What is the verdict?
62/100, Selective Positive.
Reference price $21.58 (NYSE close, Friday, October 16, 2026). Market cap about $7.51B on 348.0M shares.
FY2029 targets: Bear $18 / Base $34 / Bull $52.
SentinelOne is the cheapest credible platform in endpoint security, and for once the cheapness is not a trap.
The business has crossed three thresholds the market has not fully priced. Revenue passed $1B in fiscal 2026. Fiscal 2026 was the first full year of positive non-GAAP operating profit. And more than half of ARR now comes from outside the endpoint that made its name.
The debits are just as concrete, and they are listed in full below: five years of deceleration against a re-accelerating leader, stock comp near 30% of revenue, GAAP operating margin of -31%, a skipped MITRE year, Microsoft's bundle reaching into agent security, near-total executive turnover in eight months, and a founder who pledges shares and sells but does not buy.
| Metric | Value | Metric | Value |
|---|---|---|---|
| Market cap | ~$7.51B (348.0M shares) | Cash + investments | $813M (Jul 31, 2026) |
| ARR (Q2 FY27) | $1,218M (+22%) | Pro forma cash | ~$1.9B (post-convert) |
| Revenue FY2026 | $1,001.3M (+22%) | Debt | $1.5B 0% converts due 2031 |
| Non-GAAP op margin | +3% FY26; +10% Q2 FY27 | Short interest | 5.7% of float |
| 52-week range | $11.81 - $26.50 | Consensus | Moderate Buy, target ~$24 |
What does SentinelOne sell?
One agent, one console, one data model. Five product families, most of them assembled by acquisition and now sold as a single platform.
| Family | What it does | Built on |
|---|---|---|
| Endpoint and XDR | EPP and EDR for every OS and workload, with one-click ransomware rollback | Organic (the original product) |
| Cloud Security (CNAPP) | CSPM, KSPM, runtime workload protection, CIEM, DSPM, AI-SPM | PingSafe (2024) plus organic |
| Identity (ITDR) | Credential misuse and lateral-movement detection, deception | Attivo Networks (2022, $616.5M) |
| Data and AI SIEM | No-index data lake, streaming detection, telemetry pipelines | Scalyr (2021), Observo AI (2025) |
| AI security | Purple AI copilot; Prompt Security for GenAI and agent governance | Organic plus Prompt Security (2025) |
| Services | Wayfinder managed detection and response, with Google Cloud | Vigilance lineage; relaunched Nov 2025 |
Three of those lines are already above $100M of ARR: Cloud Security ($160M+), Data ($130M+), and Wayfinder ($100M+). Non-endpoint products passed 50% of bookings in fiscal 2026.
How is it priced?
| Tier | List price per endpoint per year | Bundled EDR data retention |
|---|---|---|
| Singularity Core | $69.99 | Not stated |
| Singularity Control | $79.99 | Not stated |
| Singularity Complete | $179.99 | 14 days |
| Singularity Commercial | $229.99 | 90 days |
| Singularity Enterprise | Contact sales | 90 days |
SentinelOne Flex (2025) adds consumption licensing across modules and passed 10% of ARR within a year, the direct answer to CrowdStrike's Falcon Flex. Revenue is 61% US and 39% international. The platform holds FedRAMP High authorization, a genuine edge in federal and regulated markets.
How did we get here?
| When | Event | Why it matters |
|---|---|---|
| Jan 2013 | Founded in Israel by Tomer Weingarten and Almog Cohen | Founder-led from day one; the architecture bet dates from here |
| Jun 30, 2021 | IPO at $35 (~$9B valuation); peak $78.53 that November | Priced at the bubble top; the stock still sits ~72% below it |
| Jun 2023 | ARR methodology change (-$27M ARR) plus a guidance cut | Stock fell ~35-38% in a day, bottomed at $12.43; the credibility scar |
| Jul 2024 | CrowdStrike's global outage | A displacement window; SentinelOne won deals but no share step-change |
| Fiscal 2026 | Platform year: $1B revenue, first positive non-GAAP operating year | Non-endpoint passed 50% of bookings; ~$249M spent on Prompt and Observo |
| Oct 2026 | $1.5B zero-coupon convertible closed with a $150M buyback | Pro forma cash ~$1.9B; nothing due until 2031 |
How good is the technology?
The architectural bet
Detection must live on the device. That was the founding decision, and it still differentiates.
A static AI engine judges files before execution, replacing signatures. A behavioral engine judges activity in real time. Protection runs fully offline, with no cloud round-trip.
Storyline correlates the agent's telemetry into a single attack narrative. STAR turns that narrative into automated response rules. Patented rollback restores files to their pre-attack state.
IDC's 2026 MarketScape describes an on-device engine trained on a decade of endpoint telemetry with a cloud-hybrid behavioral layer. Third-party comparisons cite rollback and autonomous remediation as real differentiators, not marketing.
What does independent testing say?
| Evaluation | Result | Read |
|---|---|---|
| MITRE ATT&CK Enterprise 2024 | 100% detection, zero delays (vendor-reported) | The last clean headline result |
| MITRE ATT&CK Enterprise 2025 | Did not participate (Microsoft and Palo Alto also withdrew) | A gap; CrowdStrike claimed a clean sweep in the round |
| AV-Comparatives EPR 2025 | Absent from the certified list | Participation versus failure unconfirmed |
| Gartner EPP Magic Quadrant 2026 | Leader, sixth consecutive year | Consistent analyst placement |
| IDC MarketScape | Leader in XDR (2025) and modern endpoint (2026) | Independent corroboration |
| Federal authorization | FedRAMP High (endpoint, Purple AI, CNAPP, Hyperautomation) | A real barrier in regulated markets |
Why does the AI era help, and where does it bite?
Leg one: AI as the copilot
Purple AI (GA April 2024) now runs agentic auto-investigations, GA to all customers around June 2026, and governed closed-loop response since August 2026. Its open-source MCP Server connects any LLM framework to platform context.
The monetization is visible in attach rates:
| Purple AI attach on licenses sold | Period |
|---|---|
| ~30% | Q2 fiscal 2026 |
| ~40% | Q3 fiscal 2026 |
| Above 50% (record) | Q4 fiscal 2026 |
Leg two: security for AI
Prompt Security closed on September 5, 2025. The filing values the consideration at about $159.3M ($133.6M cash plus shares), against about $180M in announcement coverage.
It governs generative and agentic AI at runtime: shadow-AI discovery across 15,000+ services, prompt-injection blocking, data-leak prevention, and governance for code assistants and MCP-based agents.
Receipts: Prompt ARR more than doubled sequentially in Q4 fiscal 2026. A Fortune 100 financial firm deployed roughly 100,000 licenses. AI security ARR (Purple plus Prompt) tripled year over year, and management targets it as the next $100M ARR category.
AI-SPM extends the same logic to cloud AI services, and the August 2026 AWS expansion targets unified governance over Bedrock and AgentCore by re:Invent 2026.
Where it bites
Three honest caveats. The base is small, so tripling is easier than it sounds. CrowdStrike bought Pangea (~$260M) and Onum (~$290M) into the same lanes. And Microsoft's Agent 365, bundled in the $99 E7 tier from May 2026, threatens to make agent governance a checkbox feature.
What do the financials show?
| $M unless noted | FY2023 | FY2024 | FY2025 | FY2026 |
|---|---|---|---|---|
| Revenue | $422.2M | $621.2M | $821.5M | $1,001.3M |
| Revenue growth | +106% | +47% | +32% | +22% |
| ARR, year end | $522M | $724.4M | $920.1M | $1,119.1M |
| Non-GAAP gross margin | 72% | 77% | 79% | 79% |
| Non-GAAP operating margin | -49% | -19% | -3% | +3% |
| GAAP operating margin | -95% | -61% | -40% | -32% |
| Operating cash flow | -$193.3M | -$68.4M | +$33.7M | +$76.6M |
| SBC as % of revenue | 39% | 35% | 33% | 30% |
| Customers over $100K ARR | ~873 | 1,133 | 1,411 | 1,667 |
Two details matter inside the fiscal 2026 numbers. The GAAP net loss of -$450.7M includes a $171.0M tax provision tied to an Israeli Tax Authority agreement; the pre-tax loss was -$279.7M. And net revenue retention was last precisely disclosed at about 115% (Q4 fiscal 2024); management now offers only stable gross-retention commentary, an opacity debit as net new ARR growth flattened.
Fiscal 2027 so far
| Q1 FY2027 | Q2 FY2027 | |
|---|---|---|
| Revenue | $276.7M (+21%) | $292.0M (+21%, above guide) |
| ARR | $1,163M (+23%) | $1,218M (+22%) |
| Net new ARR | $44M (+55%, Q1 record) | $56M (+4%, Q2 record) |
| Non-GAAP operating margin | +4% | +10% (record) |
| Cash flow note | Adjusted FCF margin 22% | OCF -$6.6M in the quarter |
| Other | 8% workforce reduction announced | RPO $1.7B (+45%, record) |
Guidance: raised on operations, cut on dilution
| FY2027 guide | Mar 12, 2026 (initial) | May 28, 2026 | Aug 27, 2026 (current) |
|---|---|---|---|
| Revenue | $1.195-1.205B | $1.195-1.205B | $1.202-1.207B |
| Non-GAAP operating income | $110-120M | $115-125M | $124-128M |
| Non-GAAP EPS | $0.32-0.38 | $0.32-0.38 | $0.30-0.32 |
| Diluted shares | 352M | ~350M | 361M |
Read the EPS line carefully: operations were guided up twice while per-share guidance fell, because the share count assumption rose. That is the stock-comp machine showing up exactly where shareholders feel it.
Is the balance sheet a fortress?
Before this week: $813M of cash and investments, no debt (July 31, 2026). Then came the week's event.
| October 2026 convertible | Terms |
|---|---|
| Instrument | $1.25B of 0.00% convertible senior notes, due October 2031 |
| Greenshoe | $250M exercised in full at closing (October 16, 2026); principal $1.5B |
| Net proceeds | About $1.41B |
| Conversion price | About $31.21 (a ~30% premium to the October 13 close) |
| Capped calls | Purchased to limit dilution (cost ~$131.6-151.4M; sources conflict) |
| Concurrent buyback | About $150M for ~6.2M shares at $24.01 |
| Pro forma position | Roughly $1.9B of cash against zero-coupon debt; nothing due until 2031 |
The verdict on the fortress: the funding position is strong, but it is financed rather than earned. GAAP margins remain near -31%, quarterly operating cash flow still swings negative, and the model runs on about $300M a year of stock compensation. The pillar analysis grades it partial for exactly that reason.
How does it stack up against the competition?
| Company | Scale | Growth | Multiple | Read |
|---|---|---|---|---|
| CrowdStrike | ARR $5.84B | +26% rev; net new ARR +51% | ~32x fwd sales | 4.8x the ARR; Flex ARR $2.29B (+101%) |
| Microsoft | Security revenue ~$37B (est.) | Bundle-driven | n/a | Defender in E5; E7 adds Agent 365 |
| Palo Alto Networks | FY26 revenue $11.48B; NGS ARR $9.10B | +24.5%; NGS ARR +63% | ~26x trailing | XSIAM over $700M ARR; CyberArk closed |
| SentinelOne | ARR $1.218B | +21-22% | ~6.1x NTM sales | Cheapest of the six EPP Leaders |
The structural problem
The same six Leaders have held Gartner's endpoint quadrant since 2023. CrowdStrike and Microsoft hold an estimated 40% of endpoint spend between them. SentinelOne holds roughly 3-6%, depending on the measure.
Where it wins, where it loses
It wins heterogeneous estates (macOS, Linux, servers, OT), air-gapped and federal deployments, and buyers who want one agent with autonomous response. The Cloudflare platform switch, replacing the closest competitor across endpoint, Purple AI, and Wayfinder Elite in a seven-figure deal migrated in under 24 hours, is the named proof point (company account).
It loses where Microsoft 365 E5 is a sunk cost and Defender is good enough at zero marginal price. Its counters: a 77-79% gross margin that funds discounting, the MSSP channel, Google Cloud delivery (May 2026), and Lenovo ThinkShield distribution, which now carries Prompt Security in APAC.
Did the CrowdStrike outage change the game?
No. It produced record competitive wins and pipeline (company), and Needham's channel checks stayed positive through late 2024. But no mass exodus materialized: SentinelOne's ARR growth decelerated from +29% (Q3 fiscal 2025) to +22% (Q2 fiscal 2027) while CrowdStrike's net new ARR re-accelerated to +51%. Displacement was incremental, not transformational.
Consolidation keeps raising the bar
Google closed Wiz ($32B, March 2026). Palo Alto closed CyberArk (~$25B) and Chronosphere. CrowdStrike bought Onum, Pangea, SGNL (~$740M), and Seraphic (~$420M), each landing in a lane SentinelOne also claims. The frame that survives all of it: SentinelOne is the only independent pure-play platform at scale in the Leaders' quadrant, which is both its differentiation and its takeout thesis.
What about management and governance?
Tomer Weingarten, co-founder, CEO since 2013 and chairman since 2021, is the strategy. He is technically credible and publicly committed to independence ("as clear as I can be," September 2023, after the Wiz episode).
The delivery audit
Mixed, and improving. The June 2023 event damaged credibility for years. Since then, revenue and operating guidance have been met or raised consistently: fiscal 2026 landed exactly on its final guide, and fiscal 2027 has been raised twice. The remaining sloppiness lives in one place: dilution, which is what cut the EPS guide.
A nearly new team
| Role | Change | When |
|---|---|---|
| CFO | Dave Bernhardt stepped down; Barbara Larson (ex-Workday) appointed | Sep 2024 |
| CFO | Larson resigned after ~15 months; the print day cost the stock 14.4% | Dec 2025 |
| CFO | Sonalee Parekh (ex-Asana, RingCentral) appointed; Padgett became President and COO | Mar 2026 |
| Chief Revenue Officer | Michael Cremen (ex-Elastic, Cohesity) joined | Jun 2025 |
| Chief Product and Technology Officer | Ric Smith departed; Ana Pinczuk (director since 2022) succeeded him | Oct 2026 |
Weingarten told CRN that almost the entire executive team changed within six to eight months. Each hire is individually credible. Collectively, it is a new team carrying a show-me story.
What is it worth?
At $21.58, SentinelOne trades at about 7.4x trailing sales and 6.1x next-twelve-month sales. The peer frame:
| Company | Multiple (October 16, 2026) | Note |
|---|---|---|
| SentinelOne | ~6.1x NTM sales | Cheapest of the Leaders; its own P/S was 79.6x in 2021 and 5.1x in 2025 |
| CrowdStrike | ~32x forward sales | Premium funded by scale and ~30% FCF margins |
| Palo Alto Networks | ~26x trailing sales | NGS ARR $9.10B, growing 63% |
| Cloudflare | ~41x trailing sales | The multiple ceiling of the group |
| Fortinet | ~18x trailing sales | GAAP operating margin of 34% |
| Rubrik | ~22x trailing sales | Faster growth, near-breakeven margins |
Consensus is Moderate Buy (17 Buy, 13 Hold, 1 Sell) with an average target near $24. October actions skew positive: Baird raised to $28, Needham to $31, TD Cowen to $29, Wedbush initiated Outperform at $25. The bears anchor on deceleration (Goldman Sachs $17.50, Piper Sandler $20). Analysts model about an 18% revenue CAGR to fiscal 2029.
FY2029 scenarios
| FY2029 scenario | Revenue | Non-GAAP op margin | Exit EV/Sales | Price |
|---|---|---|---|---|
| Bear | $1.55B (~9% CAGR) | 9% | 4.5x | $18 |
| Base | $1.71B (~18-20% CAGR) | 15% | 7.5x | $34 |
| Bull | $1.94B (re-accelerating) | 19% | 10.0x | $52 |
Base case: the consensus growth path, margin to about 15% as AI SIEM and AI security scale, and a re-rating only to 7.5x, still a discount to every peer above. Bear case: bundling and platform pull decay growth below 10%; roughly $0.3B of net cash and a plausible strategic bid underpin the price. Bull case: AI security becomes a second engine, growth re-accelerates into the high 20s, and the market pays a platform multiple again.
The takeout file
Documented, and to be held loosely. Reuters reported a sale exploration in 2023 (Qatalyst); management denied the company was for sale. Calcalist reported advanced Palo Alto talks in July 2025 at an estimated $7-10B; Palo Alto's CEO then publicly denied SentinelOne was ever the target. Treat takeout as optionality, not thesis.
What do the technicals say?
The stock doubled off its April 10, 2026 low of $11.81 to $26.50 intraday in October. It then pulled back to $21.58: October 16 fell 7.66% on 17.7M shares against a ~10.7M average, a sector selloff day compounded by the convertible overhang.
Position: about 4% below the 50-day average (~$22.5), and 17-26% above the 200-day (~$17.2-18.4 by vendor). The intermediate trend is intact; the short-term trend is broken.
Returns: year to date +43.9% (from a $15.00 close on December 31, 2025), one year +29.4%, still about 72% below the 2021 high. Short interest is light at 5.7% of float. Volatility is structural: 31 moves over 5% in the past year.
Next earnings: Q3 fiscal 2027 in early December 2026 (December 2-3 cluster, not company-confirmed), against guidance of $309-311M of revenue and $0.08-0.09 of non-GAAP EPS.
What are the risks, and what should you watch?
Risks. Microsoft bundling compounding into agent security. CrowdStrike's platform economics pulling the enterprise tier. Growth decelerating through the teens, stranding the stock between holder bases. SBC and dilution capping per-share compounding. A new executive team executing a show-me story. Agent-quality or availability incidents in a category where trust is the product. The founder's pledged-share overhang.
Watch. Q3 net new ARR re-accelerating from +4%. AI security ARR progressing toward the $100M category. The AWS AI-governance GA at re:Invent 2026. MITRE participation decisions. SBC trending below ~27% of revenue. Any acquisition funded by the convertible proceeds. And the first insider open-market purchase, a signal this team has not yet sent.
Frequently asked questions
Is SentinelOne a buy at $21.58?
Our verdict is 62/100, Selective Positive. The stock is the cheapest of the Gartner endpoint Leaders at roughly 6.1x next-twelve-month sales (CrowdStrike trades near 32x forward), while ARR grows 22%, non-GAAP operating margin has inflected to +10% in Q2 fiscal 2027, and the balance sheet holds roughly $1.9B of pro forma cash after the October 2026 convertible. The case is valuation plus inflection, earned quarter by quarter against decelerating growth, not momentum.
What is SentinelOne's biggest risk?
The pincer: CrowdStrike's platform scale above (4.8x the ARR, net new ARR growing +51% to SentinelOne's +4%) and Microsoft's zero-marginal-price bundle below, now extended into agent security through the E7 tier and Agent 365. Add dilution: stock compensation runs near 30% of revenue and the share count grows about 5% a year, which already forced an EPS guidance cut in fiscal 2027 even as operating guidance rose.
How relevant is SentinelOne in the AI era?
More than its endpoint label suggests. Purple AI attach passed 50% of licenses sold in Q4 fiscal 2026, AI security ARR (Purple AI plus the acquired Prompt Security) tripled year over year, and Prompt's agent-governance products target the exact surface AI deployment creates. Management is steering AI security toward a $100M ARR category. The offset: CrowdStrike bought Pangea into the same lane, and Microsoft bundles agent governance, so the window is real but contested.
What are the FY2029 price targets?
Bear $18 (growth decays below 10%, fiscal 2029 revenue $1.55B, 4.5x exit sales), Base $34 (the consensus ~18% CAGR path to $1.71B of revenue, ~15% non-GAAP operating margin, 7.5x exit sales), Bull $52 (AI security re-accelerates growth into the high 20s, $1.94B of revenue, 10x exit sales). A strategic takeout at precedent multiples lands near the bull case; the documented 2025 Palo Alto interest was reported, then publicly denied by Palo Alto's CEO, so it is treated as optionality, not thesis.