SentinelOne: misunderstood 10-bagger or growth trap?
The risk-reward in numbers
I often get this question from friends (it’s become a typical ice-breaker): if you had to identify the next 10x now, what would that be?
And my mind always goes to 3-4 names, SentinelOne being one of those.
But then I always add: “but that comes with risks you don’t want, trust me”.
In today’s SentinelOne brief:
Is this Cybersecurity play an asymmetric investment opportunity?
What are objective risks and catalysts to consider?
What are the key numbers to monitor and what’s my final view?
Business Model in Brief
SentinelOne’s platform was born as an agent running security checks on every device inside an organization.
An agent that can foresee suspicious signals, block the threat, roll back malicious changes, and alert the security team. All instantly.
This is what the industry calls EDR (Endpoint Detection & Response).
Over time, SentinelOne has been expanding well beyond endpoints into new segments: cloud workloads, identity security, and AI-powered data analytics.
The revenue model is the usual: annual subscriptions, per device or per seat. Now however switiching to usage and modules bundling. More modules adopted = more revenue per customer.
Classic platform upselling.
In short, their offering breaks into three pillars:
Core Security: endpoint protection, threat detection, automated response. The bulk of ARR today, the core business.
Cloud & Identity Security: entire network protection and identity threat detection (protection of passwords, API keys, codes).
Data Platform: the Singularity Data Lake ingests and correlates security telemetry from across the entire enterprise. This is perhaps their main point of divergence from traditional competitors.
All under their Singularity platform umbrella.
And the add-on ecosystem is growing on top of all of this.
A Tough Neighbourhood
Let’s face the elephant in the room, immediately: direct competition here is brutal.
CrowdStrike is actually the 800-pound gorilla. Same AI-native architecture, bigger installed base, stronger brand.
Microsoft bundles Defender into enterprise Windows licences. Not the most excellent service (according to how quality standards are assigned), but enough to capture the downmarket.
Palo Alto Networks is giving modules away at a loss to lock customers into Cortex XDR. I was mentioning this dynamic in the Zscaler deep dive: scale matters here.
So what could be Sentinel’s differentiation point here, if any?
Apparently, for them it's speed, together with optimal value for money.
What does this picture convey, concretely?
That Sentinel offers faster response times than CrowdStrike in head-to-head benchmarks. And less human friction.
It’s the nature of this platform to be agile, fast, frictionless. At least this is what they say.
Although this slide dates back to 2023, they seem to be the “biggest of the smallest” in the endpoint security market, with roughly 4% market share.
Giants apart, CRWD and MSFT…
They claim how half of the market (see the black part of the pie) remains untapped and ready to be captured by either organic or paid growth.
What’s going on in the business rn? Revenue figures
They made the headline: ARR surpassing $1billion as of Q3 FY2026, up 23% year-over-year.
They crossed the $1B milestone ahead of schedule. That's a credibility marker, and a signal the enterprise adoption is real.
What I find encouraging is the mix.
Customers with ARR over $1M in ARR are the ones growing faster. The enterprise segment is real, and it's expanding.
It also means that the SMEs downmarket is somewhat difficult to target. Same pattern we saw across other names: UiPath, ServiceNow, Zscaler.
What’s more, platform expansion within the installed base is increasingly driving ARR growth.
This reflects more upselling, higher retention.
NRR still at 109% (despite decreasing) is still a solid quality signal.
This, together with a tangible path towards profitable growth and segments expansion, definitely marks a very intersting big picture coming out of the latest quarterly update:
On top of that, we also have 2 more quality signals:
Brand Recognition: several rewards issued by Gartner Research & other organizations
Working culture: several awards by Great Place To Work (always a nice to have, indirect factor which however I see as a leading indicator, proven by several backtests)
Now that we covered the basics, let’s cut down to the chase.
What am I closely looking at?
Operating Leverage: a narrative demanding perfect execution
This is the heart of the matter.
When I started looking at Sentinel, I saw the potential but I also saw a candidate for chapter 11.
Not really for the GAAP losses, but rather for the missing cash flows.
Let’s see what’s going on financially. We have:
Adjusted Operating Margin finally on a 3 consecutive quarter positive pattern (I know this is adjusted for dilution, but bear with me):
Adjusted EPS following along:
Operating Expenses trending downward in percentage of sales → the classic Operating Leverage pattern we want to see:
In theory, we’ve got the typical ingredients of a Quality Growth story:
Sales & Marketing becoming incrementally less relevant as the brand grows, retention gets sticky, and upselling does its job
SBC on Revenue going down and spreading out the negative effect of shares dilution as the company’s size 3x, 4x, as these shares get exercised
R&D flattening down BUT still remaining 15%-20% of revenues (that’s what Management declared as goal), which I always like to see for an asset-light play
But here’s the thing.
Cash Flows from Operations are achieving the utterly crucial trajectory I must see: several quarters in row well above 0, and approaching double-digit figures.
So, Francesco why are you not into this? Aren’t you seeing what you want?
Not yet.
In fact:
The Owner’s Earnings are still negative!
Meaning the actual Earnings Power is still under the water.
In other words, the cash flows that the core business is currently producing is fully absorbed (and even overtaken) by the amount of cash that it’s needed to cover the regular yearly mainteinance of the business (for simplicity, this equals to depreciation and amortization).
There’s nothing left after maintainance CAPEX is covered.
No cash left for growth CAPEX, new aggressive R&D, aggressive buyback programs, new hiring, nothing.
Note: I added the OE formula as Custom Metric inside Fiscal - calculated as Cash From Operating Activities minus D&A over Revenues.
So, all in all, this is what we can conclude:
SentinelOne is no longer burning cash just to stay alive. Bankruptcy risk is effectively off the table. Cash from Ops is telling us this. But,
The business isn’t yet funding its own expansion. Management's stated goal of 20% GAAP operating margin is still a long way to go.
For this stock to become compelling, I need to see owner's earnings approaching cash flow from operations.
Until then, the compounding machine isn't fully running.
Let’s recap the risks!
⚠️ Risk #1 → Operating leverage fails to materialise.
This is the main risk, a textbook one.
If revenue growth decelerates (say, below 15-20%), the fixed cost base doesn’t shrink fast enough.
The current SBC costs will result into much, much higher dilution.
Result?
Market sentiment collapsing.
Stock drops to penny stock territory.
This isn’t perhaps the most likely scenario, but I can see this thing at $5 per share.
⚠️ Risk #2 → Competitive pressure prevents growth.
CrowdStrike continues to dominate new enterprise deployments.
Palo Alto’s loss-leader strategy pressures pricing.
Microsoft is always there, embedded in many SMEs.
Any of these trends accelerating would structurally limit SentinelOne’s ability to keep growing at 20%+.
⚠️ Risk #3 → Permanent pricing pressure from AI commoditisation.
As AI inference costs drop, the “AI-native” differentiation weakens.
If endpoint security AI becomes commoditized - meaningh something every player can offer at a fraction of the cost - SentinelOne loses pricing power.
This isn’t the most concerning one, but it’s a risk to to keep monitoring, especially when we have a 3-5 years investing horizon, as usual!
And the Catalysts?
This is a growth story.
Where execution won’t leave room for mistakes or delays.
Every piece of the story must come along.
In particular:
✅ Founder-led execution, sustained.
Tomer Weingarten has been CEO since founding the company in 2013.
He built this from zero to $1B+ ARR.
Founder-operators tend to have longer time horizons and higher pain thresholds. If operating leverage is coming, he’s the right person to drive it.
✅ Distribution partnerships.
SentinelOne and Cloudflare have a growing partnership integrating their platforms - with network-level threat intelligence feeding into endpoint response and vice versa.
They found this complementary alliance which must drive growth.
This expands the addressable use case and makes SentinelOne stickier inside enterprise stacks that already run Cloudflare.
This should push Sales & Marketing efforts down.
✅ Platform expansion + upselling.
Cloud workload protection and the Singularity Data Lake are both early innings.
As enterprises consolidate vendors, SentinelOne benefits if they’re already the endpoint incumbent.
We must see these AI-related segments keep growing 50%+.
Higher multi-module adoption = higher ACV per customer.
✅ International expansion.
Still predominantly a US-driven business, bur rapidly growing in international markets.
Enterprise cybersecurity spending is growing globally, especially in Europe and APAC. These markets usually lag the US, but they show up at some point.
International revenue may be a long-term lever that’s not fully priced into current expectations.
Quick Valuation Check: is S an asymmetric opportunity?
I tried to factor in everything we’ve mentioned inside my risk-reward screener.
A tool which always requires me to stay conservative.
Where both the bear case and the bull case are build by prioritizing risk over reward (this is a major shift contributing to 34.0% MWR in the past 5).
Which looks like this:
Forget about the base, middle case.
I started with the bear case scenario, where:
Earnings trajectory continues and allows S to avoid BK, but
Operating leverage fails, with revenue growth decelerating below 15%
The market re-rates this as a high-burn, slow-growth software company
Dilution still significant.
Downside from current levels: approximately -69%.
Yes, BK is excluded, but becoming a penny stock is still very much on the table if the OL story breaks.
Starting from this, I asked myself:
What needs to happen to make this a 10:1 risk-to-reward candidate?
If I’m risking -69%, I want at least a +690%.
(normally I never pull the trigger below a downside risk higher than -30%, but let’s complete the mental model…)
This is achieved when:
Revenue Growth continues at 20% for 5 years
Earnings Power reaches 25% → matching tier 1 industry standards!
Sentiment explodes to 70x earnings
Dilution partially curbed
Is this scenario possible? Yes.
Is it probable? Maybe, or maybe not.
A more realistic bull case - call it 3x from here - is achievable with 20% earnings power (Management target hit), and sentiment in the 40s. But a 3x doesn't compensate for a -69% bear case. The ratio is not there yet.
Is it a goodbye?
It’s a see you soon, Sentinel.
I’m seeing the traits of a quality company.
But I’m not seeing the cash flow potential I need to embark on such investment.
Until I see owner's earnings approach cash flow from operations, the balance between downside risk (-69%) and realistic upside (3x) doesn't justify a position in my portfolio.
A final note - more a diary-like consideration for myself than an insight for you - is this a LEAP candidate?
If Bankruptcy risk is to be excluded, a deep in-the-money 2-year call option with strike below $5 would be interesting.
The share price is low enough to keep the position size and the dollar amount very tiny and avoid unneeded losses in case things fall apart.
With the benefit of the option’s leverage.
I am not doing this btw, it’s just a thought towards new unexplored horizons.
Want the full rules-based system? get in touch!
I have a few availabilities open for 1:1 assistance, if you don’t want to waste time and get straight to fast results.
I always set a free chat in case you want the deets.
✅ Here you can have a preview on how it works (click here to watch)
That’s it for today.
📈
Happy Investing,
Francesco