SentinelOne (S) crossed $1 billion in annual revenue in fiscal year 2026, growing 22% year over year, and reported its first full year of non-GAAP operating profitability. The company ended the year with $769M in cash, zero debt, $51.9M in free cash flow, and 1,667 customers generating more than $100,000 in annual recurring revenue. It is guiding for approximately $1.2B in revenue in fiscal year 2027 with non-GAAP operating income of $110–120M, a step from 3% to roughly 9–10% non-GAAP operating margins in a single year. The stock closed March 12, 2026 at approximately $13.80 per share, down roughly 80% from its November 2021 all-time high of $76.30. The tension between those two facts (a business executing its profitability pivot on schedule, and a stock that has destroyed most of its post-IPO value) is the central question for anyone looking at SentinelOne today.
What SentinelOne Does
SentinelOne provides an AI-native cybersecurity platform called Singularity that protects endpoints, cloud workloads, and identities from cyber threats. Unlike traditional security software that relies on signature-based detection, the platform uses machine learning to detect and autonomously respond to threats in real time. The stated goal is an autonomous security operations center: an environment where AI handles the full detection-investigation-response loop without requiring human analysts to process each alert.
The platform has five primary components. Singularity Endpoint is the core EDR and XDR product, the original business and still the primary competitive battleground with CrowdStrike. Singularity Cloud provides cloud workload protection, expanded significantly through the February 2024 acquisition of PingSafe. Singularity Identity covers identity threat detection, built from the May 2022 acquisition of Attivo Networks. AI SIEM is a cloud-native security information and event management product built on the Singularity Data Lake. Purple AI is the generative AI security analyst layer, positioned as the interface through which analysts interact with the entire platform. On top of these, Wayfinder is the company’s managed detection and response service, functioning as a human supervision layer over autonomous platform actions.
The company does not break out revenue by product. All revenue is reported as a single segment.
Business Model
SentinelOne sells annual and multi-year subscriptions. The go-to-market model is hybrid: a direct enterprise sales force supplemented by a large ecosystem of managed security service providers, managed detection and response firms, value-added resellers, and OEM partners. Roughly 37% of revenue comes from outside the United States; international grew 30% in Q4 FY2026 alone. The land-and-expand motion follows a consistent pattern: a customer starts with endpoint protection, then adds cloud, identity, SIEM, or managed services as the platform matures within the account.
The cross-sell data from FY2026 shows this motion is working. The percentage of enterprise customers using three or more Singularity solutions grew from 39% to 65% in a single year. Customers using four or more solutions doubled from 19% to 42%. Customers using five or more solutions more than doubled from 9% to 22%. For the full fiscal year, non-endpoint solutions surpassed 50% of total annual bookings, a structural milestone that signals SentinelOne has evolved from an EDR vendor into a multi-product security platform. The upmarket motion is also showing in deal size: customers with more than $1M in annual ARR grew 20% year over year to 153 in Q4, and ARR per customer reached a company record.
The company has made seven acquisitions since its founding, spending approximately $1.1B in aggregate. The two most recent, Prompt Security ($180M, closed September 2025), which secures enterprise use of generative AI tools, and Observo AI ($225M, closed during Q3 FY2026), which provides AI-native data pipeline infrastructure, are strategic bets on the AI security theme rather than traditional endpoint defense. Both are early-stage assets integrated into a platform that already has $1B in annual revenue.
Financial Profile
SentinelOne’s fiscal year ends January 31. All figures below are for fiscal year 2026 (ending January 31, 2026) and Q4 FY2026 unless noted.
Income Statement
| Metric | Q4 FY2026 | Q4 FY2025 | FY2026 | FY2025 |
|---|---|---|---|---|
| Revenue | $271.2M | $225.5M | $1,001.3M | $821.5M |
| YoY Growth | +20% | N/A | +22% | N/A |
| Non-GAAP Gross Margin | 78% | 79% | 79% | 79% |
| GAAP Operating Margin | (29)% | (36)% | (32)% | (40)% |
| Non-GAAP Operating Margin | +6% | +1% | +3% | (3)% |
| Non-GAAP Net Income | $23.7M | $12.2M | $68.3M | $15.2M |
| Non-GAAP EPS (diluted) | $0.07 | $0.04 | $0.20 | $0.05 |
| GAAP Net Loss | ($110.2M) | ($70.8M) | ($450.7M) | ($288.4M) |
The GAAP loss figure for FY2026 requires two adjustments to interpret correctly. First, a $171M charge related to an advance pricing agreement with the Israeli Tax Authority (a discrete, non-recurring settlement) is embedded in the number. Removing it, the GAAP operating loss trajectory is improving materially and consistently. Second, and more consequentially for long-term shareholders, stock-based compensation of $297.6M (30% of revenue) is the primary driver of the GAAP-to-non-GAAP gap. That ratio improved modestly from 33% the prior year but remains well above the enterprise software average, though not unusual for high-growth cybersecurity companies at this stage; Snowflake, for comparison, has run SBC above 40% of revenue in recent years. It is the reason the company will not be GAAP profitable in FY2027 despite reaching approximately 10% non-GAAP operating margins. No analyst asked about it on the Q4 earnings call, and management did not address it proactively. At $298M in annual SBC on $1B in revenue, the company is effectively paying roughly $3 in stock for every $10 it earns, a real cost that non-GAAP metrics exclude by design.
Balance Sheet and Cash Flow
| Metric | Jan 31, 2026 | Jan 31, 2025 |
|---|---|---|
| Cash and investments | $769.6M | $1,141.3M |
| Total debt | $0 | $0 |
| Goodwill | $912.7M | $629.6M |
| Deferred revenue | $633.1M | $572.1M |
| Accumulated deficit | ($2,078M) | ($1,627M) |
Cash declined $372M during the year, consumed by $249M in acquisition spending and $200M in share repurchases, partially offset by $76.6M in operating cash flow. Free cash flow was $51.9M for the full year, a significant improvement from $6.7M in FY2025. The company has delivered two consecutive years of positive free cash flow. The goodwill increase of $283M reflects the Prompt Security and Observo AI acquisitions.
Product-Level ARR (Q4 FY2026)
| Product Line | ARR | Notes |
|---|---|---|
| Cloud Security | $160M+ | Strong runtime workload demand; on-prem and cloud |
| Data Solutions | $130M+ | Growth accelerating sequentially; SIEM Innovation of the Year |
| Wayfinder Threat Services | $100M+ | Just crossed $100M; 99% of threats resolved without customer action |
| Prompt Security (AI Security) | N/A | More than doubled sequentially in Q4; standalone Fortune 500 wins |
SentinelOne now has three product lines above $100M in ARR outside of its core endpoint business, with a fourth on a steep trajectory. Purple AI hit a record attach rate of over 50% on licenses sold in Q4. According to an IDC study cited on the earnings call, Purple users experienced 55% faster threat remediation, 60% lower likelihood of major incidents, and a 338% return on investment over three years.
FY2027 Guidance (issued March 12, 2026)
| Metric | Q1 FY2027 | FY2027 |
|---|---|---|
| Revenue | $276–278M | $1.195–1.205B |
| Non-GAAP Operating Income | $4–6M | $110–120M |
| Non-GAAP EPS | $0.01–0.02 | $0.32–0.38 |
| Adjusted FCF Margin | Low teens | ~tracking op margin |
The revenue guide implies approximately 20% growth, a modest deceleration from 22%. The operating income guide implies a step from $34.6M to approximately $115M, a tripling in a single year, driven by operating leverage as headcount growth remains flat and AI tooling improves engineering productivity. Weingarten confirmed on the call that a meaningful share of the company’s code is now AI-generated. The Q1 FCF guide of “low teens” is strong for a seasonally weak quarter. Note that a $40M ITA settlement payment is scheduled for FY2027, disclosed in the January 8-K; the adjusted FCF guidance accounts for this. Diluted share count is guided to 352M for the full year, up from approximately 335M, meaning the $200M buyback program is partially but not fully offsetting SBC-related dilution.
Management is explicitly targeting the Rule of 40, the software benchmark combining revenue growth rate and free cash flow or operating margin. FY2026 came in at approximately 25 (22% growth + 3% non-GAAP operating margin). FY2027 guidance puts the company at approximately 30 (20% growth + 10% non-GAAP operating margin). Sustained execution gets them to 40 in the following two to three years.
One structural model change worth noting: management guided to a shift in seasonality from the historical 40/60 first-half/second-half ARR pattern to approximately 50/50 in FY2027. Weingarten confirmed that FY2027 net new ARR is expected to come in at approximately $200M, a slight improvement over FY2026, with the first half materially stronger than prior years. Front-loading ARR additions has a compounding positive effect on revenue recognition throughout the year.
The Insider Transaction Record
The December 2025 version of this article described Weingarten as having sold approximately 77% of his stake with zero insider purchases. That characterization was incorrect in two important ways, and it is worth correcting in detail.
On the “77% sold” figure. The original analysis tracked only Weingarten’s Class A shares, which declined from approximately 4.8 million at the IPO to roughly 1 million by late 2025. It did not account for his Class B shares, which are his primary economic holding. His total beneficial ownership as of April 30, 2025, including Class A, Class B held directly, Class B held in trust, and Class B options exercisable within 60 days, is approximately 7.5 million shares. He holds more shares today than the IPO-era Class A count would suggest, because he has continued to receive RSU and option grants as part of his compensation. The premise that he has sold off most of his stake is not supported by the full ownership picture.
On the “78 sales, 0 buys” characterization. Of the roughly one hundred Form 4 filings Weingarten has made since the IPO, the substantial majority involve transaction code “S,” which appears to be an open-market sale but in nearly every case carries a specific footnote: “The sale reported on this Form 4 represents an Issuer mandated sale by the Reporting Person to cover tax withholding obligations in connection with the vesting and settlement of Restricted Stock Units, and it does NOT represent a discretionary trade by the Reporting Person.” SentinelOne uses a sell-to-cover mechanism for RSU tax withholding rather than share withholding, which generates a Form 4 coded “S” rather than “F”, creating the appearance of repeated discretionary selling when the underlying transaction is automatic and mandatory. There is no evidence from the filings that Weingarten has executed a single discretionary open-market sale.
Other non-discretionary events in the filing record include a charitable donation of 158,997 Class A shares to a foundation in December 2024, and a court-ordered transfer of shares to an ex-spouse pursuant to a marital settlement agreement, also in December 2024. The divorce settlement converted approximately 62,500 Class B shares to Class A before transferring them, which reduced his Class B count and voting concentration modestly. None of these are selling decisions.
The one executive with a genuine discretionary selling program is Ric Smith, who served as President of Product, Technology and Operations until his departure in September 2025. Smith adopted a Rule 10b5-1 trading plan on April 15, 2025 and executed sales through it in August and September 2025 via WilmerHale as filing agent. His sales were modest relative to his total position, approximately 15,000 shares, and predated his departure.
Insight Ventures has been slowly reducing its position through Rule 144 sales filed as Form 144 notices. Across approximately thirty separate fund entities, Insight filed batches of Form 144 sales in both July 2025 and October 2025. Each individual filing covers a small number of shares, but the aggregate represents a systematic wind-down consistent with a PE fund managing liquidity across a multi-fund position. The amounts are small relative to Insight’s total holding, but the direction is unambiguous.
On “zero insider purchases”: Mark Peek, who chairs the Compensation Committee and served as CFO of both Workday and VMware, purchased 40,000 Class A shares in the open market at $14.89 per share on December 16, 2025, through his Omega Living Trust, a genuine, discretionary conviction buy of approximately $596,000. It is the only open-market purchase in the filing record since the IPO.
The accurate summary: Weingarten is neither fleeing nor adding. Smith was a measured seller who subsequently departed. Insight is a slow, systematic seller consistent with fund wind-down behavior. And one experienced director, arguably the most qualified person on the board to evaluate financial value, spent $596,000 of his own money buying the stock at $14.89.
Competitive Position
SentinelOne is the primary pure-play alternative to CrowdStrike in the enterprise endpoint security market. CrowdStrike generated approximately $4.2B in revenue in its most recent fiscal year at roughly 22% growth, operates at significant GAAP profitability, and commands a market cap above $90 billion. SentinelOne is approximately one-quarter the size by revenue and roughly one-twentieth the size by market cap.
The practical consequence of that scale gap is a persistent sales force and brand recognition disadvantage. CrowdStrike’s July 2024 software outage was expected to drive displacement wins toward SentinelOne, and it provided some competitive tailwind. A concrete example from Q4: Cloudflare, which secures approximately 40% of all human-originated internet traffic, migrated to SentinelOne from CrowdStrike in under 24 hours with zero interruption. After a competitive proof of concept, Cloudflare selected the Singularity platform citing superior technology and ease of use, signing a seven-figure deal that includes endpoint, Purple AI, and Wayfinder Elite. That is a brand-name, technically credible displacement win from the market leader. But it has not yet translated into a sustained acceleration in ARR growth rates, and the broader market dynamic remains one where enterprises are cautious about switching primary security vendors given the operational risk of migration.
An underappreciated competitive dimension is on-premise and sovereign deployment capability. Weingarten described triple-digit booking growth in Q4 from customers requiring true on-premise security with no cloud dependency, specifically frontier AI labs developing models in air-gapped environments where data sovereignty is paramount. He noted that “our competitors have no ability to secure these environments.” A top frontier AI lab selected Singularity to secure mission-critical infrastructure for its flagship model development. A large global postal operator signed a five-year on-premise commitment. This on-premise growth vector is new and counter-narrative for a company generally understood as cloud-first.
Microsoft Defender, bundled with Microsoft 365 E5 licenses, remains the other significant competitive pressure. SentinelOne’s response is the same as CrowdStrike’s: compete on platform depth, AI capabilities, and cross-platform coverage that Microsoft cannot replicate across non-Windows environments with the same fidelity.
The differentiated strategic bet, security for AI systems alongside AI-powered security operations, is showing early commercial traction. Prompt Security ARR more than doubled sequentially in Q4. SentinelOne is winning standalone AI security deals with Fortune 500 companies, including a Fortune 100 financial services firm that deployed nearly 100,000 Prompt licenses. AI security is also generating wins from customers of direct competitors, functioning as a new entry point into accounts that might otherwise remain with CrowdStrike. Weingarten described this as a “new strategic entry point to expand market share and footprint.”
SentinelOne also received FedRAMP High Impact authorization during FY2026, the highest federal security classification, required for systems handling sensitive government data. This opens the federal and state, local, and education markets in a meaningful way, and most cybersecurity vendors never achieve it.
Valuation
SentinelOne trades at approximately $13.80 per share as of March 12, 2026, against approximately 335 million diluted shares outstanding, implying a market cap of approximately $4.6 billion. With $769.6M in net cash and no debt, enterprise value is approximately $3.8 billion.
| Metric | SentinelOne | CrowdStrike |
|---|---|---|
| Market Cap | ~$4.6B | ~$92B+ |
| EV / NTM Revenue | ~3.0x | ~18x |
| EV / ARR | ~3.4x | ~16x |
| Non-GAAP Op Margin (NTM) | ~9–10% | ~25%+ |
The 80%+ discount to CrowdStrike on revenue multiples reflects the scale, profitability, and brand recognition gap. Whether it is too large a discount depends on whether SentinelOne can sustain 20% revenue growth while expanding non-GAAP operating margins as guided, and whether the Prompt Security and Observo AI acquisitions integrate without disrupting core execution.
Scenario Analysis
| Scenario | Conditions | Price Range |
|---|---|---|
| Bear | Growth decelerates to 13–15%; acquisitions dilute focus; SBC remains 30%+ of revenue indefinitely; margin expansion disappoints | $8–10 |
| Base | 20% growth sustained; FY2027 guidance achieved; stock re-rates toward 5–6x NTM revenue | $18–22 |
| Bull | Growth reaccelerates to 23–25%; AI security and on-premise vectors scale materially; profitability inflection draws multiple expansion toward Rule of 40 | $28–38 |
The bear case implies the current price is approximately right. The base case, which simply requires the company to execute its own guidance, implies 30–60% upside from current levels. The $200M buyback program the company has been executing is a meaningful data point for valuation: at $4.6B market cap, $200M in repurchases at these prices is capital-efficient if management’s internal view is that the stock is worth more than $13.
What to Watch
| Catalyst | Why It Matters | Timeline |
|---|---|---|
| Q1 FY2027 ARR growth rate and net new ARR | Weingarten guided to ~$200M in FY2027 net new ARR and a more balanced 50/50 H1/H2 seasonality; Q1 is the first test of that claim | June 2026 earnings |
| Non-GAAP operating margin toward 10% | FY2027 guidance calls for $110–120M; Q1’s $4–6M guide is the seasonal low; trajectory through the year will show whether the guide is achievable | Each earnings release |
| SBC as a percentage of revenue | At 30% of revenue, the gap between GAAP and non-GAAP profitability remains wide; any management commentary on reducing SBC intensity would be a meaningful signal | Annual proxy / 10-K |
| New CFO Sonalee Parekh | Starts March 24; Weingarten’s stated priorities for her are go-to-market efficiency, balancing emerging product investment, and profitability acceleration; her first earnings call will be Q1 FY2027 | June 2026 |
| Product ARR milestones | Data ($130M+), cloud ($160M+), and Wayfinder ($100M+) are each on growth trajectories; Prompt Security’s sequential doubling needs to sustain to validate the AI security thesis | Each earnings release |
| On-premise and sovereign deployment growth | Triple-digit bookings in Q4 from frontier AI lab and government environments; this vector is new, underappreciated, and has no direct CrowdStrike competition | H2 FY2027 earnings |
| Insight Ventures Form 144 activity | Volume and pace of Rule 144 sales; acceleration as the 2028 sunset approaches would signal increasing urgency for a liquidity event | Ongoing |
| Israeli Tax Authority residual risk | The $171M discrete charge was the settlement; $40M in cash payments due in FY2027; any new transfer pricing disputes should be disclosed | 10-K filing |
| Any open-market insider purchases | Mark Peek’s $596K purchase in December 2025 is the only example since the IPO; additional purchases by financially sophisticated insiders would be a notable signal | Ongoing |
| Dual-class sunset (June 2028) | Weingarten and Insight go from 48.5% combined voting power to 7.1%; changes acquisition feasibility and activist dynamics entirely | June 29, 2028 |
SentinelOne Q4 FY2026 Earnings Release — Exhibit 99.1 (March 12, 2026)
SentinelOne Q4 FY2026 Earnings Call Transcript (March 12, 2026)
SentinelOne 8-K (March 12, 2026)
SentinelOne 10-K FY2025 (March 26, 2025)
SentinelOne DEF 14A: Proxy Statement (May 14, 2025)
Mark Peek Form 4: Open Market Purchase (December 16, 2025)
Ric Smith Form 4: 10b5-1 Plan Sales (August 2025)
Insight Partners Form 144: Rule 144 Sales (October 2025)
Research and analysis conducted with AI assistance using SEC EDGAR filings and public disclosures as primary sources.