed the ARR growth to “high growth in the number of new customers purchasing our subscriptions and to additional purchases by existing customers.” The following chart from its fourth quarter 2024 shareholder letter shows it is rapidly gaining customers that generate above $100K+ in ARR (Annual Recurring Revenue).

Customers with an ARR over $100K+ represent subscriptions from larger enterprises, which can be beneficial for subscription-based businesses for several reasons:

1. Large enterprises have more significant potential for further upside from upselling and cross-selling additional products.
2. Large enterprises are more stable than smaller businesses, which is essential in an uncertain economy.
3. ARR represents relatively predictable future revenue.

Therefore, each customer with an ARR above 100K+ means the company’s revenue streams are becoming that much more predictable. Since investors highly value predictable revenue streams, the higher the ARR, the higher the valuation the market may be willing to award a company.

SentinelOne also has high switching costs due to the time, money, and business disruption involved in removing Singularity’s agent from every device and switching to a new, unfamiliar platform. A company may also need to pay additional costs to train its security team on a new platform. So once this company gains new customers, it tends to keep them.

You can measure how sticky the platform is through its retention numbers. According to a 2021 Forbes article, SentinelOne’s gross retention rate (“GRR”) was 97% at the time of the article, meaning it only had a meager customer churn rate of 3%. However, management no longer reveals its GRR. Instead, the company highlights its net retention rate (“NRR”). The following image from its fourth quarter 2024 shareholder letter shows its NRR for each quarter over the last fiscal year

The company produced an NRR of 115% for the fourth quarter of FY 2024, meaning it retained 100% of its revenue base from the fourth quarter of FY 2023 and generated an additional 15% in revenue from those same customers through upselling, cross-selling, or price increases. SentinelOne may also benefit from a network effect and data advantages. As each new customer joins the Singularity platform, it gains more data on cyber threats and can potentially improve its ability to detect malware and hacker attempts.

The primary reason the stock trades under its Initial Public Offering price

SentinelOne has one of the fastest quarterly year-over-year revenue growth rates in the cybersecurity industry. The following chart compares its revenue growth rate to several popular companies with cybersecurity products.

However, the company lacks profitability and has negative free cash flow (“FCF”). Also, its prospects for becoming GAAP profitable and achieving positive FCF are questionable in the near term.

In a bull market where investors heavily favor SentinelOne’s top-line revenue growth and investor sentiment is “risk on,” the company’s lack of profitability and FCF may not be an issue. Unfortunately, we are in an uncertain market, and investors are more conscious of a company’s risks. Although the chart below shows that the company is in excellent financial shape in the near and medium term, with $926 million in cash and short-term investments and no long-term debt, in an environment where investor sentiment is negative towards higher risk companies, the market more often than not have avoided stocks like SentinelOne that lack profitability and produce negative cash flow.

SentinelOne’s Initial Public Offering (“IPO”) was $35 on June 30, 2021. The stock traded as high as $76.30 on November 12, 2021. Unfortunately for those who invested in the company early, inflation ran high in 2021, the Federal Reserve started boosting interest rates in March 2022, the economy became uncertain, and investor sentiment tanked. The stock now trades at $21.89 as I write this article.

Let’s investigate some of the reasons why SentinelOne has yet to achieve profitability and positive FCF.

Examining SentinelOne’s fourth quarter profitability and FCF

The chart below shows SentinelOne’s GAAP (Generally Accepted Accounting Principles) gross margins have been consistently in the high-60s to low-70s range, below many of its competitors’ gross margins.

The good news is that, historically, as SaaS businesses like SentinelOne scale their businesses, gross margins typically end up somewhere between the mid-70s and high-70s. If management can control costs and scale efficiently, GAAP gross margin expansion of at least 300 basis points (“bps”) is an ambitious but achievable goal.

The following chart highlights SentinelOne’s operating expenses. The additional good news is that management has decreased operating expenses as a percentage of revenue over the last year. However, the bad news is that it still needs to do much more to achieve profitability. The company’s spending on sales and marketing (S&M) is the prime culprit holding back profitability. Still, there will also be a need to improve spending on general and administrative (G&A) and research and development (R&D) in relation to revenue.

To give you an idea of the ballpark operating expenses as a percentage of revenue that SentinelOne will need to achieve to reach profitability, let’s look at a close competitor, CrowdStrike, which only turned GAAP profitable around this time last year. The following table compares SentinelOne’s and CrowdStrike’s operating expenses as a percentage of revenue.

Companies	S&M % of Revenue	R&D % of Revenue	G&A % of revenue
SentinelOne	58%	32%	27%
CrowdStrike	34%	25%	12%

Click to enlarge

One way SentinelOne will bring spending as a percentage of revenue down to CrowdStrike’s levels is by rapidly growing its revenue to spread more of the costs across a larger revenue base. The other way it will get there is by becoming far more efficient or, in other words, putting systems in place to do far more with fewer resources. Simple cost-cutting won’t get the job done. For instance, if SentinelOne reduced S&M spending from 58% to 34% overnight, it may negatively impact sales to the point where revenue growth would slow, disappointing the market and impeding the company’s plans to scale the business. For SentinelOne to achieve similar numbers to CrowdStrike, it will take time to scale the business, and efficiency must increase.

The following chart shows SentinelOne’s GAAP and non-GAAP losses and operating margins.

SentinelOne’s shareholder letter presents GAAP numbers alongside non-GAAP figures. Although non-GAAP numbers can show investors a company’s core profitability trends, take them with a small grain of salt, as this company’s non-GAAP numbers are heavily influenced by stock-based compensation (“SBC”), as the table below shows. The first two columns are fourth quarter FY 2024 and FY 2023 metrics, respectively, and the last two columns are full-year FY 2024 and FY 2023 metrics, respectively.

SentinelOne’s SBC is relatively high compared to a few other companies in the security industry. The following table compares SentinelOne’s SBC to a few other cybersecurity companies.

Companies	SBC as a % of revenue
SentinelOne	30.75%
Zscaler (ZS)	26.75%
CrowdStrike	20.85%
Cloudflare (NET)	20.53%
Pala Alto Networks (PANW)	13.77%
Rapid7 (RPD)	11.32%
Trend Micro (OTCPK:TMICY)	0.37%

Click to enlarge

Investors should go in eyes wide open to the fact that SBC can distort all of SentinelOne’s GAAP and non-GAAP bottom line metrics and FCF. The company’s Chief Financial Officer Dave Bernhardt said the following on the fourth quarter FY 2024 earnings call, “We remain on track to deliver both positive [quarterly] free cash flow and [non-GAAP] operating income by the end of fiscal ’25.” So, core profitability and FCF are going in the right direction. However, investors should expect GAAP profitability to take much longer to achieve, possibly as long as five more years.

Risks

Competition in the security industry is fierce, and SentinelOne faces many larger companies with longer operating histories, like CrowdStrike, Palo Alto Networks, Fortinet, and others. In addition, Microsoft (MSFT) has ambitions in the security industry with its Defender XDR product. To keep up with its competition, it may need to continue investing at high levels in R&D and S&M. Therefore, it may take longer to achieve GAAP profitability than some may forecast, or it may ultimately never achieve profitability. The company acknowledges this risk in its FY 2024 10-K (Emphasis added):

We have a history of losses, anticipate increases in our operating expenses in the future, and may not achieve or sustain profitability. If we cannot achieve and sustain profitability, our business, operating results, and financial condition will be adversely affected.

Another reason that the stock trades below its IPO price is because revenue growth has slowed significantly, and management has forecast growth to continue slowing. If the company hits management’s first-quarter FY 2025 and full-year FY 2025 revenue forecasts of $181 million and $815 million (at the midpoint), respectively, it would produce first-quarter FY 2025 quarterly revenue growth of 36% year-over-year and FY 2025 year-over-year growth of 31%. Those numbers are significant drops from last year’s revenue growth. SentinelOne generated first quarter FY 2024 revenue growth of 70% year-over-year and FY 2023 revenue growth of 47%. Rejuvenating revenue growth may be another reason the company maintains high investment levels in R&D and S&M.

Valuation

SentinelOne is a speculative company with a limited operating history that has yet to prove its business is sustainable. The company lacks current earnings or FCF to base a valuation. Although I have seen analysts forecast future earnings and FCF for SentinelOne, those forecasts have high uncertainty. It may be unwise to value this company based on those forecasts when its ability to produce sustainable earnings and FCF are up in the air. Although its cybersecurity technology has a high potential upside, investors should understand the risks of competition squeezing SentinelOne’s margins before investing.

By most traditional valuation ratios, SentinelOne looks overvalued. Seeking Alpha Quant grades the stock’s valuation as a D. The following chart compares SentinelOne’s price-to-sales (P/S) to the P/S ratios of its main competitors. It has a P/S ratio of 10.31, which is well above its sector median P/S ratio of 2.82, suggesting overvaluation.

The company has the second-lowest P/S ratio but the highest revenue growth rate. SentinelOne likely trades at a relatively low P/S ratio compared to competitors like CrowdStrike, Palo Alto Networks, and Fortinet because those companies are profitable on the GAAP net income line and generate positive FCF. Investors may have more confidence in forecasting and valuing those companies’ future earnings and FCF growth because they have displayed a track record over several years. The following chart compares each company’s net income and FCF.

The chart below shows the forward P/S ratio of each company.

I believe SentinelOne should sell at a forward P/S ratio no higher than its competitors on the chart above until it can achieve consistent FCF and make more strides toward GAAP profitability. I think SentinelOne is currently selling at the appropriate valuation. I don’t think the market will push the stock price much higher than its April 12, 2024, closing price of $21.72 until it sees more evidence that SentinelOne can continue improving its margins in the face of stiff competition.

Why it is a buy for investors willing to speculate

Digital transformation, cloud computing, edge computing, the Internet of Things, and work-from-anywhere trends should continue driving the demand for robust cybersecurity solutions. Statista projects that by the end of 2024, the cybersecurity market will reach $183.10 billion and grow to $273.60 billion by 2028. McKinsey & Company conducted a survey in 2022 suggesting that, over time, cybersecurity may develop into a $1.5 trillion to $2.0 trillion addressable market. So, cybersecurity companies could remain a key investing theme for investors over the next decade.

Suppose you are looking to invest in a cybersecurity company that has yet to experience its highest period of stock growth. In that case, SentinelOne may be an excellent choice for conducting further due diligence. Although competition may be fierce in the cybersecurity industry, there should be plenty of opportunities for SentinelOne to take advantage of without encountering competition from more prominent players like Microsoft. It has solid technology that has gained acclaim from industry analysts. For instance, in 2023, Gartner (IT) recognized the company for the third consecutive year as a leader in the “Gartner® Magic Quadrant™ for Endpoint Protection Platforms.” The company’s Chief Executive Officer Tomer Weingarten also said on the fourth quarter FY 2024 earnings call:

IDC recently named SentinelOne a leader in endpoint security for both the enterprise and mid-market. These exceptional rankings underscore the comprehensive nature of our Singularity Platform and its relevance across organizations of varying sizes and industries.

If you are an investor willing to speculate that the company can achieve GAAP profitability and positive FCF over the next several years, now may be an ideal time to buy SentinelOne. I rate the stock a buy, but only for investors who can accept the risks of investing in a company that has yet to prove that it can achieve sustainable profitability.