SentinelOne (S) Q1 2027: Non-Endpoint ARR Approaches 50% as Platform Diversification Accelerates
SentinelOne’s Q1 marked a pivotal inflection in platform mix, with non-endpoint ARR nearing half of total, underpinned by surging AI, data, and cloud adoption. Operating leverage and record net new ARR signal the company’s ability to scale profitably while capturing emerging security categories. Guidance reiteration reflects confidence in durable growth, even as management sharpens focus on high-conviction areas and trims organizational complexity.
Summary
- Platform Mix Shift: Non-endpoint ARR neared 50%, signaling effective diversification beyond legacy endpoint.
- AI Security Momentum: AI-driven offerings, particularly Prompt and Purple AI, are catalyzing new logos and larger deals.
- Margin Expansion Focus: Structural cost actions and AI productivity gains are driving multi-quarter operating leverage.
Business Overview
SentinelOne is a cybersecurity platform provider specializing in autonomous, AI-powered security solutions. The company monetizes through annual recurring revenue (ARR) from its Singularity platform, which spans endpoint security, AI security, cloud, and data solutions. Its revenue is increasingly diversified, with non-endpoint offerings—AI, data, and cloud—now approaching half of total ARR, reflecting a broadening beyond traditional endpoint protection.
Performance Analysis
Q1 showcased a step-change in business momentum, with total ARR growth accelerating and record net new ARR driven by both new logo wins and expanded platform adoption. International markets contributed 39% of revenue, reinforcing the company’s global reach. The company’s largest customers, those with $100,000 or more in ARR, grew 17% year over year, and gross retention remained stable, underscoring the stickiness of the platform.
Operating margin improvement was material, up roughly 550 basis points year over year, with free cash flow margin also expanding. This margin expansion is attributed to organizational streamlining and AI-driven productivity, enabling SentinelOne to reinvest in high-growth areas like AI security and cloud, without sacrificing profitability. Notably, the company’s remaining performance obligations (RPO) reached a record $1.5 billion, up 30%, providing multi-quarter revenue visibility.
- Platform Diversification: Non-endpoint solutions—AI, data, cloud—approached 50% of ARR, reducing reliance on endpoint security.
- AI Security ARR Surge: AI security ARR nearly doubled sequentially, with Prompt and Purple AI driving competitive wins and expansion.
- Operational Efficiency: Sales and marketing spend fell to 39% of revenue (from 47% YoY), with workforce optimization yielding $45 million in annualized savings.
SentinelOne’s ability to deliver both growth and margin expansion, while scaling new security categories, positions it as a credible contender for multi-year operating leverage and share gains in a rapidly evolving threat landscape.
Executive Commentary
"For the first time, the total ARR from our non-endpoint solutions approached 50%. This performance was driven by accelerated ARR growth of our AI security, data, and cloud solutions, a clear testament to the diversity and customer outcomes of the Singularity platform."
Tomer Weingarten, Chief Executive Officer
"We are sustaining a top-tier growth profile while rapidly expanding our profitability. Most importantly, we are driving this structural operating leverage without compromising our relentless pace of innovation."
Sonali Parekh, Chief Financial Officer
Strategic Positioning
1. Platform Expansion and Diversification
SentinelOne’s platform mix is undergoing a strategic transformation, with non-endpoint ARR now nearly half of total. This diversification is powered by rapid growth in AI security, data, and cloud solutions, reducing dependency on endpoint and creating multiple entry points for customer expansion. Cross-platform adoption is driving record ARR per customer and stickier relationships.
2. AI Security as a Market Catalyst
AI-native solutions like Prompt Security and Purple AI are emerging as lead products, both in new logo wins and competitive displacements. Prompt is frequently the “tip of the spear,” opening doors for broader platform consolidation, while Purple AI’s autonomous SOC capabilities are delivering measurable ROI and creating expansion opportunities that sometimes eclipse core endpoint deployments.
3. Operational Discipline and Cost Structure Reset
SentinelOne is leveraging AI-driven productivity and a targeted 8% workforce reduction to streamline operations and accelerate margin expansion. The company is reallocating resources toward high-conviction growth vectors—AI, data, cloud—while maintaining a strong innovation cadence. Sales and marketing efficiency gains, with spend down meaningfully as a percent of revenue, are freeing up capital for strategic reinvestment.
4. Go-to-Market and Ecosystem Leverage
Expanded partnerships with LevelBlue (largest MSSP) and Google Cloud are amplifying reach and embedding SentinelOne deeper into enterprise procurement channels. AWS Marketplace integration further lowers friction for cloud customers, while the MSSP channel enables scaled endpoint expansion without linear sales headcount increases.
5. Capital Allocation and Balance Sheet Strength
With over $812 million in cash and no debt, SentinelOne’s capital allocation remains focused on organic investment, with opportunistic share repurchases as a secondary lever. Inorganic activity is held to a high bar, with management emphasizing ROI discipline and flexibility to support innovation and market dislocations.
Key Considerations
This quarter’s results reflect a business at an inflection point, reaping the benefits of platform breadth and operational discipline. The shift toward non-endpoint ARR, AI-native product adoption, and efficient go-to-market execution are central to the investment case.
Key Considerations:
- AI Security as a Growth Engine: Prompt and Purple AI are not only expanding ARR but acting as catalysts for broader platform adoption and competitive displacement.
- Margin Expansion Sustainability: Multi-quarter operating leverage is being achieved through cost actions and productivity, with a clear path to further improvement as AI automation scales.
- Revenue Visibility: Record RPO and high retention rates create a durable revenue base, mitigating short-term volatility.
- Go-to-Market Focus: Streamlined sales organization and partner leverage (LevelBlue, AWS, Google) are reducing friction and enabling scaled expansion without proportional cost increases.
- Capital Flexibility: A robust balance sheet supports ongoing innovation and opportunistic capital deployment, with share repurchases as a potential upside lever.
Risks
Macro uncertainty and elongated sales cycles could impact deal timing, particularly for large, back-end loaded transactions. The company’s rapid product expansion introduces execution risk in maintaining best-in-class efficacy across multiple security domains. Competitive intensity remains high, especially as legacy vendors accelerate AI bolt-ons, while workforce reductions may create short-term disruption if not managed carefully. Management’s focus on high-conviction areas must translate to continued innovation and customer relevance to sustain momentum.
Forward Outlook
For Q2, SentinelOne guided to:
- Revenue between $289 and $291 million, representing 20% year-over-year growth at the midpoint
- Operating income between $23 and $25 million (8% margin at midpoint)
For full-year 2027, management maintained guidance:
- Revenue of $1.195 to $1.205 billion (20% growth at midpoint)
- Operating income of $115 to $125 million (10% margin at midpoint, a 650 basis point YoY increase)
- EPS of $0.32 to $0.38
Management highlighted several factors that will shape results:
- Strong pipeline and rising contribution from AI, data, and cloud
- Continued investment in high-ROI growth vectors, balanced with margin discipline
Takeaways
SentinelOne’s Q1 results provide evidence of a successful pivot from endpoint-centric to platform-centric growth, with AI security and data solutions emerging as key differentiators.
- Platform Mix Inflection: Non-endpoint ARR now approaches half of total, indicating effective strategy execution and future-proofing against endpoint commoditization.
- Margin and Productivity Gains: The company is delivering multi-quarter operating leverage without sacrificing innovation, a rare feat among high-growth security vendors.
- Future Watchpoints: Investors should monitor continued AI security adoption, net retention rates in large customer cohorts, and the pace of expansion in cloud and data ARR for signs of sustained outperformance.
Conclusion
SentinelOne’s Q1 marks a strategic inflection, with platform diversification and AI-native solutions driving both growth and profitability. The company’s ability to scale ARR beyond endpoint, while maintaining margin discipline and capital flexibility, positions it as a structural winner in the evolving cybersecurity landscape.
Industry Read-Through
The acceleration of non-endpoint ARR at SentinelOne is a leading indicator for the broader cybersecurity sector, highlighting a shift toward unified, AI-native platforms over legacy point solutions. Vendors unable to deliver integrated AI security, data, and cloud capabilities risk ceding share to more agile competitors. The rapid adoption of AI-native SOC tools and cloud runtime security suggests that buyers increasingly prioritize automation, ROI, and operational simplicity. Industry participants should expect further consolidation around platforms that can deliver end-to-end visibility and autonomous response, with MSSP and cloud channel partnerships becoming critical for scaled distribution.