S

Hello, and welcome to the SentinelOne Q1 FY 2027 earnings conference call. We ask that you please hold all questions until the completion of the formal remarks, at which time you will be given instructions for the question and answer session. Also, as a reminder, this conference is being recorded today. If you have any objections, please disconnect your call. I will now turn the call over to Saad Nazir, Vice President of Investor Relations.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the first quarter of fiscal year 2027, which ended April 30, 2026. With us today are Tomer Weingarten, CEO, and Sonalee Parekh, CFO. Our press release and an earnings presentation were issued earlier today and are posted on the investor relations section of our website. This call and accompanying slides are being broadcast live via webcast, and a replay will be available on our website shortly after the call. Before we begin, I would like to remind you that during today's call, we'll be making forward-looking statements about financial performance and future events, including our guidance for the fiscal second quarter and full fiscal year 2027, as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us, and that our actual results or events could differ materially.

Please refer to the documents we file from time to time with the SEC, in particular our quarterly reports on Form 10-Q and annual report on Form 10-K. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons why actual results may differ materially from those anticipated, even if new information becomes available in the future. During this call, we will discuss non-GAAP financial measures, and all comparisons made are year-over-year, unless otherwise noted.

These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our earnings presentation. These non-GAAP measures are not intended to be a substitute for our GAAP results. Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges, gains on strategic investments, impact of the previously announced ITA tax settlement, and income tax provision, which cannot be determined at this time and are therefore not reconciled in today's press release. With that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our first quarter earnings call. Q1 was a solid start to the year for SentinelOne. We delivered strong revenue growth, record net new ARR growth, and significant operating margin improvement year-over-year. Total ARR growth accelerated to 23% in Q1, driven by strong new logo acquisition and expansion with existing customers. We delivered $44 million in net new ARR in Q1, a 55% increase year-over-year, setting a new company record. This marks our fourth consecutive quarter of positive net new ARR growth while exceeding expectations. These results showcase execution consistency and strong business momentum. Our platform strategy is showing solid traction. We have established clear technology leadership across the most critical domains of cybersecurity, including AI, data, cloud, and endpoint.

Enterprises realize they cannot defend against AI-driven threats by consolidating onto legacy platforms that simply bolt on the separate tools together. What's needed is a natively unified AI-driven data and security architecture, and that is what SentinelOne delivers. According to Gartner, AI security is the fastest-growing segment in cybersecurity, growing more than 70% year-over-year. AI represents a massive market opportunity for us and a durable tailwind for our business. We are already seeing this momentum with our AI offerings as our AI security ARR nearly doubled again in Q1. AI has been foundational to the Singularity Platform from day one. This inherent AI advantage has never been more critical, and we are well positioned to expand our market share across a $100 billion-plus market opportunity. Now, let's dive deeper into the details of our quarterly performance. We are winning new logos and expanding our footprint across diverse platform categories.

Beyond the Singularity Platform's best-in-class efficacy and autonomy, its intuitive design and operational simplicity are driving strong customer adoption. In Q1, our total ARR mix reached an important inflection point. For the first time, the total ARR from our non-endpoint solutions approached 50%. This performance was driven by accelerated ARR growth of our AI security, data, and cloud solutions, a clear testament to the diversity and customer outcomes of the Singularity Platform. Our cross-platform adoption drove a record ARR per customer in the quarter, signifying the momentum and contributions across our platform solutions. Overall, we're maintaining a healthy balance between new logo acquisition and existing customer expansion. Given our scale and relative market share, this strategy allows us to increase our market share while still retaining significant future expansion potential. We maintain solid win rates across all competitive situations. We're gaining mind share and market share among customers and partners.

Customers of all sizes, especially large enterprises, are increasingly recognizing SentinelOne's AI advantage. Among our platform solutions, AI security continues to be a bright spot, with ARR nearly doubling again sequentially in Q1. Today, Prompt Security stands out as the only enterprise-grade scalable solution capable of securing AI at this level, and organizations are recognizing that this is a prerequisite for safely accelerating their AI initiatives. Let's look at our Q1 wins that exemplify this. A U.S. state government selected SentinelOne to secure its AI infrastructure in one of the first government deals led by AI security. With thousands of employees accessing AI tools across sensitive government systems, the need for real-time visibility and governance was urgent. This customer chose Prompt alongside Endpoint Cloud and AI SIEM to get runtime visibility into their employees' AI usage while satisfying strict government compliance requirements.

Moreover, we are increasingly winning standalone AI security deals from the customers of our direct competitors. This serves as a strategic entry point to expand our broader market exposure. In Q1, an iconic enterprise selected Prompt Security over the incomplete AI offering of their incumbent next-gen endpoint vendor. Winning this head-to-head evaluation has built tremendous trust. By demonstrating the superiority of SentinelOne's technology, we have opened the door to displace that next gen competitor and drive broader consolidation for this enterprise with the Singularity Platform. As organizations race to build and deploy homegrown AI applications, the attack surface is expanding faster than legacy tools can address it. To close that gap, we launched Prompt AI Red Teaming in May, purpose-built to secure AI applications from the inside out. This solution autonomously stress tests AI applications against real-world attack scenarios before they ever reach production.

This creates a highly complementary lend and expand motion for us. Red Teaming discovers the vulnerabilities in development, and our core platform seamlessly blocks them at runtime. We are now delivering AI security from the first line of code through execution. Next, Purple AI. Our agentic SOC solution is rapidly becoming the bedrock of modern security operations. With the increasingly sophisticated capabilities of Purple, we are empowering customers to respond faster, accelerate detection, and automate investigations. In Q1, we announced the general availability of Purple AI auto investigations, a major milestone in our journey towards delivering a fully autonomous SOC. Purple AI represents a significant expansion opportunity over time. In several early rollouts, we are seeing instances where ARR from Purple AI's end-to-end deployment can outgrow a customer's core endpoint footprint. Delivering agentic SOC's autonomous capabilities can drive outsized value.

Purple is built for enterprise scale and natively integrated with Singularity Hyperautomation, but its value extends well beyond large enterprises. We've architected Purple to deliver meaningful impact across customers of all sizes, and we see a particularly compelling opportunity with MSSP providers, who stand to benefit from significant cost efficiencies and a step-change acceleration across their entire operations. At the capability level, Purple's latest auto investigation feature delivers human-level reasoning at scale, providing one-click, and soon zero-click, automation with clear verdicts in seconds. This closes the critical gap between insight and action, fundamentally changing what security teams can accomplish. The accuracy we're seeing compared to human analysts make this a true game changer, allowing security practitioners to shift from manual investigation to immediate remediation. This is consistent with IDC's finding, noting a 338% ROI for Purple AI customers.

For data solutions, Q1 marked the fourth consecutive quarter of ARR growth acceleration. We are seeing increasing demand for our AI SIEM as enterprises seek unified visibility, real-time detection, and autonomous response. All this with far more efficient unit economics than legacy alternatives. With an integrated Observo AI, our customers now benefit from owning the critical data pipeline that powers modern security operations. We are delivering a truly comprehensive security data lake that natively unifies petabyte-scale ingestion, orchestration, and hyperautomation into a single seamless experience. Among several wins in the quarter, an iconic luxury brand displaced Splunk with a multi-year commitment to SentinelOne's AI SIEM as their dedicated security data platform. Their global operations needed a solution that offered unified visibility into a single AI-native platform. The combination of real-time autonomous security and operational simplicity of the Singularity Platform made it a winning choice.

In another win, a multinational services enterprise signed a seven-figure expansion with SentinelOne, replacing their existing SIEM provider. This enterprise selected the Singularity Platform for superior cost of ownership, machine speed investigations, and AI-native unified platform. Independent validation continues to reinforce our competitive position. A recent IDC business value study found that SentinelOne's AI SIEM delivers a 331% three-year ROI with only a seven-month payback period. Our AI SIEM customers see 70% faster queries, 75% faster investigations, and four times the threat coverage. For cloud security, ARR growth accelerated in Q1, driven by the strong adoption of our best-of-breed runtime security covering both on-prem and cloud environments. As AI workloads multiply and cloud environments expand, the need for robust runtime security is increasing. Among cloud security wins, one of the most valuable private companies in the world, soon to become public, significantly expanded its footprint with SentinelOne in the quarter.

To secure an enterprise of this magnitude, static cloud visibility or posture management was simply insufficient. This enterprise doubled down on Singularity Cloud for autonomous AI-powered runtime protection, capable of actively neutralizing AI-based threats across their dynamic infrastructure in real time. To secure dynamic cloud environments, organizations need more than static posture management. Our runtime cloud security stops real-world cloud attacks in real time and seamlessly scales alongside our customers' operation. It is clear that in an AI-driven threat landscape, static defenses are no longer sufficient. Verifying identity at the door is useful, it doesn't stop modern threats. We've seen this play out repeatedly. Traditional identity access management solutions and PAM solutions were built for the past. They were fine at mapping and governing access, they were never designed to autonomously detect and respond to what happens next.

Attackers often bypass access controls post-authentication, operating undetected inside environments where trust was already granted. Machine-speed behavioral analysis and continuous validation at runtime is the key competitive edge and the only formidable defense strategy to stop real-time attacks in the age of AI. As the market pivots towards securing AI agents and frontier models, the endpoint remains the ultimate control plane. You simply cannot deliver comprehensive AI security without deep foundational visibility at the point of execution on the host machine that runs AI. AI-powered EDR remains a critical vector for capturing the evolving AI security opportunity. With deep expertise and a significant portfolio of patented machine learning and behavioral detection algorithms, SentinelOne is uniquely positioned to protect endpoints and AI workloads directly where they are created and operated.

Beyond monitoring access, we align intent to action through real-time behavioral analysis, detecting threats that no identity or parameter control can see. Most recent supply chain attacks, including those targeting LiteLLM and Axios, underscore this point clearly. These were exploit-free attacks, purpose-built to bypass traditional security controls and move at machine speed. No signature, no known vulnerability, no parameter trigger. The only effective defense was autonomous behavioral protection at the host level, exactly where SentinelOne operates. These real-world examples reinforce why the execution layer is where the battle is won. We continue to be a growth leader in the broader endpoint sector by delivering the most autonomous endpoint security solution available, combining industry-leading efficacy, performance, and user experience. Nearly half of the existing endpoint sector is still using legacy antivirus solutions. This is a clear opportunity for continued market share gains.

We're also beginning to see increased traction in securing highly restricted on-prem environments where true sovereignty is required, which is a distinct structural advantage for us. While our competitors can't really secure these environments, this provides an emerging growth avenue for us. We have the distinct advantage of delivering fully autonomous, high-velocity AI protection in any environment, both cloud and on-prem. Our expanding customer base now includes some of the most sophisticated and iconic companies on the planet, from frontier AI labs and major financial institutions to critical global supply chains. The world's most demanding organizations rely on and trust SentinelOne. Turning to SentinelOne Flex, it is proving to be a highly effective model for broader platform adoption. We're seeing an increasing number of large deals and contributions from Flex. In just three quarters of its launch, Flex had crossed $200 million in TCV.

Looking ahead, our pipeline and demand for Flex shows continuation of this momentum. SentinelOne Flex is simplifying the purchasing process and driving an increasing number of large seven and eight-figure deals and longer-term commitments. Overall, our success up-market is directly fueling bigger deals, driving steady retention, and creating a highly visible, durable runway for long-term growth. With the growth of token-based AI adoption, we're also expanding our monetization model to capture the full value of how customers use our emerging solutions. Usage-based metering creates a natural growth engine as customers expand their use of our products, like Singularity Data Lake and Purple AI. Customers can choose upfront annualized SentinelOne Flex commitments that provide cost visibility and preferred economics while giving us committed revenue visibility.

Together, SentinelOne Flex and prepaid structures create a durable hybrid model, a reliable baseline with meaningful expansion opportunity layered on top. In the partner ecosystem, we continue to expand our reach and scale. Our partner ecosystem is a force multiplier, expanding our global reach and driving broader platform adoption. For MSSPs, the Singularity Platform delivers the AI-native multi-tenancy and remote management capabilities that drive valuable operational leverage. This structural advantage gives us a unique competitive edge within the MSSP ecosystem. A strong proof point of this leadership came at RSA, where we announced an expansion of our partnership with LevelBlue, the world’s largest MSSP. This partnership drives the strategic consolidation of their endpoint estate onto the Singularity Platform in the coming years and extends our reach across their global customer base.

At RSA, we also announced an expanded strategic alliance with Google Cloud to deliver autonomous security at global scale. We were honored by winning the 2026 Google Cloud Partner of the Year award. Last week, we also announced Singularity Platform's integration into AWS Security Hub Extended. This removes the traditional barriers of enterprise procurement. AWS customers can now turn on SentinelOne's AI-powered runtime security in minutes directly from their AWS console without new contracts or procurements. This pay-as-you-go model allows organizations to seamlessly secure their modern digital footprints with SentinelOne. Let's shift gears to the broader industry dynamics. Frontier AI models are rapidly changing cyber defense, allowing adversaries to execute AI-based attacks and weaponize weaknesses faster than human teams can react. To stay secure, enterprises must rebuild infrastructure from the ground up with a unified AI-native foundation.

To build modern and secure enterprise infrastructure, we believe a collaborative approach is key to solving this generational challenge. Our relationships with the Frontier AI labs are deep and strategic. We partnered with Anthropic on the launch of Claude Security and with OpenAI through its early access for cyber program, embedding frontier models throughout our platform. We complement these with our own proprietary and fine-tuned models, and our core engines remain multimodal and model-agnostic by design. AI security is becoming a focal point across the industry with programs like Glasswing or Daybreak. It validates the approach we have been building towards for years, and we are actively engaged with both Anthropic and OpenAI to ensure SentinelOne's role in this ecosystem continues to grow alongside our platform leadership. I am also pleased to share that we are a participating vendor in Project Glasswing. Proactive visibility is only half of the equation.

We must neutralize active threats at the point of execution. The new class of AI-based attacks are designed to move faster than any human analyst could react. To give the advantage back to defenders, we launch Wayfinder Frontier AI Services in Q1. With our elite partner coalition, including Mandiant, WWT, KPMG, and Booz Allen, we're fusing multimodal AI with tip-of-the-spear human intelligence. Protecting the AI-powered business world requires securing the systems where AI is actually being built and used, often Linux and Mac operating systems. While many cybersecurity vendors remain dependent on securing only Windows environments, our established strength to secure Mac and Linux systems give us structural advantages in AI security. We're expanding our native EDR telemetry to protect autonomous AI agents across these operating systems where AI compute is rapidly growing. Our Singularity Platform's on-device behavioral AI recognizes malicious execution patterns and mitigates the processes preemptively.

We autonomously stopped recent supply chain attacks instantly across multiple customers with zero prior knowledge and no human analysts in the loop before they could do any damage. At SentinelOne, we are delivering end-to-end AI security from data to runtime. Shifting gears to our operating model. As always, we remain committed to balancing durable growth with improving profitability and accelerating our path towards the rule of 40. That commitment requires us to continuously sharpen how we operate. As I outlined in March, we have been actively refining our team structures and go-to-market focus while accelerating our internal use of AI. In alignment with this strategy, we made a difficult but a necessary decision. We are streamlining our organizational structure, resulting in about 8% reduction in our workforce. This is not a reactive measure.

It is a deliberate evolution to reduce complexity, raise the performance bar, and build a leaner, more agile SentinelOne. On the go-to-market side, we see an opportunity to uplevel our teams and streamline distribution. This includes tightening our coverage and driving greater productivity across our sales organization. Our goal is straightforward, driving better operating leverage, sales efficiency, and execution velocity. On the AI side, through the company-wide rollout of frontier models, we are seeing meaningful productivity gains across our organization. Work that previously took months is now being completed in weeks, and in some cases, days. Together, these actions provide us the resources and flexibility to concentrate investments in our highest conviction growth areas: AI, data, cloud, and endpoint. Before I turn the call over, I am very pleased to officially welcome Sonalee Parekh to her first earnings call. Over the past months, we have been working closely together.

Sonalee brings an impressive level of operational rigor that aligns with our focus on execution velocity and profitability. She's a phenomenal addition to our executive team and already making an impact. In closing, I want to take a moment to acknowledge the contributions of all Sentinels. Their relentless focus, dedication, and execution drives our success. Thanks to all our customers, partners, and shareholders for their continued support. Thank you again for joining us today. With that, I'll hand it over to our CFO, Sonalee Parekh.

Thank you, Tomer, and thanks everyone for joining us today. 60 days in as CFO of SentinelOne. The conviction that brought me here has only deepened. Q1 was a strong quarter. It reflects what I've seen firsthand, a platform that is genuinely best in class, a business model with meaningful operating leverage ahead of us, and a market at an inflection point. AI is fundamentally expanding the attack surface, creating new security categories, accelerating customer urgency, opening growth vectors that are still in their earliest stages. SentinelOne is built for exactly this moment. Let's review the details of our Q1 fiscal 2027 financial performance and our guidance for Q2 and the full fiscal year 2027. As a reminder, all comparisons are year-over-year. Financial measures discussed here are non-GAAP, unless otherwise noted. Q1 was a solid quarter for SentinelOne.

Our revenue growth accelerated sequentially, growing 21% year-over-year to $277 million. Our international markets revenue grew 25% and represented 39% of total revenue, demonstrating strong international demand and a growing global footprint. In Q1, our total ARR growth accelerated to 23%, and we added $44 million in net new ARR, which comfortably exceeded our expectations. This record net new ARR growth of 55% was driven by new logo acquisition and broader Platform adoption within our existing customer base. Our move up market continues to yield excellent results. Our ARR per customer reached a new company record led by strong momentum at the top end of the market, where our cohort of customers with ARR of $100,000 or more grew 17% year-over-year. Our gross retention rate, or GRR, across our customer base remained stable, underscoring the mission-critical nature of the Singularity Platform.

For customers spending $100,000 or more in ARR, our dollar-based net retention rate, or NRR, improved both sequentially and year-over-year, driven by continued success in multi-product platform adoption. We're increasingly landing premier logos, providing us with a highly durable runway for long-term growth. Overall, we are maintaining a balanced split between new logo acquisition and existing customer expansion. Given our scale and relative market share, this focus allows us to increase our market share with significant future expansion potential. This performance clearly reflects the value customers realize from our Singularity Platform and our continued success in driving multi-product expansion and stickier customers. Now, turning to profitability. We continue to maintain a strong gross margin profile, highlighting healthy platform unit economics and scale efficiencies. In Q1, our operating margin of 4% exceeded our expectations and represented an improvement of approximately 550 basis points year-over-year.

Our earnings per share of $0.04 also exceeded our expectations and represented an improvement of 83% year-over-year. We are sustaining a top-tier growth profile while rapidly expanding our profitability. Most importantly, we are driving this structural operating leverage without compromising our relentless pace of innovation. On a trailing 12-month basis, our adjusted free cash flow margin was 6.5%, representing an improvement of about 440 basis points year-over-year. We've put the company on a path to sustainable positive free cash flow growth, which underscores our commitment to durable profitable growth at scale. Complementing this strong performance, our remaining performance obligations growth accelerated to 30% in Q1. Our total RPO reached a record $1.5 billion in Q1, a clear validation of the trust we've established with our customers and our commitment to innovation.

We ended the year with a robust balance sheet, including $812 million in cash equivalents, and investments, and no debt. Looking ahead, SentinelOne is well-positioned at the intersection of AI, data, and cybersecurity to lead the industry into the next era of autonomous defense. Capitalizing on this opportunity requires us to evolve our operating model and the way we work. As Tomer discussed, we are implementing a workforce optimization initiative impacting approximately 8% of our workforce. We are harnessing productivity gains to increase our agility and to invest in solutions like AI security, Purple AI, data, and cloud, which are key to delivering durable growth.

In connection with this initiative, we expect to incur a one-time restructuring charge of approximately $25 million in the second quarter, which will be excluded from our non-GAAP results. Once fully implemented, we expect this action to result in approximately $45 million in annualized cost savings. This provides us with the financial flexibility to purposefully reinvest in our key growth areas while continuing to drive significant operating margin expansion. With our strong growth profile, clear technology leadership, and growing structural tailwinds, we have all the ingredients to scale into a multibillion-dollar, highly profitable, durable business. Turning to guidance for Q2 and fiscal year 2027. For the full fiscal year 2027, we continue to expect revenue to be between $1.195 billion and $1.205 billion, representing 20% year-over-year growth at the midpoint. For Q2, we expect revenue to be between $289 million and $291 million, representing 20% year-over-year growth at the midpoint.

Overall, this outlook is supported by a solid pipeline, strategic partnership opportunities, and rising contribution of our emerging solutions, including AI, data, cloud, and others. As always, we continue to be mindful of the evolving macroeconomic environment and geopolitical uncertainties, which can influence deal timing and sales cycles across the industry. Turning to the outlook for our profitability metrics. For fiscal 2027, we are raising our operating income outlook to be between $115 million and $125 million, representing an operating margin of 10% at the midpoint, representing a 650 basis point increase over fiscal year 2026. For Q2, we expect operating income to be between $23 million and $25 million, representing an operating margin of 8% at the midpoint. For full year fiscal 2027, we expect fully diluted earnings per share to be between $0.32 and $0.38, representing $0.35 at the midpoint.

For Q2, we expect earnings per share to be between $0.06 and $0.08. We continue to expect a non-GAAP tax rate of approximately 17% for the fiscal year 2027. We expect our weighted average diluted share count to be approximately $347 million for Q2 and $350 million for the full year. Taking a step back, our technology leadership and competitive position remain strong. We are scaling the business while consistently driving operating leverage. Our investment approach strikes a disciplined balance between capturing long-term growth opportunities and maintaining a durable, profitable financial profile. This strategy is foundational to scaling SentinelOne into a multibillion-dollar business. At the same time, we are instilling operational discipline with a sharp focus on greater efficiency. In summary, we are well-positioned at the intersection of AI, data, and cybersecurity, leading the industry into the next era of autonomous security.

Security is no longer just a safeguard. It is a key strategic enabler of AI innovation. With a strong financial foundation, a differentiated platform, and growing market opportunity, we remain committed to delivering shareholder value. Thank you all for joining us today, and thank you to all Sentinels for giving me such a warm welcome. With that, operator, we are ready for questions.

Thank you. At this time, if you would like to ask a question, please click on the Raise Hand button, which can be found at the black bar at the bottom of your screen. When it is your turn, you will receive a message on your screen based on your place in the queue. Please accept, unmute your audio, and ask your question. As a reminder, we are allowing analysts one question today. We will wait one moment to allow the queue to form. Our first question will come from Meta Marshall with Morgan Stanley. You may now unmute your audio and ask your question.

Congrats on the quarter and the acceleration in Q1. From an opportunity standpoint, are you seeing a pickup in core endpoint as customers try to address technical debt? How are you balancing selling them the full Singularity portfolio at initial sale versus upselling them later? Thank you.

Absolutely. Thank you for the question. It is clear that the endpoint remains the most important control plane, especially in the age of AI. We are seeing a lot of focus on how to secure AI agents, how to secure surfaces that could be impacted by the deployment of more and more AI technologies. Not only this bodes well for our overall core endpoint business, if you think about Prompt Security, generative AI protection that is specific and deployed on the endpoint, this is typically what we are seeing right now and how we are landing. When we look at our pipelines, we are actually seeing a lot of contribution, not only from core endpoint, which again, has been phenomenal for us both in Q4 and in Q1 and will continue to grow, but also the immediate attach or Prompt Security generative AI protection that is adjacent to the endpoint as well.

Lastly, I'll say the definition of the endpoint is also expanding, and when you think about where AI workloads are being deployed today, it also spans towards cloud workloads. That's another strong suit of ours, where we're seeing a lot of demand for the protection of these workloads that are now housing either agentic workloads or other model workloads. All in all, really strong demand across endpoint surfaces and workload surfaces.

Thank you. Our next question comes from Brad Zelnick with Deutsche Bank. Please go ahead.

Thank you so much. Tomer, I think we'd all like to hear your thoughts on the extent Mythos, Daybreak, and just the broader pace of AI innovation might be impacting customer spending behavior. The extent to which it's, in some cases, maybe accelerating or perhaps even slowing down, or even expanding budgets. As well, why you're well-positioned to capture what's ahead.

Absolutely. Again, we're a proud member of Project Glasswing. I would say by far that drives a lot of concern. That's not going to be new to anybody. I would say at the same time, vulnerabilities are not the only concern. Code security is definitely a big component of how you secure an entire enterprise. We've launched frontier AI services alongside Anthropic and OpenAI. We're using these frontier models to go to customer environments and reduce risk immediately. We're talking about deployments that take sometimes hours and days, not weeks and months. With the customer urgency, there's also an ability to deploy fast and show immediate returns on these technologies. All in all, a lot of attention. I think a lot of customers are still grappling with what to protect first. That, again, goes back to my assertion around vulnerabilities.

What Mythos brings to bear, what models are bringing to bear right now, GPT-5.5 as well, is the ability to not only find vulnerabilities in software, but really detect and exploit weaknesses in overarching network infrastructure, not just software and not just vulnerabilities. That presents a very wide attack surface. Once again, SentinelOne is well-positioned to stop, to mitigate, and to help customers reduce risk actively. All of those things are obviously in motion. A lot of them showed up with this Mythos moment and will provide for structural tailwinds throughout the year.

Thank you. Our next question comes from Brian Essex with JPMorgan. Please unmute your line and go ahead.

Great. Good afternoon. Thank you for taking the question, and nice to see the acceleration and better profitability outlook. Maybe Tomer, for you, I would love to get some color on the reduction in force that you announced. Where were the cuts made? Any changes to the sales organization? I get the AI-driven productivity enhancements that you noted, but would love to maybe just connect the dots in terms of where the adjustments were weighed, how many to the sales org, and maybe the outlook for sales productivity and growth for the rest of the year. Thank you.

Sure. As you've seen in the past, we're focused on driving operational excellence all the time, honestly, and simplifying our processes and removing unnecessary layers. That's happening all the time. We've been carrying more organizational capacity than I think we require at this stage of our scale and growth, and our profile of hiring is also changing. The talent we're recruiting is different, and we're just aligning a lot of what we do with both our up-market success and our emerging product categories. You've seen the inflection in the overall business mix. That's tremendous. As always, we're focused on driving higher efficiencies and allocating resources towards those key growth areas, which naturally would be AI, data, cloud, endpoint. These are the growing areas for us. This is our major focus, and this is the absolutely right thing for the business.

It's never an easy decision, but at the same time, we want to go after these areas in the most aggressive way that we can. We recognize an opportunity right now, and we want to put all of our resources in the right places. We're barely impacting our technology groups with this. We are focused on streamlining parts of the organization, but we're continuously and always investing in innovation, and that's the key point here. We are delivering to the market what the market needs. We're delivering protection, best of breed, cutting-edge to our customers using frontier AI models. That's where we're going. That's where we're going to be continuously investing, and that's what you see us doing.

Thank you. Our next question comes from Joseph Gallo with Jefferies. Please go ahead.

Hey, thank you for the question. As a follow-up to that, should we expect any sales disruption, particularly in 2Q? As a part of that, certainly great to see the improvement in margins. Can you just talk a little bit more about your comfortability that you can capture this massive opportunity and not sacrifice the durability of growth? Thank you.

Of course. We don't expect any go-to-market disruption. As you can probably imagine, this comes on natural performance management. Folks that may have not been the biggest contributors, we're kind of focusing on the places where we see the greatest contribution. If anything, again, this will provide more focus in a distilled, crystallized go-to-market motion. I don't expect any major changes. We've not been changing things in a dramatic way here. This is a continuous mode for us on the go-to-market side. We've said it for quite a few quarters, there's really almost nothing new here. Again, when we look at our pipelines, when we look what the opportunity is, we're just aligning towards that. We believe that a lot of the reinvestment capacity is actually going to allow us to go after that exact same endpoint opportunity that we've been talking about.

You can see some evidence of that with our partnership with LevelBlue. This gives us immediate access to tens of millions of endpoints over the years, without needing to go and sell to those customers one by one. That's just one way that we're thinking about aggressive expansion, and we're going to do more of those. To us, it's all pointing in the right direction. We feel very comfortable with our technology's ability to go and replace the legacy incumbent, and the opportunity that comes with it is massive. It's still a massive market. It's still, in many parts, dominated by incumbents. That represents a major opportunity for us to lend with endpoint, to attach generative AI capabilities and protection from all these new vectors of attack, to leverage frontier AI models to deliver the best protection for our customers.

These are all positive trends from the business that we are, frankly, very excited about.

Thanks for the question. We are really delighted with the margin progression that we showed this quarter, and obviously to the upgrade to the operating margins guide for the full year. I think the short answer is, we don't see growth and margin expansion as a trade-off in this case. The investments that actually drive durable growth that Tomer was talking about in AI security, data, cloud, the labs, are exactly where we're reinvesting. We're removing organizational complexity that was actually slowing us down and redeploying it into the highest return and highest conviction opportunities that we see in the business. I think the evidence that we can do both is actually already in the Q1 numbers. This quarter, we delivered record net new ARR, up 55% year-over-year, while simultaneously expanding operating margin by 550 basis points.

I think that's really our platform model working at scale. When I look forward, the demand signals give me real confidence. RPO, again, at a record $1.5 billion, growing 30%. Net retention expanding in our $100,000 + cohorts. That's both sequentially and year-over-year to above 110%. Some of our products, like Prompt, ARR nearly doubling again. I think these are all leading indicators of durable growth. I think you're going to see both durable growth and sequential and annual operating margin expansion. We really feel like we can deliver on both.

Thank you.

Our next question comes from Shaul Eyal at TD Cowen. Please go ahead.

Thank you. Question to Sonalee. Now being there a couple of months, have your initiatives you would like to undertake changed, or how do you see opportunities to build upon the operating leverage you guys are seeing?

Yeah, thanks. Yes, 60 days in, I would say what struck me most coming in was really the strength of the Singularity Platform, our product leadership and technology differentiation, and then the significant opportunity in front of us for this category, much of which is just really in the early innings. I think the operating leverage potential of the business as we scale, given our industry-leading gross margins, creates this enormous opportunity to create outsized value. I would say my conviction on that has only increased. In terms of priorities, first, it's my job to ensure we're allocating our resources and investing in the parts of the business where we feel we see the highest opportunity for growth and ROI. That's data, cloud, AI security, I think will be massive. You see already our emerging solutions, now 50% of the ARR.

It's these areas where we feel like we have real competitive differentiation and a significant market opportunity ahead. I think Prompt is a perfect example of that. Second, continuing to improve on the cost structure. You saw the announcement we made today on restructuring. It's really important that we focus the business. I'm going to be extremely focused on unit economics, driving operational excellence and discipline across the business, particularly in sales and marketing, where I see the largest opportunity for productivity improvement. In today's results, you'll already know we've made a lot of progress in sales and marketing. If you look at sales and marketing as a percentage of revenue, Q1, it came in at 39%. That compares to 47% a year ago. If you think about our upgraded full-year operating profit guide of 10%, that's 700 basis points of year-over-year improvement.

I think what's most interesting and compelling, really, is what that implies in terms of where we're going to be exiting Q4, that exit operating margin. That's significantly above the 10% guide. We're on a path to deliver multi-quarter, multi-year margin expansion, which you're already beginning to see. Lastly, I think it's really important that, Tomer and I are completely aligned on this, we need to put ourselves firmly on the path to rule of 40, which means not just efficiency, but durability. I'll be really focused on taking that NRR, where we've already seen great progress, and improving upon it. It's not just on the NRR side. On the GRR side, we've seen improved logo retention this quarter and stability, and I think that just underscores the mission-critical nature of our platform.

Finally, I would just say, as one of the few platform providers in cybersecurity, the traction we're seeing with the platform is resulting in larger lands. Our ARR per customer reached a new company record, and also really importantly, and again, this is just the platform working, is stickier customers.

Thank you.

Our next question comes from John DiFucci with Guggenheim Securities. Please go ahead.

Thank you. Thanks for taking my question. Congrats to the whole team for the new addition, and it's great to have you, Sonalee. Listen, you guys put up really strong ARR this quarter with growth that accelerated. You pointed that out. It's accelerated for the first time in more than three years, after three years of somewhat moderation, which with the law of large numbers you'd expect. Frankly, the growth in new ARR, even if you take into account attrition, was even better than it's been in almost four years from our calculations. I know you don't guide to ARR, but you maintained your revenue guidance for the year, and I realize it's early, but how should we be thinking about that given that ARR is really the best determinant of the future revenue? Thanks.

Yeah, John. Thanks so much for the question, and it is great to be here. I'm thrilled to be here on my first earnings call. You're absolutely right. We had a great showing on net new ARR this quarter, as you say, record. The growth was driven both by strong new logo additions, but also strong expansion, and great contributions from our emerging products. Data ARR accelerated in Q1. I already talked about Prompt, but that nearly doubled again in Q1, and our cloud ARR accelerated strongly as well. In terms of the overall guide, we did reiterate the guide, and what I would say there is we're still pretty early in the year, and we still continue to expect positive net new ARR growth for fiscal 2027.

In terms of the actual revenue contribution on the guide, we did see a fairly back-end loaded quarter with some of those larger deals. As a larger proportion of our bookings are from larger deals, I think we'll expect to see a bit more of that back-end loading, and that's why you're seeing that from a timing perspective. We still are feeling really confident around net new ARR for the year.

That makes total sense, Sonalee, I was only going to ask one question. That's, I'm going to leave it. The second one would've been on linearity, you read my mind. Thank you.

Our next question comes from Fatima Boolani with Citi. Please unmute your line and go ahead.

Fatima Boolani, are you there?

Please unmute your line. We will come back to you at a later point. Our next question comes from Shrenik Kothari with Baird. Please unmute your line and ask your question.

Hey, guys. This is Zach Schneider on for Shrenik. Thanks for taking the question. Maybe one on capital allocation. Now with $800 million plus in cash, path towards $100 million plus in free cash flow generation, no debt, you guys have it seems much more flexibility than you've had historically. Maybe how should we think about capital allocation going forward? Are there any changes there in strategy or priorities? Thank you.

Yeah, sure. Thanks for the question. Yeah, we feel really good about where the balance sheet is, a very robust balance sheet. I think our capital allocation priorities really haven't changed. We will continue to focus on organic investments that drive our growth. We will consider inorganic investments, but I would say there's a fairly high bar there, so it would be very selective and would need to be extremely strategic. Finally, we absolutely will use our strong balance sheet and free cash flow to give us the flexibility and capacity to be able to opportunistically repurchase our shares given the long-term potential of our business and so long as we believe it's a positive ROI initiative, which certainly at current levels we would. I would say our capital allocation policy is dynamic and opportunistic.

Again, we will do our best to take advantage of any dislocations in the market and also maintain a strong cash position to support our innovation and strategic initiatives from here.

Great. Thank you.

Our next question comes from Richard Poland with Wells Fargo. Please go ahead.

Yeah. Thanks for taking the question. I guess if you just think about the balance of the reinvestment that you're making, I think you quantified it somewhere in the range of $45 million in annualized savings from the reduction. I guess as we think about how that flows through to investments and just how you're calibrating how much drops to the bottom line versus how much gets put back into things like AI. Can you help us, I guess, just contextualize that through the rest of this year?

Yeah. Why don't I start with that? For the full year, we're now guiding to about 700 basis points of year-over-year operating margin improvement. As I said earlier, that would imply exiting at an operating margin significantly above that 10%. We also talked about the desire to balance growth and profitability. We felt strongly that there were areas where we had high conviction around parts of the market and products where we wanted to reinvest some of those savings. We talked about AI security, we talked about cloud data. We really feel like those are the right opportunities to go after right now from an ROI perspective, and we feel like we'll be able to deliver both durable growth and operating margin expansion and still be able to, again, upgrade that operating margin from where we were a couple of months ago.

Well, let me just add to that. We have a tremendous R&D and product and technology groups. For us, when we look at the opportunity ahead, clearly we want to build more, we want to produce more capability that we believe can add massive value to the security posture of our customers and at large. All in all, in the world of today, the ability to build, the ability to push forward versus maybe a few years ago, a lot of the innovation was coming for other companies through acquisition. I sincerely think that with the strength of R&D, with the strength of our talent, we just want to do more, and we want to enable them to do more. We want to bring more great people on board, and that's how we're thinking. That's the philosophy behind our reinvestment.

Great. Thank you both.

Our next question comes from Roger Boyd with UBS. Please.

Awesome. Thanks for the question. Tomer, we continue to hear really strong feedback from the channel on Prompt Security, and it seems like it's already becoming a pretty material contributor to ARR. Can you talk about what you're seeing with Prompt as maybe the tip of the spear for new engagements? Have you seen Prompt lead to bigger platform deals, including competitive displacements in endpoint or data lakes? Thanks.

Yes, there's no question. Prompt is delivering the capability that every single enterprise needs right now and that none of our competitors have. We're seeing both the natural expansion for our customer base, plus landing bigger with new logos and even in competitive environments. The ease of use, the seamlessness of deployment, the time to value. I think all of those are just radically different than anything else that you're finding in the space today. The level of coverage, compliance, governance, everything that everybody's missing right now is being delivered by what Prompt can bring to bear. All in all, it's a great catalyst for us across pretty much every vector of our go-to-market motion. At the same time, you can imagine most of our customer estate is still under-penetrated. They're still not deploying Prompt.

We're also moving pretty fast to enable Prompt to be absorbed and consumed by our customer estate directly through the platform, and that's going to unlock more growth opportunities for us in the out years.

Thanks very much.

Our final question of today comes from Fatima Boolani with Citi. Please go ahead.

Oh, good afternoon. Thank you so much for taking my questions and being patient with me today. Sonalee Parekh, this one is for you, and nice to see you on board here. Just looking at the deferred revenue and billings performance, I know you don't manage the business to billings, but just as we look at the deferred revenue cadence, was there anything atypical or different here that happened just as we noted some weaker seasonality in some of the growth metrics on the deferred revenue side? Maybe tying it back to some of your commentary with respect to net retention rate, maybe outside of the 100K ARR cohort and on some of the gross retention rate comments you alluded to earlier. Would love any incremental color on why we maybe saw that come out as seasonally weaker than prior periods. Thank you.

Yeah, sure. On billings, I would say there's nothing specific to call out other than the fact that this metric can move around a bit just due to the timing of invoicing. We tend to focus, and we actually run the business much more around net new ARR as our key operating metric, where obviously we saw a record number this quarter. In terms of GRR, we saw continued stability. When I first arrived here, of course, I was looking through all the metrics. It's actually been stable for many quarters. I remember seeing that and thinking that's an extremely strong sign just in terms of the stickiness and mission criticality of our platform. When we win a customer, they stay with us.

I think up to now, where just an impact on Net Retention has been on the expansion side of things. I think we saw positive traction there with some of our larger customers this quarter, which helped to drive Net Retention up. That's something I said I think in Meta's question, around priorities. It's something that I'll be really focused on. When I look at some of the signals as we look forward to coming quarters, that's a metric that I expect to continue to improve. Again, that's what gives me confidence on the full year guide as well, is that will be a key support, that improving Net Retention Rate. Of course, every point we improve on Net Retention creates a tailwind on revenue.

Thank you. I appreciate that.

Thank you. We have now reached the end of our allotted time for questions. I will turn the call back over to Mr. Weingarten for closing remarks.

Thank you everyone. Have a good day.