SentinelOne (S) Q2 2026: Flex Model Fuels 40% Net New ARR Upside as AI Platform Expands

August 28, 2025 | By EarningsIQ Research

SentinelOne’s Q2 marked a pivotal inflection as the new Flex licensing model and AI-native platform solutions drove a 40% beat in net new annual recurring revenue (ARR), broadening both customer base and wallet share. Platform expansion, led by Purple AI and data solutions, is reshaping the company’s business mix and competitive posture. Management’s measured guidance reflects both robust underlying demand and discipline amid macro uncertainty, setting the stage for a multi-year platform-led growth cycle.

Summary

• Platform Expansion Drives Growth: Flex licensing and AI-native modules are accelerating customer adoption across endpoint, cloud, and data.
• Margin Leverage Emerges: Operating and gross margin expansion signal scalable unit economics even as innovation investment continues.
• AI Security as Strategic Imperative: Prompt Security acquisition positions SentinelOne at the forefront of generative AI risk management.

Performance Analysis

SentinelOne delivered a breakout Q2, crossing $1 billion in ARR with 24% YoY growth and a record $53 million in net new ARR—beating internal expectations by roughly 40%. Revenue grew 22% to $242 million, with international sales now 38% of the mix, highlighting global traction. Large customer count (>$100K ARR) grew 23% to 1,513, and average deal size hit a new high, reflecting both new logo wins and deeper platform adoption.

Margin structure improved materially: Gross margin stayed robust at 79%, and operating margin swung to 2% (up 500bps YoY), with net income margin at 5%. Free cash flow margin reached 2% on a trailing 12-month basis. Remaining performance obligations (RPO), a forward indicator of contracted revenue, rose 26% to $1.2 billion with stable contract durations. The balance sheet remains fortress-like with $1.2 billion cash and no debt, enabling continued strategic investment.

• Flex Model Adoption: The new unified licensing approach unlocked eight-figure deals and is enabling both new and existing customers to expand platform usage with less friction.
• Non-Endpoint Momentum: Half of quarterly bookings now come from non-endpoint solutions, with AI SIEM and Purple AI delivering triple-digit growth and record attach rates.
• Operating Discipline: Margin improvement reflects pricing power, platform leverage, and ongoing productivity gains even as R&D and go-to-market investments ramp up.

SentinelOne’s broad-based growth and rising platform mix suggest the business is scaling beyond its endpoint security roots, with AI and cloud modules now core growth drivers.

Executive Commentary

Strategic Positioning

1. Flex Licensing Model as Platform Catalyst

SentinelOne Flex, a unified and flexible licensing construct, is fundamentally changing how customers consume the Singularity platform. By allowing organizations to dynamically allocate entitlements and easily trial new modules, Flex is increasing deal sizes, accelerating sales cycles, and driving broader platform adoption across both new and renewing clients. Management highlighted that Flex already enabled eight-figure deals and is expected to drive higher retention and expansion rates as customers consolidate spend.

2. AI-Native Security Solutions Gain Critical Mass

Purple AI, SentinelOne’s generative AI security assistant, is now attached to over 30% of licenses sold and is landing seven-figure ARR deals as a standalone product. Customers are realizing tangible operational benefits—IDC found a 55% reduction in threat remediation time and a 338% three-year ROI for Purple AI users. This rapid adoption is rare in enterprise security and positions SentinelOne as a differentiated AI-first security platform. The Prompt Security acquisition extends this lead into GenAI and DLP (data loss prevention), a fast-emerging risk category.

3. Cloud and Data Platform Expansion

Cloud security and AI SIEM (security information and event management) are now core to SentinelOne’s platform narrative. A Fortune 50 win and record bookings in data modules underscore the shift away from endpoint-only sales. The company’s cloud-native architecture and real-time streaming analytics are resonating with large enterprises seeking unified visibility and automation across hybrid and multi-cloud environments.

4. Partner Ecosystem and Hyperscaler Integration

SentinelOne’s partner-led go-to-market is scaling, with managed security service providers (MSSPs) and hyperscaler alliances (notably AWS marketplace listings) acting as force multipliers. The company was named Pax8’s most valuable vendor and is a launch partner for AWS Security Hub, expanding its reach and embedding the platform in broader cloud and managed security workflows.

5. Operational Discipline and Capital Allocation

Margin improvement and cash generation are being balanced with sustained investment in R&D and strategic M&A. The $180 million Prompt Security acquisition is expected to be immaterial to FY26 revenue but positions the company for long-term AI-native security leadership. Management’s commentary reflects a focus on both durable growth and responsible cost structure as the business scales.

Key Considerations

This quarter marks a clear transition from product-led to platform-led growth, with SentinelOne leveraging Flex and AI modules to deepen customer engagement and expand wallet share. The company’s margin progress and cash generation signal a maturing operating model, while the Prompt Security deal opens a new frontier in AI risk management. Investors should weigh:

Key Considerations:

• Flex Model Impact: Early adoption is driving larger deals and higher attach rates, but long-term uplift will depend on sustained customer expansion and competitive differentiation.
• AI-Native Differentiation: Purple AI’s rapid adoption and measurable business outcomes validate SentinelOne’s AI-first thesis, but the GenAI/DLP market is still nascent and evolving.
• Cloud Security Traction: Large enterprise wins and architectural fit for hybrid environments are expanding the company’s addressable market, but execution against entrenched incumbents will be key.
• Margin and Cash Flow Leverage: Operating and free cash flow margins are improving, but continued investment in innovation and go-to-market will test discipline if macro conditions tighten.

Risks

Macro uncertainty, elongated deal cycles, and timing of large transactions remain material risks, as reflected in management’s cautious guidance for the back half. The AI and cloud security markets are fast-moving and competitive, and SentinelOne must execute against larger, well-capitalized peers while scaling new offerings like Prompt Security. Integration risk and customer adoption of new modules may also affect revenue visibility.

Forward Outlook

For Q3, SentinelOne guided to:

• Revenue of approximately $256 million, up 22% YoY
• Gross margin of about 78.5%
• Operating margin of about 4%, up 900bps YoY

For full-year 2026, management raised guidance to:

• Revenue of $998 million to $1.002 billion (22% YoY growth at midpoint)
• Gross margin between 78.5% and 79%
• Operating margin of about 3%, up 600bps YoY

Management cited a strong pipeline and platform momentum but maintained prudent assumptions around deal timing, macro, and federal sector variability. The Prompt Security acquisition is expected to have an 80bps impact on full-year operating margin but minimal top-line effect in FY26.

• Flex and AI modules are expected to drive further expansion opportunities.
• Free cash flow is targeted to be several points above operating margin for the year.

Takeaways

SentinelOne’s Q2 signals a structural shift to platform-led growth, with Flex licensing and AI-native solutions accelerating both customer acquisition and expansion. Margin leverage and cash generation are emerging as differentiators, even as the company invests in new growth vectors like GenAI security. Management’s measured outlook reflects both confidence in execution and realism about market headwinds.

• Platform-Led Growth: Broad-based adoption of Flex and AI modules is increasing deal velocity, customer retention, and average contract size.
• Margin Expansion: Operating and free cash flow margins are trending up, supporting ongoing innovation investment and strategic M&A.
• Future Watch: Investors should monitor Flex adoption rates, Prompt Security integration, and competitive dynamics in AI and cloud security as key drivers of sustainable growth.

Conclusion

SentinelOne’s execution this quarter demonstrates a successful pivot from endpoint product leader to AI-powered security platform, with Flex and Purple AI catalyzing both growth and operational leverage. The company is well-positioned for the next phase of cybersecurity, but must continue to deliver on innovation and disciplined growth in a dynamic market.

Industry Read-Through

SentinelOne’s results confirm that unified, AI-native security platforms are gaining share as enterprises seek to consolidate vendors and automate threat response across endpoints, cloud, and data. The rapid adoption of generative AI security modules and flexible licensing models is likely to become table stakes across the sector, pressuring legacy point solutions and forcing incumbents to accelerate platform integration. The Prompt Security acquisition highlights the growing urgency around GenAI risk management and DLP, with implications for both cybersecurity and broader enterprise software providers. Investors should expect increased M&A and innovation around AI governance, automation, and unified security operations as digital transformation accelerates.

S Technology Cybersecurity AI Platform Cloud Licensing