2023-05-20 07:50:00 ET
Summary
- SentinelOne shares have essentially tracked the movement of overall high growth companies for the last several months.
- The company has forecast far more modest growth than it has recently achieved.
- Margins, while improving, have a long way to go, and in particular, sales and marketing spend ratio remains at exceptionally elevated levels.
- The company's technology has been built on the use of AI and predictive models, and these models are a significant factor differentiating outcomes using Sentinel solutions with those of other competitors.
- The company's entrance into adjacencies such as web application protection as well as its recent announcement of a Security DataLake are likely underappreciated by many.
SentinelOne's shares are running in place; the company is sprinting
In some ways, SentinelOne (S) is a metaphor for high growth cyber security companies. It started life as a public company with a fantastic growth rate in an exceptional space, and with an equally fantastic valuation. Over time, while the growth rate has remained strong, the valuation started to compress, and the company started to take steps to reach a business model that investors would find attractive.
Most recently, Sentinel's shares have suffered through every downdraft brought on when less enabled companies in this space have disappointed. Its shares swooned a few weeks ago when Cloudflare ( NET ) reported a less than stellar quarter and reduced guidance. And when Amazon ( AMZN ) indicated that the April consumption of its cloud service had grown less rapidly than in the recent past, S shares were pounded again. Of course the reverse has been true; when Zscaler (ZS) prereleased positive results a few days ago, S shares spiked up for a couple of days-they wound up 10% last week and have risen by 19% so far in May.
Despite a few patches of green, this remains a market in which negative sentiment rules much of the time. Investors are still coming to grips with the reality of what seems highly likely to be a recession, and are also dealing with the uncertainties created by the debt ceiling remediation drama. The Empire State manufacturing index released on Monday, 5/15 was conspicuously ugly, although other economic macros reported this week, such as the Philly Fed index were less negative.
These days AI has become a focus for investors. In some ways it is a mania, not all that different than other crazes I have seen over the years following the IT space. I might liken it to the craze for all things cloud and SaaS a decade or so ago. That said, AI is very real-it is revolutionary, and it will change many things, including some areas of life and commerce that aren't a focus currently.
For years, modern security technology has been based on AI, and predictive analytics. Some readers may not appreciate the extent to which Sentinel's technologies are now, have been, and will be based on AI - not just generative AI, but the use of the concept to enable sophisticated threat protection both at the end point, but for identity and cloud requirements as well. I have told many subscribers to be wary about basing an investment decision simply because a vendor has AI and has been able to leverage it. It is difficult for any outsider to judge whose predictive models produce better outcomes. Certainly a reasonable case can be made that Sentinel does have very sophisticated models that produce better outcomes; that is why it gets the ratings it does from some 3rd party analysis/testing companies.
But that said, investment decisions should be made based on more than a single vector. In my opinion an investment case can be made for Sentinel shares without tying them totally to the craze for all things AI. To the extent that readers are interested in a cyber-security company which is using AI to deliver best of breed solutions to the market, SentinelOne fits that definition. It isn't, to be sure, the only reason to consider the shares, but it is certainly a factor in the company's success, and at some point it may become a factor in the valuation of the shares.
Many retail investors have fled the high growth tech space after 18 months of horrific losses, and even institutions are less invested in the space than has been true through most of the last couple of decades. The 63% institutional ownership of these shares is a level significantly below the historical average for this kind of company. And the short interest ratio at around 7% of the float is probably higher than average as well. Hedge funds have been most recently less afraid of upside spikes, and far less inclined to hold long positions in IT shares. It is part of the current calculus in handicapping the space. It is this reluctance on the part of some historic buyers to maintain positions that has animated the recent performance of high growth IT shares. In turn, this has created valuation opportunities, although when such opportunities will be realized is not completely apparent.
It may surprise some readers, but Sentinel shares have reached a point where their valuation has passed from reasonable to below average-at least in terms of the company's EV/S ratio which is now around 6.8X based on the share price at the close on 5/18. To be sure, Sentinel is not yet profitable nor has it started to generate cash and that changes the valuation calculus.
Sentinel is scheduled to report results for its fiscal quarter that ended 4/30 on 6/1. This is not a call that the quarter was either better or worse than expectations and of course I have no way of knowing how the company might guide. The last time the company reported , despite what was a strong quarter, the company management acknowledged macro headwinds and deliberately guided to a forecast that was not particularly connected to sales KPIs. Until the last few days or so, until after the Zscaler preannouncement of a strong quarter, the shares had basically traded flat. Since the ZS earnings release, the shares have risen by about 20% along with other cybersecurity shares.
Before Sentinel releases earnings, Crowdstrike ( CRWD ), one of the existential competitors of the company will be reporting its most recent results with Palo Alto ( PANW ), the largest of the independent cyber security companies reporting on May 23. So, there will be plenty of potential market moving news, along with overall macro concerns between now and the time of the earnings release. And even if I had some way of knowing what Sentinel's results might be, the reaction of the share price to earnings can be a significant surprise itself: there are surely readers who were holding Dynatrace ( DT ) and/or Wix ( WIX ) shares on May 17th and wondering why beat and raise quarters by these companies have led to share price declines (although eventually DT shares have risen). So, don't own SentinelOne shares to play the quarter.
This is a reaffirmation of my purchase recommendation of the shares that I presented 6 months ago. I am not trying to call the market share battles between this company, Crowdstrike and Microsoft ( MSFT ). And even less am I trying to establish which company has the best performing end-point security technology. Users buy a holistic set of capabilities, for the most part and consider many factors in making a purchase decision.
While the shares are a bit higher (up by 17%) than at that time I made my recommendation in November, the valuation has further compressed, and the company's path to profitability has become clearer. Overall, at least based on anecdotal checks, it appears that the environment for cybersecurity deals may be a bit less constrained than has most recently been the case. I think the shares offer even more percentage upside than they did when I initially recommended them.
Reviewing SentinelOne' competitive positioning
These days, it is impossible to discuss any IT company without discussing their investment in, and exposure to AI. SentinelOne's technology is, of course, built on AI-that has been the case since the company's inception. AI identifies anomalies in terms of usage and access and identifies threats. Threat hunting using SentinelOne, as it is called, has been based on AI for some time. When companies compete in this space, much of the discussion relates to the performance and the ubiquity of their AI models.
Not terribly surprisingly, with the advent of generative AI, Sentinel has released a solution which combines neural networks with a natural language interface based on large learning models including the latest iteration of ChatGPT. The service will be used by security analysts who can ask threat-hunting questions that will trigger automated response actions. I would not expect this offering, by itself, to move the needle on expectations for Sentinel's revenues; the release is important as some enterprises have decided that their vendors need to offer this technology in order to be considered as long-term partners.
This is a recommendation to buy Sentinel shares. Part of the thesis of the recommendation is that the company has, and will continue to have advanced technology solutions enabling its market share gains to continue for the foreseeable future. SentinelOne has always used AI for threat hunting-that is one of its differentiators. I can't really say that using AI is better than using humans to hunt threats. It probably does result in more consistent results with a lower total cost of ownership. And it may be that the publicity that AI has received will be a competitive tailwind for Sentinel.
These days, advanced technology includes forms of generative AI. Generative AI will make threat hunting easier and more automated. But really it's the less sexy parts of the AI paradigm that actually find and remediate the threats. There is more than a bit of a mania about AI, amongst investors, analysts and industry commentators that can be disturbing to see-not that generative AI isn't real, but it will not solve the world's problems either. Indeed the CEO of this company cautioned auditors on the latest conference call about the limits and expectations for AI-I can simply reprise those cautions. The hype can distort valuations and lead to investment narratives that can't be realized. My recommendation is to buy Sentinel shares as a vehicle for investing in the cybersecurity space-not because of its use of ChatGPT.
In fact, of greater importance to the company than its generative AI offering, is its new introductions for the cloud, and for identity management security as part of its Singularity Complete platform . The ability of the company to develop and sell its Singularity platform with cyber security offerings for the hybrid cloud, and for identity management are going to be key in determining how long Sentinel can maintain hyper growth and execute its pivot to profitability.
End-point cyber security is ubiquitous. All enterprises need to protect the security of their devices, and device growth, while certainly slower at this point than in the past is still a factor in demand. At this point there are still millions of devices protected by technologies first deployed decades ago. In enterprises, particularly, that is a substantial risk.
The overall endpoint security market is not growing at huge rate-most enterprises have long since deployed the technology. The research linked here suggests growth in the high single digit range over the next several years.
Currently the competition for deploying modern end point protection solutions is primarily between Microsoft Defender , Crowdstrike and Sentinel. There are many other entrants in this race. Sentinel has been a prodigious share gainer essentially since its inception. I have linked here to a competitive evaluation between Crowdstrike and Sentinel. They have been arch rivals for years, and there is probably nothing all that new when it comes to that competition. In the interest of full disclosure, I do own Crowdstrike shares as well as Sentinel shares, and have had the Crowdstrike position for years. I don't think it is necessary to suggest that there will be a single winner or loser in the endpoint security competition. There is plenty of available market and many deals, even large deals, turn out not to be actually competitive in terms of requiring responses to RFPs.
As can be seen in the linked review, probably the principal difference between Sentinel and Crowdstrike is that Sentinel has used AI as a threat hunting technology, while Crowdstrike deploys human experts as hunters. A case can be made for both approaches. That said, over the past year Crowdstrike has been honing its own AI solutions as this link to what that company calls EXPRT: AI suggests. I wouldn't want to suggest that a reason to buy Sentinel shares is because their use of AI will lead to additional share gains beyond those the company has been achieving for some years. I might suggest on the other hand that the use of AI will be a significant factor in enhancing the outcomes for cyber-security customers.
I have also linked to a comparison between SentinelOne's Singularity Complete platform and Microsoft's Defender. This is a review by PeerSpot, a service that collects, as the name suggests, product reviews from peers. Its overall review of the two offerings is fairly unambiguous; users prefer SentinelOne based on ease of deployment, features and service and support. Of course Defender is most often bundled with Windows and other Microsoft products. While certainly Defender has customers outside the Microsoft base, the preponderance of Defender users are strongly invested in the Microsoft stack and find Defender suits them well at a price point that is hard to beat.
While I recommend and own Microsoft shares, I believe that Sentinel is enjoying, and will continue to enjoy considerable competitive success replacing Defender installations that don't quite fit the needs of some users as the threat universe evolves and darkens.
The evolution of SentinelOne - Its strategy to continue its hyper growth
SentinelOne is best known as a major factor in the endpoint protection area. Certainly there is a large addressable market in that space, and it is growing, albeit modestly. But for the most part, any company in cybersecurity aspiring to maintain elevated growth rates for multiple years can't rest its strategy on a single pillar. What Sentinel calls emerging capabilities was one third of total bookings in the most recent fiscal year.
It probably isn't greatly surprising that one area of focus for Sentinel is the product set it calls Cloud Workload Protection. Cloud workload protection, over time, will probably be a larger opportunity for Sentinel than endpoint security. At the moment, cloud security is contributing about 15% to Sentinel's quarterly ACV growth, and it actually doubled quarter over quarter. I have written on several occasions when reviewing ZS how architecture is a significant factor in the performance of cloud protection solutions. Older, and non-purpose built technologies, are competitively vulnerable. Obviously Sentinel has already had a measure of success with its solution in this space . In addition to architecture, the company has enabled its solution with AI and this also seems to be a factor in benefits that the offering has for users.
It recently announced a partnership with Wiz, considered the leader in the cloud security platform management ((CSPM)) space. Wiz is still a private company, but one of the hotter companies in the space at this point and the partnership could be an important growth driver for Sentinel. Of course I don't expect Sentinel's cloud workload protection product to double ACV each quarter, but when considering the company and its probable growth rate, the evolution of this offering should be a significant consideration. I expect that this will be a development focus for Sentinel for the foreseeable future, and I do think it will achieve strong growth.
Sentinel also has an offering in the identity management market as part of its Singularity platform. Sentinel bought Attivo Networks about a year ago. Attivo revenues were at an annual run rate of about $33 million when the company was bought. Identity management was probably in the range of 5%+ of revenues this past quarter. Identity management is a necessity in offering a holistic cyber-security stack to the enterprise. While the TAM of the identity security segment addressed by Attivo was estimated to be a relatively modest $4 billion, it is a component of a platform and having this additional capability that makes it easier to sell Singularity Complete to the enterprise.
The specifics of the Attivo offering relate to identity as part of a perimeter, Attivo has described its product as part a key component of Identity Threat Detection and response, and pitched it as part of an extended detection and response solution. While the category of identity management might seem to be homogeneous, very little in cyber security is exactly what it seems. Apparently hackers often target Active Directory from Microsoft, and use a breach into that as a lever to gain access to the data of an enterprise. Attivo/Sentinel offer a defense against that kind of a breach. But SentinelOne is more a partner of Okta (OKTA) than and a competitor, and it has a fairly recent agreement in place with Okta in which it has integrated Okta to accelerate incident response.
The third area of focus for Sentinel is to enhance its platform capabilities. In addition to its identity security capability, it is focusing on what is called a security data lake and vulnerability management. These days it can be a chore, just keeping up with all the terms in use in the cybersecurity space, and really, it isn't necessary to know all the terms in order to form an investment judgement. For those with an interest, a security data lake is a centralized repository which maintains and manages all log and other data sources. These lakes have nothing to do with swimming or boating or water skiing; they are about having limitless scale, and they can be scaled up very rapidly decreasing time to benefit. They might best be thought of as a more modern technology to supplant SIEM, pioneered by Splunk (SPLK) and in use for many years now.
I don't want to pose as some kind of some cyber security guru. I am nothing of the kind. But the opportunity that Sentinel has in terms of its platform capability with a security data lake is quite substantial and the space is ripe for disruption. When investors consider the potential longevity of the company's cyber growth story, it is these opportunities outside of end point protection that give me confidence to believe that the company will be able to perform at long term hyper growth rates for the foreseeable future.
Of course, Sentinel is going to continue to invest in extending its XDR capabilities. For years, investors have struggled with the issue of who is better: Crowdstrike or SentinelOne. There is plenty of data around supporting the thesis that Sentinel's XDR leads to better outcomes when compared to Crowdstrike. And this data has been around for years and Crowdstrike has seen prodigious growth. There are many factors beyond product functionality that are components in a purchase decision. In particular, specific go to market strategies along with sales execution can be more or less effective.
At this point both companies offer fully featured platforms that facilitate a holistic approach to the current problems of cyber security. Based on what I can glean from the various review and product descriptions, it may be that Sentinel, on balance, and considering the totality of its product suite, offers a bit more of the latest technology features-this particularly is true in terms of its Cloud Workload Protection and its Security Data Lake offerings. I am also inclined to believe that SentinelOne has a lead in leveraging AI for cybersecurity. This is not, however, a call to go out and sell shares of Crowdstrike to buy a position in SentinelOne-both have investment attributes, and most particularly, at this time Crowdstrike is profitable and generates lots of cash and SentinelOne is still probably a year away from reaching breakeven status. The next section of this article discusses the changing face of the SentinelOne business model.
SentinelOne - When and how does this business model reach profitability?
Since the great rerating of the last couple of years, one of my touch points in considering recommendations has been free cash flow generation. When I first reviewed this company its gross margin was 51% . There are few things certain in investing in cybersecurity companies; one thing that is certain is that companies with a gross margin of 51% can't possible make money.
Sentinel has been taking strides toward achieving profitability. Some of the improvement comes from scale; some of it comes from a bit of expense discipline. Its non-GAAP gross margin last quarter was 75%. There were a couple of one-time items; the steady state non-GAAP gross margin was around 73.5%, and that is up by 750 basis points over the past year and up 200 bps sequentially, adjusted for one-time tailwinds from the prior quarter. One issue that has concerned investors has to do with price competition in this space, and particularly with Defender. There simply is no evidence that price competition or anything else is impeding the company's trend toward higher gross margins. During the last conference call the company called out a new agreement with a cloud provider that is expected to positively impact gross margins by about 200 bps this current year. As the company scales, its objective to reach gross margins of 80% will be easier to accomplish. The company's forecast for the current year is for a further improvement in non-GAAP gross margins to the range of about 74%. This company, as so many others, has chosen to be exceptionally conservative in its guidance, despite what would seem to be signs that conditions overall are better than feared. That would seem to apply to the company's gross margin projection for the current fiscal year in particular.
Not terribly surprising, the company's opex ratios are still high, but showing signs of improvement. Last quarter the non-GAAP research and development spend ratio was about 31%, down from about 65% in the year earlier quarter, and down from 33% the prior quarter. Overall, research and development expense was up less than 5% sequentially.
The non-GAAP sales and marketing expense ratio of 58% is one of the highest such ratios I have seen for a company of this size. It was actually up from 55% in the year ago period, although growth has started to moderate-the sequential growth of sales and marketing spend was 5.8% last compared to 9.6% sequential growth in revenues. Controlling sales and marketing spend is the greatest opportunity to rapidly improve the company's margins.
General and administrative expense was 20% last quarter, compared to 27% in the year earlier period. General and administrative expense was flat on a sequential basis last quarter.
Overall, the non-GAAP operating margin improved from a loss of 66% to a loss of 35%, and that was despite a decline in the stock based compensation ratio. Overall, non-GAAP operating expense rose just 4.5% sequentially, an indication of some level of improving expense discipline.
The company's guidance for this current fiscal year is rather muted, and deliberately so according to management. Specifically, the CFO said,
" For the full year, we expect revenue to be between $631 million and $640 million, reflecting annual growth of 51% at the midpoint. We expect the macro-related uncertainties to persist for the full year and a conservative view on revenue and ARR expectations is prudent in today's environment.
We have the raw materials to deliver against Q1 and our full year targets. Our pipeline has nearly doubled year-over-year, and throughout Q1, we've continued to build pipeline at a record pace while elevating our brand. We are winning with new customers and our existing customers continue to adopt more licenses and broader platform capabilities. We're encouraged by the diverse and large growth opportunities in front of us.
Our guidance is for revenue to grow 51% at the midpoint and obviously, revenue and ARR track closely. This is really just us taking a prudent and conservative approach based on the current macro environment. We expect these conditions to continue throughout the year. We are expecting relatively flat net new ARR for the year. That would imply about 47% ARR growth and 50% ARR growth is still achievable and we are working towards that, but want to be prudent in terms of our guidance.
The company's revenue forecast calls for sequential growth of 9%, despite the fact that the pipeline has doubled year over year and pipeline continued to build at a record pace in fiscal Q1. As mentioned, the company is projecting just modest improvement in gross margins in Q1, and throughout the fiscal year. It is forecasting a Q1 non-GAAP operating loss margins of 41%; that's a big improvement year over year, and incorporates slower percentage growth in opex than in the recent past, but is a bit of a step-back from the results of Q4. In this environment, I feel much more comfortable with a forecast that is at least somewhat de-risked, and I think it seems likely, based on the above commentary as well as the product introductions and success with adjacencies cited earlier, that this forecast is a floor and not a most likely set or expectations.
Like almost all other software companies, Sentinel's margins are very revenue sensitive. That is likely to be more the case in this environment where the company is constraining the growth of operating expenses because of macro concerns. Despite the results of Zscaler, and of Fortinet (FTNT), analysts have not raised their estimates for Sentinel nor have there been any ratings changes. At this point, most analysts rate the shares as hold, with an average price target just 10% above the current share price level. The latest analyst commentary was an initiation by Stephens & Co . at overweight about one month ago.
For the full year, the company's operating cashflow performance almost exactly tracked the performance of its non-GAAP net loss. Most balance sheet items showed modest changes; the company's growth in deferred revenues was a bit less in the last fiscal year which is more a function of contract duration. I would expect the company's operating and free cash flow metrics to track very close to its non-GAAP operating income changes for the foreseeable future.
Wrapping up - Should investors buy SentinelOne shares
I am reaffirming my purchase recommendation for the shares at the closing price of $19.15/share as of 5/18. Sentinel shares are volatile, and while they have appreciated the past 10 days or so, the valuation on an EV/S basis is hardly extended.
SentinelOne is one of the leaders in the endpoint security space and that is where it gets most of its revenues. That said, it now has entered adjacencies, particularly including cloud workload protection and what is known as a Security DataLake. It also has an offering in the identity protection space along with a partnership with Wiz, one of the hottest cyber security startups. It is my belief that it will continue to gain wallet share in the cyber-security space for the foreseeable future. It has embraced the leading trends in mitigating cyber-attacks, and appears to have a holistic solution that is resonating with larger enterprises.
Sentinel has always used AI as the core of its technology-this is not some adaptation to catch a wave, but really has been the foundation of everything the company has ever offered. Whether or not Sentinel gets a premium valuation because of its AI focus is not something I feel I can predict. It certainly doesn't have such a valuation currently.
The company uses stock based comp.-and a lot of it. Last quarter, stock based comp. was more than 36% of revenues, although that is down from 38% of revenues in the same period a year earlier. I consider stock based comp. expense to be better expressed in terms of dilution rather than the reported calculation shown using the Black-Scholes computation. Last quarter, dilution was a bit less than 1% sequentially, or around 3.5%/year. I use that figure in calculating all of the valuation ratios that I use.
Guidance for this year has been set at unusually conservative levels, a function of macro concerns rather than some slowing cadence of sales performance. Indeed pipeline growth has been accelerating and is far greater than needed to support the sales forecast which is essentially predicated on growth of ARR not larger than the growth the company achieved in that metric in the prior fiscal year.
The company is constraining the growth of opex as a prudent strategy due to macro concerns. Given that the company's unit economics have improved substantially, this would allow for significant upsides in earnings and cash flow beyond projected levels with relatively smaller changes in percentage revenue growth.
The resilience of cyber security spending has been a theme of some of the most recent earnings reports in the space and in particular, the upside preannouncement and raised forecast by Zscaler, actually a partner of Sentinel is a proof point in that observation. While overall software demand has held up better than feared based on many recent earnings reports, cyber-security demand continues to be stronger still. With a company enjoying tailwinds based on its presence in many of the emerging cyber security technologies as well as positive recognition by 3rd party analysts, the expectation for continued market share gains seems well grounded. The combination of hyper-growth and improving margins should provide the shares the ammunition needed to produce positive alpha over the coming year.
For further details see:
SentinelOne: Rapid Growth And A Pivot Toward Profitability