SentinelOne (S) Q1 2026: AI Attach Rate Hits 25% as Platform Expansion Outpaces Legacy Mix

2025-05-28 | By EarningsIQ Research

SentinelOne’s Q1 saw a decisive shift toward platform-led growth, with AI and data modules now driving half of bookings and an AI attach rate surpassing 25% of new subscriptions. While macro-driven deal delays weighed on net new ARR, the company’s pivot to flexible platform consumption and deepening AI integration is broadening customer value and setting the stage for margin-led expansion. Investors should watch for the pace of recovery in large enterprise and federal deals, as well as the impact of new platform sales motions on long-term growth velocity.

Summary

  • AI-Driven Platform Adoption: AI modules now attach to over a quarter of new deals, fueling higher per-customer value.
  • Macro Volatility Impacts Near-Term Growth: Large deal delays and elongated sales cycles pressured net new ARR, but core demand signals remain resilient.
  • Margin Expansion and Cash Generation: Record free cash flow and ongoing cost discipline reinforce SentinelOne’s path to sustainable profitability.

Performance Analysis

SentinelOne delivered 23% revenue growth in Q1, outpacing expectations despite a more pronounced slowdown in net new ARR, which management attributed to macro-driven deal delays—especially in April, the company’s largest month of the smallest quarter. International markets contributed 38% of revenue, growing faster than the overall business at 27% year-over-year, signaling balanced geographic expansion.

Platform adoption was the clear growth driver, with non-endpoint solutions representing roughly half of quarterly bookings and average deal size rising double digits. The company’s AI security module, Purple AI, achieved triple-digit bookings growth and a 25% attach rate, meaning one in four subscriptions sold included AI capabilities. Data solutions surpassed $100 million in annual recurring revenue (ARR), and contract duration expanded, reflecting deeper customer commitment. Free cash flow margin hit a record 20%, and operating margin improved over 4 points year-over-year, supporting a fourth consecutive quarter of positive net income.

  • AI Attach Rate Surges: Over 25% of new subscriptions included AI, driving a 25% uplift in deal size.
  • Federal and Large Enterprise Deals Delayed: Longer sales cycles, not churn, drove the net new ARR softness.
  • Cash Flow Outperformance: Record free cash flow margin and $1.2 billion in cash provide capital allocation flexibility.

While near-term net new ARR was pressured by deal timing, SentinelOne’s ability to expand existing customer value and secure longer-term contracts signals enduring demand for its unified AI-powered security platform.

Executive Commentary

"Purple AI achieved triple-digit year-over-year growth in quarterly bookings, underscoring strong market demand and momentum. It also achieved an attach rate that exceeded 25% across subscriptions sold in the quarter, demonstrating a strong start to the year and accelerating customer adoption of our AI security solution."

Tomer Weingarten, CEO

"We maintained an industry-leading gross margin of 79%, and our operating margin expanded over 4 percentage points year-over-year to negative 2%. We also achieved our fourth consecutive quarter of positive net income. This performance was driven by scale, cost discipline, and our focused investment strategy."

Barbara Larson, CFO

Strategic Positioning

1. AI and Data Modules Shift Mix Toward Platform Value

SentinelOne’s business model is transitioning from single-point product sales to a unified platform approach, with non-endpoint solutions—AI, data, and cloud—now accounting for approximately half of new bookings. Purple AI’s rapid adoption and the data business crossing $100 million ARR highlight a strategic pivot to higher-value, stickier offerings. The company’s new cloud security suite and AI SIEM (Security Information and Event Management, a unified log management and threat detection platform) are resonating with large customers seeking to consolidate vendors and reduce operational complexity.

2. Flexible Consumption and Go-To-Market Evolution

Leadership is retooling the go-to-market motion to emphasize platform sales over point product selling, aiming to make modules more accessible and easier to deploy. This includes bundling AI into foundational packages, resulting in immediate adoption and price uplift. The new PartnerOne program, designed for managed security service providers (MSSPs), incident responders, and value-added resellers (VARs), is expected to broaden reach and reinforce SentinelOne’s ecosystem position.

3. Public Sector and Federal Momentum Amid Uncertainty

SentinelOne achieved FedRAMP High authorization for its full platform, including the agentic AI module, making it the only such solution approved for US government use. While federal deal timelines remain unpredictable due to budgetary constraints and evolving procurement processes, the company closed a seven-figure renewal in early Q2 and sees a robust pipeline, positioning it for further public sector expansion once budget clarity returns.

4. Margin Discipline and Capital Allocation

Operating leverage remains a core focus, with gross margins near 80% and a record free cash flow margin of 20%. The newly announced $200 million share repurchase authorization signals management’s confidence in the company’s long-term fundamentals and undervaluation. Investments are being concentrated in R&D, especially AI and automation, while sales and marketing hiring is closely tied to growth opportunities and platform enablement.

Key Considerations

SentinelOne’s Q1 marks an inflection point as the company pivots decisively to a platform-led model, but near-term growth is clouded by macro-driven delays and evolving customer procurement patterns. Investors must weigh the sustainability of AI-led expansion against the unpredictability of large deal timing.

Key Considerations:

  • AI Monetization Trajectory: Purple AI’s attach rate and deal uplift validate the monetization of AI, but future growth depends on the success of agentic add-ons and broader platform adoption.
  • Deal Timing Sensitivity: Elongated sales cycles in large enterprise and federal segments highlight vulnerability to external shocks, even as win rates and pipeline remain strong.
  • Go-To-Market Execution Risk: Shifting from product-centric to platform-centric sales requires ongoing enablement, partner alignment, and customer education to avoid friction and maximize cross-sell.
  • Capital Allocation Optionality: Strong cash generation supports both buybacks and continued innovation investment, providing resilience amid market volatility.

Risks

SentinelOne faces material risks from macroeconomic volatility, especially in large enterprise and public sector deal cycles, which could further disrupt net new ARR if uncertainty persists. The shift to platform selling, while strategically sound, may introduce execution risk as sales teams and partners adapt to new motions. Competitive dynamics in AI-driven security and the pace of customer migration from legacy SIEM and endpoint providers remain ongoing challenges. Management’s more cautious full-year outlook reflects these uncertainties.

Forward Outlook

For Q2, SentinelOne guided to:

  • Revenue of approximately $242 million, reflecting 22% growth and above-seasonal net new ARR sequentially.
  • Gross margin to remain near 79%, with Q2 operating margin breakeven.

For full-year 2026, management maintained guidance of:

  • Revenue of $996 million to $1.1 billion, representing 22% growth.
  • Operating margin of 3% to 4%, an improvement of over 650 basis points versus FY25.

Management highlighted:

  • Improved trends in May after April’s slowdown, supporting confidence in Q2 and second-half acceleration.
  • Continued focus on AI and data module expansion, deeper customer adoption, and operational efficiency.

Takeaways

SentinelOne’s Q1 underscores the company’s evolution into a unified AI security platform, with margin and cash flow outperformance offsetting near-term ARR volatility. The strategic bet on AI attach and platform flexibility is gaining traction, but investors need to monitor the pace of large deal recovery and execution of the new go-to-market model.

  • Platform-Led Growth: Non-endpoint modules and AI attach are reshaping the business mix, driving higher per-customer value and longer-term contracts.
  • Execution in a Volatile Environment: Macro-driven deal delays, especially in large enterprise and federal, are a near-term headwind, but underlying demand and win rates remain solid.
  • Watch for Platform Sales Maturity: The success of the platform-centric sales approach and expanding partner ecosystem will determine the durability of growth and margin expansion in coming quarters.

Conclusion

SentinelOne’s Q1 2026 results mark a pivotal transition toward AI-powered platform adoption and margin-led growth, even as macro volatility clouds near-term ARR visibility. Investors should focus on the company’s ability to accelerate platform expansion and maintain discipline as the competitive landscape shifts toward integrated, autonomous security solutions.

Industry Read-Through

SentinelOne’s results reinforce a broader cybersecurity industry pivot from legacy point solutions to AI-driven, unified platforms that promise operational efficiency and real-time response. The rapid uptake of agentic AI modules and cloud-native SIEM reflects customer demand for consolidation and automation, putting pressure on incumbents with fragmented or latency-prone architectures. The public sector’s shift toward FedRAMP-authorized, AI-enabled platforms signals a new standard for government procurement, likely accelerating similar requirements in adjacent regulated industries. Platform flexibility and AI attach strategies are now table stakes for growth in the security software sector.

S Technology Cybersecurity AI Platform Cloud Profitability