SentinelOne - Great company but wait for a better price
Sentinel is a leader in endpoint and cloud protection with a $50 billion TAM
SentinelOne (S) is a new kind of cybersecurity company. Their software seeks to detect, prevent and respond to cybersecurity threats automatically. This is a step-up from many legacy solutions, which merely alerted cybersecurity staff about potential threats.
Sentinel’s stock has declined by 70% from its peak in November. That’s a pretty drastic reduction in valuation so let’s look closer at the company.
Cybersecurity attacks are rising across the world and have doubled over the past 2 years alone.
SentinelOne was founded in 2013 by Tomer Weingarten, Almog Cohen and Ehud Shamir. Both Weingarten and Cohen were childhood friends. Cohen worked at CheckPoint Software, ultimately becoming the director of innovation. Weingarten was an entrepreneur by heart, and built and sold his first company by the age of 24.1
In 2012, both Weingarten and Cohen identified the changing landscape of cybersecurity. They saw a market for a solution, that would automatically remediate cyber threats, instead of just alerting to them. They have succeeded in building a truly unique product and company.
Attacks are increasingly becoming automated and legacy solutions are not built to handle that kind of scale. In other words, if someone attacks you with machine speed, you need machine speed protection. Some of their customers house data for billions of users and Sentinel has to protect against crime syndicates and even hostile governments.
Sentinel’s initial focus was protecting endpoints, which are any devices connected to a network - laptops, desktops, IoT, etc. They have gradually expanded to cover cloud workloads and identity management.
Sentinel’s platform is called Singularity XDR and covers various aspects of cybersecurity - remediation & rollback, incident response,forensics, device and firewall control etc.
Since inception, the company has gathered massive amounts of data and developed AI systems that run on each cloud workload and each endpoint.
SentinelOne is essentially a data company. They analyze billions of data points and create algorithms that detect and prevent cyber attacks. The better their algorithms, the higher the detection rate and the better the protection. Data analysis is the main focus and their competitive advantage.
That’s why they acquired the data lake analytics company Scalyr for $155 million.2 The company is now offering Scalyr (under DataSet) for external customers and more applications than cybersecurity.
Malicious users (attacks) actually behave differently from regular users. They do things that normal users don’t and try to camouflage their activity. Both Weingarten and Cohen understood, that if they could train AI to recognize these patterns, their solution could be unrivaled.
Singularity platform has several AI elements:
Static AI - predicts file-based attacks
Behavioral AI - monitors behavior across the network
Streaming AI - connects various data streams and hunts for anomalies in them
Behavioral AI watches every endpoint connected to the platform and screens suspicious activity. It then constructs so-called Storylines, which is a record of activity in the network and contains any unauthorized changes to files. This allows them to track and roll back any harmful changes done.
Sentinel gathers data from customers and retains them for up to 3 years, which allows them to negate any harmful changes done in customer’s systems. It also means they have to pay higher hosting costs and store the data somewhere, which lowers gross margins.
Threats within SentinelOne are connected with intelligence from other security tools into unified alerts. This allows customers to discover how the system was breached and track it over time.
Example use cases for Sentinel’s AI:
Automatically denying access to a suspicious user
Restricting a user’s ability to send email when their endpoint is infected
Limiting an attacker’s ability to uncover IP and perform data exfiltration by limiting their access to cloud app
So in other words, it’s like a giant brain that constantly analyzes data and shuts down or reports suspicious activity. SentinelOne is a unique business, and there aren’t many companies out there who have similar software (except for Crowdstrike maybe).
The Singularity platform also features a marketplace with a handful of apps (Microsoft, Splunk etc.) that customers can easily integrate.
In May 2022, the company completed the acquisition of Attivo, which provides identity protection for users. This means that SentinelOne now protects endpoints (devices), cloud workloads and users. Nicholas Warner (president of security) mentioned on the Q1 2023 call that Attivo has the best identity protection product on the market, validated by MITRE as well.3
S Financials and outlook
SentinelOne’s revenue has grown from $46 million to $205 million in just 2 years!4 A lot of that was driven by heavy spending on marketing and R&D, while the operating loss climbed to $267 million.
This is clearly not sustainable but the company had to prove to large customers that their software works, and that’s pretty time-consuming and expensive. Operating costs as a % of revenue should come down in following quarters, and if they don’t, it’s a major red flag.
ARR (annualized recurring revenue) jumped 110% in last quarter. ARR means that if all customers at the end of Q keep and renew their contracts until the end of the year, revenue would be $339 million (excluding any new customers or churn).
I always like to look at sell-side analyst estimates, to see what the consensus is around the company. Analysts expect S to hit $1 billion in revenue by Jan 2025 along with three more years of operating losses.
The company also provided some Non-GAAP margin guidance but I don’t pay much attention to that. Non-GAAP is just another word for bullshit, as companies usually take many operating costs out of the equation. Stock-based compensation (SBC) is a very real cost, especially now that stock prices of many growth companies have collapsed.
Quarterly revenue jumped 109% to $78 million. However, operating loss was still $90 million! They are spending almost twice their revenue (all costs) to keep growing. Not good.
Sentinel spent almost 40% of revenue just on SBC. That’s way above other firms in the sector. Crowdstrike spent just 21% of revenue on SBC. They are clearly overspending to attract the best talent. Only time will tell if this is the correct strategy.
Gross margins improved quite a lot over the past few quarters which is a big positive. Their software might be scalable even after large hosting costs.
In Q1 2023 (April 2022), net revenue retention rate reached a new record of 131%.5 It means that the same customers are buying roughly 31% more from Sentinel than last year. Net retention rate above 120% is generally considered very good and it’s trending higher at Sentinel so that’s good news.
At the end of Q1, the company had $1.2 billion in cash and investments on its balance sheet (after Attivo acquisition) and very little debt. That gives them plenty of room to invest in R&D and sales without worrying much about current P&L.
The trouble is, that it masks what the true margins and growth are without burning money.
SentinelOne Management
CEO Tomer Weingarten has founded several companies before SentinelOne. He is really focused on building the best technology on the market and then making sure they can sell it to enterprises.
The initial sales strategy was to run alongside other cybersecurity products to demonstrate the sheer volume of attacks that they didn’t catch. Over time, customers began to notice and migrate to Singularity.
The importance of selling in enterprise software can never be underestimated. It takes a lot of time and energy to prove the use case and ROI of cybersecurity software to large companies. Maybe that’s why is Sentinel spending so heavily on marketing.
In a recent podcast6 , he talks about competitor Crowdstrike. He doesn’t focus much on competition, but he wants to understand their technology and go to market approach. To see if Sentinel has an advantage in either, if not how can they improve?
Weingarten is clearly a seasoned entrepreneur. The company has a Glassdoor rating of 4.6/5 and CEO approval of 92%, which are some of the highest I have ever seen. Maybe it’s got to do something with their generous compensation policy.
Major Shareholders
Weingarten owns 13.8 million shares, which is a 5% stake. Other co-founders no longer own significant stakes. Other holders include Insight Partners, Third Point Capital and Redpoint Ventures.
Competition
The whole industry is very competitive and there are many established and upcoming vendors. In endpoint protection, they compete with Crowdstrike and VMWare. In network security it’s Palo Alto Networks. And of course they also compete with legacy vendors such as Symantec, Trellix and Microsoft.
But their most relevant competitor is Crowdstrike, which has a similar AI-driven platform called Falcon. And how do they stack up? Here are links to the websites of each, where they compare their solutions:
https://go.crowdstrike.com/crowdstrike-vs-sentinelone-try-falcon.html
https://www.sentinelone.com/vs/crowdstrike/#:~:text=SentinelOne%20consistently%20outperforms%20CrowdStrike%20in,delays%2C%20and%20constant%20configuration%20tweaks.
It seems to me, that Crowdstrike is bad-mouthing Sentinel’s software and approach, while Sentinel shows relevant data from MITRE tests. The tests are an emulation of real-world attack techniques and enterprise requirements.
Here are the results compared to other competitors and SentinelOne looks like a leader:
Cybersecurity market size
The global cybersecurity market is expected to reach $382 billion by 2029, from $140 billion in 2021 (13.4% CAGR)7. There will likely be bumps on the road especially now that IT budgets might face downward revisions.
In their latest shareholder letter, SentinelOne estimates their addressable market at $50 billion. Even at 50% of that and capturing 10% would equal to revenue of $2.5 billion. The company is clearly gaining market share from competitors.
How much is SentinelOne’s stock worth?
Valuing a business like S that’s burning cash and growing fast is always hard.
I have created a simplified P&L using the sell-side analyst estimates and then adding some of mine (grey). Given that their profitability is so far away, it’s very difficult to create a DCF or value them based on a multiple of earnings.
Their revenue could grow 10x over the next 6 years, which is a very aggressive forecast. Using a P/S multiple of 7 or a FCF multiple of 40 in year 2028 would yield a market cap of $15.8 billion and $13 billion, or $14.4 billion at midpoint.
Using fully diluted shares of 443 million, I arrived at a price of $33, which is just 40% above the current one (6% CAGR). Why did I use a P/S multiple of 7 you ask? Well Microsoft and Google are trading at around 10x sales, and their business is much stronger and more profitable than Sentinel can potentially be.
At 10x sales in 2028 Sentinel’s price could be around $40, which is still just 10% CAGR.
Conclusion
SentinelOne is clearly one of the leaders in next-gen cybersecurity. Their competitive advantage is dependent on continuous research & development as well as data analytics. The quality of their algorithms is what separates them from competition. They must keep innovating and pushing in order to stay on top.
SentinelOne’s stock is clearly not a bargain even after a 70% drop. It’s trading at 25x LTM revenue and 16x forward revenue. It’s pretty clear they are growing fast but still burning a lot of money with no end in sight. I have added S to my watchlist but don’t plan to buy it yet.
https://www.calcalistech.com/ctech/articles/0,7340,L-3917654,00.html
https://www.techtarget.com/searchdatamanagement/news/252513879/SentinelOne-reboots-Scalyr-as-enterprise-data-platform
https://seekingalpha.com/article/4515887-sentinelone-inc-s-ceo-tomer-weingarten-on-q1-2023-results-earnings-call-transcript
https://d18rn0p25nwr6d.cloudfront.net/CIK-0001583708/bb9c7ec2-57d6-4692-becb-524f0e614316.pdf
https://s28.q4cdn.com/399982429/files/doc_financials/2023/q1/Q1-FY23-Shareholder-Letter-SentinelOne.pdf
https://www.listennotes.com/podcasts/founder-real-talk/tomer-weingarten-co-founder-PI1pgZlsNfd/
https://www.fortunebusinessinsights.com/industry-reports/cyber-security-market-101165