S - SentinelOne Q3: How Fast Can It Run And How Profitable Can It Get?

2023-12-13 15:54:34 ET

Summary

• SentinelOne, Inc. reported a strong fiscal Q3 with above-forecast revenues, improved margins, and raised guidance.
• The company's rapid improvement in its business model is a key factor in recommending the purchase of its shares.
• SentinelOne's new initiatives, such as its Data Lake and Cloud workload modules, are contributing to its growth and profitability.
• The company's AI initiative Purple, is likely to produce noticeable revenue growth tailwinds in the near future.
• The company's new Cyber-Strategy consulting initiative is likely to produce a significant level of software revenue drag.

Back to sustained hyper growth, but now with a very visible path toward profitability

It has been only 4 months since I last wrote about SentinelOne, Inc. ( S ) for Seeking Alpha, and I typically don't choose to write articles on SA outlining quarterly operational progression. But in the case of SentinelOne, I thought an article was appropriate given the volatility of the shares and the particularly strong fiscal third quarter (through October) the company just reported. And I wanted to reiterate my recommendation to buy the shares of SentinelOne now , even after the latest share price spike in the wake of the latest earning report.

Some readers might remark that the title of this article is quite similar to the last article...and so it is. The story is evolving and the key parts of the story are a return to hypergrowth and rapid improvement in profitability metrics. Those components are key, and yet remain underappreciated in my opinion.

Like most investors/commentators, I have read a plethora of economic prognostications. Hard landing, soft landing, even "immaculate disinflation." I will dismiss the latter out of hand, although I suppose, similar to religion, tolerance is desirable. My own view is that there will be a marked economic slowdown. The fact is that there has already been a marked slowdown in demand growth in the IT space, tied to what participants and competitors describe as macro headwinds. This article has nothing to do, really, with what the Fed might announce, or how it might announce it, or handicapping the next few inflation reports. It is about SentinelOne and investing in the cybersecurity space.

I think that when constructing a portfolio in the current economic/market environment there are two schools of thought, not entirely mutually exclusive. One school counsels a portfolio constructed of defensive, low valued investments. The other, and the one I feel more comfortable with, is finding those companies who will continue to enjoy growth despite macro headwinds. I by no means deprecate those readers/investors looking for defensive strategies; it is, I believe, all a matter of risk preference, personal financial situation and investment objectives. And certainly, no one would describe SentinelOne shares as defensive based on any commonly used definition of that word.

There has been much written about the outperformance of the shares of the "Magnificent 7" in 2023. Less has been written about the outperformance of companies whose business continues to grow at elevated rates despite macro impacts, that is the high growth IT space. It is my view that, for a variety of reasons including both the space, i.e., that of cyber security, the Sentinel's product strategy, and its technology, SentinelOne will prove to be one such company. It isn't that the macro hasn't diminished the growth rate for Sentinel and other high growth IT companies - but that the diminished growth rate is far stronger in comparison to many other potential investments in the IT space.

The current revenue growth consensus for Sentinel for next year (FY 2025 that starts on 2/1/25) is for 32% growth. I think that is a notable underestimate, but these days a reasonably defensive forecast seems a prudent strategy. But the point is, 32% will be a huge standout when many other tech companies are seeing single-digit growth or declines. Sentinel's valuation will, I believe attract a "scarcity" trade especially in light of its rapid transition to profitability and free cash flow generation.

Owning SentinelOne shares is not for the faint of heart. No one would ever suggest making an investment in these shares without a strong stomach and more than a bit of patience. I have recommended the shares for some time now, and have already had my fortitude tested by one unpleasant episode that was difficult to swallow. The shares, as I write this, are likely to be valued at levels above where they reached just before the company reported a quarter that was disappointing from an operational point of view and led to questions about transparency as well.

The question now is whether the shares remain worth an investment. A recommendation to buy SentinelOne shares cannot be for all readers, although within the constraints of writing an article for the Seeking Alpha audience, I am making the case to buy the shares generally. That said, value investors and those without the stomach for volatility and some element of patience should look elsewhere.

While profitability is on the horizon, with margins rising far more rapidly than anticipated, profitability is probably another 2-3 quarters away. And as software buyers pull back from prepaying for software, the cadence of improvement in free cashflow margins is probably going to be no better than consistent with the cadence of improvement in non-GAAP operating margins.

The shares have appreciated by about 25% since the Q3 earnings report was released in a bit more than a week ago. And the shares are up 75% since the release of the prior earnings report. I don't imagine there is any great likelihood that the shares can appreciate at that pace over the next few months, and yet based on some commonly used valuation metrics, SentinelOne shares are not hugely expensive. I have owned the shares over this period, but also owned them earlier in 2023 when they fell by 40% in just two days. That is not an unusual trading pattern for the shares of this company, and any reader contemplating an investment in these shares should be aware of this kind of volatility.

At this point in the latest earnings cycle, I think most investors in the IT growth space recognize that overweighting cyber security companies is a sine qua non of building a portfolio in the high growth space that will maximize returns and avoid some of the macro headwinds that have affected the growth of many other segments of the IT universe. I have chosen to do so by recommending the shares of what I consider 4 of the 5 leading companies in the space; CrowdStrike Holdings, Inc. ( CRWD ), CyberArk Software Ltd. ( CYBR ), Zscaler, Inc. ( ZS ) and this company. I own CrowdStrike, Zscaler and Sentinel, and they make up about 22% of the value of my Ticker Target high growth portfolio.

I prefer a sector based approach to investing; trying to determine if Sentinel Is "better" than CrowdStrike can consume an incredible amount of hours without coming to some kind of supportable conclusion. Since I have followed both companies, Sentinel has achieved the highest scores from 3rd party evaluators as to the efficacy of its end point solutions. Presumably that is at least one reason why the company has gained market share and it is likely to continue to do so.

From the perspective of market share trends going forward, the issue is going to be the success of the company's platform initiatives beyond endpoint security and the success of its Purple AI offering that is just now being delivered to enterprises.

What did SentinelOne Report and how did it guide?

Just about all of the KPIs that the company reported last quarter were above its forecast or prior expectations . In addition, guidance was also raised by more than the quarterly upside. Probably the strongest upside relative to expectations was that of operating margins.

Revenues for the quarter were 5%+ above expectations; EPS loss was $0.03 compared to the prior expectations of $0.08; ARR growth was 42% while new ARR growth was 11% - that one is a second order metric and 11% year-on year is pretty significant. The company's net expansion rate remained above 115%. The company's free cash flow margin loss was negative 14% through 9 months compared to 59% for the same time frame in the year earlier period.

Non-GAAP gross margins have reached 79%, an improvement of 800 bps year over year and by 200 bps sequentially. Non-GAAP operating margins for the quarter were negative 11% an improvement of 3200 basis points year-over-year and of 1100 basis points sequentially. Pricing has been stronger than expected and the growth in platform sales is a tailwind for gross margins.

There is no particular mystery when it comes to operating margin progression. The company is growing revenues by greater than 40%, and it has reduced its employee growth to a single-digit percentage. That alone accounts for the preponderance of the operating margin improvement and suggests that it will continue into the future.

The company is forecasting that its Q4 revenues will be about $169 million, or growth of 34% year over year, but by just 3% sequentially. The company raised its expectations for ARR growth by a couple of percent as well. The sequential forecast is very conservative, appropriate in the current environment, perhaps, but probably not terribly realistic either. Given the current ARR growth, and the apparent business momentum in terms of pipeline and close rates, as well as comments about the stability of the current business environment, I would expect that percentage upsides in terms of revenue KPIs to be a bit stronger in Q4 than the 5% reported last quarter, simply because of the multiple product introductions that have now reached GA status.

One specific opportunity that seems to be developing across the industry is market share gains from Splunk Inc. ( SPLK ). Over the past couple of years, many companies have entered the SIEM market. Splunk had apparently focused more on its transition to a SaaS model than on updating its cyber security profile. These days the gold standard in using SIEM as a cyber-security solution involves a fully unified data and security platform. That just isn't something available from Splunk, and with its pending acquisition by Cisco Systems, Inc. ( CSCO ), that kind of advanced functionality is even less likely to be a focus.

The result has been customer frustration and defection. This was seen in results reported by both Datadog, Inc. ( DDOG )and by CrowdStrike, and now has been reported by Sentinel as well. Sentinel announced its acquisition of a major Splunk user who had deployed SIEM from Splunk for 15 years! Of course, these things do happen, but rarely, and given the size of Splunk (ARR l ast reported as $4 billion ) and the size of Sentinel, the opportunity is probably not fully reflected in percentage growth estimates.

The company did not raise its sequential margin targets. I suspect that this is conservatism; margins have risen so much faster than previously projected that the CFO deliberately left forward targets alone. With gross margins now close to 80%, upsides in revenue will mostly fall through to revenue and to improved margins, and I expect that to be the case for Sentinel in Q1.

What's the secret sauce here?

As I mentioned earlier in this article, trying to discern which vendor has the best solution overall in cyber security is a fraught undertaking. For years, SentinelOne has advertised its ranking in the MITRE ATT&CK Evaluation with 100% real-time protection. It still does. I don't purport to be a cyber-security analyst. The CEO of Sentinel, despite his occasional acerbic commentary, is an expert in the space. I am sure that the rating in MITRE is key to some users, and less important to others. But it has allowed Sentinel to gain share consistently in the past and that trend hasn't changed in the last several quarters.

That said, the market for endpoint protection software is not growing at a huge rate. The report linked here says that endpoint security has a CAGR of just 7.6%. While the absolute size of the market, said to be $18 billion, is very large relative to the size of Sentinel, the kind of share gain that would be required for the company to maintain a CAGR in the mid-high 30% range is probably not achievable.

So how is it likely to happen? Some of the answer is decent execution. But it would be hard to determine if Sentinel really has better execution than its competitors.

At the moment, the company is achieving 20% of its billings from functionality outside of the endpoint security space, including Singularity Identity, Singularity Cloud, and Singularity DataLake. Combined these offerings grew triple digits year-on-year last quarter. Can that growth cadence continue? The market for those products, and Sentinel's specific offering suggest that those growth rates can continue.

Currently, the most current concept within cyber-security vendors is known as CNAAP, or Cloud Native Application Protection Platform. There are many claimants amongst the various vendors to be offering CNAAP, but the reality is that there is still much white space around most claims.

CNAAP is a development focus for Sentinel and is really the primary concentration for research and development spend. In evaluating Sentinel as an investment, a key focus ought to be its ability to put a full set of CNAAP capabilities into deployment ahead of competitors and with stronger performance.

Singularity Cloud is quite a bit beyond end-point security. It is about securing cloud workloads. I don't suggest that I can evaluate all of the different claims made about cloud security these days. Sentinel's cloud security is focused on Kubernetes and containers. Again, whether or not this is really a differentiator is hard for me to determine.

Data Lakes are centralized repositories designed to store, process and secure large amounts of structured, semi-structured and unstructured data. No swimming allowed. It is that last part, i.e., the part about unstructured data, that distinguishes lakes from warehouses. Not terribly surprisingly, lakes are growing at exponential rates. Of course, lakes have to be secured and that is part of the triad of non-endpoint solutions driving percentage growth at this point for Sentinel. The Data Lake modules that are part of the Singularity platform are priced by data ingestion, i.e., usage and not seats. That is one reason why Singularity Data Lake has been able to maintain triple-digit growth. On this most recent conference call, management called out a total addressable market, or TAM, for the modules within Singularity Data Lake of between $20 billion and $40 billion. This is the part of the business where Sentinel - and others - are displacing Splunk.

I will reiterate the size of the opportunity is such that it would support hypergrowth for years to come given the magnitude of the vulnerable Splunk base. Singularity DataLake is supposed to be twice the speed and half the cost of Splunk. There is no realistic way a 3rd party observer such as this writer can validate such claims, but the displacement evidence might suggest some substance to the claims. Of course, there is significant market beyond displacing Splunk for Singularity Data Lake that has to do with many new workloads that are being created as part of the growth that has been brought on by generative AI.

Singularity Identity focuses on credential misuse, a solution focused on Active Directory and other deception-based protections. Most organizations have some form of identity protection software and most organizations have experienced an identity breach. Sentinel's approach is to defend identity at the domain controller. There are all kinds of ways thieves gain identity, and most users recognize the need to have multiple layers of defense.

Not terribly surprisingly, Sentinel doesn't provide specific revenue growth forecasts by product. But when considering the company's opportunity to maintain a multi-year growth cadence in the mid-high 30% range, a principle component of the analysis will be the ability of these 3 specific products to continue to grow at exceptional rates.

Sentinel Purple

SentinelOne announced Purple about 7 months ago. It is a generative AI solution that is built on top of the company's Singularity platform. It is designed to be used by threat-hunting data analysts. I have linked above to the product announcement. It basically allows data analysts to use conversational English to inquire about the state of their environment.

So far, Sentinel has been the first of the cyber-security companies that have at least tried to provide some kind guard rails with regard to a revenue expectation for their cyber-security offering. The quote below from the conference call, taken literally, implies that over the coming 18-24 months, Sentinel will be deriving about 10% of its revenue from Purple.

Obviously, it takes some time to scale a whole new technology. And obviously, we're doing it responsibly. We want to make sure there are the right safeguards. We want to make sure that privacy is kept. All of these things are incredibly important for a company like ours. I mean, we're not just an average consumer company. We deal with security and we need to make sure that these things are in place.

In terms of the magnitude, I mean, Purple AI is definitely almost another product line for us, right? I mean, it's not just a module. So, how we're treating it, how we're structuring our go-to-market, what we anticipate Purple will contribute in the, call it, the next 24 months, it's definitely in the magnitude of something like cloud, something like data. But again, I mean, it's early days. It looks very, very promising. I think the fact that it's an enterprise-wide capability, so once again, it's not something that you sell per seat, it's not something that just for one footprint, and the application of it can be virtually endless in the enterprise environment. I think that puts us in a league of its own in terms of the other offerings that we're seeing in the security space.

So, this forecast suggests that Purple will perhaps add 10%+ to revenues over the next 2 years. But in addition to Purple's revenue considered in isolation, the offering is likely to solidify the company's competitive position, i.e., to induce drag.

I started this article by suggesting that the consensus revenue growth estimate for Sentinel, i.e., 32% for next year, is too low. The advent of Purple, is, in my opinion, one reason why Sentinel can overcome macro headwinds and grow at rates faster than the currently published consensus.

As mentioned in the quote, Purple is priced on usage rather than on per seat. Currently, most analysts look at ARR growth as the key metric in reviewing quarters for cyber-security companies. Over time, with the introduction of Purple and the rapid growth of Lake and Cloud, more revenue will come from usage. Usage can be an exceptionally lucrative business model for a software company, albeit with some cyclicality. As part of the investment thesis presented in this article is about profitability, the success of Purple is a key component of my overall expectation regarding margins.

SentinelOne's competitive positioning

The cybersecurity space remains hyper competitive. Most of the deals that Sentinel wins are new names for the company. Most observers tend to evaluate CrowdStrike vis-à-vis Sentinel. I think it is basically impossible to say which is "better." While many readers try to establish a single pick in the cyber-security space, I own 3 companies in the cyber-security as part of the Ticker Target high growth model portfolio. Cyber-security and will continue to be a substantial component of the IT space and there will inevitably be more than a single winner.

From an investment perspective, at this time Sentinel is growing more rapidly and is far, far less profitable than CrowdStrike. That in turn has led to an EV/S of 13.8X for CrowdStrike compared to an EV/S of 6.1X for Sentinel. I find that difference a compelling factor in deciding to have a multi-company approach in terms of investing in the cyber-security space.

From a technology standpoint, Sentinel offers a more modern set of tools to identify and mitigate threats. Basically, Sentinel has used AI (not generative AI) as the enabling technology for its end point solution since it first offered Singularity. CrowdStrike has a more modular approach to cyber security which the CEO of Sentinel labels as jointed. Given the chronology of the introduction of CrowdStrike's offerings, they are joined, although that isn't some kind of fatal disease. The two companies have been competing for years at this point…and the winner is both. I have linked here to a 3rd party analysis of the two companies.

Historically, CrowdStrike has sold its capabilities as having a human element, i.e., Falcon Overwatch, as opposed to just a software component. As the saying goes, "some like chocolate, some like vanilla." Inevitably, an autonomous solution, which is what Sentinel offers, will catch threats sooner, and more accurately; it will also miss some of the newest threats since training can't happen until there is an actual breach that can be used a training instance.

Sentinel has just announced the establishment of its PinnacleOne service which is to be helmed by Alex Stamos and Chris Krebs. While this service is not the same as the human inputs CrowdStrike offers through its Falcon consultancy, the concept is that large enterprises will look to Pinnacle for strategic direction in cyberspace and this in turn will drag along Sentinel solutions.

Over time, as Sentinel continues to expand the scope of its Singularity platform, it will compete more against Palo Alto Networks, Inc. ( PANW ). For the most part, Palo Alto should win, when it does, because of its installed base position and because of its size, and Sentinel should win because its solution offers better results. Sentinel has been willing to offer aggressive pricing since it has emerged as a significant factor in the market. As it has become a more established vendor with a multi-module approach on a single platform, its need for large discounts to win enterprise deals has begun to wane. The fact is that its stature within the industry has seemingly improved based on anecdotal comments I have heard, so that it no longer has to provide mega discounts to win deals is another significant part of the investment case for the company.

Overall, I expect that SentinelOne will continue to gain market share because of its technology, because of its platform approach and because of its newest capabilities, particularly those that are securing cloud applications and its data lake capability. With regards to SIEM, Splunk is likely to donate substantial share, and Sentinel, along with other vendors, is likely to be a significant beneficiary.

I estimate that Sentinel will have a CAGR of near 40% over the next 3 years, in part because of competitive wins, and in part because many of its newest offerings are growing at such prodigious rates.

SentinelOne: The rapid improvement of its business model is a key component of a share purchase recommendation

SentinelOne went public 2.5 years ago . It was a far different environment for stocks back then. Sentinel shares initially closed the day of the IPO at above $40. But more surprising to readers today is that the company at that time had non-GAAP gross margins of 51%, and non-GAAP operating margins of negative 127%. At that point, I thought the shares were uninvestable, and indeed that proved to be the case. All things considered, the journey to cutting losses has been more rapid than I had thought most probable back then, but there is still a ways to go.

Last quarter, the company's non-GAAP gross margins reached 79%, actually on the high side of the company's target for that metric, up 900 basis points year-on-year, and by 200 basis points sequentially. Operating ratios saw substantial improvement as well. The company continues to see the effect of its restructuring after its disappointing Q1 results.

Research and development expense was 22% of revenue last quarter on a non-GAAP basis, down from 33% in the year-earlier period. Sequentially, non-GAAP research and development expense was little changed.

The biggest improvement in terms of non-GAAP expense ratios was that of sales and marketing. Last quarter non-GAAP sales and marketing expense was 50% of revenue, down from 60% the prior year. Sales and marketing expenses grew by 4% sequentially.

Non-GAAP General and administrative expenses were 18% of revenue last quarter compared to 22% of revenue in the same quarter of the prior fiscal year. G&A expense rose by over 8% sequentially, partially reflecting a 3rd party analysis of the company's ARR disclosures.

The company has made some significant improvements in improving expense ratios, but still has a long way to go. The total of non-GAAP operating expense ratio was about 90% last quarter, down from 115% in the year earlier quarter. That is a significant improvement, to be sure, but the company still has to reduce its operating expense ratio by more than 1/3rd to reach some kind of "normal" profitability. So long as revenue growth achieves a cadence of greater than 40%, then the company's profitability goals seem quite conservative.

Last quarter, the company's free cash flow margin was about negative 13%. For the first 9 months of the year, the free cash flow margin was about negative 14%. The improvement in free cash flow margins is being hindered by the industry trend of sharply lower up-front/prepayments which shows up in the deferred revenue line. Last quarter, the increase in deferred revenue was just $1 million, compared to $9 million the prior year. The company has projected that free cash flow will turn positive in the 2nd half of FY'25.

The company uses stock-based comp, and the stock-based comp ratio is high, but down from earlier peak ratios. Last quarter, stock-based comp was 33% of revenue, down from a peak of 40% of revenues in the prior year. I look at actual dilution in evaluating stock-based comp. since dilution is the real expense associated with stock option grants Dilution was 5.7% last year, and was 1% last quarter. I have used 4.5% dilution in weighted average shares to arrive at my valuation metrics.

Wrapping Up - Reviewing the case to buy SentinelOne shares

Sentinel's most recent earnings report confirmed that its revenue growth remains at hyper levels, and that some of its latest initiatives, including its Data Lake and Cloud workload modules, are contributing strongly to growth. Last quarter also saw significant milestones on the path to profitability, and the forecast for this current quarter is noticeably conservative with regard to the likely trajectory of operating margins.

The company's generative AI capability, which it calls Purple, seems to be one of the more useful offerings I have seen. The company projected that Purple would be contributing around or more than 10% of revenue within the next 18-24 months. As the pricing is usage-based rather than based on seats, it will not contribute to ARR. Of course such a projection is more of a guess at this point, than anything else-there simply has not been an analog that would allow some kind of substantiated projection.

The company has set up a cybersecurity strategy consulting unit with a couple of industry superstars; this is potentially a significant demand driver in terms of the ability it brings to the company to attract enterprise users wanting to develop an overall cybersecurity strategy with the use of Sentinel consulting and software together.

I have been especially encouraged to see progress the company has made in terms of gross margins which reached 79% last quarter. For some time, Sentinel was known as an aggressive price cutter in the industry, and was willing to sacrifice gross margin for growth. That has seemingly ended; the company has been able to command better prices and still achieve hypergrowth, suggesting the value of its solution and its ability to sell additional modules and seats into its installed base.

S shares have a relatively modest EV/S of 6.1X based on my estimate of 4-quarter forward revenues. Of course, this relatively modest EV/S is a reflection of the company's reported non-GAAP operating losses and cash burn. I expect these will be coming to an end, probably sooner than the company has currently projected.

Competition in cybersecurity is fierce and the space is comprised of a multiplicity of vendors. I have suggested that I believe it is prudent for readers/subscribers to have several choices in the space. I consider the investment merits of Sentinel shares, which include its growing industry position, its technology, its AI capability and the strong positive trajectory of its profitability and expense metrics make it one of the leading choices in the space. Even after its recent share price spike, I feel the shares offer significant positive alpha over the coming year and beyond.

For further details see: