2023-06-20 13:12:49 ET
Summary
- SentinelOne is facing a difficult macro environment, a situation that will be compounded by CrowdStrike's increased focus on the SMB segment.
- The success of the company's expansion into adjacent verticals, is unclear. This is concerning as the cybersecurity market is consolidating towards broad platforms.
- Despite concerns about competitive positioning, SentinelOne continues to retain existing customers, add new customers, and achieve high win rates.
SentinelOne (S) appears to have hit a wall in recent quarters, with revenue growth and NRR particular areas of concern. The company continues to add new customers at a healthy pace, but it is not clear if the expansion into adjacent verticals is progressing as expected. SentinelOne will ultimately have to succeed as a platform, or face obscurity as a point solution. While current issues could be due to the macro environment, SentinelOne appears to have been impacted more than peers, raising the question of competition.
Market
SentinelOne has suggested that the macro environment is continuing to create headwinds for its business, with increased budget scrutiny leading to smaller deals and longer sales cycles. In addition to difficulties closing deals, SentinelOne is facing weak consumption growth. A significant decline in usage was observed as the first quarter progressed, and this has continued into May. Management expects this lower consumption trend to persist going forward, presumably leading to the weak guidance.
Figure 1: "SentinelOne Pricing" Search Interest (source: Created by author using data from Google Trends and The Federal Reserve)
SentinelOne's macro commentary on the first quarter earnings call appeared bleaker than most cybersecurity peers, suggesting the company is finding current conditions particularly challenging. This is something that is reflected in the rapid deterioration in the company's revenue and ARR growth.
Figure 2: Job Openings Mentioning Endpoint Security in the Job Requirements (source: Revealera.com)
SentinelOne has shouldered some of the blame for the poor first quarter performance though. Management suggested that there were some late-stage contract execution challenges that caused several large deals to slip into the next quarter. If this were a large issue, growth in the second quarter presumably would be expected to be relatively strong, but based on guidance this is not the case.
SentinelOne
The general belief is that SentinelOne has a strong core endpoint product, but the success of expansion initiatives into areas like SIEM and cloud security are not clear. SentinelOne has partnered with Wiz, a leader in CSPM, to provide customers with more comprehensive cloud protection. The customer experience has reportedly been improved through deeper technology integration. Singularity Cloud aims to extend SentinelOne's technology to the cloud, protecting against cloud-based threats at machine speed. Cloud security is a competitive segment though, and SentinelOne has a less mature sales motion for this market. Despite this, Singularity Cloud appears to be one of SentinelOne's better performing emerging capabilities. SentinelOne's emerging capabilities represented over one third of bookings in the first quarter. Singularity Cloud is the fastest-growing solution, followed by solid contributions from products like Vigilance, MDR and Ranger.
The fact that Scalyr is not included in this list is somewhat concerning, as Scalyr should be a growth driver for SentinelOne. Indexless ingestion is a natural fit for security use cases and should be a differentiator. Despite this, data consumption has been weak recently and is potentially one of the causes of SentinelOne's growth deterioration. In comparison, CrowdStrike ( CRWD ) has suggested that its LogScale product continues to perform well.
Purple AI
SentinelOne is trying to capitalize on AI hype with the introduction of its Purple AI product. This is essentially a LLM driven assistant which can help security teams through a natural language interface. Customer feedback from a live demonstration has reportedly been extremely positive.
Given the shortage of experienced cybersecurity personnel, this type of tool could be valuable in lessening the learning curve, but whether that is enough to drive revenue growth or product differentiation is unclear. If Purple AI is sufficiently effective it could also help security teams respond to threats faster and reduce operational cost.
CrowdStrike has also introduced an SOC assistant based on generative AI called Charlotte. LLMs are a commodity, but the data that they have access to is not. CrowdStrike has a high-fidelity data advantage based on 10 years of attack data, its threat graph and human analysis from OverWatch. CrowdStrike believes that the continuous human feedback provided by OverWatch, Falcon Complete and its intel teams is a competitive advantage. Given SentinelOne's focus on automated detection and response capabilities, Purple AI may be at a disadvantage as it likely has significantly less access to annotated data.
Competition
While there is a lot of concern regarding SentinelOne's competitive positioning, it is not clear that competition is a large problem at the moment. ASPs are reportedly stable , and the company continues to win against both legacy and next-gen vendors in most situations.
Management has suggested that some competitors are becoming more aggressive, especially when SentinelOne is targeting their clients. This includes vendors offering extremely favorable pricing or incentives, something that SentinelOne has stated that it will not do.
SentinelOne has suggested that Microsoft ( MSFT ) is a strong competitor, but this appears to depend on the target customer. SentinelOne has suggested that Microsoft isn't really competitive amongst more discerning customers, and that when Microsoft wins, it tends to be a decision led by a CFO-type of person. This is similar to CrowdStrike's suggestion that Microsoft tends to win through bundling and executive relationships.
The primary competitive concern for SentinelOne should be CrowdStrike's increased focus on the SMB segment. While this represents a significant long-term threat, it is likely too early for this to be having a significant impact. SentinelOne stated that growth from its MSSP partners was resilient in the first quarter and net customer additions were also fairly robust.
In comparison, CrowdStrike saw strong demand from SMBs in the first quarter and has seen some success with Falcon Go amongst these customers. CrowdStrike still needs to ramp its channel partners though. CrowdStrike's Dell partnership hasn't really gotten traction yet and the company only recently announced a partnership with Pax8. As CrowdStrike's SMB focused initiatives ramp, the competitive pressure on SentinelOne's business is likely to increase.
Financial Analysis
Revenue growth and net new ARR were both weak in the first quarter, which was in large part responsible for the negative share price reaction. SentinelOne's international business was a bright spot though, growing 84% YoY and now representing 35% of total revenue.
Revenue growth is only expected to be 38% YoY in the second quarter, with net new ARR continuing to decline YoY. Full year revenue growth is expected to be roughly 41% based on the assumption that the macro environment continues to deteriorate.
Figure 3: SentinelOne Revenue Growth (source: Created by author using data from company reports)
While SentinelOne's current financial performance is concerning, net customer additions continue to be robust. Customer retention remains strong and SentinelOne continues to achieve high win rates with stable pricing.
Customers with more than 100,000 in ARR increased 61% YoY, but growth in this cohort was very weak in the first quarter. Some of this is likely related to weak usage growth, but this figure may also have been impacted by the change SentinelOne made to how ARR is calculated.
SentinelOne's NRR dropped significantly in the first quarter, although the exact reason for this is unclear. Consumption growth has clearly been an issue, and seat additions are likely weak at the moment as well.
Figure 4: SentinelOne Customers (source: Created by author using data from SentinelOne)
SentinelOne had been making modest progress on improving margins, although this stalled in the first quarter. Poor revenue growth weighed on operating profit margins and the company has been forced to take action. SentinelOne is planning on laying off around 5% of its workforce and reducing future headcount growth plans. The company is also trying to reduce variable spend and cloud hosting costs, with an expected total impact of approximately 40 million USD.
Figure 5: SentinelOne Gross Profit Margins (source: Created by author using data from company reports) Figure 6: SentinelOne Operating Profit Margins (source: Created by author using data from company reports)
Valuation
SentinelOne's stock looks relatively inexpensive based on its growth rate and revenue multiple. There remain questions about the company's profit margins and competitive positioning though. An increased focus on the SMB segment by CrowdStrike will likely increase competitive pressure going forward and represents a downside risk.
A growth slowdown is not particularly surprising given the current macro environment and SentinelOne's focus on the SMB segment. More concerning is the company's ability to expand into adjacent verticals. Scalyr should be a bright spot for SentinelOne, but appears to be performing poorly.
Much of this is already priced into the stock though, particularly at the post-earnings lows. SentinelOne should continue to grow rapidly, particularly in a better demand environment and margins will improve over time.
Figure 8: SentinelOne Relative Valuation (source: Created by author using data from Seeking Alpha)
For further details see:
SentinelOne: Weak Consumption Is A Concern