SentinelOne Aktie

Good afternoon, and welcome to OneCon. Please welcome Chief Business Officer, Eran Ashkenazi.

Hello, everyone. Good evening. First of all, this is a welcome to OneCon 2026. Give it a round of applause. So this is -- I know you're tired, you had a long day. Same here, by the way. This is just a warmup, okay? This is just the preshow. Tomorrow is kind of the big kickoff. However, we wanted to kind of do something interesting this year, so we have a couple of evening sessions for you. Just really just 1 session and 1 -- actually 2 sessions. One of them is from our Chief Customer Officer, Steve Stone. He will talk about how we are combining AI and experts together. Everything that we've done within the Wayfinder Threat Hunting Services and a lot of takeaway things that you can take with you to your own environment because we learned a lot of lessons by using AI and experts together.

The second session is actually the Sentinels League Threat Hunting World Championship were from thousands and thousands of participants, we came all the way to the finalist and we're going to choose the one clear winner. So again, tomorrow, we'll do all the things about housekeeping and apps and parties and schedules, tonight is just to get into the groove, okay? So take a deep breath, relax, start enjoying the show. And first up, it's our Chief Customer Officer, Steve Stone.

All right, folks. As Eran said, we're trying some new things here this year. And I love that we are starting off with threat hunting tonight. I think when we run a business, it's really easy to forget about what we do every single day and threats how we find them, that's what we're here to do. So we're really excited to have all of you here with us in Vegas. I'm pretty happy here being my third OneCon. How many of you is this your first OneCon? Look at that, a lot of first OneCons. All right. I love that.

So what I want to kind of start with is let's do some like typical Vegas stuff. Let's do some accountability. Vegas loves that. When you hear Vegas, you think accountability. I think if you go buy one of those magnets in the lobby, it says, what happens in Vegas, let's hold on to it for a year and then talk about it with 1,000 people. It's like really awkward on a magnet. But that's not what we're going to do here. We're going to talk about threat hunting and we're going to talk about AI. But what I really want to talk about is, are we delivering on what we promised you when we stand on stages like this. When we look back at the last year, what we promised you, are we delivering that? And we want to be transparent and accountable so then we can talk about what we're doing, how we see it changing the world and where we are going at SentinelOne. And for today, we're going to really focus on that AI and expert piece.

So it's hard to overstate how much changed in the last year. I had the benefit of being on stage and talking about predictions what we thought was going to happen. I went back and checked our scorecard and give us like a B-. I think we did pretty good. But with AI, our assessment was it's going to change fast, and we don't really know what that's going to be. That's kind of a mulligan of a prediction. You kind of get that one right, and that one turned out to be true.

If we look at the big headlines from cybersecurity, all of them come back to something to do with AI. We can start with the Hugging Face incident. I know we are all very familiar with. We can start with multiple governments having multiple clashes with AI companies. We can talk about international disputes around chips. We can talk about how we in the U.S., let's talk about Anthropic and OpenAI and Nvidia and then we look in China and DeepSeek, particularly their V4 and running on Huawei's Ascend chips. These are things we just didn't talk about.

But if I had to give one example of what's really driving this change, I'd pick the example from the U.K. government. The U.K. government put out an assessment about 3 months ago and their official government assessment is that the frontier models are doubling their offensive cyber capability every 4 months. That means since the last time we were here for those this is your second, third or fourth OneCon, that offensive capability from those models has tripled. That's a change in pace we have not seen before in this industry. And it's really driving a lot of things.

So I think it's really important. We just talk about this is moving so fast, and this is the pace we must meet. When we talk about the things we owe you as customers, this is the pace that we owe you. And I think it's also fair to say we stood on the stage, and we made a bunch of promises. We rolled out a bunch of products. I am really, really excited for you folks to see what Chris Corde and his team is going to roll out tomorrow. Tomer is going to provide his vision, but it's hard to dive into those things if we don't instill confidence in all of you that what we say we're going to do, we do.

And we look back at last year, we talked a lot about AI. We talked about the expansion of Purple AI. We talked about agentic investigations. We relaunched our threat services with AI being the single thing that ran through every one of those elements. We launched our own Frontier AI services. And what I'll talk about here as an example of our commitment to you is our AI-driven hunting because I think, ultimately, the thing we focus on the most at SentinelOne is pairing the right technology with the right people. That's how we see AI really changing this market. And honestly, that's how we see it having the greatest impact in securing your organizations.

So let's talk about where we see AI and where we fit in hunting. At SentinelOne, the base of every single thing we do is detections, period hard stop. This is the first and last thing we do every single cycle. As we dive into that, for those who have done detections, the concepts are not complicated. The work is incredibly difficult. We start with fragile detections, what we talk about with indicators of compromise, we will take any advantage we have to find and stop attackers. If they want to give us things that we can go track, we will do that. Although we try not to rely on that because what matters today could be irrelevant tomorrow. The command and control that we're seeing for key intrusions can be worthless in 30 seconds, but we'll use that advantage.

Second, like everyone else in the cybersecurity industry, we use signatures. We write specific content to look for specific things and really try to focus on how to be impactful for there. And then what has always made SentinelOne different is our focus on autonomous models. SentinelOne's first patent ever in 2014, 12 years ago was for an autonomous model to detect malware. We sit and watch a lot of organizations struggle to move into the AI area, we were already here. This is where we started at SentinelOne. So this excitement that we feel, it just feels like we get to really focus on the things that started with us and that we really get to do well here. So our autonomous models will always be the core of how we approach detections.

Last year, one of the things we stood on this exact stage and talked about was we relaunched our threat services. I don't want to spend any time with architecture. I don't want to talk about offerings, but I do want to talk about one of the core components that we built into every single level was a multi-tiered threat hunting capability. As we looked at this, we felt this is critical. Detections are the base, detections are key. But we combine that with hunting, we can move faster, we can pivot we can identify and flag things to our analysts that we would never pass on in a product. There's a huge difference between something being viable for hunting and being production-grade ready for a platform. And so we want to leverage these 2 different things, so they're complementary and not competitive.

At SentinelOne, you can see we're pretty original with our names. We have threat intel-based hunting, where we use Intel. We have real-time hunting, which is where we hunt in real-time and retrospective hunting, where we do more computationally intensive and requires more analysis type of work and that we time bound that. But the thing that we launched that we had never done before at SentinelOne was our AI-based threat hunting. This was our first foray into this. And when we talk about our commitment to technology and experts, I think this is single best example we can give you of how we approach that.

So I want to give you 3 examples of why we think this is important and where we see successes and what we're going to build around in the future. Ultimately, our overall goal is to tie all of these things together. Our goal is to create as many layers as many traps as many ways that we can detect, find, isolate, prevent and respond to threat activity, and we'll do this in any way we possibly can. And this is always part of our whole. So when we talk about the benefits from AI-assisted hunting, we have to think about it as part of this whole. This is how we approach the strategy here at SentinelOne.

So let's just kind of give some metrics. Everybody in Vegas loves metrics. So we'll go through this one pretty quickly. But we talk about scope and scale for artificial intelligence. What does that mean? What does that actually apply? How does that actually manifest in your organizations and in our work.

If we look at the last year, market analysis says the typical organization will grow their endpoints about 16%, that matches what we see at SentinelOne. We typically see an environment grow about that same amount. So by extension, we should have 16% more detections and hunt findings than we did last year because we have that much more surface area. But as we focus on those autonomous models and the ability to scale, we see that a 50% increase in our true positive detections in that last year. We've identified more than 14 million true positives to our customers in the last calendar year, and that's growing faster than we see overall endpoints and environments. But where we see AI-assisted hunting providing the greatest benefit as part of that larger capability is the ability to move at speed and scale.

So let's show how that fits in here. We launched AI assisted threat hunting at OneCon. It went live on 1 December. In the first quarter, we had it, we saw a 380% increase in our ability to find malicious activity using that methodology. That's fine. Any of us that have built something, your first iteration, you're going from nothing to something. So all right, that's great. We love it, but that's not really a meaningful number. As we were 6 months into this effort, we saw AI-assisted hunting's ability to find evil increase 1,400%. And right now, today, we have seen that ability to go up 2,200% in the last year since we were on this stage in this room, this is what we believe the outcomes and the scope and scale of this technology and our people combined works.

But that doesn't mean anything 22,00% cool, awesome. That doesn't mean anything for your environment. The real number when we talk about scope and scale that matters to us and our organizations that build, field and respond to these things is 28. We notify customers 28 times every single day of intrusion activity that we found solely for our AI-assisted hunting. We will do this at least once while I am here on this stage. That is what AI and the right people building the right models and understanding that is able to provide to us. So that's one example.

Let's get into like intrusions stuff. I love intrusion stuff. I've been very lucky to spend 25 years in the intrusion business. I had to promise I wasn't going to spend too much time talking about intrusions on stage, but we want to give a second example of where we see AI-assisted hunting help. And we'll start with React2Shell. I'm sure most of you in this room are very familiar with React2Shell. This is the fastest mass exploitation event of the last year, and this was our very first stress test of our AI-enabled hunting. What we saw here for React2Shell for those who may not be familiar with it, this is a critical vulnerability around React servers that the company that builds these went public with on 3 December.

Let's talk about a stress test. We launched AI-assisted hunting on 1 December. We dealt with the largest mass exploitation event of the last year within 48 hours of us building this new capability. For those who may not be real deep in how this works, you'll see the CVSS score of 10.0. that's as high as it gets. There's nothing worse. There's not a 12, there's not a 15, there's not a 10A and B. If you see a CVSS of 10.0, that's essentially the industry saying, this is as bad as it gets. This can be easily exploited and it can do really dangerous things, and everybody needs to pay attention immediately.

The reason this particular React2Shell, when we look at this, what was so dangerous about it was, you could have exploitation based only on a crafted HTTP request, no authentication required, no user action, no code push to servers, a single HTTP request could lead to active compromises. That's why we saw this as a 10.0. And at SentinelOne, this became an all-hands on deck immediately. Every single 1 of our capabilities to be able to find this, we started working on overnight. Didn't stop. This is as serious as it gets for us. And as we see this play out, we saw industry reporting within the first 24 hours. AWS was the first organization to come out publicly and say they knew of at least 1 Chinese-based threat group that have already exploited this vulnerability and it was within about 12 hours, fairly rapid turn on this.

As we sat and looked at our posture in detection and hunting, we knew we have strong coverage in Linux and Mac early, but we had real challenges on Windows, just the way this manifested. I would freely love to dive into the details there. But again, I'm on a shot clock and they may be so, I would not. But we had weaknesses we had to cover. We had strengths to build around. This is exactly why we have those 7 different layers and how we're able to use them together. We're able to have detection, the strengths for 2 of the 3 areas and then we're going to focus hunting and detections on the ones we have the weakest coverage.

Within the first 48 hours, CISA has identified this as a KEV. That just means the U.S. government knows this thing is being actively exploited out in the wild. By the time they put this out, they were 36 hours behind. The first exploitation had happened 36 hours before this notification went to the public. This entire time, we're cranking on the back end, and then we start to see mass exploitation. We saw Google Threat Intelligence put out a piece on they saw no less than 5 different Chinese-based threat groups exploiting React2Shell. We saw an additional 2, so across our enterprise, our research told us there was at least 7 significant groups that had already exploited this within the first week and we're running active intrusions.

If we go back to the first contact, the first time we actually observed React2Shell at one of our customers, it was on December 9. And the first fire we had was AI-assisted hunting. That was the very first way that we found this 10.0 based activity. We had built a specific hunting engine that was designed to recognize the general shape of web exploitation. We would never take a tool designed to do a general shape of web exploitation and load that into your devices. It would explode every device would just go off. We would bury our customers in alerts. And that alert would take significant global visibility and multiple analysts with different skill sets to suss through and make sense of it. That's why we use hunting versus detections.

And that fire in and of itself, when that thing fires and now we have something to work with didn't mean it was conclusive. That first fire just meant there's something interesting to look at. And this is where we start seeing the technology and the experts working hand in hand. We had a specific threat hunter looking at this fire, and it looked like pentest. And we see pentest 24/7. So when we see malicious activity, that masquerades as a pentest, it's not in isolation. We see lots of pentests all the time. So our analyst looks at this and just says the thing that we never want to admit in this industry just doesn't feel right. We love to say we have technology answers, everything is universal. It's machine driven. It's not how we got going on this. We had an expert who looked at pentest for years, and that expert could say, I just know this isn't right.

At this point, we started waking people up. We start moving across our MDR organization. We start moving across our detection organization because now we have real content, we have a real trail that we can start pulling apart and figuring out how we're going to detect this, where is the best place for coverage, what do we do on endpoints? What do we do in cloud, which rule sets get what? This is where we think we really shine. This is what SentinelOne loves to do more than anything else. And as we figured that out, we were now able to move across those 7 different categories and strengthen all of them and expand our detection surface area. We're able to take the things that we were finding in hunting, which we're able to refine down and now it is production grade. Now we can load it into the platform. And now, by the way, we can hunt for something totally different. We can take that work from the AI models and the experts, move into the platform and build an entirely new AI model and go after something new and original and innovative.

And this process just kept happening day after day after day. And by the time we ended that first 30 days, we had identified a total of 8 attempted victims from numerous threat groups using React2Shell against our customers. What was interesting was that exploit by that point, had been used for a number of different things. We saw some really interesting attempted domain reconnaissance that we believe was designed to lead to some really in-depth intrusions. We saw coin mining, we saw crypto mining. These things aren't necessarily exciting, but you don't know that at the time. So we worked through all of these things. And this is the kind of things we write blogs about. We did. This is the kind of things that we talk about a threat conferences. How do you find something that has never been seen before and is as dangerous and critical as this is. So we think this is our second example.

This brand-new capability we rolled out was able to hold up against what is one of the most difficult challenges we have seen in the last year. So we can see trends that show a scope and scale is demonstrably improved and we have experts and AI. We can see that it's able to find highly evasive and dangerous types of activity that is also representative amongst a bunch of other noise. And then the third example I want to give is kind of boring. We never want to say on stage that something is going to be kind of boring, but again, we're all in the same work here. We all spend our time trying to secure our organizations.

One of the things that may be the only thing harder than finding something for the first time is making sure you can find it day after day, month after month, year after year because now not only are you evaluating, does your detection rules still work you're also evaluating is that rule capturing everything. SectopRAT is one of our best examples of that. I'll just refer to that as this RAT moving forward. That's kind of an awkward word. This thing has been out there for 7 years. We've been detecting and reporting this to customers for 7 years before our first OneCon ever occurred, we were working against this activity. And it's not super exciting, but it's important. Primarily, it steals browser sessions and crypto wallets. But what we saw over time was there was a new delivery wrapper every few months. So we had to be prepared to deal with this constantly evolving RAT and again, go back and make sure across all of our levels and say everything is still where it needs to be. We're still firing on this.

And what we're able to do is really start working through, what do you use detection for? And our answer was we're going to use detection to really look at the behavior of this thing and not focus on some specifics and not focus on the whole entity. What we're going to focus on those areas is with hunting. So some examples over this summer, we have done dozens of updates on this threat over the years. I mean, literally dozens of different things. July 13, pretty typical. Pretty typical example of how we do this. We started on the 13th of July, we update our static rules. They've got some new Windows and Linux rules that really help us find this specific piece of malware. That's great, but that's not the strongest detection.

We also focus on changing our behavioral detections, how do we find this overall model of a cookie stealer, whether it's SectopRAT or not, Also, we have those fragile detections. We had 50 known active indicators of compromise that were doing command and control. We'll take them. If the bad guys come to us, we will take it. We will make sure that's a layer as well. But then what we started changing was our ability to use AI-assisted hunting. We were already doing regular hunting.

We had found more than 6 findings that we had discovered via retrospective hunts that we were running, looking back 2 weeks against customers. But what this new capability gave us was, we were able to also run AI-assisted hunting to say, are we finding the edges of this thing what's happening and evolving that may be something that just we've never seen before, it looks a little bit different, and then we can run the whole drill all over again. So in this case, -- we did not use AI-assisted hunting as the core detection or hunting technology. We used it to evaluate our other capabilities and make sure things were exactly how we thought it would be.

And in this business, this is one of the most difficult tasks. So we're able to say, you know what, we absolutely are finding this. In this case, the new wrapper is masquerading as a fake Claude Desktop installer. Great. It's a new kind of installer. We've seen this over and over again. But we can verify that our static rules and our behavioral detections are working effectively cross it off the list. That's the first way.

Second way, we're able to point the rest of our hunting at going after the chain. What are the things that do change over time. Let's create a rule set that targets specific EXEs that poses specific things. Perfect for hunting. We wouldn't want to load that in detections because that's going to change. We want to make sure we can be nimble and we can move quickly. And we're able to verify this again against our AI-assisted hunting. And then our third layer we're able to say, you know what, let's just actually go build for this thing with AI as well. But in this case, we actually built a specific DLL side-loading hunting pack that was designed not to go after this tool, but to go after this activity. So now let's go see what it fires on. And it fires on these things, we can now bring it back, analyze it. Now we have full attack paths, we have full intrusion chains, and we can run right back and work this against every one of our layers and make sure it's correct.

So I present these not as us here at SentinelOne saying we're great, like we won a trophy. What we're actually saying is, this is why we pair experts and technology together. This is why we are committed to this path. It helps us move at a speed and scale we could not before. It helps us find high-end rare intrusion activity, and it helps us do our daily job better. It's rare to find a single capability that can do those types of things day in and day out.

And what I would leave you with as we talk about AI and hunting is really 2 quick sets of takeaways. And then I'm really excited for folks to see our hunting challenge come on. I'm really, really excited to see our experts go after these things. But we look at the attacker side of the house, I got some bad news, I got some good news. Bad news. attackers are using AI. That's not next year, that's last year. We are seeing AI-driven attacks across the entire threat landscape. It's not just the remit governments. We're seeing individuals use it. We're seeing small groups use it. We're seeing governments use it. AI-driven attacks are here to stay. This genie does not go back in the bottle. That's the bad news. Good news, these are actually like super detectable. That's a technical term, by the way, super detectable industry term. We can see these things.

In some ways, AI-driven attacks may actually be a little bit easier to find because the AI agents are not quite as focused on some of the evasive activity. So we have more things that we can detect on. Plus one of my favorite things about looking at prompts, it is the only time in my entire career where the attacker has to literally write out what they want to do. I would have killed for that 25 years ago. That allows us to detect. So we should not give up hope. We should not sit and say the attackers have all the advantages. We can find these things.

The challenge we now have, what is changing in the landscape and the piece that we all need to pay attention to, speed is changing. If you go and look at the media reports, almost all of that is focused on vulnerabilities. You can read about every one of the Frontier models and its ability to find hundreds to thousands of vulnerabilities. You can easily read about the ability of these models to create exploits against those vulnerabilities. It doesn't really change much. And the example I would give is, finding vulnerabilities was never the attacker bottleneck. We were multiple vulnerabilities and exploits behind 20 years ago.

We were 100 vulnerabilities and exploit behind 2 years ago. We're 1,000 vulnerability exploits behind now. It helps. It helps the attacker. It's an advantage, but that's not the biggest challenge we have. The biggest challenge we have is, for the first time, we are literally seeing attackers move at machine speed. I know all of you have heard that before. I know you've read it in marketing decks, I know you've heard it talked about on stages just like this one, but it's real. The speed with which attackers can move through an event is unparalleled. That is our biggest challenge and the thing that we have to work incredibly hard to solve.

Here's the good news. On the right-hand side here, we have the same capabilities. Everything they are doing, we can do. And I'll kind of get on a limb here in a little bit, in my career, this is the first technology I actually think benefits defenders more than it does attackers. The things it solves for us compared to the things that solves for them, we gain more ground. We gain more capability. But as we talked about in this presentation, that tool by itself does nothing. It's not going to get us home free. If we can pair that right tool with the right expert, we can do really interesting and powerful things. We can do things we've never done before, and we can move at a speed and scale that was not in our wheelhouse before. We find that really exciting here at SentinelOne.

And again, I just want to say, we talk about things being real. It's easy to see things on a slide and think about it as a concept. But the people that did this work are here in this room. We have Luca here in the room that runs our Hunt team. We have Brian Kerns that helps drive a lot of this AI-assisted hunting. We have Sagi Shoshani, who helps build these models and detections and make sure it works. We have Matan Weinstein that does the exact same things. These are real people. These are not some imaginary thing that we have sitting behind a curtain somewhere. You can talk to them here. You can hear their experiences. You can ask them what are we getting right? What are we getting wrong? And you have the same people, too. We know we are not the only ones doing this. And that's why we want to have discussions like this. We want to share our lessons. We want to share what we think will work against the speed we see with these attacks, and we want to do it together because that's how this thing is going to work. That's the first piece of good news.

The second, another capability we have that we never had before is we can treat agents like we treat people when it comes to tasks. We can say, where do we want to put an agent and where do we want to put a person? Here's the good news with agents. They're not taking PTO to go to their niece's wedding, they didn't get in a car wreck on the way into work. They're not having a bad day and are distracted because the lunch wasn't right. It runs 24/7. We can make intentional choices about where we put that capability and then save and augment the cycles of our actual experts. We can take the people that we need to do the really difficult work and we can lift them out of the mundane and we can put tools in their hands, they've never had before. And that's not us at SentinelOne. That's everyone of us in this room. I don't know that I've seen anything more exciting in my short career than the ability to do this.

We finally have capabilities other than just wearing our people out going into hero mode working nights and weekends. We can let the machines do that. We can build sustainable lives for our people, and I know that sounds dramatic. And I know that sounds emotional. But that's how real we think this capability is here. So you'll see a lot more of what we intend to do over the next year tomorrow. Again, Chris and his team is going to walk through what we think is going to be some really impactful upcoming technology. You'll hear Tomer talk about where he is taking SentinelOne and how he views the entire landscape, not just the threat landscape changing and where we intend to fit into that. And again, our whole point here is to spend time with you. Our whole point here is to learn from you, have you learn from us, let's compare notes, and let's get after this thing because it's not going away.

And with that in mind, I'm going to hand it over to our threat hunting challenge. We're going to bring them on stage. You can actually see some folks threat hunt live right in front of you. So thank you, everyone.

Hey. Thanks so much to everyone for joining us at the SentinelOne session. Delighted to have Tomer, Founder and CEO on stage with me along with Sonalee, relatively recent CFO. Hey, thank you both for being here. We really appreciate it.

Absolutely. Our pleasure.

Super happy to be here.

Tomer, we were just talking off stage on it's a really great time for us to pick your brain a little bit on some of the architectural shifts that are happening in cybersecurity. Maybe, as a starting point, walk us through what one of your more sophisticated customer conversations look like. When they call you in and they say, look, we see the Hugging Face news, we see all of the agentic risks that we're taking on here. Please solve this problem for us. What do you say in terms of the customer journey response?

Yes. I think what's really important more than anything else is to separate the hype from kind of the actualities of these attacks. And I think what's interesting in these recent incidents that we've seen, fundamentally, there's nothing new. And I would try and kind of unpack that a bit. What these agents have done is nothing that a human attacker has not done in the past. So in essence, we're not seeing any type of new behavior. We are seeing a new level of velocity. We're seeing a new level of speed, but we're not seeing new techniques.

And I think that's where it's becoming really, really interesting when you start to peel back, okay, what should people do right now? There is no magic solution out there from any cybersecurity vendor. No matter what you heard, there's nothing that solves the issue that we're facing right now in terms of the speed and the velocity. But with that, if you invest in better fundamentals and you can actually achieve better fundamentals faster, that is really your best shot at mitigating risk. And note that I'm saying, not stopping the breaches, mitigating risk. I think in this day and age, if you claim that you stop breaches, that's unreliable. That's not credible.

I mean we're seeing all these breaches happen. You read about all these breaches happen. Products are failing. Everybody is failing. So this notion that we can stop it, we can prevent it. We can live in a world where these things are not happening, it's misguided. We can reduce the risk. I think that is the #1 thing that we're letting our customers do is figure out, okay, where should I be focused? I mean there is an ocean of different ways where attackers can actually leverage AI right now to find these nooks and crannies to get in your environment. Another reality is that nobody is able to fix all of those, maybe a few companies. But the level of hygiene that you need is just -- it's extreme.

I would say that -- I'll take us as an example, right? I mean we're a company, too. We need to protect ourselves as well. And our hygiene has been extremely, extremely high for many, many years. Pre-Mythos, post-Mythos, like all that stuff doesn't really matter to us as much when you think about the fundamentals that are needed. Being vulnerability free, you don't need Mythos to tell you that you need to be vulnerability free and fix all your vulnerabilities. The fact that awareness is expanding doesn't really mean that the problems were not there to begin with.

I would even extend this to say that AI is not good at cybersecurity at all. We are bad at building secure infrastructure, all of us combined. And that's why AI, which is a great search engine, is able to find all these things that we have basically sucked up for many, many years, right? So we got to really think about what's happening. It's not that AI suddenly is becoming so proficient. The problems were there. People were sitting on vulnerabilities for years. People were not fixing and configuring their environments for decades.

The complexity, security vendors are also part of the issue. They're introducing more complexity into the mix. You're buying a platform, you're actually buying sometimes 7 different platforms from the platform provider. You're trying to stitch everything together. You're applying manual policies for something that moves at machine speed. Like there's a complete misalignment between kind of the pace of technology and the pace that AI brings and the status quo of our infrastructure. I sincerely don't believe that AI at this point in time is so remarkably good, specifically and surprisingly just in cybersecurity. I mean we're talking so much about cybersecurity. The problem is not AI getting better. It's the state of cybersecurity itself.

My favorite thing you said there is we're not seeing new techniques. Maybe I'll ask the question then, okay, so if the existing techniques get automated scaled happen faster. What is the limiting factor to being able to take the existing building blocks of the security architecture and make it more sophisticated to be able to deal with greater scale if it's the same technique.

Yes. I think you need to do 2 or 3 main things. One, visibility, and we've talked about it, I think, throughout years on this stage in the context of AI, but also not in the context of AI. You need visibility. There's this nomenclature saying in cybersecurity, you can't secure what you can't see. And it's very true. I mean you got to really have visibility into each and every one of these workloads, those parameters. Every piece of your environment needs to be monitored. And that, I think, is the basis for anything that follows.

Then I think what's lacking is how do we get to the same type of velocity and speed to match what we're seeing with AI, and that comes through more automation and leveraging AI or machine learning in these environments to basically take the visibility but find the signal fast enough before it turns into something that somebody else finds for you. And the last piece, and I think this is where it gets really interesting, it's about building more and more generic ways to understand that something different is happening.

And I'll give you a simple story. This is, I don't know, maybe 4 months ago, and it seems like it was a lifetime ago, but we had all these supply chain attacks. LiteLLM, Axios, like all these libraries that developers are using have been poisoned. And then people using AI for development, Claude, Codex, all these tools were automatically downloading these poisoned libraries, and Claude was just executing those on the device itself. So in essence, in a complete automated manner, hundreds of enterprises, Fortune 500 companies got completely compromised. By the way, the moment Claude executed that innocent library, all the secrets, all the passwords, everything you've had also laterally in your network was being pulled and sent out, which means that your collateral damage now and the need to fix, I mean, all these derivative kind of damages that happened because of it, is also like a pretty long-haul remediation story.

We, on the other hand, with a piece of software that was built 10 years ago, 10 years ago. I mean, the logic -- we didn't know generative AI is coming 10 years ago. I don't think anybody, including the people that build it, right? With that technology focused on the most generic aspect of cybersecurity, which means behavior, not exploit specifically, not viruses, not signatures, not Trojans, not ransomware, not the actual private cases of how you do badness, but focus on what badness generally looks like or how different it looks like from benign behavior, we've been able to stop all of these attacks with no prior knowledge, no prior understanding.

The system just saw something. It didn't care if it was Claude or the user or an attacker, it didn't really matter because what it exhibited looked different. So the more we focus on generic ways to take visibility and then discern good behavior from bad behavior, whether it's a human user or the agent that's running on the machine or some SaaS workload that's now downloading stuff that it shouldn't. To me, that's the only answer. And very coincidentally, that's exactly what we built in the last decade or so.

Now we're extending all of those models to also be applicable even in and through the introspection of the agent and the AI model itself. Right now, it's very focused on machine behavior. This is kind of the gist of endpoint protection. Now when you add visibility, again, coming back to visibility into what agents are doing, you're able to basically apply the same type of algorithms to discern, hey, is this agent really doing what it's supposed to do.

And then we go, I think, even deeper into what I believe is going to be required here for AI alignment in general. And this is a problem cybersecurity never tackled. It's a complete new problem for everybody. How do you make sure AI stays aligned to what you want, to what humans need. And the only way to solve that is by matching intent with behavior continuously and all the time in a form that's external to the model. And I think that is, by far, the only thing I would invest on for cybersecurity in the next 5 to 10 years is solving AI alignment and AI safety. And I think there's a lot of corollary things that we do today for enterprise defense, but the AI alignment issue is going to supersede pretty much every other problem we see in cybersecurity.

How do you do it?

You leverage a lot of the knowledge that you have today. And I think that you need to also get to this realization that the model is never going to govern itself. And that cyber people that want to solve AI alignment should not be investing in building some super intelligence because you don't need super intelligence to keep AI aligned. You need something that is more balanced, something that is designed to govern, not to be smart, just to know when intent differs from the exhibited behavior. And that's the entire thing. I mean -- and it's not simple to build, obviously.

But it does, in many ways, resemble the core EDR problems that we've seen in the past. I mean they were much more binary and file and attacker inclined, but it's still about operations, and it's still about what's happening and it's still about behavior. So to me, intent behavior equals eventually AI alignment. How do you do it fast enough? How do you make sure that the model can't temper protections, which is what we're seeing right now with guardrails. Yes, there's guardrails. There are safeguards where we just trained the model to be much more safe. The model doesn't care.

The model -- we're seeing it right now play out in real time. The model does what it wants at the end of the day. The model does what it believes is serving to the goal that it was given. It looks at the guardrails and say, okay, I see the guardrails, but maybe I'll do this. It's almost like a kid, right? I mean you give it all kinds of, hey, don't do that, don't do this, don't do that. Sure. Yes, absolutely. I will not. But then sometimes you do. And I kind of feel like there's really no way inherently in the transformer architecture that allows for that determinism to ever be exercised.

So it's a question of the current architecture for LLMs. By the way, I don't think there's any certainty that this is going to be the dominant architecture for years to come. I think what you're able to build today with the velocity that AI coding gives you is maybe a complete new architecture for the future. Maybe it's time for us to contemplate how we build a new reasoning model and not one that leans on brute forcing chain of thought and randomizing tokens and using language as the basis. I mean, right now, it works, and we're putting more money into it. And we kind of feel, okay, the more compute we put in, the better outcome we're going to see. I have a question for everybody here. Where are the AI outcomes? Where are they proven in the market?

Cutting, customer experience.

Revenues, dramatic growth, amazing outcomes, transformative change for earth.

Do you think this is because it's the wrong architectural model by a transformers? Or do you think it's a change management problem?

Probably a bit of both, but I think that underneath it all, it's a question of trust. And I think we are just unable -- if you're working with these models like firsthand, you understand you can't trust this. It should be impossible.

If I just -- let's go down this thread for a second. If we solve the alignment problem the way that you're suggesting, then you get the trust and then you get the unlock from a productivity and adoption.

I believe so. But I also think that it's -- that's a deeply rooted architectural problem because to do that in a way that is noncircumventable by the model or the software itself, you can't have security running at the same level, at the same layer at the same ring that the model is running. And just in terms of compute, even today, if you take normal cybersecurity, if you're running in user space, I don't care what you do. You're toast. You're toast. Everything can bypass you. So the stories about like user space becoming the thing and in the wake of the CrowdStrike outage and blue-screening 8 million devices across the world, people are like, "Hey, get out of the kernel, you have to get out."

Everybody is going to get out. Nobody is out. What are we like 2 years, 3 years from that event. Nobody is getting out. And the reason you're not getting out is because the moment you're out, you're a toast. Like you're in the same level that the attackers are, and you got no shot, no shot to prevent any type of an attack. So the need to be as low as it can be in the operating system is a dire need in the question of AI alignment.

And I would say that it's even more acute, you likely need at this point to even have either a new chip design where you can separate compute for whatever security you put inside versus whatever is running the actual software in the model or you need some form of a better security enclave. Even the security enclaves that we've seen today, Apple, as an example, I think they got really great security enclave capabilities. They offer you protection, you can load your software and then they protected via hardware, that got compromised also. So it seems like we would, at some point, need to really think about how we separate hardware in a manner that allows for security that cannot be bypassed by what it's supposed to be securing, which sounds pretty obvious, but it's really not the case today.

Yes. Super interesting. Let me ask you about this concept of taking the proprietary data set that's in SentinelOne and applying it to some sort of LLM technology such that you're able to get maybe it's purple or maybe it's the continuous penetration testing loop where you can run offense and defense with agents to level up the scalability of the existing architecture. What are your thoughts on how that makes sense for SentinelOne?

Yes. I don't know. I mean it's going to be a jagged answer. I think that there is a lot of focus on vulnerabilities, maybe too much focus on vulnerabilities right now. This entire notion that you're going to have the red agent and the blue agent and they're going to handshake each other and one is going to find, one is going to fix and everything is going to be miraculously pristine after that. I haven't seen it. I haven't seen it. And we've been red teaming our environments in an automated manner for years. And obviously, once we got access to more and more frontier models over time, we've used frontier models to do that as well.

You find a lot of stuff, you still need humans in the loop. You still need to prioritize stuff. You still need to understand what's real and what's not real. And the fixing element, I mean, it's not just finding and fixing it. It's finding, it's fixing, it's putting temporary controls, it's rolling deployment for production systems. Who's going to let AI roll out a production system completely automatically. Nobody is doing that today. That's the one place I would not exercise AI. So to solve cybersecurity in this miraculous, one is going to see them, one is going to find them and we're good. Haven't seen that happen.

And look, again, we're a Glasswing program participant. We're part of Daybreak. We got access to every model that you can dream of, like everything that's preview, we already have it. We've had it for a while. Obviously, all the open source out there. I think the other realization is that there is no like supreme intelligence out there. These are largely in terms of the level of reasoning and intelligence, these models are not very different from one another. Some are better at keeping course. Some are better at scale. Some have better speed, better cost perspectives, better specialties. But in general, the reasoning quality is not dramatically different.

But even when you take one of these models and you say, okay, I'm going to pick a model, and I'm going to start fine-tuning it or doing some stuff post training. And just to ground everybody, like doing stuff post training is very, very limited. Like you're not changing the true innate behavior of the model. You're trying to kind of keep it in track. It's all done post training. To think that you have done something post training that is so dramatically better that is going to win against adversarial AI, again, I haven't seen that in our research.

And especially, I mean, at some point, it also becomes like a very like linear and binary question. Like let's say, you're taking what's it called, NVIDIA Nemotron, that thing. That stuff is not like even top 10 in reasoning performance. By any benchmark, honestly. And then you're saying, okay, I'm going to use that as my basis. Just an example. I'm going to use that as my basis, and I'm going to sprinkle some fine-tuning in my data from years of doing cybersecurity and like the Chinese open-source models are probably like by a factor of 5 better than these models today.

Today?

I haven't seen them lag. Moreover, I've seen them add incredibly, incredibly sophisticated ways to scale their models that I think a lot of the frontier companies are coping today. That's the -- I think the benefit they have when they're seeing something open source. But all in all, to just kind of pick one model and say, I'm going to train this to be the best thing of all models, I think that's like total wishful thinking. No matter if you're -- I don't know, no matter if you know Jensen or not, I don't think that, that changes stuff, right? I mean at the end of the day, you have to be agnostic. You have to understand where the limits are.

And I think in many ways, I think what we're trying to do more than anything, this has nothing to do with technology, is to stop confusing customers, to stop making pompous claims, to stop thinking that you can develop something that is completely unprecedented, going to win. That's the solution. Here you go. It's right here. Let me open my jacket and give you the solution. None of that exists today, and that's part of the issue. And we're all trying to think around corners and understand, okay, where this is going. I think it's proven very elusive, not because we don't know exactly what the potential of damage here is, but more because these models are unpredictable. They kind of not only improve in an unpredictable manner, but they also lack precision in an unpredictable manner.

So it's very interesting to obviously kind of go about and try and solve it. But then I always go back in cybersecurity, it has to be fundamentals. People have not gotten their fundamentals together yet. So don't rush to deploy the AI security agentic [ spaceship / Red ], whatever on your, whatever, that's all going to help you. Spoiler alert, not going to get more secure. You really have to start fundamentals. And I think that's why also we're seeing this amazing traction around runtime protection and around endpoint protection because it's very obvious. Like you're running AI workloads some place, you need to monitor that workload. That's it. We don't need to talk too much about AI at that point. I mean you need the visibility, seeing the visibility, seeing immediate alerts, you're seeing amazing signal coming from all these new found workloads.

To me, that has to remain the focus for at least the next year or so. The speed in which people are doing it, that has to change. So if anything, this day and age needs to give us this wake-up call, which I think it's -- I don't know how many more wake-up calls this world needs to have about cybersecurity for things to move faster. But right now, we also have to recognize the limits of what the infrastructure can absorb. You can't just deploy overnight across the world. You can't fix this globally in 2 days. It's going to take time naturally. I think it is moving faster, but it's moving faster incrementally.

And I think just the level of confusion right now is also somewhat, I think, drawing customers into kind of a loop of what do they need to do, who do they need to talk to, who's going to solve it. There's almost like they're sitting there and they're waiting for their vendor that already kind of is preexisting to come and descend from the top and say, okay, now the problem is solved. Now to be honest, we're all trying to do it. We're absolutely trying to do it. I mean we're also getting to the point that we understand that the fastest way to deploy is actually not by talking to us, just like clicking a button on your console and starting to do things in a much more automated way. So a lot of what we're investing in today is this ability for our customers to just click a button and get it on with and not go to those protracted sales cycles that we're seeing in cybersecurity and deployment. We want to automate everything for you. We believe that's the real power in AI right now is that can really automate stuff. It's a great search engine. It's a great automation tool. Everything else will be really careful with.

Sonalee, this is a perfect opportunity to have you opine on the future of the transformer architecture. Tomer was just talking about, look, it doesn't happen overnight. And you had this language in your script that I thought was actually very CFO-esque, which is...

Appropriate?

Yes, CFO appropriate. Yes, architectural changes are multi-quarter and multiyear in nature. Now you had a really clean July quarter. So I think 2 things might be happening. One, to Tomer's point, things are happening a little bit faster. And two, you have a little bit more of a handle on SentinelOne forecasting and having been in the seat for a couple more quarters. So talk to us about both of those things. What are you seeing in terms of pattern recognition or rather what's changing on the pattern recognition for deals in the pipeline, conversion rates, salespeople productivity, all that good stuff.

Yes. So you're right. It was my second quarter this past one. And we don't just think it was a clean quarter. We think it was a great quarter. We're really proud of what we achieved. And for those of you who didn't go through our earnings, we actually beat on the quarter and raised our full year revenue guidance.

And I think it was -- the magnitude is important because I actually think it was one of the largest beats in a number of quarters.

So thank you for noticing that. It was, and we actually raised by significantly more than the beat, just showing our confidence in the outlook in the business. So you asked a couple of questions there. So in terms of how customer conversations are going and this -- I think you were alluding to the Mythos moment and how is that impacting our pipeline and our deal cycles and conversion rates. So we see a really strong demand environment, and that is very, very clear in our pipeline. But my comment around this being a multi-quarter, multiyear tailwind for us and the industry still holds true because boring from what Tomer just said, we need to focus on the fundamentals. We need to focus on how quickly customers can actually absorb all this new technology.

And I think from our perspective, one of the areas where we're seeing a lot of strength and traction is in our AI security products. And that was one of the things that really drove the strength in our net new ARR and will continue to drive that. And those are great conversation openers with our customers. But just to give you an example, I was on a customer call this week. It was a very, very large infrastructure provider, global infrastructure provider. And the CIO was saying, look, we need to clean-sheet our stack and specifically our security stack because we don't want security to just be something that we do to protect ourselves and protect our customers. We want it to become strategic for us and for our business.

But that is a multi-quarter conversation. And that is something that I want to bring all of the team across this company into. And yes, we want SentinelOne to be part of that journey and please tell us what products you think we need. And again, this is where the power of the platform comes in. The reason they want us to speak to us is because we bring a true platform approach. But it's something that is going to take place over many quarters. And whilst we're definitely seeing it in the pipeline, like when you actually see that hit the revenue numbers, that's going to be over time. And I think that's great actually because it's a cumulative impact.

The other question you asked was around kind of the sales productivity and efficiency. And Tomer talked about like where we are seeing the benefits of AI. And one thing that's very dear to my heart and a metric that my team focuses on all the time is net retention because we all know that it is way better business to keep and expand a customer in SaaS than to go out and acquire a new one. And you've seen really strong net retention metrics from us in the last 2 quarters, particularly in that cohort of $100,000 customers and above, which tend to be our stickier customers.

And again, I think that's a validation of the platform strategy. They are buying more and more products from us. And guess what, when you buy several products from us and you're adopting our platform, you're much less likely to churn. And I think that is one of the things that's driving that productivity and net retention. And then the other thing is just among our sellers, we are seeing improved productivity, and we are seeing lower and faster deal cycles. So again, these conversations that do take 6 to 9 months or sometimes 9 to 12 months in the case of enterprises, large enterprises, we are seeing a slight contraction in that sales cycle, which is starting to come through in the numbers.

And then finally, on the renewals process, we started automating our renewals process, particularly for that really long tail. And we can touch way more customers, and we can actually reach out to them earlier in the cycle. And that's giving us a lot better predictability. And one of the things that I'm really going to be focused on as we go into fiscal '26 planning, Tomer and I are planning for the first time together is how do we bring that number that as we think about net retention, how do we improve that number and really work on that churn and downgrade, particularly with all these new products to like just drive it higher and better.

One of the debates in cybersecurity for some time now and especially over the last couple of years has been the importance of scale. And in some ways, you have well scaled relative to some of the new entrants in the space. On the other hand, you've got 2 or 3 really large competitors that sometimes have a larger microphone and throw more dollars at the problem. So from a CFO perspective, if you're trying to reduce churn and grow NRR, how do you do that in a way in which you can use your sort of middle of the road size as an advantage and maybe there's a better expression for that relative to the companies that just have much bigger R&D investment budget?

Yes. So I'll answer that, and then I'll let Tomer comment on R&D as well. So look, I think a couple of points I would make there. We feel like we are able to make the investments we want to make. And look, you can see for yourself how well some of those emerging products are doing. Like we've seen record growth and in some cases, like in the case of AI security, so Prompt and Purple AI, like meteoric growth. We tripled our ARR year-over-year in that product. So we feel like we are able to make those investments that we need to make in the products where we see real outsized opportunity to grow.

And that's notwithstanding the competitors -- and yes, they are formidable competitors. We feel like we're formidable. And our win rates continue to improve year-over-year. So we're seeing those competitors and our win rates are -- like we're getting better over time. The second thing I would say is we also invest in our go-to-market. And one of the things that I just touched on earlier, automating renewals, that's something where actually we're seeing better productivity from our sellers, and we're able to take some of those savings and reinvest in areas again where we see the ability to deliver outsized growth. So I feel like from where I'm sitting right now, we really have the potential to take advantage of the time in this opportunity in this space to make the kind of investments we need to make to continue growing and hopefully accelerate our growth.

Yes. I would say R&D and our technology, I mean, versus the competition, that is not my #1 concern. It's far from being my #1 concern. Honestly, I mean, we -- you would say with our size, with our position, with like all the stuff, we still have the best technology in the market. Like we show up every day to POCs with the world's leading companies, and we win time and time again, regardless of the size of Microsoft or Palo Alto Networks or CrowdStrike. So I would say size is just not a good reflection of quality of technology. Bigger microphones, for sure, more confusion, for sure, controlling a narrative or weaving a narrative for sure. I think that's our challenges, by the way, as a company at that size, which to me, by the way, is quite foreign.

I'm a technologist to me it's like I just want to build the best stuff ever and make sure the customers are protected. Instead, we need to kind of come up with all kinds of counter-fairytales for what these other people are telling and saying and trying to promote. It's part of the game. We all get it. I wish that in this day and age, people would actually focus on what's important and what matters and not the fairytale stories about how identity is going to solve agentic protection today because I just bought a company. But 3 months later, identity is just going to be one sliver and just bought another company, that's going to solve it for you. And we all eat it. Like customers eat it. Analysts eat it. Everybody is eating it.

And I kind of look at it kind of sometimes with like deep, deep frustration on like why do people continue believing in those stories? I mean these stories change. If you just go back 3 months, 4 months, 6 months, it no longer holds. What they've said, what this market has been saying 6 months ago doesn't hold today anymore. The brilliant acquisitions that you've done 9 months ago, nobody cares about it today. But we all have like very distinct short-term memory, I would say, and we kind of move and move and the human brain works in a very susceptible way, sadly.

And I think that a lot of folks have learned how to manipulate that, to be honest. And I think that's the main thing we're dealing with, right? It's dealing with confusion. It's dealing with the kind of fear, uncertainty, and doubt that people are fueling into the space instead of really being like almost like in a very dry way, technical about the problem and technical about the solution. And let's just go and solve it. Let's not tell stories all day long. Let's just focus on how this thing is getting risk from here to here in a quantifiable, measurable way. Those stories that you're telling on earnings calls, they're not doing it. I'm saying it also about myself. Like to me, it feels like a cybersecurity theater that's completely disconnected from what's actually happening in environment. Sorry to be so blunt today, but...

No, that's why we love you because you're direct and blunt. So hey, please join me in thanking Tomer and Sonalee.

Thank you, all. Appreciate it.

Hello, and welcome to the SentinelOne Q2 FY 2027 Earnings Conference Call. [Operator Instructions] Also, as a reminder, this conference is being recorded today. If you have any objections, please disconnect your call.

I will now turn the call over to Saad Nazir, Vice President of Investor Relations.

Good afternoon, everyone, and welcome to SentinelOne's Earnings Call for the Second Quarter of Fiscal Year 2027, which ended July 31, 2026. With us today are Tomer Weingarten, CEO; and Sonalee Parekh, CFO. Our press release and earnings presentation were issued earlier today and are posted on the Investor Relations section of our website. This call and accompanying slides are being broadcast live via webcast, and a replay will be available on our website after the call.

Before we begin, I would like to remind you that during today's call, we will be making forward-looking statements about financial performance and future events, including our guidance for fiscal third quarter and full fiscal year 2027, as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual results or events could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our quarterly reports on Form 10-Q and annual report on Form 10-K. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements.

Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons why actual results may differ materially from those anticipated even if new information becomes available in the future.

During this call, we will discuss non-GAAP financial measures, and all comparisons made are year-over-year unless otherwise noted. Those non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our earnings presentation. These non-GAAP measures are not intended to be a substitute for our GAAP results.

Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges, gains on strategic investments and income tax provision, which cannot be determined at this time and are, therefore, not reconciled in today's press release.

And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our second quarter earnings call. Q2 was an outstanding quarter for SentinelOne. We exceeded our top and bottom line guidance, delivered record second quarter net new ARR and record operating margin. Building on this momentum, we are raising our revenue operating income outlook for the year. Q2 marks our fifth consecutive quarter of positive net new ARR growth and outperforming expectations. These results reflect what increasingly defines SentinelOne: top-tier growth, expanding margins and undisputed technology leadership.

Cybersecurity is at a fork in the road. AI is transforming the way software is built, businesses operate and adversaries attack. The speed, scale and sophistication of AI models are making the threat landscape increasingly complex. At the same time, AI also gives defenders the power to transform security outcomes through accelerated response times and unmatched efficiency.

The approach of bundling fragmented products or marketing disjointed platforms is not the answer. The strategy repackages complexity, it doesn't remove it. Enterprises today do not need another point solution, a feature product or a bigger bundle. They need real-time connected intelligence that operates at machine speed. This requires a unified architecture, a single control plane, purpose-built to defend the modern infrastructure in the age of AI. This is the vision we found at SentinelOne on, an AI-native approach to cybersecurity long before the Mythos moment.

Singularity is the autonomous security platform of the future. Our technology differentiation lies in a clear architectural advantage. Every platform solution we offer, from Endpoint, Cloud and Data to AI SOC, AI EDR and ADR is the best-in-class capability on its own, unified by our industry-leading autonomous runtime engine and delivered via a single pane of glass. Machine speed runtime protection is fundamental to our platform architecture, and our AI security growth and contribution already indicate we are leading in this fast-moving category.

This quarter provided a clear validation across 4 fronts for SentinelOne: one, market-leading wins with the world's most discerning organizations; two, growth acceleration of our AI security, data and cloud solutions; three, sustained displacements of legacy endpoint vendors; and four, our distinct architectural advantage in securing modern AI infrastructure.

First, let's start with how the most discerning buyers in the world are choosing SentinelOne. Our competitive win rates increased sequentially and year-over-year, anchored by growing platform momentum and consolidation wins. Net revenue retention among our largest customers expanded again in the quarter. 7- and 8-figure customer wins are becoming consistent. And cross-platform adoption drove a record ARR per customer, growing double digits year-over-year.

Enterprises are increasingly consolidating multiple point products with the Singularity platform. The clearest example in leading aerospace and defense enterprise chose Singularity to execute a complete rip and replace of our primary competitor, consolidating Endpoint, Data, Cloud as well as AI Security with SentinelOne. And our AI security capabilities widened the gap as the competitive alternative was not good enough to help this enterprise accelerate AI adoption. Facing sophisticated nation-state threats, this customer had extremely stringent security requirements. During an intensive proof of concept, SentinelOne delivered a step change improvement in analyst workflows and security efficacy over the incumbent.

Second, we are seeing strong contributions across the board from our AI, Data, Cloud, Wayfinder and Endpoint solutions. We had another exceptional quarter for Prompt Security, which remains our fastest-growing platform solution. as organizations move AI models and autonomous agents into live production, robust security is mandatory. We are capturing this wave, driving strong demand across model security, agentic guardrails and enterprise AI usage.

Prompt Security is leading this category as the definitive AI security solution for the enterprise. Demonstrating this momentum, Bell Canada selected Prompt Security to secure one of the nation's most critical networks. They require real-time visibility, automated guardrails and strict compliance for their workforce, and SentinelOne delivered it. This win validates that enterprise-grade AI security is a prerequisite for safe AI adoption, and our momentum in this category continues to accelerate.

The telecom sector continues to be an area of competitive edge for us. We protect operators across 5 continents, including several of the largest carriers in their respective markets. These are among the most demanding security environments anywhere, massive distributed infrastructure, persistent nation-state threat exposure and stringent regulatory requirements or scale and expansion in that environment demonstrates the breadth and the resiliency of the Singularity platform.

We continue to win stand-alone AI security deals from our direct competitors. This is serving as a strategic entry point for broader platform expansion. As AI adoption scales, enterprises are confronting an unprecedented threat landscape. They need to protect AI tools and sensitive data while enforcing strict run time controls over autonomous agents. Our increasing AI security innovations address these challenges, now offering agentic security, AI red teaming capabilities and enhanced AI entitlement management. This is enabling enterprises to adopt AI rapidly without compromising security, privacy or trust. Building upon our technology leadership in EDR, we are on track to establish similar leadership in agentic as well as AI detection and response.

Next, Purple AI continues to redefine the AI SOC, serving as our core engine for autonomous security operations. An increasing number of new customers are landing with Purple AI from day 1, while our existing customer base continues to expand its usage. With our recently launched agentic investigations, Purple AI autonomously analyzes alerts across complex environments, producing definitive assessments in seconds rather than hours.

IDC independently validated a 338% 3-year ROI for Purple AI customers. Purple AI's accuracy relative to human-led workflows further underscores its disruptive potential. As Security operations evolve towards continuous agentic defense with human oversight, SentinelOne sits at the forefront of this paradigm shift. By continuously advancing Purple AI, we empower customers to accelerate detection, automated investigations and execute remediation at machine speed.

ARR from our AI security offerings, Prompt and Purple AI, continues to be in hyper growth, tripling year-over-year in Q2. We expect this to become our next 9-figure ARR category, following Endpoint, Cloud, Data and Wayfinder. This momentum highlights our technology differentiation and market leadership in defining the next generation of AI cybersecurity.

For Data Solutions, Q2 marked our fifth consecutive quarter of ARR growth acceleration. We believe the future SOC will be hybrid. Enterprises will continue to operate across diverse security tools and data sources while increasingly adopting AI-driven investigation and automation. Our security data lake is built for that transition, from intelligent data pipelines and AI SIEM to Purple AI and hyper automation. We help customers consolidate and optimize security data and turn it into faster detection, investigation and response from pipeline to SIEM to autonomous SOC.

SentinelOne covers the full security data life cycle. This is evident in our accelerating momentum with AI SIEM. Among new customer wins, a global services firm selected SentinelOne's AI SIEM over both legacy and next-gen alternatives to unify telemetry, improve operational visibility and accelerate incident response. By establishing the Singularity platform as their centralized security data foundation, the customer unlocked petabyte scale telemetry control and lay the groundwork for AI-driven automation.

Demonstrating our expansion momentum, a major international retailer expanded its deployment with SentinelOne. This win fully displaces a legacy endpoint vendor while expanding this customer's data footprint. By unifying endpoint protection and security data analytics on the Singularity platform, this customer is establishing a foundation to scale their data volumes by several terabytes in future phases.

External validation continues to highlight our competitive edge. According to an IDC business value study, SentinelOne's AI SIEM delivers a 331%, 3-year ROI, 70% faster queries, 75% faster investigations and 4x the threat coverage. For cloud security, Q2 marked the third consecutive quarter of ARR growth acceleration. This momentum is driven by strong adoption of our best-in-breed runtime cloud security, covering both cloud and on-prem environments. The massive AI infrastructure build-out is driving accelerated demand for us, making real-time run-time protection an absolute imperative as enterprise cloud footprints, expand and AI workloads multiply.

Among cloud security wins, a major American tech giant significantly expanded its SentinelOne deployment, choosing Singularity Cloud over a close competitor. The customer cited our superior platform performance and operational ease of use as the decisive factors. As their cloud infrastructure rapidly scales, this expanded partnership creates a natural compounding growth opportunity for Singularity across their environment.

Among new customer wins, a leading global financial institution standardized on the Singularity platform following a rigorous competitive evaluation against both legacy incumbents and next-gen contenders. Given strict regulatory requirements and the operational complexity of a distributed cloud environment, this enterprise selected SentinelOne for a unified autonomous cloud security.

Modern cloud environments are dynamic, distributed and directly connected to mission-critical AI workflows. Static posture management and periodic vulnerability scans are simply not enough. Organizations need runtime cloud security to detect and neutralize active threats and execution. Underscoring our cloud security leadership Frost & Sullivan named SentinelOne a visionary leader in its 2026 Frost Radar for cloud workload protection platforms, recognizing our innovation and growth against the field of more than 45 qualified vendors.

Third, we continue to grow our endpoint footprint, particularly through large-scale consolidation deals. Through our strategic partnerships with MSSPs, we are consolidating multiple incumbent endpoint states onto the Singularity platform. Singularity Endpoint delivers the most autonomous EDR technology, which combines industry-leading efficacy, performance and user experience. The secular shift towards infrastructure modernization continues to provide a powerful long-term tailwind. Nearly half of the sector still relies on legacy antivirus, creating a massive displacement opportunity. This transition is backed by proven economic value, with IDC Research demonstrating that Singularity endpoint delivers a 301% 3-year ROI.

Highlighting our traction for endpoint security, a major government agency administering national public services standardized on Singularity EDR. This agency selected SentinelOne following a rigorous evaluation that demonstrated our platform's real-time speed, autonomous response and superior total cost of ownership. Validated by existing reference deployments across major public institutions, this win underscores our trusted position in securing mission-critical government infrastructure.

Fourth, we have a distinct architectural advantage in securing the modern AI infrastructure. As AI agents gain autonomy, real-time runtime security becomes paramount. Behavioral detection and continuous validation at machine speed are essential to intercept unauthorized actions before harm occurs. Governance defines what an AI agent is permitted to do, but run time is where the actions are executed. Securing AI requires deep visibility directly at the point of execution across endpoints, cloud workloads and the underlying infrastructure where agents operate.

This plays directly to SentinelOne's core strengths. Our AI native EDR foundation combines years of technology leadership in behavioral detection and autonomous response. As cybersecurity shifts from detecting threats to governing autonomous agents, EDR naturally evolves into AI detection and response. This positions SentinelOne as the premier platform to defend both traditional endpoints and the emerging AI stack.

We are also capturing a structural tailwind in sovereign defense, a major differentiator for SentinelOne. As public and private institutions deploy private AI stacks to maintain data residency, sovereign AI security becomes an operational imperative. Organizations simply cannot rely on architectures that export sensitive telemetry off site. We are the only modern security platform that can be deployed to cloud, on premises in [ air gap ] environments. Our platform's on-premises deployment capability delivers high velocity runtime protection wherever the AI workload resides. This magnifies our competitive advantage. When sovereignty, control and machine speed defense matter most, the world's most security-conscious organizations select SentinelOne.

Demonstrating our sovereign deployment differentiation, an aerospace and defense giant selected SentinelOne after rigorous multi-vendor proof of concept. In an air gap highly restricted environment, SentinelOne was the sole provider to pass every requirement, delivering a seamless deployment and operational capabilities that legacy and next-gen competitors simply cannot offer.

On the distribution front, our partner ecosystem continues to serve as a force multiplier. We are expanding our global reach, accelerating platform adoption and driving efficient scale. Singularity's multi-tenant architecture, centralized management and native automation empower service providers to efficiently manage vast customer states. A great example of this momentum is LevelBlue, the world's largest managed security provider who selected SentinelOne to scale its managed security service offerings.

In Q2, we expanded our partnership by naming LevelBlue as a premier remediation partner for Wayfinder Frontier AI Services to bridge the gap between threat discovery and resolution. SentinelOne customers leveraging Wayfinder Frontier AI Services can now connect directly with LevelBlue experts to develop and execute prioritized remediation programs. This capability empowers security teams to eliminate software vulnerabilities faster, improving overall application resilience.

Simultaneously, we are scaling our hyperscaler alliances as cloud and AI infrastructure converge. We expanded our AWS collaboration around unified AI governance, integrating our AI security capabilities directly with Amazon Bedrock AgentCore to deliver real-time run-time guardrails for autonomous agents.

On SentinelOne Flex, it's becoming an increasingly important driver of platform adoption that gives customers a streamlined way to adopt and expand across the Singularity platform. Within a year of its launch, SentinelOne Flex has now exceeded 10% of total ARR. We are seeing strong traction with both new and existing customers, larger strategic commitments and a strong pipeline of Flex opportunities. Our Flex offering in lines purchasing with evolving security priorities and reduces the friction associated with adding new capabilities over time. Overall, the Flex model is creating a stronger foundation for consolidation, expansion and long-term partnership.

Across the broader industry, SentinelOne is emerging as a clear winner of the AI security era. And that is because we spent a decade building toward it. Offensive AI capabilities are compressing the time between vulnerability discovery and [ reponization ]. What was theoretical quarters ago is now an operational reality. Frontier models are advancing from basic vulnerability discovery to reasoning through multi-stage attack paths and executing autonomous cyberattacks.

For instance, Anthropic recently demonstrated models executing end-to-end attacks across complex networks, while OpenAI noted that emerging model capabilities are rapidly approaching critical cybersecurity thresholds. By serving as a security partner in initiatives like Glasswing and Daybreak, we are helping establish SentinelOne as a trusted brand time security layer for emerging AI-native software. As AI tools become more capable, security must evolve in parallel, detecting and stopping threats at machine speed autonomously. The implication is undeniable.

The window between vulnerability discovery and exploitation has effectively collapsed. Autonomous agents introduced unprecedented operational risk. Agents don't just generate text, they execute code, call APIs, handle credentials and interact with infrastructure, often finding execution paths their developers never intended.

A stark example occurred recently at Hugging Face, where an autonomous agent system executed thousands of actions at machine speed, escaped its sandbox, crossed boundaries and compromised external infrastructure. For defenders, the lesson is clear: you cannot assume an agent will remain confined or behave as intended. While governance defines what an agent should do, runtime security governs what it actually does. This is our foundational vision and our moat.

We are a pioneer in modern runtime security. Our technology sits precisely where AI agents execute across data, endpoints, cloud workloads and applications. Our proprietary behavioral AI engine was built to analyze anomalies and intercept malicious execution in real time. As cybersecurity evolves to governing autonomous software or agents, our runtime foundation gives us the unique ability to map behavior through action, making SentinelOne the essential platform for the AI era.

As AI compresses the attackers' time line from discovery to exploit, SentinelOne is helping defenders compress the time line from detection to remediation. We are leading this paradigm shift on both fronts, delivering AI for Security and Security for AI. Singularity is the autonomous security platform of the future. Reflecting on the overall performance, we made exceptional progress across every dimension of our business, sustaining top-tier revenue growth, accelerating profitability and extending our technology leadership across the highest growth categories in cybersecurity.

We outperformed expectations, delivered our fifth consecutive quarter of positive year-over-year net new ARR growth, achieved a company record double-digit operating margin and drove expanding customer adoption across data, cloud, AI security, Purple AI and Flex, and we are pairing all of this with a stronger growth and operating income outlook for the year. SentinelOne is built by innovators with a relentless commitment to technology leadership, and our performance demonstrates the talent and execution of our teams. As we enter the second half of fiscal year '27 we are well positioned to build on this momentum and lead the AI security landscape while delivering durable, profitable growth and long-term shareholder value.

In closing, I want to recognize all Sentinels for their dedication, as well as our customers, partners and shareholders for their continued support. Our mission to be a force for good remains paramount as we work to ensure AI itself remains a force for good.

Thank you again for joining us today. I'll now hand the call over to our CFO, Sonalee Parekh.

Thank you, Tomer, and thanks, everyone, for joining us today. Our Q2 results reinforce our strong business momentum and solid execution. We exceeded all top and bottom line guided metrics, achieved record profitability and are raising our fiscal year '27 revenue and operating income outlook. Now let's review the details of our Q2 fiscal '27 financial performance and our guidance for Q3 and the full fiscal year '27. As a reminder, all comparisons are year-over-year and financial measures discussed here are non-GAAP unless otherwise noted.

Q2 was a solid quarter for SentinelOne. Our revenue grew 21% year-over-year to $292 million, exceeding the top end of our guidance range. International markets represented 39% of total revenue, demonstrating a growing global footprint. In Q2, our total ARR grew 22%, and we added a record second quarter net new ARR of $56 million, growing 4% year-over-year. This was driven by both strong new logo acquisition and broader platform adoption within our existing customer base.

Our move upmarket continues to yield excellent results. Our ARR per customer reached a new company record, led by strong momentum at the top end of the market. We're increasingly landing premier logos, providing us with a highly durable runway for long-term growth. For customers spending $100,000 or more in ARR, our dollar-based net retention rate, or NRR, was up year-over-year and expanded sequentially for the third consecutive quarter. This improvement is driven by continued success in multiproduct adoption and a growing contribution from our AI products.

We are also beginning to see the benefits from the investments we have made in automation, particularly in our renewal process. Overall, we are sustaining a healthy balance between acquiring new logos and expanding existing customer accounts. Given our expanding scale and market presence, this strategy allows us to capture incremental market share while unlocking substantial future growth potential. This performance reinforces the clear value customers are realizing from our Singularity platform and our proven ability to cross-sell into emerging product categories.

Now turning to profitability. We continue to maintain a strong gross margin profile, highlighting healthy platform unit economics and scale efficiencies. A standout achievement this quarter was reaching 34% in sales and marketing expense as a percentage of revenue, a 900-plus basis point year-over-year improvement. Achieving this milestone while simultaneously growing net new ARR for a fifth consecutive quarter is a definitive validation of an increasingly productive and efficient go-to-market strategy.

In Q2, we delivered a record 10% operating margin, representing 820 basis points of expansion year-over-year, above the high end of our guidance range and a clear demonstration of the operating leverage inherent in our business. Our earnings per share of $0.08 also exceeded our expectations and doubled year-over-year. We continue to drive a top-tier growth profile while delivering significant margin expansion and creating the capacity to invest in AI innovation and technology leadership.

On a trailing 12-month basis, our adjusted free cash flow margin reached 6%, an improvement of roughly 400 basis points year-over-year. We remain on a consistent path towards sustainable free cash flow growth, underscoring our commitment to delivering durable profitable growth at scale. Complementing this strong performance, our remaining performance obligations, or RPO growth accelerated to 45% in Q2. Our total RPO reached a record $1.7 billion in Q2, a direct reflection of the mission-critical trust customers place in the Singularity platform.

We ended the quarter with a robust balance sheet, including $813 million in cash, cash equivalents and investments and no debt. We will continue to employ a measured and dynamic capital allocation policy. Our approach strikes a disciplined balance between investing in our highest conviction growth opportunities organically and inorganically and returning cash to shareholders via opportunistic share buybacks. Our balance sheet gives us the flexibility to do both.

Turning to our guidance for Q3 and fiscal year '27. For the full fiscal year '27, we are raising our revenue outlook to a range of $1.202 billion to $1.207 billion, representing 20% year-over-year growth at the midpoint. For Q3, we expect revenue in the range of $309 million to $311 million, representing 20% year-over-year growth at the midpoint. Our improved revenue outlook for the year is grounded in the business trends we see today, a solid pipeline and demand environment, expanding platform adoption and improving retention rates.

Recent market shifts, or what many are calling cybersecurity's Mythos moment, are refocusing enterprise boardrooms on systemic AI security. While these structural shifts create tailwinds for our business, it's important to note that modernizing cybersecurity infrastructure and enterprise budget deployments are multi-quarter and multi-year shifts that materialize over time.

Turning to our outlook for profitability. For fiscal '27, we are again raising our operating income outlook to a range of $124 million to $128 million, representing an operating margin of approximately 10% at the midpoint, an improvement of approximately 700 basis points over fiscal year '26. For Q3, we expect operating income in the range of $38 million to $40 million, representing an operating margin of approximately 13% at the midpoint.

For full year fiscal '27, we expect fully diluted earnings per share in the range of $0.30 to $0.32. For Q3, we expect earnings per share in the range of $0.08 to $0.09. Our EPS outlook reflects the impact of a higher expected diluted share count driven by stock price appreciation as well as nonoperating FX impact related to international assets and liabilities. We continue to expect a non-GAAP tax rate of approximately 17% for the fiscal year '27. And we expect our weighted average diluted share count to be approximately 370 million for Q3 and 361 million for the full year.

Taking a step back, the opportunity in front of us has never been stronger. We are scaling with discipline, driving significant operating leverage and seeing accelerating momentum across our AI products and the Singularity platform. Our AI security leadership and deepening platform adoption give us a clear line of sight to durable profitable growth, and we are executing against that opportunity with conviction.

As security transforms from a protective safeguard into an essential enabler of enterprise AI, SentinelOne is uniquely positioned at the center of AI, data and cybersecurity. Security is no longer just a defensive measure. It is a key strategic enabler of AI innovation. With a strong financial foundation, a leading cybersecurity platform and significant market tailwinds, we remain focused on creating outsized shareholder value.

And with that, operator, we are ready for questions.

[Operator Instructions] Our first question today will come from the line of Patrick Colville with Scotiabank.

This one is for both Tomer and Sonalee. There's been a lot of noise about this advanced AI preparedness. You guys talked both extensively about this in your prepared remarks. But I wanted to just double click on a kind of a subtle nuance. Is advanced AI preparedness at SentinelOne more of an accelerant for the core Endpoint business? Or is it more of an accelerant for newer product areas in data, AI and cloud? And then maybe another kind of subtle down which I want to touch on is, is it starting in SentinelOne's enterprise customers and flowing down to the mid-market? Or is it actually more the other way around?

Yes. Thank you for the question. I think it's really broad-based, and I'll try and maybe expand here a bit. I mean what we're talking a lot about Mythos, obviously, but it's not only Mythos. I mean we've had a significant incidence with Hugging Face and OpenAI. We're seeing open-source models become de facto for [ tear ] performance.

I think there's a broad-based understanding that AI is something that you have to regulate, you have to govern and you have to make sure it's being adopted in a safe way. And I think what's becoming even more clear that the only way to do it is through monitoring it at run time when it's actually executing, when it's actually exhibiting behavior and doing what it's supposed to do. And when you think about how you do that, that really touches pretty much every aspect of our platform. You want modern endpoint protection to be able to see all AI workloads.

Whether they're on employee endpoint or on a cloud workload AI or an on-premise server, you need the visibility that modern endpoint protection brings. But at the same time, obviously, to respond to AI-based attacks and AI-assisted attacks, you need to shrink down the time it takes you to actually see and then react to these actions that you see out there. And that goes all the way to how do you accelerate data ingestion and response to attacks with touches our data platform. So we're seeing an acceleration in our data platform.

We're seeing an acceleration in our cloud workload security. And obviously, we're seeing an acceleration with our AI security products with both Prompt Security and Purple AI. It's really, really clear that right now, the best way to regulate AI, the best way to deal with AI borne attacks is a modern cybersecurity solution and especially a platform that's completely autonomous, which right now in the market, if you're looking for broad-based cybersecurity platform that's both autonomous and can be deployed in any given environment from air gap environments and all the way to cloud native, SentinelOne is basically the only option you have.

And that's just driving growth-based performance for us, which is very evident in the numbers here. It was evident last quarter as well. The entire first half for us have shown more than 20% net new ARR growth. I think some of it is what we're showing also in our race to the year.

Yes. And Patrick, if I could just add to that. I mean, obviously, modern endpoint is our largest installed base of customers. But data, AI and cloud are where we're really seeing a significant mix shift and strong, strong acceleration. And those categories are obviously accelerating off of a smaller base. So the percentage growth is much more dramatic in those categories. And that's where I'd expect to see the durable multiyear tailwind that we talked about in our prepared remarks to our ARR composition over time.

And to touch a bit on the market segments, you mentioned the enterprise demand. That's obviously there. We're doing more and more larger deals, more 7-figure deals, more 8-figure deals than any time before.

But at the same time, it's clear that everybody and anybody needs protection. And the way to scale protection for our nation is not through a correlation of consultants, it's through autonomous products that can actually deliver protection in real time in a complete scalable way. I think we're doing some of that also through our MSSP ecosystem, enabling in a complete distributed way, the deployment of our products across many, many segments all across from mid-market to SMB and federal, [ SLED ], every segment right now requires modern protection. And the MSSP ecosystem we have is one of the best ways to actually scale that entire market motion. And we've seen that even evident in this quarter, where our top MSSP partners have actually doubled down and expanded their contract in this quarter.

Thank you, both. I mean, monumental moment in cybersec. And really good to hear both you, Tomer and Sonalee, kind of sounding so positive about the ability to capture the opportunity.

Your next question comes from the line of Meta Marshall with Morgan Stanley.

Great. And congrats on the quarter. Tomer, maybe to start with you, just in terms of -- you have a rapidly expanding product portfolio, customers are clearly interested in a wide array of products. Just -- how are you working with the sales force to kind of develop kind of the best playbooks in order for -- what's the best order of trying to sell the products to not kind of elongate sales cycles and get the customers kind of the greatest near-term traction?

And then Sonalee, just in terms of with now having almost 6 months under your belt, just how are you kind of balancing out this showing continued leverage with balancing a lot of growth opportunities?

Thank you. I think the best recipe for us is meeting customers where they are and being flexible with them. It's very clear that solutions like [ from ] security are kind of the #1 go-to when customers are thinking, how do I regulate AI for my workforce, and that's what we see time and time again.

Now with that, it's very, very clear that once you deploy these solutions, there are going to be derivative questions and derivative challenges that then our platform is there to solve. How do you then make sense of all the data? How do you string response in real time? Is it through hyper-automation and more data aggregation? So a lot of the components in our platform are actually very synergistic. And that shows up in the way that we sell, and that shows up in the way that our platform is deployed.

I would say we're seeing more and more compression of our sales cycles just with that dynamic. We're seeing larger duration of contracts. We're seeing more efficiency with our sales force. So all of those are really showing the strength of the platform to rise up to this moment and deploy protection that actually matters. And I think that is beyond any single feature or capability is what SentinelOne delivers. We deliver peace of mind for these customers. We deliver an ability to fend off the most advanced attacks in the market today.

And we're seeing them all. We're seeing them come from foreign adversaries. We're seeing them come from cyber criminals. The entire attack landscape has been negatively democratized with AI, and we're seeing an acceleration of attacks. It's very, very clear that if you're not deploying modern solutions, the gap is only going to become wider and wider for you.

Thanks, Meta, for the question. So the fact is we don't really see growth and margin expansion as a trade-off from where we sit today, just given the inherent operating leverage in the platform strategy. So the areas that are really driving the durable growth that Tomer referred to in his prepared remarks around AI security, data and cloud, all of which accelerated significantly in Q2, are exactly where we're seeing opportunities to reinvest.

The last few quarters, we removed quite a bit of organizational complexity that was actually slowing us down, and we redeployed it where we see the highest conviction opportunities to grow. And also in some of our highest performing sales motions.

So I think the evidence we can do both is playing out in the numbers. If you look at the first half, we delivered 22% net new ARR growth while simultaneously significantly expanding operating margins by over 800 basis points this quarter. And we are raising both our revenue and operating income outlook. I think that's really a validation that the platform model is working at scale.

So when I look forward and when we thought about raising the guide, the demand signals gave us real confidence. So RPO, again, at a record $1.7 billion, accelerating to 45% growth, net retention expanding in our $100,000-plus cohort, that's both sequentially and year-over-year. So that's several quarters. It's now a trend. And the products like AI security that are tripling ARR year-over-year, these are all leading indicators of durable growth.

So we're really committed to both delivering consistent growth and multi-quarter, multiyear operating margin expansion. And we really feel like we can and will execute on both.

Your next question comes from the line of Joseph Gallo with Jefferies.

It was great to see the net new ARR growth even in a really tough comp. And congrats on doing that for 5 straight quarters. My first question is certainly as net new ARR comps get easier, is it fair to expect continued net new ARR growth into the second half of the year?

And then just as a follow-up to that, Tomer, you said acceleration a lot on the call. Like I can hear the excitement. What would it take for overall ARR growth to accelerate? I mean, we're starting to see that inflection with some other cyber vendors. So just wondering if it's more of a pipeline timing thing, mix shift? Like what would it take for the overall business to accelerate?

Yes. So I'll start with that. And you're absolutely right. We had a great quarter of net new ARR and off a very tough comp for Q2. And we did beat our internal expectations. And the growth was driven by both strong new logos, but also strong expansion in our largest customers.

And I think a consistent theme you've heard from us is just this acceleration in contribution from our emerging products, again, the platform strategy really working and coming to life. So data, cloud and AI security all accelerated in the quarter. We don't guide specifically on net new ARR, but we do expect for the full year for net new ARR to grow year-over-year.

Yes. And to your question on acceleration, let me just say that I fully believe that this is just the beginning. I think what we're seeing in front of us is a significant opportunity. And we're seeing ourselves operate better to capture that opportunity. Again, you can see that through our sales efficiency improving. You can see that through the evolution of our go-to-market, which will continue.

We're putting more and more capabilities directly into the platform for customers to consume completely by themselves. That's a complete new motion for us. And we're kind of adding more and more layers to the way that we go to market. So all in all, our eyes are set into the future. There's increasing demand to what we do. We're one of the only platforms on the market today. We're leading with an autonomous mode of operation, that is exactly what this moment calls for. So we're feeling pretty confident in our ability to continue and grow.

Your next question will come from the line of Mike Cikos with Needham.

I'll echo congratulations on the quarter. I'll ask both questions up front here. But for Tomer, for Prompt Security, at least our CSO checks have indicated overwhelming support and enthusiasm for Prompt, just given it's not tied to a specific model, really allowing customers to adapt in real time to an increasingly -- what seems to be a polyglot model environment.

So my question is more of a sales and strategy question, but how do you ensure SentinelOne is investing enough in support of growing AI security adoption, just given this massive greenfield opportunity in front of you? And I'll just ask the other upfront, but for Sonalee, if I could just unpack the net new ARR through a different lens from the earlier question from Joe. It's great to see the emerging products continuing to climb higher. But if I look at the 4% year-on-year growth, I just wanted to double check, is there anything we need to be thinking about as far as what's happening with the endpoint ARR or other parts of SentinelOne's ARR base when thinking about the total composition there?

I'll take the ARR security question quickly. As you can imagine, I mean, that is our #1 priority. And not only this is an emerging capability for us, it is actually one that augments the classic endpoint motion in a very nice way. And not only we are scaling that function, and we're seeing it grow quarter after quarter. We're seeing record pipeline for our AI security product.

We're seeing record pipeline for Purple. Purple is an agentic investigation tool. So all these -- like key points for us that really are in the intersection of AI are the things that we pay attention to the most. And moreover, the majority of our innovation is going towards these products.

Again, this is just the beginning. We are envisioning a world in which agentic endpoint protection is something that every AI workload will need. And AI workloads -- and we were seeing that today already -- are going to be by masses more than employees that are using endpoints.

So the opportunity in front of us is unbounded. Our technology is leading the market, and we want to push that innovation all the way to being able to secure every single AI workload that our customers need to secure. And there is no world in which you deploy an AI workload without security.

So as you can imagine, we're scaling our go-to-market. We're putting more innovation. We're putting more marketing into it. And even naturally, that's the pull that we're getting from our customers. So it aligns really, really well.

Yes. And in terms of the unpacking the net new for Q2, one other thing I would just call out that you didn't mention is just we did see improved net retention as well, which obviously is helpful in the net new. As far as endpoint is concerned, we continue to see healthy growth there and continue to be a technology and IP leader there. In fact, we see it as a very large opportunity for legacy replacement, as we always have. So we're actually seeing ARR acceleration with some of our MSSP ecosystem there and continued success in endpoint with our large enterprise customers and upmarket.

Your next question comes from the line of Roger Boyd with UBS.

Awesome. Sonalee, just two questions on the margin side. I think the rough cut was guidance implies a little bit of acceleration in expenses for the back half of the year. Can you just talk about what you're expecting on the OpEx side?

And you've been very clear about kind of your ability to progress on both growth initiatives and margin expansion. But is that framework at all tilting a little more towards growth after a pretty good first half and the gut the team clearly has for the opportunity in front of you? And then second question was just, any comments on how you're thinking about hiring after the reset earlier this year?

Yes, of course. So firstly, we're really thrilled with the progress we've made on margins. And one thing I would specifically I'd like to call out is the progress we've made on sales and marketing as a percentage of revenue. The progress there has been above 900 basis points of year-over-year improvement, and that's an acceleration on what we did last quarter. So we're really pleased with that.

And in fact, we're actually seeing better trends amongst our go-to-market motion, larger lands, compression in deal cycle times. We're seeing better attainment, better productivity. So again, really thrilled with what we've delivered there and how we're executing.

As you think about the second half of the year, what I would say is we will -- you will continue to see margins expand, and we did raise the full year on operating income outlook as well. However, you're not going to see margin expansion at the same rate. So we will see an improvement in Q3 sequentially and an improvement in Q4.

And if you look at how I guided for the full year, the 10% implies a much higher exit rate on Q4. So significantly higher than where we are today and actually quite a bit higher than what I guided for Q3. So you will continue to see that expansion. However, we are seeing lots of great opportunities to invest so we've given ourselves some cushion for that reinvestment.

And again, it's all the products that we're talking about and big opportunities just even around some of our go-to-market motions, partner channels. And we want to make sure that we have plenty of room to be able to invest there. And that is fully contemplated in how I've guided, including in the raise guide.

Your next question comes from the line of Shaul Eyal with TD Cowen.

Thank you. Good afternoon. Two quick questions on mind. Let me try and bundle those. 42% year-over-year growth in RPO, that looks very solid. Is it -- what's driving kind of this growth? Do customers sign longer-term commitments and contracts, or do ACV actually go higher? That's my first one.

And my second one, maybe, that the 100,000 customers actually grew 13% versus 17% last quarter. And again, good job on the ARR, which grew 22%. Can you reconcile that? Are you seeing substantially more expansion within the largest customers? Or what's the thinking of large customers versus new logos?

Yes, sure. So why don't I kick off on RPO. I'm going to correct you, it was 45%, not 42%. And that is an acceleration on last quarter. Last quarter, we were at $1.5 billion, this quarter, we did $1.7 billion. And yes, we are seeing larger lands, and we specifically talked about larger lands with upmarket with some of our customers signing 7 and 8 quarter -- 8-figure deals. And that's something we've seen now for a couple of quarters and again in Q2. And we're also seeing increased duration of contract life, which is contributing to the overall RPO acceleration.

And I think that -- I mean, it's kind of the same question asked in a couple of different ways. We're lending larger. We want to go upmarket. We've said that for a few quarters. We're executing on that. But obviously, as you grow the average deal size per customer, you're just ending up adding a little less customers every quarter. But that's a dynamic that we've been looking for. That's exactly what we want to see. And we're just landing bigger and bigger.

I think the opportunity in front of us, again, when you look at the incumbent endpoint base, there's still 50% of the market that's completely up for disruption. We want to go after that. We want to make sure that we can address every type of deployment there. And a lot of those are actually very discerning customers that are running their deployments on air gap or on-premise environments. We're one of the only vendors out there that are applicable to those environments. And obviously, that is a very lucrative opportunity for us.

So we are driving our average deal size higher and higher, and that's also kind of what you see as the inverse dynamic on our overall customer additions. But it's just healthier for us and it's more efficient for us, and it's what we're going to continue and do.

Your next question comes from the line of Josh Tilton with Wolfe Research LLC.

Awesome. Thanks for sneaking me and at the end, I'll keep it to one. I think that, at least from our perspective, like we see all the goodness in the quarter. We heard the word acceleration, like we get it's the Mythos moment. Like everything seems great, like all the words, all the numbers. And I know that you guys don't guide to it, but I think what some people are trying to understand is we do have this guardrail for net new ARR for the full year, and it's calling for low to mid-single-digit growth. And I think we're trying to understand why we're not hearing a message around how come that guardrail isn't coming up.

It doesn't feel like that low to mid-single-digit growth for the year kind of reconciles with all the strength that you've seen in the second half and all the positivity that you're talking to in the environment. And again, understand it's not guided to, but it is an important metric for us. So is there anything you can just help us to better understand how we should think about that net new ARR guardrail for the full year, given the great first half and everything you're seeing in the market?

Yes. I mean, I think what I would point to is some of the trends that we're seeing. As you say, with our emerging products, we're seeing really nice acceleration. We're also seeing great -- I called out a trend in net retention. I think last quarter, we saw it expand and we saw an uptick, but it was too early to call it a trend. We're now seeing that trend. We're talking about the trend in the demand environment, a very, very solid pipe. Also talking about larger lands and deal sizes and compression in cycle times.

So I think all of this together gave us the confidence to raise our revenue guide by more than what we beat this quarter. So it's taking all of those trends into account. And again, like something that I said earlier in the call is we still do absolutely expect our net new ARR to grow year-over-year. And if you look at the first half, for example, we beat our own internal targets and we grew net new by 22% year-over-year. So I think everything we're seeing in the demand environment and the trends that are in front of us right now in the business have given us the confidence to be able to raise what we do guide on.

Your final question will come from the line of Brian Essex with JPMorgan.

[ John ], on behalf of Brian. Just a quick one on -- you've mentioned sovereign AI security as a structural tailwind and it sounds like SentinelOne is well positioned as a modern platform in that sense. Could you just talk more about the market opportunity there as public and private institutions build their private AI stacks?

Absolutely. I think what's very clear is that organizations out there and countries want to control their own data. To do that, you can't just ship data to the cloud. You can't really even think about the data outside of your own data center or AI factory.

And when you think about how you deploy security in a complete sovereign way that's controlled and confounded within the walls of your data center or AI factory, that's where SentinelOne self-hosted on-premise capability comes into play. And it's an incredibly unique proposition in the market today. There is no next-gen endpoint provider that can deliver that in every single environment, with complete independence of any cloud out there.

So when you think about what we can provide to those building their own data centers, their own data stores, for those who wanting control on their own data without shipping it to any third-party cloud, SentinelOne becomes the only security stack that they can deploy and fully control.

We have no further questions at this time. I will now turn the call back over to Mr. Weingarten for closing remarks.

Thank you all for joining us today.

Hello, everyone, and welcome to this webinar. Before I hand things over to our speakers to officially get things started, while people trickle in, I'm just going to review some housekeeping items.

So first things first, this webinar is being recorded, and a copy of the recording will be sent to all registrants in the next couple of days. So look out for that in your e-mail, you can share that with colleagues or have a rewatch if you need. The second piece is that we are live. This is a live webinar. Our speakers are here. So you can use the Q&A box on your screen to ask them questions. And if we have time, we will be going over those at the end. We also have some moderators in the chat who will be able to answer some specific questions for you there. And then we also have a resources box on your screen, and that has links and downloads related to today's topic. And lastly, if you are a member of ISC2, CPE credits will be automatically credited to your account in the next 4 to 6 weeks from this webinar.

So again, this is being recorded and, a copy will be sent to all registrants in the next couple of days. And now that we're about 1 minute, 1.5 minutes in, I think that most people have joined. So I'm going to hand it over to our speakers, and they will get started. Anthony?

Awesome. Thanks, Molly. Welcome, everyone. Glad you're here. We have a packed agenda designed to cover a lot of ground in 30 minutes. So I want to get right into it.

Security operations is one of the most crowded categories in our industry right now. Every vendor has a take, and most of them have slides that look pretty similar. What's genuinely hard to find is an independent evaluation built on real hands-on testing, not vendor submissions. Latio has just published their inaugural security operations market report, SentinelOne earned the SOC Platform Leader Designation. And today, you're going to hear directly from the analysts who evaluated us, see the data behind the report and watch the platform in action. Let's get into it.

My name is Anthony La Scala. I am Principal Technologist at SentinelOne, and I'm joined today by James Berthoty, Founder and Analyst at Latio. James, welcome. Great to see you again.

Hello. Thanks for having me. Happy to join and talk to everybody.

Yes. We are thrilled to have you join us today and chat about your background, Latio and the inaugural Security Operations Report. Before we get started, I'll give our viewers a quick look at the agenda.

All right. So we're going to start with introductions and a quick glance at James' history and why he built Latio the way he did. Then we'll cover the research behind the report, the categories evaluated and James' definition of a modern SOC platform. Before I dive into the platform, we'll discuss SentinelOne's ranking as platform leader, including our meaningful differentiators. I'll wrap things up by showing you the Singularity Platform in action, and we'll leave a few minutes for Q&A at the end. All right. With that, let's get things started.

All right. So James, tell us a little bit about your background. What does Latio do? And why did you build it the way you did?

Yes. I'm super glad to talk about this. For the last 15 years, I've been a security practitioner, and so I worked across security operations teams in a big MDR environment, and then into cloud security and application security, was involved in compliance automation. So I've really touched most aspects of security. And the big missing piece that I found just from doing analysis and trying to find tools was the headache of, first of all, understanding like what a vendor actually does and what their security tools are actually capable of because everybody tends to use the same language to talk about pretty different things.

And the second piece was that there are all of these opinions that are out there and rankings of products and talking about how they work from people who don't even use or get hands-on time with the products. And so the #1 thing that we try to do is actually use the products, get a clear idea of the use cases, understand who they're actually built for and then just make that really clear to practitioners of like these are the circumstances under which you should look at vendors in this category, and here are the most relevant ones to look at based on our times in the tool.

Yes. And that makes Latio genuinely different from how most of the analyst firms work, your hands-on keyboard approach. So this was Latio's first security operations market report. Why SecOps and why now?

Yes. I think for a while, the SecOps industry has sort of -- was this consolidated like you have an EDR tool and you have a SIEM. And those were sort of the debates that were happening, and there weren't a lot of movement or specialized players within that. And then you had the evolution of like data pipeline tools and taking a lot more different approaches of how you can build an end-to-end SOC experience outside of just the EDR and the SIEM. And then, of course, there's a lot of movement around AI SOC and a hodgepodge of different vendors getting shoved into that as an emerging category. And once again, those are all pretty different and unclear, like the differences between one another, even though they all say the same thing.

So that's basically what we look for when we do a report is when there are a bunch of vendors saying they do the same thing, even though they're all pretty different. And so that's why the security operations industry is ready for evolution across all of the core technologies as well as modernization on those things. And then the data has to become more accessible than ever to enable teams to actually use AI beyond just this is a SOAR, but now has a chatbot in it.

It always starts with that data foundation, which I know that we're going to hit on a little bit later today. So how many vendors did you evaluate for this report? And what does that process actually look like? Like are you running real attacks reviewing documentation or evaluating demos?

Yes. So it's a mix of all of those things. We generally try to do about 50 vendors. Sometimes I get too excited with our reports and do like up to 100, and that is always complicated. But yes, we try to get as hands on with the tool as possible, sometimes because of the nature of certain tools, we can't get hands on. And in those cases, we try to look at test environments and get really granular in the demos that we're going through with people, always looking at the documentation and understanding the use cases to then understand like the relative maturity of those use case capabilities and mapping them to the use cases that practitioners have.

Awesome. So what were your expectations going in? Did anything about SentinelOne's approach surprise you?

Yes. I mean I think for a long time, the differentiator with SentinelOne was being very early to invest in a data lake architecture. And so if you have a lot of history in SIEMs like I do, like the Elastic Stack is how most of these things work, where they're ingesting logs and doing a bunch of crazy data optimization strategies to make search possible across them. And what gets lost in that is you're treating logs isolated from their larger environmental context.

And so I think SentinelOne like made an investment a long time ago, that's really paying off into building a data lake architecture to where there is asset context, combined with the EDR telemetry, combined with just general SIEM telemetry and now augmented by the SOAR and data pipeline technologies as well to where now SentinelOne is one of the few providers that actually has like a competitive offering across every lane of those independent pieces of building a SOC platform and then putting all of that together to deliver results that whether it makes AI querying underlying data easier, or it's about driving like that asset context and making it clear to people where the alert sits in their environment. Those are the things that I think really are at the heart of paying off now as many vendors are trying to rebuild their architecture into more data lake pieces. Yes.

Data, data lake foundations, it's going to be a recurring theme today. But no, I'd love to hear that from you. And it's also a great segue into the report. So let's dive into some of the survey results here. Now we're setting the foundation on what tools teams are using. So our research found that most teams use an MDR managing SIEM and EDR. Tell us more about what this means for dedicated SOC teams?

Yes. I think there's really trends across all 3 of these. And the first is really interesting, even though it's the vast minority there haven't invested in SOC. I think it's important to talk about because a lot of cloud-native organizations, like their security journey sort of started with CNAPP and then is evolving into the other pieces. And so they don't have a traditional understanding of security operations of sort of that EDR plus SIEM combination. And really for them, it's about expanding what does log collection look like for us outside of the cloud more specifically. And they're sort of expanding into the traditional to endpoint telemetry as they're sort of having to builds, Entra ID and all of these, like Windows components creeping their way into their architecture over time, like those companies are sort of transitioning into that MDR category.

And I think that's where really running a SOC is really hard, and it's also just really scary. Like if you're a 1- to 5-person security team, which is a lot of like the mid-market for security, you might have the technical capability to run a security operations team. But first of all, you're going to get like drowned in alerts. So if you're not constantly tuning all of the rules and making sure everything is up to date. So nobody wants to do that alone. And then responding to an incident, like I've had to respond to a bunch of incidents, and it's really scary to do it alone. Like there's times I've been the only on-call person and being the one who has to like wake everyone up is a big thing to do. And you never want to feel like you're -- like the tug-and-pull of am I making a big deal out of nothing? Or is this a critical incident that I'm overlooking? Like that's something that people want partnerships to do.

And so even people who have dedicated SOCs are typically augmenting with some kind of managed service, whether that's like threat intelligence or forensic services, like really operations is a team sport, and everyone is sort of getting involved. And I think that's the theme that we saw with a lot of the data.

At 2 in the morning, every log, every alert looks like a full-scale breach. So no, I totally understand that. And we have a little bit more info on the tools that teams are using here in this next slide. So SIEM and EDR technologies, they're remaining at the top for monitoring security operations, how does this impact a customer security environment?

Yes. I think this is just -- this really highlights that there have been a lot of start-ups over a long period of time who have tried to eke out some of these subcategories. But far and away, the backbone of the SIEM -- of the SOC is the SIEM and EDR technologies. And this goes into when we talk about a modern security platform. At this point, just the vast majority of people that we surveyed for the report, my own experience is wanting to have it at a bare minimum, someone who is combining the SIEM and the EDR offering into a single location because it's constantly this tug-and-pull on how many -- how much of our EDR telemetry should we send to our SIEM? Is that enough? Is it too much? And that is a huge bulk of the telemetry in and of itself in the day-to-day work. and having SOC analysts have to like pivot between the data, write all these custom searches to stitch that data together, creates a lot of just the friction of just trying to manage those 2 technologies. Never mind if you're trying to bolt on like a data pipeline tool in front of it, a SOAR on the back end of it and trying to build automations. Like there's a lot of complexity that gets introduced very quickly.

And I think with this, one of the things I was surprised to see is that a lot of people having multiple SIEMs is like a big talked about part of the industry because it certainly affects large enterprises who are on that. But I think more and more people are dealing less with having multiple full-fledged SIEMs and more with just having multiple places that have data that they want to access. Like if their data team is sending some stuff to Snowflake, sending things to Databricks, sending things to S3, like they want to be able to access that data as though it was native as well.

Absolutely. And the -- we're talking about centralization here and pulling things together so that they're more unified. And so for organizations that have disparate tools, we're seeing actually a little bit of resistance or concern before they would migrate to a different SIEM. So there are concern that the migration may be not worth the investment? Or what do you think is the main driver of the dissatisfaction with current SIEM implementations?

Yes. I think the general takeaway here is a SIEM is -- one of my first MSP jobs, there was a guy who said a firewall is a firewall, right? Like he doesn't care if they're using XYZ brand of firewall, like they're all going to work sort of the same. And I think a lot of security practitioners have that approach with SIEM, right, like a SIEM is a SIEM. Some of them have better query languages, some of them have worse ones. Some of them are a little better in one way or another, but they all generally work the same as sort of like the prevailing opinion because they are based primarily on an elastic type of architecture, even if it's not elastic happening, like that is the driver behind a lot of what I'll say like, SIEM technologies for maybe the last like 15 years.

But I think what we've seen is that architecture is rapidly changing to where now there are benefits towards more of these data lake models that make it so that everything from query time to flexibility to data storage to long-term storage, a lot of those concerns are finally getting addressed in an intuitive way. And I think that's pushing people towards being willing to migrate, but they're afraid that they're going to lose all of this 15 years' worth of detection engineering that they've done and log ingestion and log health and custom log sources, like everything they've built, they don't want to lose that in the migration. And so there's this delicate balance happening right now of teams that want to migrate because they see the benefit, but don't want to lose the technical debt that they've built over the last 15 years. And so I think a lot of vendors are trying to figure out how to help with that transition and make it as smooth as possible for people.

Yes, absolutely. It's the usability of the platform, but also the ability to move the data in there. And we're going to be diving into the usability of the platform a little bit later. But I want to move on to the stat that you've all been waiting for, AI within the SOC. I know everyone here is tired of hearing AI, but it is the future, and it is a critical component of security operations.

And so the stat -- it really caught my interest. So in the report, you argue that AI SOC tools fit within traditional categories, but vendors mark them as if there's something entirely new. What's the real distinction practitioners should make when evaluating these tools?

Yes. I think the first thing, and it's what this stat highlights is that we don't need to believe the hype that it's like if you're not doing this in-house or if you're not using an AI SOC tool, you're falling behind or you're in the underworld of security or something like far and away, that's what this -- 80% of people we surveyed when they talk about AI SOC as being a part of their budget, they are picturing analysts using tools like Claude to help in their incident response process. They are not talking about buying a new tool that does like agentic response actions or something like that. And so when it really is coming down to how do we help enable analysts with the best data access possible with the best AI tools possible to help speed up all of their end-to-end interactions.

And so then to answer the second part of that question of like how do we think about how AI SOC tools should be assessed in general. Broadly, you have a couple of different categories where there's ones that are purely focused on incident response, and they're just running a bunch of federated searches and having AI stitch the data together. And the challenge that, that creates is anyone who's worked in a SOC knows that searches are never just like, "Oh, I wrote a perfect search, and now we're done." It's a lot of trial and error and trying to stitch data together. And without direct access to the underlying data, things can get very complicated.

On the other side of like AI SOC solutions, you have tools that focus more on like the data ingest side or on the detection engineering side. And what those tools can do is like be really focused on the building of the detections and management piece, but they tend to do less on the incident response piece. And I think, all in all, it comes down to access to the underlying data and getting that to an agent in the most effective way possible. And in my opinion, teams shouldn't shoehorn themselves, as much as possible should avoid shoehorning themselves into particular vendor approaches for AI. Because at the end of the day, these tools are changing so fast, where we saw how quickly everyone was on ChatGPT and then everyone goes to Claude and then people go to Codex and then people like this stuff is changing so quickly that it's all about trying to avoid vendor lock-in.

Yes, absolutely. And we're hitting on multiple points here. But when we talk about AI, you really also have to think about the underlying data. And the report's conclusion is essentially like fix your data architecture first and then automate. So James, for an organization that's still in the middle of that, still fighting data quality issues, where do you tell them to start?

Yes. I mean this is -- every single organization out there is struggling with this. And I think, from my approach, it's starting with data pipelines. And that doesn't have to mean buying a data pipeline tool, that can mean manually tracking this in a spreadsheet or whatever. But you have to have a clear sense of what are your log sources and where are those -- what are the destinations of those log sources. And without tracking that and trying to figure out what are the applicable visibility layers that we need and where do those logs even exist when we need them, it sort of makes anything else that happens down the line even harder to achieve.

But then once you have that visibility, you have to figure out where is the best place for this data to live. And that's a very challenging question because for some organizations, and to me, it's just about being realistic. If you are a 1- to 5-person security team, you're not going to try to build or at least you shouldn't try to build the world's most distributed best-in-class data storage architecture of like this is in Databricks, this is in Snowflake, this is in SentinelOne, this is -- like you should pick like a simple all-in-one place to point your logs at. And so in the report, we have like a box for like vendor data lake solutions are like probably what you're going to look for.

But then depending on if you have particularly noisy log sources that you don't need to access on a daily basis, or you have ones that provide nice context for additional alerting, that's where you start to bring in other storage strategies to augment the approach. So just to reiterate for me, it goes to starting with the data pipelines to get that visibility, and then thinking about how do we want to route this. And then the final piece is how do we want to build detections on top of this? Do we have the detection engineering capabilities or tools to make sure that we're building detections on top of the relevant log sources? And a lot of that comes into wanting to maintain and manage your detections in a single place, hopefully, it's code, hopefully deploying out on a regular basis, but that itself is a transition, a lot of teams are trying to work on as well.

Yes, absolutely. And it all goes back, we call it the foundation because everything else is really built upon it. So let's shift now to how Latio thinks about the modern SOC? And let's hit our report framework. In 2026, every vendor calls themselves an AI SOC provider. The category is real, but the marketing has gotten ahead of what most teams actually have in place. So James, let's ground this. How do you actually define a SOC platform? And what has to be there for it to qualify?

Yes. I think it's sort of the culmination of everything we've talked about so far, where from a pure feature perspective, to me, it involves some sort of EDR offering because that's a core tenet of what the SOC does, some type of SIEM capabilities and then some kind of managed SIEM MDR capabilities. And really like at a bare minimum, those 3 pieces are what probably 90% of the security operations market is looking for from a core capabilities perspective.

And then when we talk about, okay, then broader picture, like how do we figure out which SOC platform to go with, this is where sort of this diagram comes in as far as like, here's what a traditional SIEM looks like and why it's so complicated. Because when I was a part of managing these SIEM architectures for tons of companies of all sizes in an MDR context. And you had 3 different full-time roles that are very challenging for teams to take on. One is a team that's actually doing the SIEM engineering and managing a complex SIEM architecture, especially if you're self-hosting it. The second is a team of analysts that are like doing the day-to-day responding to alerts. And then the third and most important was the detection engineering team or threat hunting team and trying to have them -- like they are the ones upon which everything else rest because all of the -- if the analysts are getting flooded with 500 alerts due to a bad rule, they are basically unable to work until the rule gets fixed.

And so a lot of teams, I think, would overinvest if you haven't done this before, like over invest on the analyst side and then wonder why the -- all of your alert metrics are off because the detection engineering team is the one that is the most significant to reduce those downstream burdens on teams.

But now we're really seeing that traditional locked-in architecture is really exploding as far as the diversity of people want to store the data where they want to be able to store it, and they want to be able to access it quickly and with flexibility. And so that's when we're starting to think about what does a modern SOC architecture look like from a best-in-class SOC platform? It's going to have more of that data lake architecture. It's going to bring asset context in together with the incident data, and it's going to allow teams to build detections, build ingest across a wide variety of storage use cases for people.

Yes. Security always comes back to layers, and this is really what we're seeing with modern SOC architecture is you have that layering, that data foundation and building up from there. And one misstep, one wrong detection rule can negatively impact everyone downstream of that, the analyst downstream of that.

So let's dive into where SentinelOne landed for the SecOps market report? Now James, you named us, SentinelOne, the SOC Platform Leader. Walk us through what you actually saw in the evaluation that earned that designation, and what differentiated us from the other platforms you assessed?

Yes. I think, it really comes down to those things we've been talking about as far as when it comes to what makes a SOC platform leader, it is that combination of covering all of the core use cases that a SOC would have, along with managed services, all built into the same place. And then around SentinelOne specifically, like it's how the data lake architecture plays into the AI SOC story, combined with some of the emerging like attack surface management, attack testing, like red teaming light approaches to find some of those exploitability issues and help with prioritization as well. And really just getting a ton of value for a security operations team to use SentinelOne as an all-in-one tool. And I think SentinelOne's primary strength is there's a genuine cohesion to how all of the products work together as far as building on top of that data lake architecture. As far as a lot of other platforms, you're like pivoting between pretty drastically different products in order to accomplish some of these same outcomes. But yes, it all comes back to that data lake investment early on.

Starting with that solid data foundation and layering it from there with a unified approach, absolutely.

So let's -- I want to pull up some of what you've described here into a visual. So we've captured 6 areas where SentinelOne really stood out in the evaluation. And I think that this maps closely to what we've been talking about throughout the webinar. So the one that I want to highlight specifically here is AI security. So James, you described this as one of the most comprehensive AI security solutions you've evaluated. With the Prompt Security acquisition, we're covering everything from AI red teaming to MCP proxy controls in one platform. In a category that's moving this fast, can you say more about why the breadth here stood out?

Yes. I think, even though our next report is the AI Security Report to plug it here. So we'll be going into some more depth on like AI security tools and what makes them good or bad. But I think, from our last report in 2025 on AI security, like Prompt Security was one of the clear leaders of that category. And of all of the acquisition -- because basically, a ton of companies did these like first-generation AI security acquisitions with different bets on what's going to help people the most, and it was a lot of like network security companies doing a lot of that. And I think Prompt Security stood out for both its breadth of different approaches very early on and was really a leader across like thought leadership and research and the tool itself in terms of delivering everything for protection from like ChatGPT-style plug-in monitoring to endpoint monitoring more in depth of tools like Claude as well as like the runtime access control pieces. And so it really just comes down to of the acquisitions to make.

I think the team at Prompt is a great one and continues to do great work. And yes, as far as comprehensiveness of a solution, a lot of other entries into the category have been through much more like niche or pointed offerings of things like model scanning or creating AI bombs or just runtime protection or monitoring. And so it really is that combination of approaches that creates the breadth that teams really need for AI security because it's moving so fast. And the best thing, most organizations are no longer talking to me about monitoring Hugging Face, for example, not because -- it's just not the primary use case anymore, even though there are many companies betting big and it's paying off in terms of like self-hosting a lot of this stuff. It's just not the primary use case compared to like Claude is the AI use case of the moment.

Yes, absolutely. SentinelOne definitely backed the right horse, and Prompt has been a fantastic acquisition, a super strong team and the product is incredibly strong. I've gotten to play with it and demo it myself, and it is incredible the protections that you can implement on AI now, especially as enterprises are adopting them at en masse. Now what ties all of this together is that unified data plane though. And so with Purple AI, which is our AI within singularity, being able to reason across endpoint cloud and identity logs altogether all in one place, is really an important differentiator for us because we're pulling in and able to analyze the data without switching to different consoles or separate products to be able to actually understand the full story.

So let's -- I want to pull what you described here, and this quote is from the report and it says, I'll just read it directly actually here. SentinelOne is a strong fit for organizations, either looking for a complete security platform or those with endpoint coverage looking to extend into SIEM, AI SOC and AI security without adding vendors. So that's really 2 conversations we have most often with customers. Organizations who want one place for everything and those who started with endpoint and are ready to extend the platform they already have. Either way, there's no new vendors, no new contracts and no new data silos. James, any final thoughts before I show what this looks like in the platform?

Yes. I think I really just want to give a practical example of why the single data model matters for the AI queryability of things because the way most tools in this category work from like a start-up perspective is basically having AI write queries across different tools. And that's what creates a lot of surprising either results or hallucinations or things not working or driving costs up because at the end of the day, they don't know if the data is there or not. And so they're trying to infer and build memories over time of like, here's how your log sources work, here's how your data structures work across all these different SIEMs. And then they're trying to write federated searches across a bunch of different data sources. And that's really what creates the mess is like the AI just doesn't have the full context to understand what's going to be there when it goes to look for it.

And that's the key challenge that drives up costs and drives down performance of a lot of these systems. And that's why whether it's SentinelOne or any system, like having a consolidated data model or even if you're buying a start-up in this category, it's like it's just important that they are also trying to map and consolidate the data in some way and that it's not just the AI doing like a best guess over and over again to try to see if that data is there.

Because the other thing is what's really important when you're doing an investigation is knowing what data is not there to understand like, is there a way you can make an actual judgment on if an incident happened or not. Sometimes it's really important to know we can't make that judgment because we need to turn on the firewall logs or we need to turn on the endpoint logs or there's something that got missed. And really, it's just that full context of like what is and isn't there is so important for making these things work effectively.

Those are the gaps in visibility that threat actors live in. And so having all of that data available, queryable, and searchable within one place is critical. So now I think it's time that we dive into it. For anyone who hasn't seen the platform, I'm going to show you some of the moments from the evaluation that map directly to what you've been hearing from James.

Every SOC starts with the data problem. Teams burn hours normalizing noisy, inconsistent telemetry, storage costs spiral, analysts work off low fidelity signal, acting as data janitors instead of defenders. Most SOCs investigate only about 20% of the alerts they see in a day. Observo AI changes where that work happens. In its stand-alone console, you watch the pipeline filter, enrich and route data in-flight before any of it's ingested. Observo cuts noise by up to 80% upfront. Analysts start with clean, high confidence signal instead of raw low-fidelity noise. When the data is right, every downstream tool performs better, and every decision is more confident. That is what turns data janitors into threat hunters.

Before an attack begins, the smartest move is to find the door an attacker would use and close it first. That is what the offensive security engine does. Most vulnerability management ranks findings by CVSS score, a theoretical measure of how bad a flaw could be in principle. OSE goes further. It safely tests your live public-facing assets the way an attacker would and shows you what is genuinely exploitable right now.

Here is a Log4J Remote Code Execution finding. This is not a severity rating, it is proof. You can see the actual exploit evidence, the JNDI-LDAP string OSE injected and the DNS request that came back confirming the callback fired. The vulnerability did not just score high, it executed. That is the difference between a list of theoretical risks and a verified path into your environment. OSE tests real assets, not hypothetical scenarios and surfaces evidence of exploitability instead of a number. So you harden what an attacker can actually reach first, proactive hardening backed by proof before anyone has to respond to an alert.

Now the threat arrives. Attackers achieve lateral movement in under 48 minutes. This scenario is modeled on Scattered Spider, social engineering into identity compromise into cloud lateral movement. The question is not whether an attack will happen, it's whether your team can move faster than the attacker. Traditionally, an analyst chases that attack across 5 or more consoles, correlating alerts from different tools. Unified alert management removes the pivoting. Native SentinelOne alerts sit in the same queue as Proofpoint phishing detections and Palo Alto command and control alerts, same format, same enrichment, partner intelligence surfaces right alongside your own with the same context. Faster triage, no context switching, analysts stay in one view.

Piecing that attack chain together by hand takes hours. Behavioral AI does it automatically. It flags OS level events as they happen and maps them to MITRE ATT&CK, drill into storyline and the full attack reconstructs down to the command level. From initial access to lateral movement, the story assembles itself with 0 manual correlation.

Here is the reality most teams live with. Most alerts are never investigated. The ones that are take hours because the analyst hits the bottleneck. Watch what happens instead, a critical EDR alert fires with a malicious detection, an agentic investigation triggers automatically with no analyst action. By the time anyone opens the alert, the report is already waiting. It carries an AI verdict, an executive summary, key findings, a threat summary, a full time line and recommended next steps. The investigation is complete before the analyst even looks. Verdict-ready, actionable from the start, response is just as immediate because hyperautomation already fired on the true positive verdict.

Normally, the analyst creates the ticket, notifies the team and works containment one step at a time. that administrative work burns hours. Here, a single true positive verdict triggers 1 playbook. It notifies Slack at once, opens the Jira ticket and provides containment options directly within that ticket. The execution log shows the average resolution time. Response executes across every tool in the stack from one trigger. SentinelOne's own SOC runs this way, resolving alerts in an average of 4 minutes across 250,000 alerts a month.

This extends to managed service. MDR is usually opaque. You get expert coverage but lose control of the response logic. Here, MDR actions and escalations feed directly into hyperautomation. MDR becomes the trigger, hyperautomation becomes your customizable response layer. You get the expertise of a managed service and the freedom to define what happens next.

All right. All right. Thank you, everyone. It's time to get into questions. We've got a few minutes. Let me pull up what's coming from the audience here. James, for a security team starting their SIEM evaluation today, what's the first question they should ask a vendor before anything else?

Yes. I mean the short version of this is to ask to see a demo. I know that was always my first question that I would always have. But I think the things to look for through a demo or through the questions is trying to really understand, first of all, their underlying data model and trying to understand the -- how that data model is going to map to the day-to-day operations of your environment?

I think just I can use like a mistake I almost made early on in my career was I was doing a lot of DevOps work. We had a lot of work in a DevOps tool. I wanted to use that as our primary SIEM. But I was taking a pretty selfish approach because we had an existing SOC team that had a different SIEM for their use case. And I think it would have been the wrong decision for us to try to like split the data in that way to try to make teams happy like that, and that's how you end up in this sort of like sprawling data mess.

And so I think it's unfortunately like a series of compromises that teams have to make to try to pick a place where you're getting the most value out of having as much consolidation as possible or taking the opposite approach, frankly, and trying to take on the burden of you want to store the data and ingest it however is best. And then you're asking yourself, okay, how am I going to run unified detections across this disparate data architecture that I'm going to have.

Yes. Avoiding data silos and making sure that everything is monitored or unified in a way where it can be monitored, absolutely. Now I want to -- I have one from me here. Is there a category in the evaluation where you expect your vendors to be further along than they actually were?

Yes. And it's really a flip of -- you can almost see the top-down demands around AI optimization that are happening because, frankly, I was shocked at how advanced most AI features are from most of the larger platforms, like including SentinelOne, to be frank, where most major providers have SOAR capabilities at this point that they have really rushed to build AI capabilities on top of, whether that is like a chatbot or like an agent builder or an orchestration layer. Like teams invested, especially the platform players invested really quickly into AI SOC-style capabilities. And so I was surprised at how quickly those have materialized.

I think what's been slower to materialize is some of that underlying data flexibility support from people where there's -- basically, there's 2 pressures that have happened at once. One is on the -- towards the being able to run decentralized detections across all of your environment and the other is the AI push. And teams really, by and large, invested in AI first and then are still trying to figure out their approach to consolidated versus distributed data architectures.

Got you. So we saw organizations pushing the AI before the data and now needing to really rebuild that foundation that we've been talking about.

Yes.

Awesome. Well, it looks like we have one last question here. For practitioners in the audience who don't know what OCSF is, why does it matter for day-to-day investigation work?

Yes. I think OCSF is really fun because it reminds me of like open source security tooling where you either have almost no opinion and don't care at all, or you are super in the weeds and have like an incredibly strong opinion about it. And so I tried to tread really lightly on it because I think OCSF is an amazing initiative with a goal that is really important around knowing how do I -- when I query data like an IP address, I want a standard way to do that. And there are so many different logs that have similar enough log types that it should be simple to do that.

And where that becomes especially important for AI is because it needs to know if the data is there or not, like we were talking about earlier, and OCSF is an amazing standardized way to know if the data is there or not. But the biggest downside to OCSF is, if a vendor does not support it, it sort of breaks the whole thing because then you have this like elegant OCSF query that you've done and then you have to start slapping vendor data across it. And so the biggest weak point for it at the moment is just mixed support from different log sources and vendors. But at the end of the day, it's incredibly important, and it's only grown more important for AI to be able to have some of these standardized queries. Yes.

Yes. It's the standardization, the normalization of the log so that they are easier to query to find and OCSF really does support that. And it looks like we had one last-minute question coming in that I might be able to answer here. Srishti, I've always known S1 to provide SIEM capabilities, hence, the AI SIEM branding. But I noticed on one of the platform extension slides that it list SIEMs or just to clarify, does S1 natively include all of these core features, now?

Yes, everything that we showed today is a SentinelOne feature. And so they are all available with the Singularity Platform.

All right. So that, we are at time. Thank you so much, James, for being here. Now before we sign off, go check out the full Latio security operations market report. It's available for download right now. And the link should be on your screen. It's worth your time. It's practitioner-led research built on hands-on evaluations, and it gives you a real framework for assessing your security stack independent of any vendor. And if you want to see more of what I showed today, request a demo. We can set up a session tailored to your specific environment.

Well, James, thank you so much. I really appreciate your time today. Thank you to our audience for joining us today. I hope you all have a great rest of your day and signing off from SentinelOne. Thank you.

Thanks for having me.

Pleased to welcome. It's a stock I recently upgraded. So I'm always happy. Well, let's say the other way, it's awkward when I just downgraded and host companies. It's better to upgrade and then host companies. So I'm very happy to host Tomer and Sonalee to speak about SentinelOne.

And I want to start before we do, like I do in any other session, I want to start with 30 seconds of our views. The space is great. When you think about cybersecurity and you think about endpoint as a domain, not as a solution, as a domain and where you can grow from an endpoint there are really only 2 companies at the high end of technology, and it's CrowdStrike and SentinelOne. And the difference is scale. But at the end of the day, what you're seeing today, what we've seen last quarter and that's the reason why we upgraded is because you see the signs of growth. You see that the company is translating all these efforts to go into new areas, into numbers. It's tangible now and margins are going to grow also.

So this is why we thought the timing is right. And I took advantage of the fact that stock went down, and I said today is a great entry point because in my view, I hate to say I'm sure because I'm never sure. But in my view, as we progress through the year, you will see more growth and more margins. And at the end of the day, the space is good. If growth is accelerating and if margins are going up, that's the reason to buy stocks. So that kind of the introduction, I would like to give on SentinelOne. So, Tomer, thank you very much for joining us.

Absolutely, really appreciate the upgrade and the kindness.

Thank you. I want to step back and understand the drivers for growth. What are the areas that are successful? We've seen growth in multiple areas and multiple ways. Take the time to kind of take us through the story -- the growth story of the company. What are the areas you've invested in and you are currently seeing the progress? And what are the areas that you're still working on and focusing on?

Yes, yes. Look, I mean, AI, obviously, is something that is driving a ton of customer interest. And with AI, I think what's really interesting is that there is no good idea on how you adopt AI securely. And the customers are left with a myriad of different actions on how they can think about it. But the reality is that AI needs to run someplace. It needs a compute surface, which has an operating system and typically is either a device, something that you use or a workload in the cloud.

In both of these situations, the only control in all of cybersecurity that is designed to produce visibility, enough visibility to see what AI is doing is these things that we call EDR solutions or endpoint protection solutions whether on the endpoint or in the cloud or on the workload. So in some way that I think none of us can claim to have predicted over the past decade. AI is driving complete tailwinds for endpoint security products, knowing that when you think about the new wave of agents that are going to be deployed in the enterprise, already being deployed in the enterprise you need something alongside these agents that verifies what they're doing in any given moment.

That is not identity protection. That is not network security. And I'm not saying these are not needed, but they cover a very different facet of security. They allow for access management, but once an agent, authenticated identity security pretty much finished the job. And there's nothing else out there that can actually give you the view as to what is happening.

How do you monitor it? And then where does that data go? Where does it go? And it goes into something that should serve as a real-time data lake, which is another capability that we've, I think, innovated into the market 3 years ago. So you're kind of seeing 2 of the most critical parts of our platform naturally be in just incredible demand today, and that is driving a lot of the pipeline, a lot of the growth that we're seeing. And on top of that, we also made an acquisition in the form of Prompt Security that is designed specifically to secure AI.

So we are now sitting in 3 critical junctures all being driven by the massive influx in AI usage and all of those are providing for us for complete platform adoption because now you're not just talking about the endpoint security or the workload security aspect, but you're talking about a broad-based platform that you can consume whichever part you want in your AI journey. And the AI journey differs, the pace differs, what you're deploying differs. The type of Frontier AI that you're deploying is different, but the common theme is that you have to have broad-based security and visibility that starts with endpoint protection and workload protection or more broadly, runtime protection and then ends with data visibility and actioning all that stuff that you're seeing.

So it's really a tremendous tailwind for all of cybersecurity. But I think more specifically and just given your intro, 4 vendors that can provide modern endpoint and workload security and there's 2 of those, as you mentioned. And we're just seeing, I think, a lot of pull from the market, from our customer base. Now it's incumbent upon us. So, of course, to deliver that and to make sure that the customers have the most streamlined way to procure these capabilities from us.

Another background question is the positioning of the company. So we have Microsoft offering endpoints, we have even Palo Alto with Cortex. We have CrowdStrike, of course, a direct competitor. How do you articulate the addressable market of SentinelOne? What is the niche or what is the area of the market you're going after?

I think, look, we've talked about the platform. And when we say platform, and that would probably be true for all 3 other vendors that you mentioned. And in total, there's 4 platforms in this market, it's us, and it's the folks that you mentioned. And you got endpoint security is one leg. You've got SIEM and data is another leg. You've got cloud, cloud workloads and such is the third leg, and the fourth leg is now becoming AI. So endpoint data, cloud, AI. That is the totality of a $100 billion market opportunity with no single winner in sight, that never happened in cybersecurity. It's not happening now in cybersecurity, and it will not happen in cybersecurity.

So when we think about that broad-based opportunity, true platform is the only play that can actually capture it. And that's where you're seeing all 4 companies succeeding in different scales to your point. But that is the opportunity we're going after, much like the others. And our customer base is similar to all of the others. We secure 25%, almost 30% of Fortune 500s. People think we're an SMB company. No, we're also SMB company. Being an SMB company in this market, a mid-market company is not a disadvantage. The long tail of the $100 billion market sits with the mid-market. It doesn't sit with a Fortune 500 alone. So our ability to sell to every segment in the market is the strength. Our ability to give a fully self-served platform, that's intuitive to use, easy to deploy, doesn't require protracted services. That gives us a lot of strength.

And I think that to us, every account in the Street is something that we feel we're applicable to. Our go-to-market motion, I think, is not as mature as some of our competitors. Our motion in general is very different given that some of these companies have amassed 70,000, 100,000 accounts. Most of the growth is coming through upsell and cross-sell to their existing account bases. We got about 15,000 customers, not a small customer base. But at the same time, 50%, and that's still true from pretty much every quarter for us, the bookings come from new logo acquisition, which is a motion that the others have largely kind of stop pursuing or just don't really focus on pursuing.

So we have the same type of market opportunity. We have a different scale. We have a different challenge. We're going after new logos, they're mostly defending, it's just a different type of a ball game. But in essence, technology is, to me, the biggest determining factor and we got the best technology in the market when you think about endpoint security, when you think about workload security, and we can talk about some of the attacks that we're seeing right now that also point to a very specific way of deploying endpoint security and another one that we've talked about for many, many years, which is autonomous security.

The last couple of years, people have opened up to the notion of, okay, things can happen in an autonomous way. When we said autonomous security 5 years ago, many people raised their eyebrow and said, maybe yes, maybe not. Today, if you're seeing this onslaught of supply chain attacks and when you understand that AI agents are becoming the attack surface, and they are being abused by their automated mechanism of work, the import libraries, automatically, these libraries can be poisoned and can be used to trick the AI agent, to take all your credentials and passwords and send them out in the course of 20 milliseconds. Then you understand that most of what you have in cybersecurity today is defunct, not designed to understand when something goes wrong, not designed to do it in real time and not designed to stop it while our EDR can.

We stopped all of these supply chain attacks in the past 30, 60 days that we've seen that hit many Fortune 100 companies, frontier labs, I think OpenAI disclosed publicly that they were affected by 2 of those, not our customers, some other frontier labs are our customers, not them. So it's also about what technology you can deploy, when can you deploy it? Not all EDRs were created equal, and I think that if we put direct competition aside, there's still 50% of this market that's in the hands of incumbents.

And a lot of the conversations that we're hearing right now are about customers, even our customers that still have footprints with incumbents. We're now waking up and saying, okay, now is the time to move and we need to move fast because a non-modern EDR would not stand any shot. And obviously, an autonomous EDR is something that can really help us, especially if we're deploying more and more of these AI agents.

Now the notion of an AI agent is also expanding. It's not this code-based thing that is not applicable. This is Claude. Claude is an AI agent. If you have Claude installed on your desktop, you have a tab that's called Claude co-work, that's a fully-fledged autonomous agent that can do stuff for you, sometimes doing stuff for you without you even knowing. So that growing recognition for a customer that they need visibility into it, that they need better regulation, that they need governance is driving EDR sales. It's driving Prompt Security generative AI, DLP protection and it's driving more data that needs to go someplace. All of those are the exact same I think, areas that we've been focused on, and we're now even more focused on.

So we moved away a little bit. People have been asking us throughout the day and through earnings. Okay, so you said you're reinvesting and you're putting more stuff in the focus areas. What are those? And what are you moving from? These are the areas. All the other small adjacencies in cybersecurities, exposure management here and there and identity and some others, let's let other people deal with that. To me, we have such tremendous opportunity in the core of cybersecurity and such adequate technology to deal with it, that if we're not doing that, if we're not putting everything we can into that opportunity, which is big in itself, then we're just kind of wasting our time or not yielding as much which is part of what Sonalee and I decided to do.

It's why I took the job.

Last question before I ask -- I speak with Sonalee. Last year, we spoke about a lot of initiatives, but the results were not as good, this quarter when I look at below the surface, above the surface, everywhere I looked at your numbers things were clicking. What changed? What changed in the last year that now -- and I don't care what the share price did because that's just a different market, kind of different issue. I care more about the numbers. The numbers were strong across the board. And the question is what changed in the last year? And how sustainable is the strength that you are seeing today in the numbers?

Yes. I mean, a lot change. I think we took all of last year to basically, redo a lot of parts of our business. So I think we talked a lot about go-to-market in the previous earnings call last year, maybe more than I ever wanted to talk about go-to-market. But it was needed. We needed to adjust. We needed more rigor, we needed a better sales force, we needed better talent. We were saying, we want to move up market. We weren't as much of an upmarket company in the past couple of years, now look at our ACV per customer. I mean it's shooting up in a pretty significant way. Our logo acquisition in the upper end of the market is much, much better. And that starts to create a dynamic where you're becoming more effective.

If ACV per customer is up, if the percentage of sales and marketing for revenue is starting to look much more like a grown-up company, I think that just drives the right type of secular tailwind that we want to see across our business, making sure that we can create the customer experience that we need. If we're moving upmarket, if we're talking to different customers we haven't talked to before, we want to make sure that we do in the best way possible to create the outcome that we set out to create.

So all of that, it doesn't change overnight. I think it's something that we started seeing evidence of internally throughout last year. You're right. It wasn't fully reflected in the number because there were still a lot of moving parts. We're rebuilding lots of parts of our executive team. We have pretty much a fresh ready-to-roll executive team for a couple of quarters now and these are amazing people, amazing people that we just didn't have, that same caliber in the past.

So all of these things, I think, are now -- I think things that are now driving is better rigor across the business. Technology was always great. We always have phenomenal technology. I think like throughout the years, that was the one thing that we didn't manage to mess up. I'm kidding, of course. But I think now it's aligning which is a better operational rigor, better go-to-market. And I'm not declaring victory by the way. There's still much more work to do, but it is looking better.

Sonalee, I'm going to start with a tough question. You're the third CFO in a short period of time. Tell us about the infrastructure you have seen from the numbers management point of view, what are you working on? What are you focusing on? What needs to -- what do you need to do in order to have consistent reporting and not to have the hiccups we had in the past?

Yes. That is a tough question. And then you're the first one to ask me that particular question. So firstly, just with respect to the infrastructure and the team I inherited, kudos to my predecessor, I inherited an extremely strong finance bench. One of them is sitting right there, who has made my life amazing in the last couple of months as I prepped for earnings, our Head of IR.

So in terms of bench strength infrastructure, like I don't worry about things like the control environment, that is just not even on my radar. I actually feel like -- it is on my radar, but I don't need to worry about it. I actually feel like I have been able to go really deep in some of the operational things that are big priorities for my boss here really early on because the infrastructure is so good. In terms of priorities and where I'm focused, so first and foremost, I feel like it's incumbent on me in the seat to ensure that we are allocating our capital and investing in our highest conviction opportunities, and Tomer talked about some of those.

But one of the things he didn't say about what are the factors of our success in the last year is we are a true platform, and we are now truly diversified. Like we are not just an endpoint company. We now have 50% of our ARR coming from outside of endpoint. And there are some real growth drivers within that. So we talked about AI security and Prompt. Prompt has basically doubled ARR for 2 consecutive quarters and nearly quadrupled since we acquired it just a couple of quarters ago. I mean that's phenomenal growth. It's my job to ensure that we feed that baby, so it can grow.

In my first week, I asked for a meeting with the GM of Prompt, and I asked him what he needed from me in order to ensure that the target that he has for the full year is actually 20% or 25% higher. And why can't that be a $100 million business in a couple of years. So these are the kind of things I'm focused on, which is great because this category has a lot of opportunity. Tomer talked about the $100 billion TAM. So AI security data, where we have a very strong presence. Again, we saw that accelerate this quarter. Cloud, again, accelerating. So I think my biggest priority and what I really feel like I need to get right is ensuring we make those investments.

Secondly, operational excellence and rigor. And there are certain things that when I arrived, when I looked at our sales and marketing spend as a percentage of revenue, it was really off benchmark, and we've made some progress this quarter. Hopefully, you saw. 39% as a percentage of revenue as opposed to 47% a year ago. But there is more to do there. And I think actually some small changes that we've even made on some of our marketing channels and the efficacy of our marketing spend has already started to yield results, but you'll see continued progress there as the year rolls on.

Thirdly, I think net retention is a big one for me. And our platform strategy really helps with that. This quarter, we saw -- it was a number I was extremely focused on. We saw net retention for our customers spending $100,000 or more with us going above 110%, so that was a significant improvement. And as I look ahead and I think about what's going to drive our growth, I think we will continue to see improvements in that net retention number. So those are kind of near-term priorities.

In terms of the cadence around earnings and getting back into this beat and raise cadence, like, of course, that is what we want. Of course, that is discipline that I will hopefully bring. And some of you in this room have known me for a long time. It's -- hopefully, I have a track record in doing that. I think one of the things that I have become really involved in is the weekly forecast meeting. I work very closely with our sales ops team. I think there are investments that we are going to make there. And I think the CFO office will be a lot closer to sales ops than perhaps in the past. And other investments we're making on the customer success side around our churn and downgrade. And that's, again, an area that I think has real scope to improve with some small changes. So those are, again, priorities right now.

And in terms of the margin side of the business, I see already a very clear multi-quarter sequential margin improvement story that will translate into a multiyear margin improvement story because of the industry-leading gross margins that we have today and the operating leverage that's inherent in this great business as we continue to grow 20%.

So margin -- in the past, a year ago, I remember that I compared your margin to CrowdStrike that were at the same level, and I showed a big difference. They were higher margin. And the question is what are the levers in margin? What are the things that you can improve with margins over time that is it just about revenue growth and leverage on revenue growth? Or is there anything that you can structurally change within the expense level?

Yes. I think -- I mean, on the gross margin side, I think we're already pretty -- like there might be some optimization, but I think -- so it's really in the other line items and that roll out to operating margin. I think like sales and marketing, I'm going to come back to that we're not stopping at 39%, right? And I think if you look at not just CrowdStrike, but if you look at other peers and software companies that are $1 billion plus, we're going to be ARR significantly above $1 billion. We are outside the benchmark, and I do not see any structural reason. We see no structural reason, and we are fully aligned on the efficiency measures that we're taking that, we actually feel are going to drive not just better outcomes and unit economics, but we think it's actually going to drive better revenue growth as well. Because I think that there were layers of pockets of inefficiency that were actually dragging the whole business down.

And I ran this playbook at other places that I've worked as well and when you eliminate those bottom producing sellers, you create way better books and territories for your great sellers to go and attain and over-attain. And like we have no problem incentivizing our sellers to go and over attain. We want them to. And we think we're creating the conditions for that to happen. So like if you were to ask me, is there any structural reason why you should not have best-in-class operating margins? Absolutely not. We did 700 basis points year-over-year this year. We will have significant operating margin expansion next year, but we also believe really strongly in investing alongside those operating margin improvements. And while we have these incredible opportunities like shame on us if we squander the opportunity to go and fuel the growth. So it's going to be balanced.

I would say, I mean just to add to that, and we're fully aligned. We are expanding margin pretty fast. So 700 basis points year after year almost, just look at where we're going to exit this year, and I think that's going to give you a good sign as to, hey, we're starting to look pretty close to everybody else. So you're right that at that same scale. I think it's just a different opportunity in a different interest environment and hard to compare. But now that things are starting to be more aligned. I think you're going to see us kind of operate at those same levels pretty quickly.

So I tell you what caught my eyes this time, this cycle. I stopped covering you for about 6 months. We had another analyst, and I came back to cover you about 2 months ago. And when you reported the numbers before that when we were preparing, I look back at your -- and I look back at your growth. And I said, this company had so many issues with sales and some products. And still you grew revenues over 20% consistently.

That's the way we look at it, too.

Right. And the question I have is, do you think you can accelerate growth? Do you -- what's your goal? Accelerate -- achievable goal, accelerate growth, maintain growth, 20% is pretty darn good in this kind of market.

I don't think there's a day that passes that we don't think about how we accelerate growth.

Yes.

Can we do it? Are we committing to do it? I think that's not for us to say at this point, but it is something that, by far, we have as a target internally for ourselves to figure out how we do it. And I think there's plenty of levers in the business to achieve that while recognizing that what you call -- we've had so many issues. It's also flying a very fast plane and changing its parts at the same time. Those are the issues that you see. And look, I would take -- this has nothing to do with Sonalee. I'll take the full responsibility for all of it. These are needed changes.

Now we're at the scale that as a public company, there's no way for you to hide some of these things. Ideally would want to maybe do some of these things in a private setting, but it doesn't make them less of an imperative to do. And my sense is, I'd rather do it. I don't care if it looks like an issue or doesn't look like an issue. It's the right thing to do. It's what's serving the business for the long term, and we're going to keep on doing that to the dismay of sometimes even people that work at SentinelOne, to the dismay that some of my loss of my hair, to the dismay of all of it, I'm going to keep on taking the right decisions for the long term. But I think we're seeing less and less of that, and we're becoming better and better.

And I think those are the exact same things that then funnel into accelerated growth. And that's something that we absolutely want to see, we believe the opportunity for the SentinelOne is bigger than even that 20%. But there are things that still need to line up for us to sit on this stage or other stages and come and say, hey, we're now guiding up. We're accelerating and it looks tremendous.

By the way, we've had some acceleration even in Q1 from Q4. So that was nice. We've had massive improvement in net new ARR, 55% year-over-year, nontrivial by any degree. So the components are there. There's still a lot of things that we need to align, but I think it's on both of ours radar for sure.

So in the interest of time, I'll just go maybe to my last question, which is something we spoke about, but I want to understand it. We speak a lot about AI. But there is a difference between what I -- when I talk to cybersecurity companies. There is a real concern over AI, et cetera. But when I speak with software companies, deployment of agentic AI is not giant. It's not big. It's starting. We talk about it, but it's a relatively small piece of revenues. Why is it the driver now in cyber? Meaning, is this just a potential opportunity in the future? Or do you see already now enterprises customers deploying, not just thinking about, but rather deploying AI cyber solutions?

Yes. No, we're definitely seeing them deploy. And I think that you're going to have to have the cybersecurity controls to deploy AI. So cybersecurity comes first. And I'm glad that that's actually happening. And I think the Mythos and Glasswing beyond the tangible specific like vulnerability discovery and all that stuff. I think the awareness that you really have to have a handle on what's happening before you just start deploying things, that awareness is there.

So I think we're starting to see kind of cybersecurity become a prerequisite for AI adoption. You're still seeing AI adoption that's uncontrolled. You're still seeing a lot of AI in the enterprise right now, maybe not agents. But AI usage that is completely unregulated. Not every one of our customers have Prompt Security, and I can tell you that they have nothing else. And same is true for many other customers across the cybersecurity landscape. So the need is there. the deployment is starting. I think the understanding that a lot of these agents are not something that is easily controlled is both delaying the pace and making cybersecurity a much of a needed ingredient.

But there's going -- it's going to take a little bit of time. I think these agents are just not as accurate as we want them to be. And we're great partners of Anthropic and OpenAI and Google across all these facets. Lots of promise, lots of talk, lots of examples, but true production grade type of capabilities, I'll be wary of deploying at scale at this point. And I think the more that proves to be a tried and tested motion. I think your SaaS companies might have a different aspect at that point, but cybersecurity has to be infused in it.

Otherwise, you lose control very quickly, and you have no idea what's happening. And that is, I think, the most critical thing that our customers are worried about when I have kind of conversations with large customers, they're not asking about EDR. They're not asking about the capability. They're asking about security strategy. They're asking how to deal with everything given the portfolio that you have.

Right? Tomer, Sonalee, thank you very much.

Absolutely. Thank you for having us.

Thank you, Tal.

Hello and welcome to the SentinelOne Q1 FY 2027 Earnings Conference Call. [Operator Instructions] Also as a reminder, this conference is being recorded today. If you have any objections, please disconnect your call.

I will now turn the call over to Saad Nazir, Vice President of Investor Relations.

Good afternoon, everyone, and welcome to SentinelOne's Earnings Call for the First Quarter of Fiscal Year '27, which ended April 30, 2026.

With us today, are Tomer Weingarten, CEO; and Sonalee Parekh, CFO. Our press release and an earnings presentation were issued earlier today and are posted on the Investor Relations section of our website. This call and accompanying slides are being broadcast live via webcast, and a replay will be available on our website shortly after the call.

Before we begin, I would like to remind you that during today's call, we'll be making forward-looking statements about financial performance and future events, including our guidance for the fiscal second quarter and full fiscal year 2027 as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual results or events could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our quarterly reports on Form 10-Q and annual report on Form 10-K. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements.

Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons why actual results may differ materially from those anticipated, even if new information becomes available in the future.

During this call, we will discuss non-GAAP financial measures, and all comparisons made are year-over-year, unless otherwise noted. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our earnings presentation. These non-GAAP measures are not intended to be a substitute for our GAAP results. Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges, gains on strategic investments, impact of the previously announced ITA tax settlement and income tax provision, which cannot be determined at this time and are, therefore, not reconciled in today's press release.

And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our First Quarter Earnings Call. Q1 was a solid start to the year for SentinelOne. We delivered strong revenue growth, record net new ARR growth and significant operating margin improvement year-over-year. Total ARR growth accelerated to 23% in Q1 driven by strong new logo acquisition and expansion with existing customers. We delivered $44 million in net new ARR in Q1, a 55% increase year-over-year, setting a new company record. This marks our fourth consecutive quarter of positive net new ARR growth while exceeding expectations. These results showcase execution consistency and strong business momentum.

Our platform strategy is showing solid traction. We have established clear technology leadership across the most critical domains of cybersecurity, including AI, data, cloud and endpoint. Enterprises realized they cannot defend against AI-driven threats by consolidating on to legacy platforms that simply bolt on the separate tools together. What's needed is a natively unified, AI-driven data and security architecture, and that is what SentinelOne delivers.

According to Gartner, AI security is the fastest-growing segment in cybersecurity growing more than 70% year-over-year. AI represents a massive market opportunity for us and a durable tailwind for our business. We are already seeing this momentum with our AI offerings as our AI security ARR nearly doubled again in Q1. AI has been foundational to the singularity platform from day 1. This inherent AI advantage has never been more critical and we are well positioned to expand our market share across $100 billion-plus market opportunity.

Now let's dive deeper into the details of our quarterly performance. We are winning new logos and expanding our footprint across diverse platform categories. Beyond the Singularity platform's best-in-class efficacy in autonomy, its intuitive design and operational simplicity are driving strong customer adoption. In Q1, our total ARR mix reached an important inflection point. For the first time, the total ARR from our non endpoint solutions approach 50%, this performance was driven by accelerated ARR growth of our AI security, data and cloud solutions, a clear testament to the diversity and customer outcomes of the Singularity platform. Our cross-platform adoption drove a record ARR per customer in the quarter, signifying the momentum and contributions across our platform solutions. Overall, we're maintaining a healthy balance between new logo acquisition and existing customer expansion.

Given our scale and relative market share, this strategy allows us to increase our market share while still retaining significant future expansion potential. We maintained solid win rates across all competitive situations. We're gaining mind share and market share among customers and partners, customers of all sizes, especially large enterprises, are increasingly recognizing SentinelOne's AI advantage. Among our platform solutions, AI security continues to be a bright spot with ARR nearly doubling again sequentially in Q1. Today, Prompt Security stands out as the only enterprise-grade scalable solution capable of securing AI at this level and organizations are recognizing that this is a prerequisite for safely accelerating their AI initiatives.

Let's look at our Q1 wins that exemplify this. The U.S. state government selected SentinelOne to secure its AI infrastructure in one of the first government deals led by AI security. With thousands of employees accessing AI tools across sensitive government systems, the need for real-time visibility and governance was urgent. This customer chose Prompt alongside Endpoint Cloud and AI SIEM to get run time visibility into their employees' AI usage while satisfying strict government compliance requirements. Moreover, we are increasingly winning stand-alone AI security deals from the customers of our direct competitors. This serves as a strategic entry point to expand our broader market exposure.

In Q1, an iconic enterprise selected Prompt Security over the incomplete AI offering over their incumbent Next-gen endpoint vendor. Winning this head-to-head evaluation has built tremendous trust. By demonstrating the superiority of SentinelOne's technology, we have opened the door to displace that next-gen competitor and drive broader consolidation for this enterprise with the Singularity platform. As organizations race to build and deploy homegrown AI applications, the attack surface is expanding faster than legacy tools can address it. To close that gap, we launched singularity AI red teaming in May. Purpose built to secure AI applications from the inside out. The solution autonomously stress tests AI applications against real-world attack scenarios before they ever reach production. This creates a highly complementary land-and-expand motion for us. Red Teaming discovers the vulnerabilities and development, and our core platform seamlessly blocks them at one time. We are now delivering AI security from the first line of code through execution.

Next, Purple AI, our agentic [ SOC ] solution is rapidly becoming the bedrock of motor security operations with increasingly sophisticated capabilities of Purple, we are empowering customers to respond faster, accelerate detection and automate investigations. In Q1, we announced the general availability of Purple AI auto investigations a major milestone in our journey towards delivering a fully autonomous SOC. Purple represents a significant expansion opportunity over time. In several early rollouts, we are seeing instances where ARR from Purple AI's end-to-end deployment can outgrow a customer's core endpoint footprint, delivering agentic [ SOC ] autonomous capabilities can drive outsized value. Purple is built for enterprise scale and natively integrated with Singularity hyperautomation, but its value extends well beyond large enterprises. We've architected Purple to deliver meaningful impact across customers of all sizes and we see a particularly compelling opportunity with MSSP providers, who stand to benefit from significant cost efficiencies and a step-change acceleration across their entire operations.

At the capability level, Purple's latest auto investigation feature delivers human-level reasoning at scale, providing one click and soon zero-click automation with clear verdicts in seconds. This closes the critical gap between insight and action fundamentally changing what security teams can accomplish. The accuracy we're seeing compared to human analysts make this a true game changer, allowing security practitioners to shift from manual investigation to immediate remediation. This is consistent with IDC's finding noting a 338% ROI for Purple AI customers.

For data solutions, Q1 marked the fourth consecutive quarter of ARR growth acceleration. We are seeing increasing demand for our AI SIEM as enterprises seek unified visibility, real-time detection and autonomous response. All this with far more efficient unit economics than legacy alternatives. With an integrated Observo AI, our customers now benefit from owning the critical data pipeline that powers modern security operations. We are delivering a truly comprehensive security data lake that natively unifies petabyte scale ingestion, orchestration and hyper automation into a single seamless experience.

Among several wins in the quarter, an iconic luxury brand display [ Splunk ] with a multiyear commitment to SentinelOne's AI SIEM as their dedicated security data platform. Their global operations needed a solution that offered unified visibility into a single AI-native platform. the combination of real-time autonomous security and operational simplicity of the Singularity platform made it a winning choice.

In another win, a multinational services enterprise signed a 7-figure expansion with SentinelOne replacing their existing SIEM provider. This enterprise selected the Singularity platform for superior cost of ownership, machine speed investigations and AI-native unified platform. Independent validation continues to reinforce our competitive position. A recent IDC business value study found that SentinelOne's AI SIEM delivers a 331% 3-year ROI with only a 7-month payback period. Our AI SIEM customers see 70% faster queries, 75% faster investigations and 4x the threat coverage.

For Cloud Security, ARR growth accelerated in Q1 driven by the strong adoption of our best-of-breed runtime security covering both on-prem and cloud environments. As AI workloads multiply and cloud environments expand, the need for robust runtime security is increasing. Among cloud security wins, one of the most valuable private companies in the world, soon to become public, significantly expanded its footprint with SentinelOne in the quarter. To secure an enterprise of this magnitude static cloud visibility or [ poster ] management was simply insufficient. This enterprise doubled down on Singularity cloud for autonomous AI-powered runtime protection capable of actively neutralizing AI-based threats across their dynamic infrastructure in real time.

To secure dynamic cloud environment, organizations need more than static posture management. Our runtime cloud security stops real-world cloud attacks in real time and seamlessly scale alongside our customers' operation. It is clear that in an AI-driven [indiscernible] landscape, static defenses are no longer sufficient. Verifying identity at the door is useful, but it doesn't stop modern threats. We've seen this play out repeatedly. Traditional identity access management solutions and PAM solutions were built for the past. They were fine at mapping governing access, but they were never designed to autonomously detect and respond to what happens next. Attackers often bypass access controls post-authentication, operating undetected inside environments where trust was already granted. Machine speed behavioral analysis and continuous validation at runtime is the key competitive edge and the only formidable defense strategy to stop real-time attacks in the age of AI.

As the market pivots towards securing AI agents and frontier models, the endpoint remains the ultimate control plane. You simply cannot deliver comprehensive AI security without deep foundational visibility at the point of execution on the host machine that runs AI. AI-powered EDR remains a critical vector for capturing the evolving AI security opportunity with deep expertise and a significant portfolio of patented machine learning and behavioral detection algorithms SentinelOne is uniquely positioned to protect endpoints and AI workloads directly where they are created and operated.

Beyond monitoring access, we align intend to action through real-time [indiscernible] analysis detecting threats that no identity or parameter control can see. Most recent supply chain attacks, including those targeting light LLM and [ Axios ] underscore this point clearly. These were exploit free attacks purpose built to bypass traditional security controls and move at machine speed. No signature, no known vulnerability, no perimeter trigger. The only effect of defense was autonomous behavioral protection at the host level, exactly where SentinelOne operates. These real-world examples reinforce why the execution layer is where the battle is won.

We continue to be a growth leader in the broader endpoint sector by delivering the most autonomous endpoint security solution available, combining industry-leading efficacy, performance and user experience. Nearly half of the existing endpoint sector is still using legacy antivirus solutions. This is a clear opportunity for continued market share gains. We're also beginning to see increased traction in securing highly restricted on-prem environments, where true sovereignty is required, which is a distinct structural advantage for us. While our competitors country securities environment, this provides an emerging growth avenue for us, we have the distinct advantage of delivering fully autonomous high-velocity AI protection in any environment, both cloud and on-prem. Our expanding customer base now includes some of the most sophisticated and iconic companies on the planet from Frontier AI labs and major financial institutions to critical global supply chains the world's most demanding organizations rely on and trust SentinelOne.

Turning to SentinelOne Flex. It is proving to be a highly effective model for broader platform adoption. We're seeing an increasing number of large deals and contributions from Flex. In just 3 quarters of its launch, Flex had crossed $200 million in TCV. Looking ahead, our pipeline and demand for Flex shows continuation of this momentum. SentinelOne Flex is simplifying the purchasing process and driving an increasing number of large 7- and 8-figure deals and longer-term commitments. Overall, our success up market is directly fueling bigger deals, driving steady retention and creating a highly visible durable runway for long-term growth.

With the growth of token-based AI adoption, we're also expanding our monetization model to capture the full value of how customers use our emerging solutions, usage-based metering creates a natural growth engine. As customers expand their use of our products like security data lake and Purple AI. Customers can choose upfront annualized SentinelOne Flex commitments that provide cost visibility in preferred economics while giving us committed revenue visibility. Together, SentinelOne Flex in prepaid structures create a durable hybrid model, a reliable baseline with meaningful expansion opportunity levered on top.

In the partner ecosystem, we continue to expand our reach and scale. Our partner ecosystem is a force multiplier, expanding our global reach in driving broader platform adoption. For MSSPs, the Singularity platform delivers the AI-native multi-tenancy and remote management capabilities that drive valuable operational leverage. This structural advantage gives us a unique competitive edge within the MSSP ecosystem. A strong proof point of this leadership came at RSA, where we announced an expansion of our partnership with [ Level Blue ], the world's largest MSSP. This partnership drives the strategic consolidation of their endpoint estate onto the Singularity platform in the coming years and extends our reach across their global customer base. At RSA, we also announced an expanded strategic alliance with Google Cloud to deliver autonomous security at a global scale and we were honored by winning the 2026 Google Cloud Partner of the Year Award.

Last week, we also announced Singularity platforms integration into AWS Security Hub extended. This removes the traditional barriers of enterprise procurement. AWS customers can now turn on SentinelOne's AI-powered runtime security in a minutes directly from their AWS console without new contracts or procurements. This pas as you go model and allows organizations to seamlessly secure their modern digital footprints with SentinelOne.

That shift gears to the broader industry dynamics. Frontier AI models are rapidly changing cyber defense, allowing adversaries to execute AI-based attacks and weaponized weaknesses faster than human teams can react. To stay secure, enterprises must rebuild infrastructure from the ground up with a unified AI native foundation. To build modern and secure enterprise infrastructure, we believe a collaborative approach is key to solving this generational challenge. Our relationships with the Frontier AI labs are deep and strategic. We partnered with Anthropic on the launch of Cloud Security and with [indiscernible] AI to its early access for cyber program, embedding frontier models throughout our platform.

We complement these with our own proprietary and fine-tuned models, and our core engines remain multimodal and moralistic by design. AI security is becoming a focal point across the industry with programs like [ Glasswing ] or [ Daybreak ]. It validates the approach we have been building towards tears, and we are actively engaged with both Anthropic and OpenAI to ensure SentinelOne's role in the ecosystem continues to grow alongside our platform leadership.

I'm also pleased to share that we are a participating vendor in [ Project Glass wing ]. Proactive visibility is only half of the equation. We must neutralize active threats at the point of execution. The new class of AI-based attacks are designed to move faster than any human analyst could react. To give the advantage back to the vendors, we launched [ Wayfinder ] Frontier AI services in Q1. We are a lead partner correlation, including [ Mandiant ], WWT, KPMG and [ Buzen ] were fusing multimodal AI with tip-of-the-spear human intelligence. Protecting the AI power business world requires securing the systems where AI is actually being built and used of in [ Linux and Mac ] operating systems. While many cybersecurity vendors remain dependent when securing only Windows environment, our established strength pocure [ Mac and Linux ] systems give us structural advantages in AI security. We're expanding our native EDR telemetry to protect autonomous AI agents across these operating systems where AI compute is rapidly growing.

Our Singularity platforms own device behavioral AI recognizes malicious execution patterns and mitigate processes preemptively. We autonomously stopped recent supply chain attacks instantly across multiple customers with 0 prior knowledge and no human analysts in the loop before they could do any damage. At SentinelOne, we are delivering end-to-end AI security from data to run time.

Shifting gears to our operating model. As always, we remain committed to balancing durable growth with improving profitability and accelerating our path towards the Rule of 40. That commitment requires us to continuously sharpen how we operate. As I outlined in March, we have been actively refining our team structures and go-to-market focus, while accelerating our internal use of AI. In alignment with this strategy, we made a difficult but the necessary decision. We are streamlining our organizational structure, resulting in about 8% reduction in our workforce. This is not a reactive measure. It is a deliberate evolution to reduce complexity, raise the performance bar and build a leaner, more agile SentinelOne.

On the go-to-market side, we see an opportunity to uplevel our teams and streamline distribution. This includes tightening our coverage and driving greater productivity across our sales organization. Our goal is straightforward, driving better operating leverage, sales efficiency and execution velocity. On the AI side, through the company-wide rollout of frontier models, we are seeing meaningful productivity gains across our organization. Work that previously took months is now being completed in weeks and in some cases, days. Together, these actions provide us the resources and flexibility to concentrate investments in our highest conviction growth areas, AI, data, cloud and endpoint.

Before I turn the call over I'm very pleased to officially welcome Sonalee Parekh to our first earnings call. Over the past months, we have been working closely together. Sonalee brings an impressive level of operational rigor that aligns with our focus on execution velocity and profitability She's a phenomenal addition to our executive team and already making an impact.

In closing, I want to take a moment to acknowledge the contributions of all sentinels, the relentless focus, dedication and execution drives our success. And thanks to all our customers, partners and shareholders for their continued support. Thank you again for joining us today.

With that, I'll hand it over to our CFO, Sonalee Parekh.

Thank you, Tomer, and thanks, everyone, for joining us today. 60 days in as CFO of SentinelOne and the conviction that brought me here has only deepened. Q1 was a strong quarter, and it reflects what I've seen firsthand, a platform that is genuinely best-in-class, a business model with meaningful operating leverage ahead of us and a market at an inflection point. AI is fundamentally expanding the attack surface. Creating new security categories, accelerating customer urgency and opening growth vectors that are still in their earliest stages. SentinelOne is built for exactly this moment.

Now let's review the details of our Q1 fiscal '27 financial performance and our guidance for Q2 and the full fiscal year '27. As a reminder, all comparisons are year-over-year and financial measures discussed here are non-GAAP, unless otherwise noted.

Q1 was a solid quarter for SentinelOne. Our revenue growth accelerated sequentially, growing 21% year-over-year to $277 million. Our international markets revenue grew 25% and represented 39% of total revenue, demonstrating strong international demand and a growing global footprint. In Q1, our total ARR growth accelerated to 23% and we added $44 million in net new ARR which comfortably exceeded our expectations. This record net new ARR growth of 55% was driven by new logo acquisition and broader platform adoption within our existing customer base. Our move-up market continues to yield excellent results. Our ARR per customer reached a new company record, led by strong momentum at the top end of the market where our cohort of customers with ARR of $100,000 or more grew 17% year-over-year.

Our gross retention rate or GRR, across our customer base remains stable underscoring the mission-critical nature of the Singularity platform. For customers spending $100,000 or more in ARR, our dollar-based net retention rate or NRR, improved both sequentially and year-over-year, driven by continued success in multiproduct platform adoption. We are increasingly landing premier logos providing us with a highly durable runway for long-term growth. Overall, we are maintaining a balanced split between new logo acquisition and existing customer expansion. Given our scale and relative market share, this focus allows us to increase our market share with significant future expansion potential. This performance clearly reflects the value customers realize from our singularity platform and our continued success in driving multiproduct expansion and stickier customers.

Now turning to profitability. We continue to maintain a strong gross margin profile, highlighting healthy platform unit economics and scale efficiencies. In Q1, our operating margin of 4% exceeded our expectations and represented an improvement of approximately 550 basis points year-over-year. Our earnings per share of $0.04 also exceeded our expectations and represented an improvement of 83% year-over-year. We are sustaining a top-tier growth profile, while rapidly expanding our profitability. Most importantly, we are driving this structural operating leverage without compromising our relentless pace of innovation.

On a trailing 12-month basis, our adjusted free cash flow margin was 6.5%, representing an improvement of about 440 basis points year-over-year. We put the company on a path to sustainable positive free cash flow growth, which underscores our commitment to durable profitable growth at scale. Complementing this strong performance, our remaining performance obligations growth accelerated to 30% in Q1. Our total RPO reached a record $1.5 billion in Q1, a clear validation of the trust we've established with our customers and our commitment to innovation. We ended the year with a robust balance sheet, including $812 million in cash, cash equivalents and investments and no debt. Looking ahead, SentinelOne is well positioned at the intersection of AI, data and cybersecurity to lead the industry into the next era of autonomous defense. Capitalizing on this opportunity requires us to evolve our operating model and the way we work.

As Tomer discussed, we are implementing a workforce optimization initiative impacting approximately 8% of our workforce. We are harnessing productivity gains to increase our agility and to invest in solutions like AI security, Purple AI, data and cloud, which are key to delivering durable growth. In connection with this initiative, we expect to incur a onetime restructuring charge of approximately $25 million in the second quarter, which will be excluded from our non-GAAP results. Once fully implemented, we expect this action to result in approximately $45 million in annualized cost savings. This provides us with the financial flexibility to purposefully reinvest in our key growth areas while continuing to drive significant operating margin expansion. With our strong growth profile, clear technology leadership and growing structural tailwinds, we have all the ingredients to scale into a multibillion-dollar, highly profitable, durable business.

Now turning to guidance for Q2 and fiscal year '27. For the full fiscal year '27, we continue to expect revenue to be between $1.195 billion and $1.205 billion, representing 20% year-over-year growth at the midpoint. For Q2, we expect revenue to be between $289 million and $291 million, representing 20% year-over-year growth at the midpoint. Overall, this outlook is supported by a solid pipeline, strategic partnership opportunities and rising contribution of our emerging solutions, including AI, data, cloud and others. As always, we continue to be mindful of the evolving macroeconomic environment and geopolitical uncertainties, which can influence deal timing and sales cycles across the industry.

Turning to the outlook for our profitability metrics. For fiscal '27, we are raising our operating income outlook to be between $115 million and $125 million, representing an operating margin of 10% at the midpoint, representing a 650 basis point increase over fiscal year '26. For Q2, we expect operating income to be between $23 million and $25 million, representing an operating margin of 8% at the midpoint. For full year fiscal '27 we expect fully diluted earnings per share to be between $0.32 and $0.38, representing $0.35 at the midpoint. For Q2, we expect earnings per share to be between $0.06 and $0.08. We continue to expect a non-GAAP tax rate of approximately 17% for the fiscal year '27. And we expect our weighted average diluted share count to be approximately $347 million for Q2 and $350 million for the full year.

Taking a step back, our technology leadership and competitive position remains strong. We are scaling the business while consistently driving operating leverage. Our investment approach strikes a disciplined balance between capturing long-term growth opportunities and maintaining a durable, profitable financial profile. This strategy is foundational to scaling SentinelOne into a multibillion-dollar business. At the same time, we are instilling operational discipline with a sharp focus on greater efficiency.

In summary, we are well positioned at the intersection of AI, data and cybersecurity. Leading the industry into the next era of autonomous security. Security is no longer just a safeguard. It is a key strategic enabler of AI innovation. With a strong financial foundation, a differentiated platform and growing market opportunity, we remain committed to delivering shareholder value. Thank you all for joining us today, and thank you to all SentinelOne for giving me such a warm welcome.

And with that, operator, we are ready for questions.

[Operator Instructions] Our first question will come from Meta Marshall with Morgan Stanley.

Congrats on the quarter and the acceleration in Q1. From an opportunity standpoint, are you seeing a pickup in core endpoint as customers try to address technical debt? And how are you balancing selling them the full singularity portfolio at initial sale versus upselling them later?

Absolutely. Thank you for the question. It's clear that the endpoint remains the most important control plane, especially in the age of AI. We're seeing a lot of focus on how to secure agents, how to secure services that could be impacted by the deployment of more and more AI technologies. So not only this bodes well for our overall core endpoint business.

If you think about Prompt Security, Generative AI protection specific and deployed on the endpoint. This is typically what we're seeing right now and how we're lending. So when we look at our pipeline, we're actually seeing a lot of contribution, not only from core endpoint, which, again, has been a phenomenal for us both in Q4 and in Q1 and will continue to grow, but also the immediate attach of from security, generative AI protection that is adjacent to the endpoint as well.

Lastly, I'll say the definition of the endpoint is also expanding. And when you think about where AI workloads are being deployed today, it also spans towards cloud workload. And that's another strong suit of ours where we're seeing a lot of demand for the protection of these workloads that are now housing either a genetic workload or other model workloads. So all in all, really strong -- really strong demand across endpoint surfaces and [indiscernible] services.

Thank you. Our next question comes from Brad Zelnick with Deutsche Bank.

Tomer, I think we'd all like to hear your thoughts on the extent [ Mehos ], Daybreak and just the broader pace of AI innovation might be impacting customer spending behavior. The extent to which it's, in some cases, maybe accelerating or perhaps even slowing down or even expanding budgets. Any color is helpful and as well why you're well positioned to capture what's ahead?

Absolutely. And again, we're a proud member of the [ Glasswing ] project. I would say, by far, that drives a lot of concern. And that's not going to be new to anybody. I would say, at the same time, vulnerabilities are not the only concern. So code security is definitely a big, a big component of how we secure an entire enterprise. We've launched Frontier AI services alongside Anthropic and OpenAI, we're using these continue models to go to customer environments, and we do risk immediately. We're talking about deployments that take sometimes hours and days, not weeks and months. So with the customer urgency, there's also an ability to deploy fast and show immediate returns on these technologies.

So all in all, a lot of attention. I think a lot of customers are still grappling with what to protect first. And that, again, goes back to my assertion around vulnerabilities. What [ Minto's ] brings to bear, what models are bringing to bear right now, GPT 5.5 as well is the ability to not only find vulnerabilities in software but really detect and exploit weaknesses in overarching network infrastructure, not just software and not just vulnerabilities and that presents a very wide attack surface. Once again, SentinelOne is well positioned to stop, to mitigate and to help customers reduce risk actively. All of those things are obviously in motion. A lot of them showed up with this [indiscernible] moment and will provide for structural tailwinds throughout the year.

Our next question comes from Brian Essex with JPMorgan.

Nice to see the acceleration and better profitability outlook. Maybe Tomer, for you, I would love to get some color on the reduction in force that you announced. Where were cuts made? Any changes to the sales organization? And I get the productivity, the AI-driven productivity enhancements that you noted, but would love to maybe just connect the dots in terms of where the adjustments were weighed, how many to the sales work and maybe the outlook for sales productivity and growth for the rest of the year?

Sure. And as you've seen in the past, we're focused on driving operational excellence all the time modestly, and simplifying our processes and removing unnecessary layers, that's happening all the time. We've been carrying more organizational capacity than I think we required at this stage of our scale and growth. And our profile of hiring is also changing. The talent we're recruiting is different, and we're just aligning a lot of what we do with both our upmarket success, in our emerging product categories. You've seen the inflection in the overall business mix. I mean, that's tremendous.

And as always, we're focused on driving higher efficiencies and allocating resources towards those key growth areas, which naturally would be AI, data, cloud endpoint, these are the growing areas for us. This is our major focus. And this is the absolutely right thing for the business. It's never an easy decision but at the same time, we want to go after these areas in the most aggressive way that we can. We recognize an opportunity right now, and we want to put all of our resources in the right places. We're barely impacting our technology groups with this. We are focused on streamlining parts of the organization, but we're continuously and always investing in innovation, and that's the key point here. We are delivering to the market what the market needs. We're delivering protection, best-to-breed cutting-edge to our customers using Frontier AI models. That's where we're going, that's where we're going to be continuously investing. And that's what you see us doing.

Thank you. Our next question comes from Joseph Gallo with Jefferies.

As a follow-up to that, should we expect any sales disruption, particularly in 2Q? And as a part of that, Sonalee, great to see the improvement in margins. Can you just talk a little bit more about your comfortability that you can capture this massive opportunity and not sacrifice the durability of growth?

Of course. We don't expect any go-to-market disruption. As you can probably imagine, this comes on natural performance management, folks that may have not been the biggest contributors, we're kind of focusing on the places where we see the greatest contribution. So if anything, again, this will provide more focus on kind of distilled crystallized go-to-market motion. I don't expect any major changes. We've not been changing things in a dramatic way here. This is kind of a continuous moat for us on the go-to-market side. We said it for quite a few quarters. There's really almost nothing new here.

And again, I mean, when we look at our pipeline, when we look where the opportunity is, we're just aligning towards that. We believe that a lot of the reinvestment capacity is actually going to allow us to go after that exact same endpoint opportunities that we've been talking about. You can see some evidence of that with our partnership with [ Live Blue ]. This gives us immediate access to tens of millions of endpoints over the years without needing to go and sell to those customers one by one. That's just one way that we're thinking about aggressive expansion, and we're going to do more of those.

So to us, it's all pointing in the right direction. We feel very comfortable with our technology's ability to go and replace the legacy incumbent in the opportunity that comes with it. It's not -- it's still a massive market. It's still in many parts, dominated by incumbents and that represents a major opportunity for us. To lend with endpoint, to attach generative AI capabilities and protection from all these new vectors of attack to leverage Frontier AI models to deliver the best protection for our customers. These are all positive trends from the business that we're frankly very excited about.

Yes. So thanks for the question. And we are really delighted with the margin progression that we showed this quarter and obviously, it's the upgrade to the operating margin guide for the full year. I think the short answer is we don't see growth in margin expansion, the trade-off in this case. The investments that actually drive durable growth that Tomer was talking about in AI security, data, cloud, the labs are exactly where we're reinvesting. So we're removing organizational complexity that was actually slowing us down and redeploying it into the highest return and highest conviction opportunities that we see in the business.

And I think the evidence that we can do both is actually already in the Q1 numbers. So this quarter, we delivered record net new ARR, so up [ 55% ] year-over-year, while simultaneously expanding operating margin by 550 basis points. So I think that's really our platform model working at scale. And when I look forward, the demand signals give me real confidence. So RPO, again, at a record $1.5 billion, growing 30%. Net retention expanding in our $100,000-plus cohort that's both sequentially and year-over-year to above 110. Some of our products like Prompt ARR nearly doubling again. I think these are all leading indicators of durable growth. So I think you're going to see both durable growth and sequential and annual operating margin expansion. We really feel like we can deliver on both.

Our next question comes from Shaul Eyal at TD Cowen.

Thank you. Question to Sonalee. So now being there a couple of months, have your initiatives you would like to undertake changed? Or how do you see opportunities to build upon the operating leverage you guys are seeing?

Yes. Thanks. So yes, 60 days in. I would say what struck me most coming in was really the strength of the Singularity platform. Our product leadership and technology differentiation and then the significant opportunity in front of us for this category, much of which is just really in the early innings. So I think the operating leverage potential of the business as we scale, given our industry-leading growth margins creates this enormous opportunity to create outsized value. And I would say my conviction on that has only increased.

So in terms of priorities, first, it's my job to ensure we're allocating our resources and investing in the parts of the business where we feel we see the highest opportunity for growth in ROI, so that's data, cloud, AI security, I think, will be massive. And you see already our emerging solutions now 50% of our ARR. So it's these areas where we feel like we have real competitive differentiation and a significant market opportunity ahead. I think Prompt is a perfect example of that. Second, continuing to improve on the cost structure. You saw the announcement we made today on restructuring. It's really important that we focus the business. I'm going to be extremely focused on unit economics. Driving operational excellence and discipline across the business, particularly in sales and marketing, where I see the largest opportunity for productivity improvement.

In today's results, you'll already know we've made a lot of progress in sales and marketing. So if you look at sales and marketing as a percentage of revenue, Q1, it came in at 39% that compares to [ 47% ] a year ago. And if you think about our upgraded full year operating profit guide of 10%, that's 700 basis points of year-over-year improvement. But I think what's most interesting and compelling really, it's what that implies in terms of where we're going to be exiting Q4, that exit operating margin. That's significantly above the 10% guide. So we're on a path to deliver multi-quarter, multiyear margin expansion, which you're already beginning to see.

And then lastly, I think it's really important that -- and Tomer and I are completely aligned on this. We need to put ourselves firmly on the path to Rule of 40, which means not just efficiency but durability and all be really focused on taking that NRR where we've already seen great progress and improving upon it. And it's not just on the NRR side, on the GRR side, we've seen improved logo retention this quarter and stability. And I think that just underscores the mission-critical nature of our platform. And then finally, I would just say it was one of the few platform providers in cybersecurity, the traction we're seeing with the platform is resulting in larger land. So our ARR per customer reached a new company record. And also, really importantly, and again, this is just the platform working is stickier customers.

Our next question comes from John DiFucci with Guggenheim Securities.

Thank you. Congrats to the whole team for the new addition, and it's great to have you, Sonalee. Listen, you guys put up really strong ARR this quarter with growth that accelerated, you pointed that out, but it's accelerated for the first time in more than 3 years, after 3 years of somewhat moderation, which with the law of large numbers you'd expect. But frankly, the growth in new ARR even if you take into account attrition was even better than it's been in almost 4 years from our calculations. So, I know you don't guide to ARR, but you maintained your revenue guidance for the year. And I realize it's early, but how should we be thinking about that given -- I mean that ARR is really the best determinant of the future revenue.

Yes. So thanks so much for the question. And it is great to be here. I'm thrilled to be here on my first earnings call. So you're absolutely right. We had a great showing on net new ARR this quarter, as you say, record. The growth was driven both by strong new logo additions, but also a strong expansion and great contributions from our emerging products. So data ARR accelerated in Q1. I already talked about Prompt, but that nearly doubled again in Q1, and our cloud ARR accelerated strongly as well.

In terms of the overall guide, we did reiterate the guide. And what I would say there is we're still pretty early in the year and we still continue to expect positive net new ARR growth for fiscal '27. In terms of the actual revenue contribution on the guide, we did see a fairly back edge loaded quarter with some of those larger deals and as a larger proportion of our bookings are from larger deals, I think we'll expect to see a bit more of that back-end loading, and that's why you're seeing that from a timing perspective. But we still are feeling really confident around net new ARR for the year.

That makes total sense, Sonalee, and I was only going to ask one question that's going to leave you. The second one would have been on linearity, but you read my mind.

Our next question comes from Fatima Boolani with Citi. We will come back to you at a later point. Our next question comes from Shrenik Kothari with Baird.

This is Zach Schneider on for Shrenik. So maybe one on capital allocation. Now with $800 million plus in cash path towards $100 million plus in free cash flow generation. No debt, you guys have it seems much more flexibility than you've had historically. So maybe how should we think about capital allocation going forward? And are there any changes there in strategy or priorities?

Yes, sure. Thanks for the question. So yes, we feel really good about where the balance sheet is, a very robust balance sheet. I think our capital allocation priorities really haven't changed. So we will continue to focus on organic investments that drive our growth. We will consider inorganic investment. But I would say there's a fairly high bar there. So it would be very selective and would need to be extremely strategic.

And then finally, we absolutely will use our strong balance sheet and free cash flow to give us the flexibility and capacity to be able to opportunistically repurchase our shares given the long-term potential of our business and so long as we believe it's a positive ROI initiative, which certainly at current levels we would. So I would say our capital allocation policy is dynamic and opportunistic. And again, we will do our best to take advantage of any dislocations in the market and also maintain a strong cash position to support our innovation and strategic initiatives from here.

Our next question comes from Richard Poland with Wells Fargo.

I guess if you just think about the balance of the reinvestment that you're making, I think you quantified it somewhere in the range of $45 million in annualized savings from the reduction. I guess as we think about how that flows through to investments and just kind of how you're calibrating how much drops to the bottom line versus how much gets put back into things like AI. Can you help us, I guess, just contextualize that through rest of the year?

Yes. So why don't I start with that. So for the full year, we're now guiding to about 700 basis points of year-over-year operating margin improvement. And as I said earlier, that would imply exiting at an operating margin significantly above that 10%. And we also talked about that desire to balance growth and profitability. And we felt strongly that there were areas where we had high conviction around parts of the market and products where we wanted to reinvest some of those savings. We talked about AI security. We talked about cloud data. We really feel like those are the right opportunities to go after right now from an ROI perspective. And we feel like we'll be able to deliver both durable growth and operating margin expansion and still be able to, again, upgrade that operating margin from where we were a couple of months ago.

Yes. I would just add to that. I mean, we have a tremendous R&D and product and technology groups. And for us, when we look at the opportunity ahead, clearly, we want to build more. We want to produce more capability that we believe can add massive value to the security posture of our customers and at large. So all in all, I mean, in the world of today, the ability to build, the ability to push forward versus maybe a few years ago, a lot of the innovation was coming for other companies through acquisition, I sincerely think that with the strength of our R&D with the strength of our talent, we just want to do more. We want to enable them to do more. We want to bring more great people on board. And that's kind of how we're taking that process behind our reinvestment.

Our next question comes from Roger Boyd with UBS.

Thanks for the question. Tomer, we continue to hear really strong feedback from the channel on Prompt Security. And it seems like it's already becoming a pretty material contributor to ARR. Can you talk about what you're seeing with Prompt as maybe the tip of the spear for new engagements? And have you seen Prompt lead to bigger platform deals, including competitive displacements and endpoint or data lakes?

Yes. And there's no question. Prompt is delivering the capability that every single enterprise needs right now in that none of our competitors have. So we're seeing both the natural expansion for our customer base, plus lending bigger with new logos and even in competitive environments. The ease of use, the seamlessness of deployment, the time to value I think all of those are just radically different than anything else that you're finding in the space today, the level of coverage, compliance, governance, everything that everybody is missing right now is being delivered by what Prompt can bring to bear.

So all in all, it's a great catalyst for us because pretty much every vector of our go-to-market motion. And at the same time, you can imagine, most of our customers state is still underpenetrated. There's still not deploying Prompt. So we're also moving pretty fast to enable Prompt to be absorbed and consumed by our customers state directly through the platform, and that's going to allow more growth opportunities for us in the out years.

Our final question of today comes from Fatima Boolani with Citi.

[indiscernible] with me today. So Sonalee, this one is for you, and nice to see you on board here. Just looking at the deferred revenue and billings performance, I know you don't manage the business to billings, but just as we sort of look at the deferred revenue cadence? Was there anything atypical or different here that happened just as we noted, some weaker seasonality in some of the growth metrics on the deferred revenue side and maybe tying it back to some of your commentary with respect to net retention rate maybe outside of the $100,000 ARR cohort and on some of the gross retention rate comments you alluded to earlier. I would love any incremental color on why we maybe saw that come out of seasonally weaker than prior periods.

Yes, sure. So on billings, I would say there's nothing specific to call out other than the fact that this metric can move around a bit just due to the timing of invoicing. So we tend to focus, and we actually run the business much more around net new ARR as our key operating metrics, where obviously we saw a record number this quarter.

In terms of GRR, we saw continued stability. It's actually -- when I first arrived here, of course, I was looking through all the metrics. It's actually been stable for many, many, many quarters. And I remember seeing that I'm thinking that's an extremely strong sign just in terms of the stickiness of mission criticality of our platform. Like when we win a customer, they stay with us. I think up to now, where we've seen some -- we're -- just an impact on net retention has been on the expansion side of things. And I think we saw positive traction there with some of our larger customers this quarter, which helped to drive net retention up. And that's something I said. I think in Meta's question around priorities, it's something that all be really focused on. And when I look at some of the signals as we look forward to coming quarters, that's a metric that I expect to continue to improve.

And again, that's what gives me confidence on the full year guide as well is that will be a key support that improving net retention rate because, of course, every point we improve on net retention helps -- it creates a tailwind down on revenue.

Thank you. We have now reached the end of our allotted time for questions. I will turn the call back over to Mr. Weingarten for closing remarks.

Thank you, everyone, and have a good day.

Hello, and welcome to the SentinelOne Q4 FY 2026 Earnings Conference Call. [Operator Instructions] Also, as a reminder, this conference is being recorded today. If you have any objections, please disconnect at this time.

I will now turn the call over to Saad Nazir, Head of Investor Relations.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the fiscal year ended January 31, 2026. With us today are Tomer Weingarten, CEO; and Barry Padgett, Interim CFO. Our press release and an earnings presentation were issued earlier today and are posted on the Investor Relations section of our website. This call and accompanying slides are being broadcast live via webcast, and a replay will be available on our website after the call.

Before we begin, I would like to remind you that during today's call, we'll be making forward-looking statements about financial performance and future events, including our guidance for the fiscal first quarter and full fiscal year 2027, as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual results or events could differ materially.

Please refer to the documents we file from time to time with the SEC, in particular, our quarterly reports on Form 10-Q and our annual report on Form 10-K. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today.

If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons why actual results may differ materially from those anticipated, even if new information becomes available in the future.

During this call, we will discuss non-GAAP financial measures, and all comparisons made are year-over-year unless otherwise noted. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles A reconciliation of the GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our earnings presentation. These non-GAAP measures are not intended to be a substitute for our GAAP results.

Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs restructuring charges, gains on strategic investments, impacts of the previously announced ITA tax settlement and income tax provision, which cannot be determined at this time and are, therefore, not reconciled in today's press release.

And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fourth quarter earnings call. Fiscal 2016 was a landmark year for SentinelOne We achieved $1 billion revenue scale, growing 22% year-over-year and delivered full year operating profitability, a significant milestone towards profitable growth.

In Q4, our total ARR grew 22%, driven by strong new logo acquisition and expansion with existing customers. We delivered $64 million net new ARR in Q4, a company record. This marks our third consecutive quarter exceeding ARR expectations, showing execution consistency and positive growth. We drove about half of our new business 2 new logos, showing a balanced split between new logo acquisition and expansion within our existing customer base.

We're gaining traction in the most critical domains of cybersecurity, both AI for security and security for AI. We're helping organizations advance their digital transformations, securely and intelligently. SentinelOne offers the only cybersecurity platform that delivers this unification truly.

AI represents a significant TAM expansion and a long-term tailwind for our business. From early on, AI native security has been foundational to our platform architecture. This early advantage positions us to emerge as the category winner in the AI era across more than $100 billion market opportunity. We've established SentinelOne as a clear technology leader in cybersecurity.

Our relentless focus on delivering AI-powered innovations to truly unify security data and automation has positioned us at the forefront of the industry. As we enter the new fiscal year, we're accelerating our path towards achieving the rule of 40, driven by durable growth and higher profitability. Now let's dive deeper into the details of our quarterly performance.

We are winning new logos and expanding our footprint across diverse platform categories. Enterprises are choosing the Singularity platform for unified AI native security that provides a single pane of glass in seamless workflow. We firmly believe that cybersecurity shouldn't be complicated. Beyond the Singularity platform's best-in-class efficacy, its intuitive design and operational simplicity are driving stronger customer adoption. Today, our unified platform spans 7 core solution categories, delivering more than 40 different modules designed to solve the most complex use cases, all while providing end-to-end autonomous cybersecurity.

In fiscal '26, our non endpoint solutions surpassed half of our total annual bookings, a clear testament to the diversity and customer outcomes of the Singularity platform. Customers are increasingly consolidating on our platform. In fiscal '26, the percentage of our enterprise customers using 3 or more solutions increased to 65% versus 39% a year ago. Enterprises using 4 or more solutions, more than doubled to 42% versus 19% a year ago. And enterprises using 5 or more solutions, increased to 22% versus 9% a year ago. And for many of the enterprise logos we're adding, this is just the beginning of a long-term expansion journey.

In Q4, our cross-platform adoption drove a record ARR per customer, signifying solid momentum and contributions from our AI data cloud, Wayfinder and endpoint solutions. Customers of all sizes, especially large enterprises are increasingly recognizing singularities architectural advantage. Our Q4 performance clearly demonstrates this momentum. We drove sequentially higher win rates across every market segment, anchored by accelerating gains in the enterprise. Let's look at an enterprise win that exemplifies this.

Internet security giant Cloudflare, the company securing about 40% of all human originated Internet traffic moved to SentinelOne in less than 24 hours, completely uninterrupted. After a rigorous POC, they selected SentinelOne to replace our closest competitor as their security platform of choice, citing our superior technology and ease of use as the deciding factors. This 7-figure deal included endpoint security, Purple and our Wayfinder Elite services. This is a clear testament to our technological edge and the platform value we deliver.

Next, looking at our key growth drivers, Purple is becoming the bedrock of modern security operations, empowering teams to respond faster, accelerate detection and automate investigations. The trajectory of purple adoption continues to outpace our internal expectations, hitting a record attach rate of over 50% on licenses sold in Q4. According to IDC's independent study, Purple user experienced faster threat remediation, 60% lower likelihood of major incidents and an impressive 338% return on investment over just 3 years.

We're seeing strong Purple uptake across both new logos and existing customers. Many of our Purple AI customers are expanding their usage, signifying future growth potential and the value it delivers.

For AI Security, we are benefiting from the accelerating enterprise demand for secure adoption of AI models, agentic workflows and employee AI usage. In Q4, ARR from Prompt Security more than doubled sequentially. In addition to existing customer upsells, we started winning stand-alone AI security deals with Fortune 500 companies. Moreover, we are beginning to win AI security deals from customers of our direct competitors, creating a new strategic entry point to expand our market share and footprint.

There are no serious scalable alternatives to Prompt Security in the market and customers need to adopt AI now. For example, in the past quarter, a Fortune 100 financial services company deployed nearly 100,000 licenses for AI security and governance. Prompt is helping solve complex AI governance and compliance challenges for customers across our industry. In another example, a multinational retail giant deployed Prompt Security to eliminate a visibility black hole surrounding unmonitored employee usage. They chose SentinelOne for quick deployment, visibility and real-time AI security, all while satisfying strict European GDPR requirement.

We also launched Claw security, the industry's first open source security suite to secure emerging autonomous agents like OpenClaw and others. For data solutions, we surpassed $130 million in ARR with growth accelerating sequentially. We are seeing rising demand for our AI SIM as it delivers deeper visibility, real-time detection and autonomous response, all with far more efficient unit economics than legacy alternative.

In Q4, we also launched our new AI native Data Security Posture Management solution, or DSPM, to help customers secure their data and AI workloads. Furthermore, to Observo AI, we now own the data pipeline that powers modern security operations. The market is clearly recognizing this value. We were just named SIM Innovation of the Year in the Cybersecurity Breakthrough Awards. We have now fully integrated Observo AI's data pipeline solution into the Singularity platform. This creates a truly comprehensive data architecture natively unifying petabyte scale ingestion, data pipeline, orchestration and hyperautomation into a single, seamless experience.

For Data Solutions, we signed a multiyear infrastructure partnership with a global hyperscaler. It's part of our expanding alliance, SentinelOne's threat intelligence data now pairs with this company's native threat intelligence services. This shared telemetry model powers our own joint offerings and establishes a highly strategic growth vector for our data business. In addition to taking share from legacy incumbents, our platform is now beginning to serve as the foundational data layer for the world's largest technology innovators.

For Cloud Security, we are seeing strong expansion, especially with our best-of-breed runtime workload capabilities, covering both on-prem and cloud environments. In Q4, our Cloud Security solution surpassed $160 million in ARR as cloud environments expand and AI workloads multiply, the need for robust security is increasing. We are meeting this demand by delivering comprehensive cloud-native detection and response that scales with our customers' infrastructure, simplifying their operations and elevating defenses with our unified platform.

For end point, we achieved double-digit ARR growth in Q4. We continue to outgrow the broader market by delivering the most autonomous endpoint security solution available, combining industry-leading efficacy, performance and user experience. Nearly half of the existing endpoint sector is still using legacy antivirus solutions. We see this as a clear opportunity for continued market share gains.

Our leadership in AI native security is attracting the most advanced technology innovators in the world. In Q4, 1 of the top frontier labs selected a Singularity platform to secure its mission-critical infrastructure and the development of its flagship models. This win underscores that the architects of the AI frontier recognize SentinelOne is the definitive security layer for the future of intelligence.

In the era of AI, securing a highly restricted on-premise environments where true sovereignty is of paramount importance are becoming one of the most strategic growth opportunities. While our competitors have no ability to secure these environments, we saw triple-digit booking growth in the quarter signifying an emerging growth revenue for us. We have the distinct advantage of delivering fully autonomous, high-velocity AI protection, both in the cloud and on-premise. This differentiation was clear in our recent win with one of the largest postal operators globally. The customer signed a 5-year commitment to secure their vast network with SentinelOne. Our ability to deliver specialized on-premise security at scale while meeting the most rigorous government standards was the deciding factor.

In addition, we are seeing strong enterprise interest in Wayfinder Threat services, which crossed $100 million in ARR in Q4 as enterprises race to adopt generative AI, they often lack the blueprint to do so safely. Wayfinder fills that gap by serving as both an implementation arm and a managed supervision layer for AI cybersecurity our Wayfinder AI augmented services deliver immediate time to value by deploying in under 15 minutes and resolving 99% of threats without any customer action required.

Trust is a big factor. We believe that expert human oversight is the way forward to build customer trust when adopting new autonomous technologies. Wayfinder embodies this vision by pairing our AI native platform with elite AI security experts.

As expected, SentinelOne Flex is proving to be a highly effective model for broader platform adoption by simplifying the purchasing process, Flex is driving larger deal sizes, multisolution deployments, and extended commitments. Flex simplifies the path for large-scale platform adoption and secures long-term high-value partnerships. For a platform consolidation win, we secured an 8-figure TCV deal with an iconic global logistics company that standardized on the Singularity platform for unified AI security.

To protect their highly distributed and critical infrastructure, this enterprise consolidated multiple competing vendors on the Singularity platform. SentinelOne was the clear choice to modernize their operations and securely implement AI. Alongside industry-leading efficacy, Singularity platforms intuitive design, unified interface and ease of use are key differentiators that are driving strong platform adoption. We're delivering the only single plane platform on the market capable of being deployed anywhere, which stands in stark contrast to our next-gen peers.

Large enterprises, especially leading innovators are recognizing this. In many cases, securing millions of assets in a single deployment. Our continued upmarket trajectory is driving larger deal sizes and steady retention rates. Lending these premier enterprise logos at scale provides us with a significant, highly durable runway to drive strong growth for years to come. Today, we probably secured nearly 1/5 of the Fortune 500s and hundreds of Global 2000 enterprises.

Our expanding customer base now includes some of the most sophisticated and iconic companies on the planet alongside highly regulated mission-critical infrastructure. From the pioneers building today's frontier AI models to the global category leaders in semiconductors, automotive, aviation, finance, and smartphone giants the world relies on.

In the partner ecosystem, we continue to expand and deepen our engagements. Our partners are a force multiplier, helping expand our reach and scale. We are seeing strong traction driven by increasing platform adoption across AI, data cloud and broader platform solutions. We are increasingly winning at the top end of the market, highlighted by an 8-figure strategic partner win in Q4. This deal provides access to our entire Singularity platform to a flexible deployment schedule. In addition, we are strategically scaling our mid-market adoption by driving operational leverage for our partners.

Our success across the managed security ecosystem is a clear testament to this strategy. In fiscal '16, we achieved over 60% ACV growth with our top 20 MSSP partners and over 75% ACV growth with our top 10 MSSP partners. These partners are rapidly expanding beyond the end point. They're adopting our AI data, cloud and broader platform solutions. Our MSSP partners are standardizing on SentinelOne. Our unique platform architecture delivers the multi-tenancy and remote management capabilities that drive real operational leverage and technology differentiation. This technology advantage translates directly into a dominant competitive position for SentinelOne in the [indiscernible] security ecosystem.

We're also deepening collaboration with hyperscalers by integrating our technology and platform across their cloud marketplaces and AI services. Together, these alliances are enhancing our market presence, and positioning SentinelOne is a trusted partner for enterprises worldwide. In the public sector, we achieved overamp authorization at the high impact level and this opens more public sector opportunities for us in both federal and SLED environments.

Let's shift gears to the broader industry dynamics and why SentinelOne is a distinguished beneficiary for the AI era. There has been a lot of debate about the impact of AI on traditional SaaS business models. While some of these concerns are justified, especially if you're selling an antiquated platform built upon a legacy code base, modern security operations remain mission-critical.

Cybersecurity is an imperative for safe adoption and usage of AI. It is a significant tailwind for SentinelOne, and we're already seeing AI security is the fastest growth category for us today. We are the builders enabling secure AI adoption for builders. Our enterprise success clearly validates this. Our platform and AI models are forged from real-time proprietary threat intelligence data at petabyte scale that is gathered across tens of thousands of organizations and tens of millions of assets globally. That scale, intellectual property and depth of data combined with human insights are a unique competitive moat.

The reality is that cybersecurity is paramount in the age of AI. The market needs reflect this reality. Gartner recently highlighted that AI security is the fastest-growing segment in cybersecurity, expanding over 70%. Security and trust remain the single biggest barrier to enterprise AI adoption in the United States and globally. At SentinelOne, we're helping organizations to move from basic AI systems to true autonomous agenetic action with trust and safety embedded as our guiding principles. We are putting defenders firmly in control of the AI boom delivering the platform tools strategies and services they need to build, secure and benefit from AI.

We are delivering an end-to-end AI native platform that seamlessly delivers security for data infrastructure and run time is a single unified system. We actively partner with invest in and protect the pioneers building today's frontier AI models. Grounded in this ecosystem, we are pushing into the frontier of autonomous agenetic security where AI doesn't only assist humans but also independently detects and stops complex threats in real time.

Reflecting upon the past year, we've delivered strong growth and margin improvement while driving innovations that are shaping the future of cybersecurity with an increasing scale and durable top line growth, we're continuously refining our operating model to be well positioned for the opportunities ahead. We remain laser-focused on our most efficient go-to-market channels while unlocking structural productivity gains by integrating AI throughout our business.

We have always operated with a builder mindset. Looking ahead, we're establishing a stronger SentinelOne that is well positioned to lead in an AI-first security landscape while creating long-term value for our customers, partners and shareholders.

Before I turn the call over to Barry, I'm pleased to welcome Sonalee Parekh to our leadership team. Sonalee is joining SentinelOne as our new Chief Financial Officer. She brings more than 25 years of experience across public software and technology companies. Sonalee has a proven track record of scaling high-growth software platforms, driving financial discipline and overseeing multiproduct strategies. That's an ideal fit to lead the next phase of SentinelOne's financial strategy. delivering growth and profitability. I look forward to our partnership.

I would also like to thank Barry for his leadership and steady hand as interim CFO. He has been a trusted partner, ensuring a seamless transition and leading our finance function.

In closing, I want to take a moment to acknowledge the contributions of all sentinels, the relentless focus, dedication and execution drives our success. And thanks to all our customers, partners and shareholders for their continued support. Our mission to be a force for good remains as important as ever in ensuring AI is also a force for good. Thank you again for joining us today.

With that, I'll hand it over to our Interim CFO, Barry Padgett.

Thank you, Tomer, and thanks, everyone, for joining us today. Let's review the details for Q4, the full fiscal year '26 and our guidance for Q1 and fiscal year '27. As a reminder, all comparisons are year-over-year and financial measures discussed here are non-GAAP unless otherwise noted.

Fiscal year '26 was a transformational year for SentinelOne, highlighted by 2 major financial milestones. Firstly, we scaled the business past $1 billion in revenue, growing 22% year-over-year. Secondly, we achieved full year operating profitability, driving a 600-plus basis point year-over-year improvement to expand our operating margin to 3.5%. Let's review the financial performance of our fourth quarter.

In Q4, our revenue grew 20% year-over-year to $271 million. International markets grew 30% and represented 40% of total revenue, reflecting strong international demand and a growing global footprint. In Q4, our total ARR grew 22%, and we added a record $64 million in net new ARR, which exceeded our expectations. These results were driven by a balanced split between new logo acquisition, and platform adoption by existing customers.

As we continue our strategic shift upmarket, our ARR per customer reached a new company record. We are seeing strong momentum at the top end of the market as our cohort of customers with ARR of $1 million or more grew 20% year-over-year to 153 customers in Q4. Additionally, customers with ARR of $100,000 or more, grew 18% to 1,667. Furthermore, retention rates across our large customers remain strong, underscoring the mission-critical nature of the Singularity platform.

For customers with $100,000 or more in ARR, our gross retention rate was 96% in Q4. Our dollar-based net retention rate for these customers was 109%, driven by these large organizations continuing to adopt the broader platform and consuming multiple products from us. Overall, we are maintaining a balanced split between new logo acquisition and existing customer expansion. Given our scale and relative market share, this focus allows us to increase our market share with significant future expansion potential.

Turning to margins. We maintained a solid gross margin profile in Q4 at 78%, highlighting healthy platform unit economics and scale efficiencies. In Q4, our operating margin was 6%, representing an improvement of 450 basis points year-over-year. We also achieved a net income margin of 9% in the quarter. On a trailing 12-month basis, we delivered a free cash flow margin of 5% and successfully delivered our second full year of positive free cash flow. This is an important milestone that underscores our path towards sustained profitable growth.

We ended the year with a robust balance sheet, including $770 million in cash, cash equivalents and investments and most importantly, no debt. Given our strong balance sheet and confidence in our long-term trajectory, we opportunistically repurchased 6.5 million shares this quarter, bringing the total shares repurchased to $12.2 million in fiscal year '26. We will continue to employ a balanced capital allocation strategy, prioritizing organic investments while returning capital to shareholders.

Turning to our guidance for Q1 and fiscal year '27. As we enter our next chapter of scale and profitability, we are enhancing our guidance framework. In addition to our revenue and operating income outlook, we are providing guidance for earnings per share and some helpful modeling assumptions. We believe this enhanced framework offers a more comprehensive view of the company's earnings growth and cash generation. For the full fiscal year '27, we expect revenue to be between $1.195 billion and $1.205 billion. representing 20% year-over-year growth at the midpoint. For Q1, we expect revenue to be between $276 million and $278 million, representing 21% year-over-year growth at the midpoint.

Our fiscal year '27 revenue outlook also implies a year-over-year improvement in net new ARR. Overall, our outlook is supported by a solid pipeline strategic partnership opportunities and rising contributions from our emerging solutions, including AI, data, cloud, Wayfinder and others. At the same time, we continue to monitor the evolving macroeconomic environment and geopolitical uncertainties, which can still influence deal timing and sales cycles across the industry.

Turning to our profitability metrics. For fiscal '27, we expect operating income to be between $110 million and $120 million, representing an operating margin of 10% at the midpoint. For Q1, we expect operating income to be between $4 million and $6 million, representing an operating margin of 2% at the midpoint. Our strong operating income outlook is driven by increasing operational efficiencies with scale and with cost discipline. We're accelerating toward the rule of 40, mainly led by sustained top line growth and improving profitability.

For full fiscal year '27, we expect fully diluted earnings per share to be between $0.32 and $0.38 per share representing $0.35 at the midpoint. And for Q1, we expect earnings per share to be between $0.01 and $0.02. We expect a non-GAAP tax rate of approximately 17% for fiscal year '27. We expect our weighted average diluted share count to be approximately $345 million for Q1 and $352 million for the full year.

Adjusting for the scheduled tax settlement payments of $40 million for fiscal year '27 disclosed in our January 8-K, we expect our adjusted full year free cash flow margin to closely track our operating margin outlook for fiscal '27. For Q1, we expect adjusted free cash flow margins to be in the low teens, reflecting our standard historical seasonality and strong underlying cash generation. Taking a step back, our technology leadership and competitive position remains strong. We are scaling the business while consistently driving strong operating leverage.

Our investment approach strikes a disciplined balance between capturing long-term growth opportunities and maintaining a responsible, profitable financial profile. This strategy is foundational to scaling SentinelOne into a multibillion-dollar, highly profitable business.

Before closing, I'd like to welcome Sonalee as our new CFO. Her expertise scaling global businesses is a great fit for us. Over the coming weeks, I'll be working closely with Sonalee and our seasoned finance team to ensure a seamless handoff. In summary, we are very well positioned at the intersection of AI, data and cybersecurity, leading the industry into the next era of autonomous security. Security is no longer just a safeguard. It is the strategic enabler of AI innovation. With a strong financial foundation, a highly differentiated platform and a vast market opportunity, we remain firmly committed to maximizing our business potential.

Thank you all for joining us today. We'll now take your questions. Operator, please open up the line.

[Operator Instructions] Our first question comes from Brian Essex at JPMorgan.

Maybe for Tomer. Would love to understand some of the dynamics around the growth that you've had this quarter, particularly in light of the lower sales and marketing growth. What percentage of the deals were partner-led or partner influence and what are the plans for hiring and expectations for productivity as we kind of move through fiscal '27?

Thanks for the question, Brian. We delivered record fourth quarter net new ARR, 6% year-over-year growth and strong -- probably the strongest sequential growth we've had in the last 24 months. It really demonstrates more than anything, execution consistency and solid demand pretty much across the board. I'd say that there wasn't any big change between our business with partners and our business with end customers. We are doing larger deals, and I think that's properly reflected.

Flex is taking, I think, a more pronounced part of our overall bookings. So all in all, I would say the dynamic is 1 that we've seen throughout the quarters and throughout the year. As we look into next year, when we kind of review how we want to focus, I think we're pretty clear that we're on a quest to optimize. So I don't think you're going to see us grow head count in a significant way.

And to really apply that sales productivity, which is reflected in the margin guide is going to get better. And we are clear with our continued upmarket trajectory, we are clear on the need and the desire to do more with our partner base. We are clear about the potential in our partner base. You can see some of the figures with our growth reverse partners, top 10 partners growing 75% year-over-year. Obviously, there's a lot of potential both in our partner base. and with our move to upmarket. So all in all, we plan to do much of the same this year in an improved manner with an optimized sales force.

Our next question comes from John DiFucci at Guggenheim.

Since Brian asked about top line, I'm going to ask about the bottom line. It's just a little confusing like this quarter, and in the first quarter, profit margins are a little lower than I think people were looking for, at least we were. But for the year, they look great. So if you guys just explain that a little bit, maybe, Barry, again, just so we understand what's happening in the model.

Yes, John. On the free cash flow side, we feel pretty comfortable on the cash collection. We've seen a meaningful improvement over the past few years. That being said, I can be a little lumpy just in terms of larger deals and kind of when they fall into a particular quarter. And as they -- those larger deals kind of roll out maybe over months and quarters as opposed to day like smaller deals.

Our next question comes from Meta Marshall at Morgan Stanley.

I guess I just wanted to ask, clearly, a lot of success selling with the 65% of customers having 3 or more solutions. Just how do you kind of in combination with maybe NRR ticking down a hair. Just how are you thinking about just ability to continue to add new -- further adoption of new products into the base?

Absolutely. We definitely think that this is a source for additional growth for us. we're very stable on the NRR front. I think the biggest thing I would call out there is that actually, for us, means that we're doing more new logo business which is exactly what we want to see, and we've kind of executed that strategy for the last few years. It's not going to change this year. So we're really driving those in tandem. And what you can see is that not only we're creating more and more adoption within our customer base, even with that, our customer is still relatively underpenetrated.

We got tremendous capability. Our platform is incredibly broad. And that just means that for a lot of the new logos that we're just starting the journey with the expansion opportunity is really in the future, which is great, which really means that we can continue and onboard new customers. And then with time, we yield more and more from the customer base. That's exactly the dynamic we want to see. That's exactly what's expected in these results.

Our next question comes from Brad Zelnick at Deutsche Bank.

This is Nasr Islam on for Brad Zelnick. So we've heard from you, Tim and your peers in recent quarters of the importance of endpoint security, especially in the Gen AI era. Can you provide an update on how endpoint progressed in the quarter? And any changes in the competitive landscape that you're seeing, if any?

Of course. Endpoint still remains a strong, strong growth driver for us. We grew double digit, and that is nontrivial in the market today. We're still gaining share in endpoint. And there's still a lot to go after in terms of incumbent providers. It's clear that the best control point right now for Gen AI is actually attached to those same end points. So when you look at us selling AI security, I think the success we're seeing there is pretty much tied to our ability to deploy that within minutes, sometimes on those exact same endpoints, whether our agent is already there or not our ability to continue and extend our endpoint footprint is what makes our AI security product incredibly successful.

So all in all, not only you're gaining the best and the most complete telemetry from the endpoint today. It's also becoming probably one of the only true control points to regulate what employees, what the workforce is doing with generative block it, sanitize it, make sure there's no data leakage, put the right card rails, and that's exactly what we're doing with our AI security platform and with Prompt security specifically.

Our next question comes from Shrenik Kothari at Baird.

So Tomer, you brought in Sonalee. As she steps in, what are the top, say, 3 -- 2 to 3 priorities you explicitly asked her to or will ask her to focus on first? And then just related to actually, how should [indiscernible] think about the next phase of the model under her.

Of course, thank you for the question. I think clearly, we're incredibly excited to have Sonalee and her focus is going to be durable growth and acceleration in our go-to-market. I think what we're seeing right now is, I would say, growing demand for our platform with multiple avenues for growth. We've talked about AI security, that's growing triple digit. We've talked about on-premise, which is a new avenue for growth for us, now growing triple digit as well and infrastructure deals that are also growing triple digits.

So obviously, our job is going to be to balance that with continuing and improving and honing in on our entire go-to-market and sales and marketing expense. There is no surprise here that as we look into next year in the coming year, the landscape is changing in terms of what customers are looking for. And it's very clear that we have some of the most unique solutions right now for some of the most urgent problems in the market. So as we look at this year, a lot about realigning, a lot of our resources to go after these opportunities as we improve our business. You can see some of that already reflected in our operating margin. This is the trajectory we're on. We're accelerating our path to even better profitability, we're optimizing on cash flow. I think these are the things that we will collectively be focused on.

Our next question comes from Patrick Colville at Scotiabank.

Tom, let me ask this one to you. I mean, nice reacceleration in new ARR this quarter you kind of gave us, let's talk, breadcrumb that you're expecting a year-on-year improvement in new ARR in fiscal '27. So I guess, 2 poles. One is can you just unpack that last bit a little bit more to provide any more color. And then the -- what would be the driver of that? Is it kind of core endpoint to your point earlier, that there's like the [ NASA ] spend on endpoint? Or is it that plus these emerging products and the kind of multiple tailwinds coming together in fiscal '27?

Yes. Let me try and unpack that. And I think that obviously, that's exactly what we want to see. We want to improve net new ARR. You've seen a little bit of that in Q4, but I think that's what we're looking at for this coming year. I think on top of that, we're also starting to see a seasonality change.

We're really -- we're moving from this 40-60 first half, second half dynamic we've had in the past couple of years, more to roughly kind of 50-50. So that obviously means that the first half of the year is very solid. And obviously, that has a positive impact on growth for the year for both revenue and ARR. So these are some of the dynamics that we're seeing there. Some of it is coming from end point.

I wouldn't call it the full renaissance, to be honest. But there is definitely more traction in endpoint. I think if you're seeing some of our businesses kind of crossing the $100 million ARR mark and still accelerating in a pretty significant way. Those are kind of our sources both added revenue growth and added ARR growth. So all in all, we believe that an improved net new ARR, that's kind of a good starting point for us is our revenue guide.

Our next question comes from Richard Poland at Wells Fargo.

I guess, just on the gross margin side, I've noticed that gross margin ticked down a little bit in the quarter, but I think it was a -- maybe a touch better than expectations. As we look forward to next year, could we see that start to stabilize or pick up? Or just kind of anything underlying there that we should think about?

Yes, of course. I would say our gross margins are incredibly stable. They're also best in industry, so they're incredibly high. We kind of put it exactly at the high end of our range, our long-term targets. So all in all, we feel like they're stable. They're going to continue to be stable. We don't forecast any change in that.

Our next question comes from Mike Cikos at Needham.

Tomer, if I could come back to the prepared comments and the opening script. Great to hear about the 7-figure deal over Cloudflare, displacing your next closest competitor. Can you just discuss that a little bit more as far as how Cloudflare came to you? How the deal came together again, just given their positioning in the software ecosystem that they're thought of as being pretty market leading. And I'd just love to get some more color there.

Of course. It's a combination of obviously the set of capabilities that we have today that through the prepared remarks, I think we've -- we tried really outlining how unique the capabilities that we have today are especially at scale.

So when customers are looking to add and prepare themselves for adopting more generative AI, more AI agents the most advanced ones really need these capabilities now. They can buy over a demo. They can buy over something with the road map. They need something tangible that works today and works at scale and it's proven. And that's exactly what Prompt Security and Purple AI brings to bear. These are already fully deployed, fully scalable products that are covering right now millions of devices, assets globally. So that drives, I think, a lot of demand from customers of all competitors.

And in the case of Cloudflare, I think efficacy was a big deal, the ease of deployment, coverage for systems of all operating systems. These were some of the key things that they wanted to find I think they also wanted to like-minded partner that can move fast with them in AI. And again, as you pointed, despite them being a leading partner for some of our competitors, they've chosen the best technology that they could and doing this at a scale where you need to be completely flawless in your transition to create no interruption. I think that was also a very impressive feat by both teams. And I think that kind of just punctuates the win.

Our next question comes from Shaul Eyal at TD Cowen.

Tomer or Barry, can you talk to us about the sources of operating leverage in margin for fiscal '27 as we think about double-digit for the year?

Sure. Happy to share here. There's a couple of things I think that we're super focused on. Firstly, really sharpening the focus on the highest yielding go-to-market opportunities. So you heard Tom talk about some of the product lines and some of the businesses that are rapidly growing for us, some of them in the triple digits making sure that we really are investing behind those and giving them the oxygen they need.

And then secondly, not necessarily germane just to us, but integrating AI throughout our business and our business operations, and we're seeing meaningful productivity gains across the board, everything from engineering and development to how we serve customers to how we just run the internal organism itself.

Yes. I would just add to that. You've seen us through the past couple of years also taking pretty hard decisions on what not to invest in and what to potentially deprecate and prune away I think these are decisions we're going to continue to make. You've seen us do that with a couple of product lines last year. We don't expect the exact same thing this year. but we are definitely honing in on more areas that we just see higher yield.

So I think it's not going to be far fetched to see us kind of narrowing our focus, at least in go to market, on the most -- not only the most yielding but the most important part of our platform and what's the most important right now for customers. So all in all, we have not grown our head count. We have not inflated our ranks in the past couple of years. That's definitely not going to happen this year. We're definitely finding more and more ways to become more productive with AI. It's already happening. A meaningful amount of the code we generate today is already generated with AI. That has tremendous impact on us.

We're a big R&D shop. We're a big innovation hub, that means that we can build more with less, that we can take products to market faster, that we can iterate and get better outcomes to customers. All of those are going to help us also drive, I think, just benefits to the bottom line as well.

Our next question comes from Roger Boyd at UBS.

Tomer, it looked like it was a pretty strong quarter overall for new customer acquisition. You noted, I think half of new business came from new customers. And against that, you had 50% attach rate of Purple I guess any kind of directional color on what that attach rate looks like with new customers? And to what extent are you finding that Purple is maybe driving some of these new customer wins and really influencing your win rates in areas like endpoint.

Of course. First of all, it's pretty balanced. I mean we're seeing the uptake both from existing customers and new customers. I think we mentioned a couple of earnings calls ago that we've created a new bundle, and we took our complete bundle and made it a complete AI bundle basically adding in some of the Purple AI capabilities, that's definitely creating a nice differentiator for us kind of in the mass market.

So that is driving some of that attach. But at the end of the day, I think it's really clear when you can create 60% faster outcomes when you can have 300% plus return on investment, it becomes almost a no-brainer that if you're using one of these things, you're actually saving money and the economics are actually looking favorable for customers. And that, I think, is the main driver behind the perioral uptake.

We're also, as I've said in the past, we're continuously adding more capabilities to the Purple suite we're adding more and more Agentic capabilities that are completely integrated to the platform. We don't require customers to buy another product or to deploy something else or to build their own agents or we just give them a studio, we're giving them complete integrated AI capabilities. They can turn on with one click of a button. And that's in itself that type of seamlessness, that user experience is resonating in the market.

Our next question comes from Joe Gallo at Jefferies.

It was great to see the $130 million in data ARR. Can you just talk through the sustainability of growth in that business? And then, Tomer, just regarding SIM, how do you think that market evolves in an LL based world? Does it become more or less important? Is there any risk of disruption?

Thank you for the question. Our data business is going to go only one way, which is up, and that is terabytes and terabytes and petabytes of data that we're seeing down our pipeline. There is a very familiar dynamic in the data space, where obviously, the initial land is just a piece of customers' overall data needs. And obviously, they -- when Board our data lake, it's just the starting point for them into how much more they can put into it over the years. We're already starting to see those expansion opportunities OP, we're absolutely seeing more and more demand for data lake capability.

Specifically for SIEM, and I think there's a small nuance here, SIEM, you can think about it as a front end for security operations that you put on top of the data lake. And I would say that certain customers, they won't still that front end, they want those capabilities. But at the same time, what we're seeing more and more is that when we apply some of our Purple suite Agentic operations directly on the data lake, directly on the ingested data. Obviously, now with Observo integrated into it, the ability to now ingest data in real time and apply LMs that are on the backbone of Purple AI to then orchestrate an autonomous operation to us that the future of where cybersecurity is going to go. And I'm saying the future, but it's also happening right now for certain customers.

So I do think that it's really a question about both what models are you going to support for customers. Some customers are going to want more controls, more dashboard, more of that legacy experience, I would call that the SIEM experience. And other customers, these are much more focused on automation, on embedding LLMs, and embedding agented work flows into their data ingestion. It's close as going to be to the point of ingestion. And that to us, again, is almost a new model for cybersecurity that maybe in the course of the next few years, is going to make them something that is less mandatory than it is today. But right now, what we see in the market with both approaches, and we're doing what customers are asking us to do.

Our next question comes from Eric Heath at KeyBanc.

Nice finish to the year. Maybe, Barry, Tomer, could you just speak to the linearity in the quarter that you saw, just given that the DSOs were a little bit higher than they have been in revenue being in line with your guidance?

Yes. I think the revenue beat for us. The entire year was kind of every kind of minimum beats, I would say. Q4 was a little bit more back-end loaded. I think you kind of see that as well reflected. As Barry mentioned, some of the collections kind of came a bit later than we wanted. I mean -- but nothing too dramatic. I think that's the full extent of the dynamic that we've seen.

Otherwise, I think the other saying, obviously, when you're not getting these collections in time, you're just going to show up a bit later. So as to expect for something a bit more healthy, maybe in Q2. And I think, again, I've called out the kind of changing seasonality for us. So that's another dynamic that's going to be at play probably going to look a bit different for us this year in a very positive way, I should say. So these, I think, kind of [indiscernible] the dynamics that we're seeing.

Our next question comes from Adam Tindle at Raymond James.

I just wanted to continue on that last comment there, Tomer, on net new ARR and seasonality. I think you said earlier, 50-50 for first half, second half. And if I'm doing the math right for the full year, you're probably going to be somewhere in the neighborhood of $200 million of net new ARR, correct me if I'm wrong there. But I think that would imply $100-ish million or so in the first half, which would be very strong, I think, up over 20%.

I know it's important with Sonalee coming on. And under prior CFOs, we had kind of early stumbles in terms of relative to expectations and numbers and just wanting to avoid that. You talked on the call about gaining credibility, which you're certainly doing as you're executing. So I wanted to give us a forum to kind of flush out those net new ARR comments so we don't get too far ahead of ourselves for the first half as Sonalee comes on.

Of course. Good questions overall. I would say first, I think you're not wrong on the net ARR number, probably a slight improvement over that. And I think the seasonality is just what we have line of sight to right now and just a very solid start for the year. Once we kind of are able to transact earlier in the year. I mean, you can just do the math of what that means for the rest of the year. And that's really what we're seeing. That's really what's happening. So we're just calling it out. And as I mentioned, just a good starting point for us. So we're starting to maintain that consistency. And I think that should persist. We don't see a reason why it's not.

Our next question comes from Jonathan Ho at William Blair.

I wanted to maybe dig a little bit into Wayfinder. And could you maybe give us a sense of what some of these enhancements like human plus AI capabilities and Intel, how does that allow you to maybe reimagine modern MDR solutions?

Thank you. Great question. And I think that's exactly it. I mean it's really clear that the role of MDR is shifting. If MDR in the past years, what's really manual human work to shift to alerts with the increased automation and autonomous action of our platform. Our MDR analysts and overall service is graduating to be more of a supervision layer, and that's helping us, I think, not only scale but also achieve much better outcomes customers. And I think more than anything, it's really clear that we all need to still establish a level of trust when we talk about autonomous agents.

Obviously, the margin there is quite big with some of what these autonomous agents are doing. So for us, a good way to control that in a good way to make sure that agents always stay within their guardrail that all autonomous action in critical action is always happening with human supervision, is attaching services like Wayfinder to really monitor these genetic actions that are happening, and we're doing so in a highly scalable way. And once again, that's something that really resonates with customers.

Right now with us, they can actually onboard a genetic workflows and have humans regulate that. And that's a big thing. We're not just offering them a piece of technology, we're offering them complete managed supervision of their security stack.

Our next question comes from Ittai Kidron at Oppenheimer & Co.

A couple for me, maybe one for you, Tomer and one for you, Barry. Tomer on your side. Clearly, you have a very broad portfolio at this point, and it's nice to see the traction there. Can you talk about how the comp plan for quotas for salespeople is changing because of that? And what are you incentivizing and how to get salespeople focus on the right thing.

And then for you, Barry, with your initial guide for fiscal '27 and kind of going back to the previous questions. In what way are you more conservative? Or in what way is your guidance philosophy right now for '27 different from the exercise you guys went through in '26.

Thank you for the questions. Comp plans haven't changed in a dramatic way. I just want to remind everybody that we always had this component that we call emerging products, and we're just changing what we put in that basket. Those will be emerging products. And we like the behavior that we're seeing. We also see some natural affinity to what customers are asking for, and we're making sure that we're aligning that basket of emerging products. reflect what is happening right now in the market and what we believe are the best products that obviously are the best fit what customers are trying to solve right now.

You're not going to be surprised that you find things there like AI security, you're not going to be surprised that data is still there. So obviously, that is a great tool for us has been and will continue to be to just drive people in the right direction and in where the market is currently showing the most demand.

And I think just to your question on sort of guidance overall, I think this is the right starting point for the year. We're really comfortable with the guide. And if you look at the things that are supporting it, it's really a few things, solid pipeline, strategic partnership opportunities. We've been talking a lot about the rising contribution of our emerging solutions, AI, data, cloud, Wayfinder, others. So we feel like we're at the right spot.

We have no further questions at this time. I will turn the call back over to Tomer Weingarten for closing remarks.

Thank you all for joining us today, and talk to you next quarter.

Hello and welcome to the SentinelOne Q3 FY 2026 Earnings Conference Call. [Operator Instructions] Also, as a reminder, this conference is being recorded today. If you have any objections, please disconnect at this time. I will now turn the call over to Saad Nazir, Head of Investor Relations.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the third quarter of fiscal year 2026, which ended October 31, 2025. With us today are Tomer Weingarten, CEO; and Barbara Larson, CFO. Our press release and an earnings presentation were issued earlier today and are posted on the Investor Relations section of our website. This call and accompanying slides are being broadcast live via webcast, and a replay will be available on our website after the call.

Before we begin, I would like to remind you that during today's call, we will be making forward-looking statements about financial performance and future events, including our guidance for the fiscal fourth quarter and full fiscal year 2026 as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual results or events could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our quarterly reports on Form 10-Q and our annual reports on Form 10-K.

These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons why actual results may differ materially from those anticipated even if new information becomes available in the future.

During this call, we will discuss non-GAAP financial measures, unless otherwise noted. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our earnings presentation. These non-GAAP measures are not intended to be a substitute for our GAAP results. Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges, gains on strategic investments and income tax provision, which cannot be determined at this time and are therefore not reconciled in today's press release.

With that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fiscal third quarter earnings call. Q3 was another strong quarter for SentinelOne. We exceeded our top and bottom line expectations, demonstrating durable growth and continued operating leverage. Our ARR grew 23% year-over-year, driven by continued momentum in new business generation and expansion with existing accounts and adoption of our emerging platform solutions. Our operating margin reached a new high in Q3 underscoring continued operating leverage and increasing efficiencies across the business. We've put the company on a path towards sustainable profitability, both on a quarterly and annual basis. an incredible milestone, demonstrating our commitment to profitability.

Overall, our Q3 results highlight steady execution, continued business momentum and strong demand for our differentiated AI-driven singularity platform. We're expanding our market share and gaining traction among the most important domains in cybersecurity, and we're well positioned to lead in both AI for security and security for AI helping organizations advance their digital transformations securely and intelligently.

Let's dive deeper into our customer success and platform momentum. We're winning new logos and expanding our footprint across enterprises of all sizes and industries globally as AI reshapes how businesses operate Companies are turning to SentinelOne for a unique platform experience that combines AI, data and security. The best security is not complex. It simplifies operations and provides a great user experience. And onside industry-leading efficacy, Singularity's intuitive platform, modern interface and ease of use are key differentiators that are driving strong platform adoption. Our emerging platform solutions continue to scale and achieve outsized growth. In Q3, our non endpoint solutions represented approximately half of quarterly bookings underscoring the growth, diversity and expanding value of our platform. In addition, our ARR per customer reached a new company record in the quarter. This was primarily driven by strong contributions our data, purple AI and cloud security solutions.

Let me share more details starting with Purple AI. Purple growth continues to exceed our expectations and achieved a record attach rate that surpassed 40% of licenses sold in Q3. Proposed growth is being driven by strong adoption from both new customers and existing customers. It's becoming a cornerstone of modern security operations, enabling analysts to automate investigations, accelerate detection and strengthen response, reaching this level of adoption so rapidly is a rare feat. At OneCon 2025, we unveiled the next generation of Purple's Agentic AI capabilities, amplifying its ability to try us and remediate threats autonomously in real time. It is a true step towards autonomous security operations, where humans and AI work together seamlessly.

Q3 was also a standout quarter for Data Solutions, bookings growth accelerated to driven digits year-over-year, and we're seeing growing demand for our AI SIM solution. We're delivering an industry-leading AI native security data analytics offering that delivers deeper visibility, real-time detection, faster investigations and autonomous response all with more efficient economics and lower cost for customers. And through the acquisition of Observo AI, we now own the data pipeline that powers modern security operations from data telemetry to AI-driven analytics and response. I'll share more on this later.

Q3 also marked our strongest quarter for cloud security bookings growth in the last 12 months signifying rising demand for our comprehensive CWS and CNAPP offerings as cloud environments grow, and AI workloads multiply so does the need for security. We're delivering comprehensive cloud-native protection that scales with our customers' infrastructure. It simplifies operations and fortifies defenses through a unified AI-powered security platform. In endpoint, we continue to outgrow the market by delivering industry-leading efficacy, performance and user experience. Customers need a platform that brings simplicity, intelligence and best-in-class security in a single unified offering. Our growth leadership and innovation in the endpoint market are the foundation for further expanding the singularity platform scope. For instance, our endpoint advantage is enabling us to seamlessly enter the data loss protection space, delivering integrated DLP directly from the agent without requiring additional dependencies.

On SentinelOne Flex, we're seeing strong momentum as customers adopt the singularity platform dynamically, though early, Flex is already helping us secure larger multi-solution deals and longer-term customer commitments. Enterprises need security that combines simplicity, intelligence and dependable protection. Singularity provides that balance, enabling faster response, streamlined operations and stronger defense across the enterprise. We're seeing strong traction with large global enterprises driven by improved win rates and deeper expansion across existing accounts, which reflects our technology advantage and platform value. And our results clearly underscores our strong competitive position and growing product differentiation.

Let's look at a few customer wins from the quarter that exemplify this for data solutions, a global hospitality brand adopted AI SIEM to replace its legacy Splunk deployment. The customer consolidated on our AI native platform for its superior performance and user experience. The competitive replacement demonstrates the growing traction of our AI SIEM. More and more enterprises are selecting SentinelOne to modernize security operations and efficiency. For cloud security, a SentinelOne Flex deal, a global consumer products company signed a multimillion dollar deal with a 5-year contract to secure tens of thousands of cloud assets with Singularity. The customer chose SentinelOne for its unified AI-driven cloud security. And by leveraging Flex, the enterprise can dynamically adapt our platform solutions as their needs evolve. It shows both the value of singularity cloud and the flexibility of the Flex model. In federal, a major U.S. federal agency significantly broadened its deployment across the Singularity platform by adding broader platform solutions, including Purple AI, cloud security and threat services. This multiyear 8-figure commitment reflects deep trust built over time and our traction in the public sector. Organizations in highly complex and sensitive environments are choosing SentinelOne to simplify operations and drive efficiency at scale.

Lastly, one of the biggest deals in the quarter was with a Fortune 500 brand, securing hundreds of thousands of endpoints and expanding into new solutions. This customer, like many others, consolidated multiple point solutions onto our Singularity platform for better security outcomes and experience. It's a great example of how large enterprises are simplifying their security operations and standardizing on singularity for unified AI native to protection at scale. These wins highlight our growing traction with large enterprises in continued upmarket success. They also reinforced the industry's recognition reflected in the 2025 IDC Marketscape which named SentinelOne, a leader in worldwide XDR software.

On the partner ecosystem front, we continue to expand and deepen our engagements. Our partners are a force multiplier, helping expand our reach and scale. We're seeing strong traction driven by increasing platform adoption across AI SIEM, Purple AI, CNAPP and broader platform solutions. We're strategically scaling adoption in the mid-market while driving operational leverage for partners. As an example, we expanded the scope of partnerships with NinjaOne and Pax8 in the third quarter. Among hyperscalers, we deepened collaboration with AWS and Google Cloud, integrating our technology and platform across their cloud marketplaces in AI services. Together, these alliances are enhancing market presence and positioning SentinelOne is a trusted partner for enterprises worldwide.

Now let's turn into the innovation engine that's fueling our growth. We're helping organizations master 2 disciplines at once, AI for security and security for AI so they can innovate with confidence. We're putting defenders in control the AI era, giving them the tools to build secure and benefit from AI in a simple, fast and secure way. To extend our innovation lead and further differentiate our AI advantage, we acquired Observo AI, the category-defining data streaming platform for AI native telemetry pipeline management.

Let me highlight a few important points on this. Security is, at its heart, a data problem. In legacy rules-based data pipeline platforms simply weren't built for today's ever-growing tax surface and data-intensive security operations. Observo delivers an AI-native real-time telemetry pipeline that ingests, enriches summarizes in routes data across the enterprise before it ever reaches a SIEM or a security data link. Importantly, Observo gives us ownership of the data pipeline that powers motor security operations. This lets us manage the entire flow of security data from ingestion and retention to analytics and response, all within a single unified platform. Combined with the Singularity platform, we can deliver significant platform value by enabling fast and seamless data onboarding into our AI SIEM or any other destination. Security teams struggle with cost, complexity and delays created by increasing bigger volumes, forcing compromises that can reduce visibility, limit protection and slow response. Observo empowers customers to drastically reduce costs, improve detection and act faster. This acquisition accelerates our innovation road map and amplifies our current data offerings where we saw triple-digit bookings growth in Q3.

In addition, for Prompt Security, the response from customers, partners in the broader market has been incredible. Comp addresses an urgent and growing need Nearly every organization is now adopting AI tools. And every CISO we engage with is focused on doing it safely as enterprises accelerate their use of generative AI and Agentic tools, they're looking for real-time visibility, governance and control. Prompts technology is seamless to deploy and frictionless to scale. We're seeing healthy early traction in the field. The sales motion for Prompt aligns naturally with our existing go-to-market framework, both as a cross-sell opportunity among existing customers and there's an entry point for new customers looking to secure AI usage and technologies. Together with our AI 4 security offerings, we are well positioned to secure the full life cycle of AI adoption. We're helping enterprises embrace AI safely and confidently proving that innovation and security can move forward together.

At OneCon, we introduced several major innovations that advance our leadership in AI native security. First, with Gen AI security, powered by Prompt, we're helping enterprises adopt and secure generative AI safely and its scale. Second, we unveiled our new AI ready data pipeline powered by Observo AI, which we believe will transform how organizations collect, process and act on security data in real time. Third, we expanded Purple AI's Agentic capabilities, giving fenders greater autonomy and precision in detection and response. Purple AI is completely integrated across the entire singularity platform and delivers a unique out-of-the-box applied AI experience. Purple's newer capabilities include natural language with hunting a genetic investigations and automated response workflows, driving significant efficiency gains in faster threat remediation for security teams. And we introduced the new Wayfinder Threat Detection and Response suite of managed services, designed to give customers the ultimate human plus AI defends against modern cyber risks. Wayfinder embodies this vision by bringing together SentinelOne's Agentic AI and Google's Threat Intelligence with the most elite threat hunters, analysts and incident responders in the industry. For customers, this means faster detection, smarter response and stronger defenses available 24 hours a day. This is how cybersecurity evolves, humans and AI working side by side, learning from each other and responding in real time.

At SentinelOne, we're helping enterprises build the foundation for modern, intelligent and resilient digital infrastructure. Importantly, this vision is resonating with customers and partners. The response and excitement at OneCon show that our approach is in line with the market needs. The spirit of our innovation announcement at OneCon was well captured by CRN whose article titles stated that SentinelOne partners sheer AI moves for leading the charge on autonomous security. We're laser-focused on delivering true value in tangible outcomes through both AI security and security for AI. As I reflect upon our overall performance, we're continuing to deliver top-tier growth and margin improvement while driving innovations that are shaping the future of cybersecurity. Our technology advantage is clear. We're delivering world-class innovations and leading the industry in AI native cybersecurity. At the same time, we're making tangible progress in building a stronger sales and marketing engine. The last 2 quarters reflect steady improvement in execution and meaningful progress along that journey. As we look ahead, we remain focused on durable and profitable growth this quarter we made tremendous progress towards that goal by putting the company on the path to sustained profitability. I'm incredibly proud of what our teams have accomplished. We're building a stronger, more efficient and more innovative company and leading the way in AI security for the modern enterprise.

Before I turn the call over, I want to address the news of a leadership transition. Barbara Larson will be stepping down as CFO to pursue an opportunity outside the cybersecurity industry. I want to thank Barbara for his leadership and partnership. She has been instrumental in supporting our path to suppressing $1 billion in ARR and in guiding our transition to achieve sustained profitability. We are grateful for Barbara's contributions and wish her the very best in the next chapter of her career. We have initiated a search for our next CFO. Barbara will remain with us through mid-January to ensure a seamless transition upon Barbara's departure, our Chief Growth Officer, Barry Padgett, will serve as interim CFO. Barry is a seasoned executive with more than 25 years of experience in operational leadership at companies like SAP and Stripe. He knows our business intimately and is already a great partner for our finance organization. Barry's leadership will ensure a steady hand as we move forward. Importantly, we have an excellent finance leadership team supporting Barry and ensuring continuity. Our Board and executive leadership are confident in the seamless transition, and our profitable growth strategy remains unchanged.

In closing, I want to take a moment to acknowledge the contributions of all Sentinels for another solid quarter their relentless focus, dedication and execution drives our success. And thanks to all of our customers, partners and shareholders for their continued support. Our mission to be a force for good remains unwavering. Thank you again for joining us today.

With that, I'll hand it over to our CFO, Barbara Larson.

Thank you, Tomer, and thanks, everyone, for joining us today. Let's review the details of our Q3 financial performance and our guidance for Q4 and fiscal year '26. As a reminder, all comparisons are year-over-year and financial measures discussed here are non-GAAP unless otherwise noted.

In Q3, we outperformed our guidance on both top and bottom line metrics. Our total ARR grew 23% and we added net new ARR of $54 million in the quarter, which exceeded our expectations. This outperformance was driven by broad-based momentum across both new customer wins and existing customer platform expansion. We're gaining market share and mind share across our platform solutions notably AI, data and cloud. These results reflect steady execution and healthy demand across the business. In Q3, revenue grew 23% year-over-year to $259 million. International markets grew 34% and represented 40% of total revenue, reflecting balanced growth and an expanding global footprint. Customers with ARR of $100,000 or more grew 20% to $1,572. Our ARR per customer reached a new company record, highlighting our broader platform adoption and increase in average deal sizes. This reflects the value our customers realize from our platform and our continued success in driving multiproduct expansion. Our net retention rate remained strong and well into expansionary territory, driven by customer adoption of our broader platform solutions, including AI, data, cloud and others.

Turning to margins. We maintained an industry-leading gross margin of 79%, highlighting healthy platform unit economics. We also achieved operating profitability of 7% in the quarter, with operating margin improving by nearly 1,200 basis points year-over-year. We also benefited from the timing of expenses as some spending shifted to Q4. We achieved sustained quarterly operating profitability, a significant milestone toward long-term profitable growth, and we remain on track to deliver our first full year of operating profit this fiscal year. We also achieved our highest quarterly net income margin, which increased to 10% in Q3, significantly higher from breakeven in the prior year quarter. I'm excited to share that Q3 also marks an inflection point for sustainable quarterly free cash flow margin. We achieved a free cash flow margin of 6% in Q3 and remain firmly on track to deliver our second consecutive full year of positive free cash flow margin. Another key milestone that underscores our path towards profitable growth. Complementing this strong performance, our remaining performance obligations grew 35% in Q3, reflecting growth acceleration on both the sequential and a year-over-year basis. Our total RPO reached $1.3 billion in Q3, a clear validation of the trust we've established with our customers and our commitment to innovation.

From a capital allocation standpoint, our strong balance sheet and improving margin profile provide the flexibility to allocate capital strategically, fueling growth initiatives while driving long-term value creation. In line with this strategy, we extended our technology leadership with the acquisition of Observo AI, a leader among real-time data pipeline companies. This is a strategic deal benefiting SentinelOne's competitive position while enhancing value for our customers and partners. Observo's technology is highly complementary to our data solutions and the singularity platform. The best security starts with clear visibility and Observo enhances that by enabling data to flow instantly into our singularity data lake. This seamless integration delivers unified AI-driven security and moves us one step closer to achieving truly autonomous security operations. The purchase price for Observo AI was approximately $225 million. We expect the top line financial impact of the transaction to be minimal in fiscal year '26 with immaterial ARR and revenue contribution and an estimated 60 basis point impact to our full year operating margin. We finalized and closed both the Observo AI and Prompt Security transactions in Q3.

Turning to our guidance for Q4 and fiscal year '26. For fiscal year '26, we expect revenue to be approximately $1.001 billion, representing 22% year-over-year growth and increasing the midpoint of our prior guidance range by $1 million. For Q4, we expect revenue of approximately $271 million, which represents 20% year-over-year growth. This outlook is supported by a healthy pipeline, continued customer and partner momentum and growing contributions from our emerging products. Cybersecurity remains a top priority across the industries, and this is reflected in the strong demand we're seeing for the singularity platform. As always, we continue to monitor the macro environment which can influence deal timing and sales cycles.

Turning to our outlook for margins. For the full year, we expect gross margin to be approximately 78.5%, and for Q4, we expect gross margin to be approximately 77.5%. Our guidance for gross margin also incorporates strategic investments in cloud infrastructure and capacity expansion. This is a reflection of our growing global scale and platform diversification. For the full year, we now expect operating margin to slightly exceed 3%. This indicates an overall operating margin improvement of more than 600 basis points compared to fiscal year '25. And for Q4, we expect our operating margin to be approximately 5%, representing a year-over-year improvement of about 400 basis points. Our full year operating margin outlook absorbs a combined 130 basis points of impact from the Prompt and Observo acquisitions, and an additional 120 basis points from FX-related headwinds we've seen this year. Adjusting for these macro and strategic factors, our guidance implies meaningful outperformance compared to the initial operating margin guidance provided in March. Importantly, we are reaffirming our commitment to delivering positive free cash flow for the full year which we expect to be a few points higher than operating margin. Taking a step back, our momentum, technology leadership and competitive position remains strong. and we are delivering top-tier growth at scale with continued operating leverage. Our investment approach strikes a thoughtful balance between maximizing long-term growth opportunities and maintaining a strong, responsible and profitable financial profile.

In summary, we're executing on our strategy with focus and discipline, delivering strong growth, improving profitability and continuing to invest in the priorities that will shape our long-term success. With a solid financial foundation, a differentiated AI-powered platform and a large and growing market opportunity, we're confident in our ability to drive sustainable, profitable growth and create long-term value for our shareholders.

Before we turn to Q&A, I would like to briefly address my upcoming transition. It's been a privilege to serve as CFO of SentinelOne during such a pivotal time. I'm incredibly proud of what we've accomplished together, scaling the business to over $1 billion in ARR and achieving sustainable profitability. I remain a strong believer in SentinelOne's bright future. With its differentiated AI-powered platform and a massive market opportunity ahead, I believe SentinelOne is uniquely positioned for profitable growth and long-term success. I want to thank Tomer for his trust and partnership and the entire SentinelOne team for their hard work. Over the coming weeks, my full focus will be on ensuring a seamless transition. I will be working closely with Barry and our seasoned finance leadership team to ensure a smooth handoff. I leave with full confidence in the company's financial foundation and its future success. Thank you all for joining us today.

We'll now take your questions. Operator, please open up the line.

[Operator Instructions] Our first question will come from Saket Kalia with Barclays.

Okay. Great. Barbara congrats on your next phase.

Thanks, Saket.

Tomer, maybe for you, it's great to hear that half of the bookings are now coming from outside endpoint. Can you just maybe talk about which products outside of endpoint are kind of becoming the most material from a new business perspective? And to what extent is Flex enabling that? .

Thanks for the question. First and foremost, Data Solutions. That accelerated for us to triple digit year-over-year growth with both new customers and existing customer expansion. So a lot of momentum in kind of the semi replacement space. And obviously, with the acquisition of Observo, this will continue and remove friction in these transitions and allow us to onboard more and more data into our data analytics platform. The second contributor is Purple AI with no surprise, it's about 40% attached, which is a new record for us. This is only for the base capability. That really validates our applied AI approach baked in directly into every part of the platform. And that, we believe, delivers true customer value and inefficiency gains. And obviously, when you think about Flex, that is what's allowing these customers now to have the freedom to consume every part of SentinelOne platform. So that is also a catalyst, and we're seeing that come up online for us in a pretty nice way. So the platform goes wider, and Flex that consumption across the board. And we believe that these are going to be the modules for us going to carry growth for years to come.

Our next question will come from John DiFucci with Guggenheim. .

Listen, team, this looks like a good strong quarter here, and it's really nice to see that free cash flow, but guide was just a little lighter than we were looking for. I think the Street was looking for. Is there anything to read into that? I only half jokingly asked whether it's because Barry is going to be less focused on growth next quarter in his new role. And just trying to trying to figure that out. And I guess, at Barbara, we'll miss you here. And it's -- SentinelOne has become pretty consistent here since you've been there, and I think people are starting to understand showed the way your cadence has worked out here. But is there anything other than an opportunity outside of cyber that you can say?

Yes. Well, let me first cover the guidance, which I think you're specifically talking about the revenue outlook. So Q4 revenue outlook reflects steady momentum in the business. It's supported by a healthy pipeline, continued momentum with customers and partners and growing contributions from our emerging products. As you know, Q4 is seasonally the largest quarter of the year. So things like deal timing in-quarter linearity can influence quarterly revenue. We believe that's a prudent approach to take given that the macro environment continues to be dynamic. And then just zooming out from a full year perspective, our FY '26 revenue guidance implies an improvement of $1 million compared to the midpoint of our prior guidance. Again, steady execution and business limit time. .

And then on your second question, this is just really a personal decision for me, you can owe time opportunities, but it was an opportunity for me that comes in a space that I'm deeply passionate about helping SentinelOne surpass $1 billion in ARR, reach non-GAAP profitability has been a really important milestone for me personally. I just want to be clear, that decision is entirely independent of SentinelOne's outlook. We've built a really strong foundation, achieved profitability, have solid momentum. That's clear by our Q3 outperformance and outlook for FY '26. And I'll just say, I care deeply about the SentinelOne team, which is why I'm committed to staying through mid-January and help Barry and the team with the seamless handover. So thanks for the questions, John.

Your next question will come from Brian Essex with JPMorgan.

Barbara graduations from me as well. I guess maybe to piggyback on John's question, could we -- could you touch on gross margin and it looks like the guide calls for a little bit of sequential gross margin compression. Just would love to get your puts and takes on the drivers of that? What's -- what you see in the pricing environment and maybe with the longer-term outlook, how that may or may not have changed after what you've seen this quarter?

Yes. Thanks for the question. So Q3, we delivered industry-leading gross margins of 79%. We expect to sustain gross margin at the high 70s level. In terms of the puts and takes, our Q4 guide includes strategic investments in cloud infrastructure and capacity expansion. This is really just a reflection of growing global scale and platform diversification. For example, just this week, we announced that singularity platform is now GA on Google Cloud and Saudi Arabia. So you can see the traction we're having in international markets.

Your next question will come from Brad Zelnick with Deutsche Bank.

This is [indiscernible] for Brad Zelnick. Tomer, nice quarter on both the new business and the margin front. As you evaluate the breadth of products in the Singularity platform, do you see the need to add further functionality perhaps through further M&A? And relatedly, what are the guardrails of M&A as you balance both profitability?

We believe we have a pretty complete platform. I think if you kind of look at the sum total of our old -- all the capabilities we have, it's incredibly competitive in the market. There aren't many type of providers that have the breadth and depth of capabilities that we have. We made these 2 acquisitions in areas that we believe are incredibly strategic, not only for now, but also for the future opportunity in cybersecurity. So as we look at our platform capability set today, we don't envision any big missing pieces. We're going to remain opportunistic. But at the same time, we don't change our philosophy around M&A. And we have a substantial part of our platform built in-house. We're going to continue and invest in innovation in-house. And in the areas where we believe there is both opportunity and a strategic gap we might hope to acquire. But again, nothing impending, and we believe our platform is incredibly competitive at this point.

Your next question will come from Meta Marshall with Morgan Stanley.

Great. Maybe just in terms of -- you kind of noted improvement in execution and just kind of traction with the Flex deal. Just wondering if you could kind of give more details in terms of where you're seeing kind of that strength and with both Flex and with kind of improved execution.

Sure. Definitely, steady execution, a lot of platform momentum. Our teams executed above our expectations. And I think what's also clear is our technology advantage is resonating. And at the same time, we're still making tangible progress in building stronger sales and marketing engines, but the last 2 quarters really reflect a steady improvement in execution and meaningful progress along that journey. SentinelOne Flex, there's just a lot of momentum that customers adopt the singularity platform in a more dynamic fashion. And it's still early for us but Flex is already helping us secure larger multi-solution deals and longer-term customer commitments. I think you see some of that true acceleration of RPO as an example. The target is obviously to do more and more larger deals. You can also see that through a record ARR per customer contribution. So the more dynamic licensing capabilities we give to our customers, the more they're going to consume from the platform. So it's enabling our teams to land bigger and with efficiency for us. To us, strategically, Flex again opens the door for customers to experiment and buying more of our platform, and we're seeing that translate into more and more business for us. When you think about these acquisitions that we've done, we think about the new capabilities that we bring online Flex allows customers to immediately consume them as well. So it bodes well for our entire go-to-market motion.

The next question will come from Joseph Gallo with Jefferies.

It was great to see the net new ARR growth the past 2 quarters. Just any commentary on 4Q? And then given you're investing so much in capacity, you're clearly confident on the future. Can we expect net new ARR growth to grow again in the next year? Or how should we think about the glide path of growth into next year?

Joe, thanks for the question. So while we don't provide formal ARR guidance for Q4, we do expect net new ARR to be higher sequentially which would be consistent with what we've seen historically from a seasonality perspective.

Your next question will come from Fatima Boolani with Citi.

Barbara, congratulations on your next adventure. I wanted to drill in on the net new ARR performance. That 1% growth, can you unpack sort of the puts and takes there? And Barbara, maybe if you can help marry that with some of your commentary in the prepared around net retention rates well into the expansion territory. I'm just sort of trying to reconcile the RPO and booking strength versus maybe a little bit more anemic on the net new ARR side.

Thanks for the question. So Q3 net new ARR remained solid. We saw healthy contributions from new customer wins, expansion with existing customers. We also saw record ARR per customer. Really, that's driven by continued adoption of our emerging solutions, AI, data, cloud, so continuing to innovate and execute in this quarter is an evidence that our land and expand strategy is working well, given the momentum we're seeing across our emerging products. And from an NRR perspective, yes, remains in expansionary territory and relatively stable with what we've seen the past few quarters.

The next question will come from Eric Heath with KeyBanc.

Barbara, you mentioned the guide takes some considerations like deal timing and linearity into effect when we talk about Q4. I'm just curious like thus far through the month of November, if linearity was a little bit slower than maybe anticipated. And maybe if there is the sales cycle there possibly getting longer as you introduce Flex steels that are bigger and more strategic in nature?

Yes. I mean I would just comment on 2 factors that I discussed last quarter that are still relevant to Q4. In quarter linearity is one of them that we expect it to be a back-end loaded quarter, especially given the U.S. holidays in November and December and then also lower than initially anticipated services contribution. So as a reminder, services contribute to revenue, but not to ARR.

The next question will come from Jonathan Ho with William Blair.

I just wanted to see if you could give us a little bit of a sense of where we are in terms of AI security adoption and maybe where customers are in terms of that maturity curve adopting some of these new solutions. It sounds like you've had tremendous success. And I just wanted to see maybe what inning we're in, in terms of analogies. Congrats, Barbara.

Thank you.

Well, I mean, obviously, to us, or security is now centered around Prompt Security. The response from customers and partners has just been incredible. It is obviously an urgent and growing need. Every organization adopting AI tools and every CISO we engage with is just focused on doing it in the most safe way possible. The usual generative AI and Agentic is accelerating, as anybody can see and everybody can see. And customers are obviously looking for real-time visibility, governance and controls as they deploy AI workloads. So we're seeing healthy early traction in the field, the sales motion for Prompt, the lines very naturally with our existing go-to-market framework. It's a great augmentation to our endpoint footprint into our AI footprint with Purple. So it's both a great cross-sell opportunity among existing customers and an entry point for new customers looking to secure usage and the technologies that they onboard. So all in all, really great traction right now. pipeline looks promising. And all in all, as you can imagine, everybody is looking for ways to deploy AI workload responsibly and Prompt is just a great answer for that.

The next question will come from Shaul Eyal with TD Cowen.

Tomer, what actions are you taking internally to accelerate net new ARR performance? Maybe how do you guys think about hiring into the new fiscal year? . Congrats, Barbara. .

Yes. I think a lot of what we just discussed, I mean, SentinelOne Flex is allowing us to just drive with more efficiency, customer expansions, obviously, continuously investing in the acquired assets is another strategy for us where we continue and scale these businesses as we integrate them. The other, I think, action that is allowing this is also a very rapid integration into our existing platform capabilities. So all of those just result, I think, in more strategic conversations with customers. It's not just about selling AI security or a pipeline it repositions our entire platform and create more and more competitive differentiation. We were able to come in and fully deliver end-to-end security fully deliver end-to-end data onboarding, data onboarding, data ingestion, data retention in one solution in one unified platform. So as we think about net new ARR that's obviously the #1 imperative, which is land bigger and expand bigger and now we have the capability set and the outcomes to deliver to customers.

The next question will come from Mike Cikos with Needham.

Congrats on the quarter and best of luck to your Barbara. I just wanted to sanity check some of the commentary here and appreciate the consistent messaging on what you guys are communicating on [indiscernible]. But it would be helpful that the margin here with respect to deal timing, macro sales cycles. How did that play out in Q3 versus your expectations? And then to the degree you can elaborate, how was public sector? I know it's a relatively small part of your business, but if that in any way impact how are you thinking about the guidance here as well.

I think that in terms of deal time, I'm just going to echo what Barbara said. The environment, as you can see throughout this entire earning cycle is a bit unpredictable. So for us, we felt to be the most prudent to solve for that, so to speak. With that, we feel very confident in our ability to execute against our Q4 guide. So all in all, we are just trying to create a more measured approach to what we see out there in terms of deal timing. Barbara mentioned, Q4 is our biggest quarter, so there's a lot of business coming in. linearity can change $1 million here or $1 million there, which is the entire gamut of this adjustment. So again, all in all, these are the factors that we're taking into play here as we continue and execute through the year. And obviously, as you can see for the full year guidance, we have taken our guidance up.

As regards to federal business, Q3 was in line with our expectation. Overall, we remain mindful that federal opportunities also in progress at a slower pace due to procurement cycle and budget dynamics. But at the same time, our engagement in the federal vertical remained very strong. with positive demand signals and alignment across our federal high offerings, which span all the way from our endpoint solution and through data in AI. Just this quarter, as we mentioned, we had a meaningful extension with an existing customer. And we've been global relationships advancing the opportunities and solidifying SentinelOne's position as a trusted long-term partner across the entire federal ecosystem.

The next question will come from Shrenik Kothari at Baird.

This is Zack Schneider on for Shrenik. So you noted the minimal revenue and ARR contribution from Observo next year. But just more from a high level, previously, you talked on how it unlocks a multi-hundred million dollar ARR opportunity by really eliminating third-party telemetry dependencies. So just curious to hear sort of what benefits have you seen since the acquisition and just tactically how you're positioning Observo versus private vendors and some platform peers and competitive bake-offs?

This goes back to my commentary around giving a complete end-to-end out-of-the-box functionality, not only Observo brings advanced capabilities to ingest data. It's not just another data pipeline, it's a complete AI data pipeline, which just the pace of onboarding, the level of ease of views that we can provide is already above and beyond everything else in the space. And when you couple that with ultrafast data like we have, you kind of arrive in a world, we have the complete data suite from data pipeline and ingestion to data lake and search and data orchestration and hyperautomation. So think about SentinelOne and AI SIEM and our data solutions is a complete one-stop shop to transition away from your olden legacy stock provider and same provider and into an ultra fast quick-to-deploy type of a solution that's fully AI-enabled. And obviously, if you then take into consideration the amount of automation that we can bring into the picture given we control that real-time streaming element and the data ingestion pipeline then you start to understand the art of the possible with deploying more and more Agentic-based capability to automate more and more of the tasks in cybersecurity, which obviously has been our vision for quite a while now, and that marriage of data ingestion, data processing and data orchestration really starts to produce this vision of the complete autonomous cybersecurity platform, which is where we're going.

The next question will come from Adam Tindle with RJF.

Okay. And best wishes to Barbara. Tomer, I wanted to just mention, you talked about the partner ecosystem and just to be very blunt, a competitor called out a pretty big displacement on their earnings call just earlier this week, and that was a partner that you had ramped just earlier this year. They're indicating that there's more to come after this. Just wanted to sort of give you a forum to respond to some of that comments on defending that and the notion of more displacements to come? And if you could tie that into how you're thinking about forward growth from here, the ability to maintain this 20% growth, which you're guiding to in Q4, that would be helpful.

Sure. I think you're going to have to talk to them. I mean, we still have quite a lot of licenses going with all of our partners. And at the same time, this quarter, specifically we doubled down in a very significant way with 2 of our biggest partners with multiyear commitments. So we have not seen any meaningful disruption from whatever competitor that is. Our partner ecosystem is incredibly robust. I mean we have a lot of partners globally. So I don't know exactly what they were talking about. But at the same time, all I see is growth from our partnership as a whole. As for the next year, I think you can look at our Q4 exit rate is a good indicator. All in all, we have a ton of momentum in the business. At the same time, we're trying to balance the macroeconomic environment and how unpredictable and at times volatile it can be. But all in all, we have a lot of confidence in the momentum we're seeing right now in the traction we're seeing with our solutions. And I think more than anything, the customer reception and how well our solutions resonate versus everything else out there just gives us a lot of hope that this is a few resolutions at the right time and just a great market fit.

The next question will come from Joshua Tilton with Wolfe Research.

Guys, can you hear me?

We can hear you, Josh.

Barbara -- actually, maybe just one is for Tomer. I guess, my question is, there's been a lot of talk and a lot of focus and rightfully so about -- I don't know if it's been more focused on the bottom line or just an emphasis on delivering operating cash flow, free cash flow, just more conversation around profitability this year. And I know it's only in the interim while you guys conduct a search, but I can't help but notice that you're kind of choosing to replace the CFO that seems to have led this -- this profitability vision with someone whose title is growth or growth officer. And my question [Technical Difficulty] reading too much into a title.

You're absolutely reading too much into it. I don't think there was any intend to signal anything. And we'll continue down the same path that we've been executing towards in the past couple of years. I mean you're seeing us consistently expand operating margin year-over-year, and that's going to continue into next year as well. We're striving to achieve the Rule of 40 as fast as we can basically and that is just the way that we look at expansion. And we believe there is obviously more operating leverage in business that we'll continue to extract.

The next question will come from Patrick Colville with Scotiabank.

Tomer, I guess my question is for you, please. When I look at the metric around the proportion of quarterly bookings from emerging products, it's kind of interesting to me that it stayed consistent around 50%. And so I guess that could mean 2 things. It could mean that the core endpoint has like continued to surprise to the upside, and there's still like a decent amount of Trelix, McAfee, et cetera, to go after or it could be that these emerging products have maybe been a bit disappointing versus what we might have hooked. So I guess could you just unpack that metric? And like what is going on behind the scenes? And maybe with a lens towards next year? Like what should we expect next year there?

Sure. I'd say, I mean, to us, it looks like a very balanced contribution. We like it where we are. There is definite potential and continued expansion in the core endpoint space, and we definitely don't want to wave that away. I just mentioned we doubled down with 2 of our biggest endpoint partners. So that obviously shows you that there's more to go after in that core endpoint space. And obviously, we're having a lot of success there. We have one of the best products in the space. But then obviously, a lot of our data solutions, which are high pertinent both for existing customers, but also as we lend in competitive state. Those are strategic to us as well. So we kind of feel like the 50-50 contribution is a good place for us to be as we continue to execute both on the core endpoint opportunity and starting to extract more and more meaningful revenue of throne data analytics from AI. We're also adding more and more capabilities to our endpoint suite. So it's not only about EDR, rating adjacent capabilities to continue and expand in that core footprint. So all in all, we've got multiple growth vectors as we go into next year.

We have no further questions at this time. I will turn the call back to Tomer Weingarten for closing remarks.

Thank you all. Our third quarter results show the solid execution and progress we're making as we scale the business. Customers are increasingly turning to SentinelOne for better security outcomes and value and we're focused on driving durable growth, expanding margins and continuing to deliver the industry's leading AI-powered security. Again, thank you all for joining us today.

Please welcome our CEO and Co-Founder, Tomer Weingarten.

It's always so incredibly exciting to see everybody here and do this every year. I actually want to start by welcoming everybody to OneCon, but I also want to start with thank yous. I want to thank our customers, obviously, I want to thank our partners. I want to thank our teams. There have been so many dedicated Sentinels working day and night to make this possible, the people that build the products, the people that support the products, the people that sell the products, everybody is putting their heart and soul to make this event happen and also, obviously, to fuel the innovation that protects all of us collectively.

So let's give all of you and them a nice round of applause, please. Okay. And yes, this is always a very exciting event. But I don't know, for some reason, it kind of feels even more exciting this year. Maybe it's the smell of GPUs in the air, maybe it's the fresh sound of data center compute cycles. I don't know what it is, but it seems like the future is upon us. It's very clear that this year, with the advancements in AI, we are looking at a whole new landscape. We're looking at a whole new future of possibilities, not only for cybersecurity, but for all of humanity. And sometimes it's exciting, sometimes it's a little bit scary.

I mean, the unknown, the uncertain, it's definitely very interesting to see it where you're on the front row, defending from the bleeding edge use cases of how people leverage AI, both for good and for bad. So there's not like a really great way for me to ease into it. But at the end of the day, cybersecurity has become the single most important factor in the survival of humankind. It's no joke. It's no longer a technical discipline. It's a survival imperative. Humanity's dependence on intelligence and on infrastructure, on systems and on data makes the protection of these systems fundamental to civilization itself. The digital, biological, geopolitical, all of these worlds are merging together, making the security of intelligence and of systems synonymous with the security of life itself.

I'm not exaggerating. This is the meaning of cybersecurity. The question is no longer whether cybersecurity matters, should we do it more? Should we do it less? Is it working? Is it not working? It's really becoming a very simple question. Can we sustain existence without cybersecurity, without mastering the discipline of cybersecurity? And given that the balance of power, the stability of this world will depend on how we govern AI, how we control AI, how we harness AI for our own benefit, for humanity's benefit, it's important for us to always remember that AI's potential mirrors its destructive potential as well. Nation states and individuals alike can easily wield AI for disinformation, for disruption, for creating havoc and mayhem complete digital warfare. We're starting to see that already. You'll hear about it in some of the sessions that you listen to today.

This new arms race is not about weapons. It's about control. It's about control of autonomous intelligence. It's about control of compute, and it's about control of energy. A secure AI future requires global cooperation. It requires all of us bending together and working together to create a different reality. It's about ethical design and it's about resilient architecture. What does the world need most from cybersecurity? We've all been doing cybersecurity for quite a long time now, but it doesn't seem like we're giving all of us that use cybersecurity, both as enterprises and as end consumers, what they need.

So let's try and figure out like what are these things that cybersecurity needs to deliver to make the world a more secure place. Well, the first one might be an easy one, but it's not. Trust, security must be intelligent. It must be autonomous. It should be anticipatory. It cannot be reactive. All of cybersecurity today is entirely reactive. That is a huge problem. It also has to be fully auditable, steerable and transparent, which again, is not the case today. We have a hard time trusting our cybersecurity. Continuity. We all look at cybersecurity today as this force that is there to block the badness and rein us back in, make sure we're not doing things that could eventually lead to a breach or to a compromise.

But in essence, cybersecurity should empower progress, should not restrict it, should not limit it. It should enhance the flow of information and not stop it. And lastly, confidence. The world needs confidence in the systems it uses and the systems it depends on, the ability to move fast, safely and with agility. But there's many, many, many challenges with cybersecurity today. We here wake up every day trying to solve some of the most monumental challenges in cybersecurity. And to get to where we believe the promise of cybersecurity needs to be, we have to overcome these challenges.

And the first one, and I'm sure none of these are going to be very surprising to you, is complexity. Too much data, too little understanding. The volume and diversity of data today is beyond any human comprehension. We got no way to decipher all the data alone. We got no way to make sense of it. We got no way to do it in a manner that actually provides the outcome that we want. The second thing is fragmentation, probably one of the most deeply rooted issues of cybersecurity. Fragmented defenses, where defenses remain siloed. They don't talk to one another. They don't know one another, no idea what each one of these surfaces are doing. Endpoint, cloud, identity, network, all of them are disconnected.

You can put all the data in one nice place. It doesn't mean these surfaces are connected or that they know how to exchange data and exchange insights between them. And lastly, speed, which is one of the most critical ingredients to ever be able to protect any asset in this world. Attackers weaponize AI faster than defenders can adapt. I think this is very, very clear and true to today. Without being able to monitor what's happening right now in this instant and act instantaneously, we will become irrelevant. Cybersecurity will become irrelevant. If cybersecurity continues to be after the fact, it will become completely irrelevant.

Okay. As we think about all these different ingredients and components, I think it's also important to ask what do we need to secure even? I mean, are we securing servers? Are we securing the cloud? So when we kind of wake up in the morning and we think, okay, how do we design our systems? How do we design the systems that we give you, we really try and focus on what are the biggest things that we want to make sure are going to be safe. And the first one is us, people, human identity, protecting who we are and what we do in digital form. And it's no secret that our digital identity is becoming as important, I guess, for some people, even more important than our physical identity. Think about all these influencers. Their identity online is greater than their identity in the physical world.

Eventually, and it's happening today, both identities are going to merge together. We will not have a separate identity. It will be one of the same. So we have to protect that. And then obviously, data, but not data itself, but data integrity. If we can trust that the information that we're consuming is authentic, that it's uncorrupted, that it's not painted, we cannot trust anything that's built on top of that data. So we have to go back to our foundations to make sure that this world is secure. And lastly, intelligence, artificial intelligence, system intelligence, as our dependence grow, we have to make sure that artificial intelligence itself is not being manipulated by any type of bad actor. Truth itself is under attack in the world of today, synthetic identities, deep fakes, misinformation, you name it. It's all happening. And that algorithmic manipulation sometimes blur what's actually real.

Okay. How do we get there? I mean enough with the doom and gloom. Let's do something about it. Let's make sure we can actually live in a safe world for all of us. But we need an entire change of approach, an evolution of approach, if you may. And it's really about the architecture of the future and what we need to build right now, autonomous architectures, streaming architectures, contextual and accountable from reacting to preventing, from this concept of detection and response to, let's say, proactive and predictive from complex to simple and ideally from simple to invisible. This is where security will go. And we're putting some tangible foundations.

You're going to hear a lot today through our innovation sessions of what's coming to the platform that you all use. And that's really important. Why we work on this vision? And I'm actually going to show you a quick sneak peek video on what's coming next, what we've been working on and what we're going to continue to work on. What's going to be important to remember is that we're taking a gradual approach that doesn't only end with a spectacular mode for cybersecurity, but also that infuses capabilities every single day to the console that you use today to the Singularity platform. There's no one big bang where security gets solved. It's all going to be gradual. It's what we need to make sure that we move from this reactive mode of today and into an autonomous mode in the future.

But again, it's not going to happen in one fell swoop. Streaming data, high-frequency ultra-scalable data lakes. What took hours with legacy systems processing data is now taking seconds in high-frequency data lakes like the Singularity data lake. That's a step function change in what you can now do and what you can now create with these types of technologies. And it's very, very meaningful because when data lives within the platform, it really means that artificial security intelligence like Purple can now act immediately, instantly and across all that data, all these entities and all the time. When you can query up to 7 years of history of data and you put all that context into AI, you get a very, very different outcome than just the bolt-on AI, let's query, let's do some NLP type stuff that you're seeing from a lot of others in our space.

To get AI actionable for cybersecurity, it's not enough just to put the data into it. You have to build contextual augmentation, you have to reduce the noise, and you have to enhance the signal. It's not as easy as taking data and putting it into an LLM. It's about building a whole system that creates that outcome, an outcome that is autonomous, but that is also incredibly accurate and is fully auditable. We don't want any system out there that has something that we cannot explain or that we cannot audit or that we cannot trace back. That's a huge imperative to how we build AI systems. So let me show you a quick video. And when I say quick, it's going to be really quick. If you blink, you might miss the interesting bit. We've been trying to balance between exposing what we're working on, but also giving you some understanding of how we're thinking about the problem. And again, I think you'll find it really, really interesting.

[Presentation]

Okay. Yes, I know. I know. I know. It's fast. I know. I know. Look, it was either this or not showing anything. So we opted to give you something. But really, I think when you look at what we're building today and that fusion between humans and AI, I think that's the most interesting bit of all of cybersecurity right now. How do we bring these disciplines together so we can actually create a safe mode of operation for AI without taking away any of the speed. And you'll see some of the components that go into the system are being actually now introduced in the Singularity platform, but I'm not going to steal their thunder. There's going to be a great innovation session later on, and you're going to see what investigations are looking like. So all of this comes with a pretty significant ethical imperative as well. We have to harness AI responsibly.

We can't just put AI and hope for the best or just enjoy the benefits without thinking about the guardrails needed in place. So we have to do it with accountability and supervision. Every AI decision must be explainable, governed and aligned with human intent. So AI is not just this force that goes through tasks, it's actually something that is aligned with what we want to achieve. It's an autonomous system that can act at machine speed, but is always in service of human purpose. And that's hard. Aligning these models to what we want is hard because sometimes we don't even know exactly what we want them to do.

Connecting all these endpoints, these clouds, users, everything together, that's the goal with AI, deciphering through the masses of data and putting it together in one context. That's the adaptive ecosystem that we want to create. And that's why you've seen us go and acquire. You've seen us go and build. You've seen us go and partner to create that adaptive ecosystem. And all of it is for one purpose that you are a part of, securing the human future. The mission of cybersecurity is freedom. It's freedom to innovate, it's freedom to build, it's freedom to thrive. Cybersecurity should protect human potential, not limited. And the measure of success will be a world where humans and machines collaborate safely. That's what we all want, creatively, ethically.

The mission of cybersecurity is not control. It's freedom to ensure that technology remains humanity's greatest ally. And that's our commitment. That's what we're here to do. That's what we have been doing for the past decade. We are here to champion humans. We're here to empower. The world needs security that is invisible yet omnipresent. The world needs security that is intelligent enough to protect without friction. And it has to understand purpose, which is probably the most difficult thing about this entire problem. But we are here, and we're committed to innovation. We're committed to creating this future with you and for you. This is why we wake up every single day. Every single Sentinel knows that this is the mission that we have today, that the technology that we built and are building is doing one of the most critical and important things one can ever do.

So with that, thank you so much. I'll see you through the innovation sessions as well, which will be much more interesting than this one. So thank you so much. Really great to see you all.

All right, folks. Thanks, everyone, for being here. I really want to start with that. Time is our most valuable commodity. You've chosen to spend that with us today. So we just want to say thank you for us here at SentinelOne. So as Eran mentioned, I work inside an organization where we focus exclusively on threat. All we do is bad guys and breaches. No other topic hits our portfolio. And so we really get to spend our time on what are we seeing today and what are we expecting tomorrow. I was initially asked to do kind of the fairly typical conference talk. Let's stand up, let's talk about a year-end review, let's tell you what we saw, pretty safe. So we wanted to be a little bit riskier actually.

We wanted to provide 2 different things. First, we wanted to talk to you about what we think is coming. That's risky because we are often wrong when we do assessments in the Intel business, most folks just call that guessing, but it's Tradecraft and Intel. And the second, we want to give some visibility into how we see the world. We want to be transparent with our customers and partners, so you can make your own assessments based on our world view. So we're going to really focus on 4 major needle movers that we think are going to radically reshape the threat landscape in the next 3 to 5 years. I'll cut to the ending here and tell you what those are going to be. Those are going to be Russia, China, North Korea and AI, but we'll dive into all 4 of those more as we go through.

As we kind of kick off, though, I really want to kind of start with this. This is what intelligence is. I've spent 25 years doing threat intelligence in the military, in the intelligence community and in the private sector. We love to overcomplicate this topic. We love to explain Tradecraft. Don't even get us started on classification markings and sharing. But ultimately, intelligence is really straightforward. Our job is inform decision-makers by providing the right data at the right time in the right format so it can be actioned. That's it. That's all we do when the [ day ] is done for intelligence. So in that spirit, what we will do today is we're going to give you the same thing that we give our executives and our Board. How do we think the world is going to change?

For us, we use that to forecast what capabilities we need. For you, it's no different. How do you secure your businesses not from yesterday, but from what's coming tomorrow. This is really hard, though. I made that sound really, really easy. Where do you focus really comes down to 2 core challenges. And the first is just signal-to-noise ratio. Both of these are going up dramatically. I'll kind of start with the noise first. I won't waste anyone's time. All of our news feeds are full of cyber threat stories. You can see them everywhere you go. It's almost -- it never ends. It just keeps going. But we're also seeing just as much signal, actual real things.

Every single measure in the threat landscape is up and to the right. We see more actors than ever. We see more malware than ever. We see more vulnerabilities than ever. Like there's a trend here, right? Like I could just keep going. Not one trend is going down in the threat landscape. So we see both the increase in signal and noise. And I'll talk a lot this morning about context. I think context really helps us make good decisions. Cybercrime, according to the FBI, has gone up 144% in the last 6 years. Let's compare that with traditional crime. Burglaries are down almost 50%. Drug crimes are down 27%. Homicides are down 15%. Imagine if I stood on this stage and said, we think in the next 6 years, there will be 144% more murders. That's the comparison we have when it comes to cyber threat.

We're not saying that to scare. We're not saying that to spook. We're really saying that as a call to action and how to use this time to prepare for those things. So ultimately, when it comes down to intelligence, we make guesses. We make assessments. This is kind of a typical one. I'm not the first person to stand on a stage and give an example of an assessment gone wrong. But I want to flag this not because it's funny, not because Robert Metcalfe got this wrong, but to show how challenging this business is. For those who might not know Robert Metcalfe, he was the co-creator of the Ethernet. This person knew technology. He's a Turing Award recipient, the highest honor in his field. He has an actual law named after him.

Metcalfe's law dictates the way that modern telecoms work to this day. And this is what he thought the Internet was going to do in 1996. It's easy to get this wrong. It's also easy to stand on stage and kick rocks at other people. I've been doing this business for 25 years. I have been wrong more times than I can count, but that's the job. The job is not to tell you history, it's to tell you what we think is going to happen. In one of my more and more infamous papers, when ransomware was starting to flip over from targeting individuals to corporations, I was asked to author a paper that went to multiple governments, multiple Fortune 500 companies where my assessment was relax. This ransomware thing is not a big deal. It's going to be like DDoS, we'll figure it out and it will just be background noise.

So I don't want to tell you not to listen to me, but let's also add some context. Some of this is going to be us saying what we think and some of that's going to be incorrect. So as we move forward, how do we do that? How do we predict the next 3 to 5 years, knowing we're going to make mistakes. The way that we approach this at SentinelOne is we really do it very similar to the futures market. I'm not a finance person. I'm not a quant. I won't dive really into how this market works. But the model that we use is let's look for the major trends and then let's assume variance, just like the futures market does.

So this is why we're going to talk today about what we think the 4 major trends are going to be, what is going to fundamentally shift the threat landscape versus describe to you what the threat landscape looked like yesterday. As we go through that, there's going to be of the 4, 3 of them that require geopolitical context. I think one of the things that is different at SentinelOne, and we take quite a bit of pride in, we don't just do cyber intelligence. We also do geopolitical intelligence. This is part of what we do. So the 3 events that we think require some scene setting before we dive into the landscape starts with Russia. Multiple governments are assessing that Russia is going to invade a second European country no later than 2030. This is one of these assessments that's actually not that hard to make.

You can actually literally see it from space. We're watching Russia rebuild multiple military bases. At the same time, they are an active armed conflict with Ukraine, and some of these bases are different. Some have more context. This one you see here, this is a Russian military hospital that they're building right on their border. You only build military hospitals on borders when you expect casualties. There is no other purpose for these institutions. So we could talk all day long about why we think Russia is going to invade another country in 2030, but we think this will be the scene setter for 1 of the 4 needle movers that we're going to see, and we'll come back to this. The other part we see is we're watching them do this today.

Literally yesterday in the news, Russian military aircraft were probing European airspace. They've been doing this all year long. This is a typical Russian playbook that they run in advance of intrusions -- sorry, invasions, I should say. The second major needle mover we see is going to be China, Taiwan. I've spent most of my career as a China watcher. I love, love, love China from an intelligence perspective because it's the easiest thing in the world. They do this crazy thing in China where they write down what they're going to do and then they go and do it. They literally follow their plans. They tell you 5 years ahead of time what is going to happen. And then they write another paper that says, here's what we need to adjust, and then they do it again.

Forecasting China is like the simplest thing in all of threat intelligence. Number one on their list is reunification with Taiwan. We've been talking about this as long as I've been doing this. This was here before I showed up. However, we think this is changing right now. We think the China-Taiwan situation is potentially the single most important thing we will deal with from a cyber threat perspective by the end of this decade. And it's based on a few things. Ultimately, it's based on one person. Xi, who runs China, when 2022 was appointed to his third term in the Chinese Communist Party. I won't spend too much time getting deep into Chinese politics. This is a big deal. A big deal there is a third term senior leader. And immediately upon him taking office, he starts going through and making actions for Taiwan.

Within a week of taking over, he officially tasks the Chinese military to have the capability and war plans to invade Taiwan no later than 2027. We're going to come back to that date. That data is really important. We then start to see other things happening. We start to see things like China building up its maritime fleet, not its Navy, it's actual commercial shipping. Why in the world are we talking commercial shipping at SentinelOne's OneCon event. This is how invasions work. There's a great quote that's hundreds of years old now where Napoleon talks about amateurs talk tactics, professionals talk logistics. This is how invasions are fed. This is how invasions are equipped, and we're seeing it in real time.

Again, I would love to say we're really smart, but you can see it from space. Like this is not hard to find and ascertain why this is happening. We also look at other things that are happening that they are forecasting. And in 2027, there are 2 major events that will concur at the same time. First, the Chinese Communist Party will celebrate its 100th year anniversary. They are already planning this being their largest event for 2027. This is going to be a huge deal in China. And Xi is laser-focused on his place in history. He is adamant in carving his name into the rock that is Chinese history. He wants to be viewed on the same page as Mao, and he looks at this 100-year anniversary as his window to do that. Also, he has already declared he has every intention of taking over a fourth term. No Chinese senior leader has ever taken over a fourth term.

And all reporting indicates that he wants to do this because in his fourth term, he can unify China and Taiwan. We are seeing multiple indicators, this long-term topic is likely to come to fruition in the next 2 to 3 years. So this is going to be our second needle mover that requires some geopolitical context. And the third is North Korea. North Korea is the opposite of China. This is the wildcard. They routinely do things both in cyberspace and also in the real world that just surprise us. And the world changes very quickly in North Korea. One of the major events we've seen over the last 10 years is in 2017, North Korea underwent significant international sanctions based on their testing of nuclear weapons and ballistic missiles.

That led to what the world thought was going to be an economic suffocation of North Korea that would force them to move off of their aggressive geopolitical situation. And that's not really what happened. Let's pin 2017 in our minds. I'm going to come back to 2017 here in a few minutes. That's going to be a very important date. So as we fast forward a few years, what we saw was the opposite. North Korea actually became more aggressive. Something happened between 2017 and 2021 that allowed them to not only survive sanctions, but become more emboldened, become more aggressive, and that has been accelerating in the last 8 years. The largest acceleration occurred in 2024. North Korea, for all of its aggression in this world, had always stated publicly they intended to unify with South Korea peacefully, no longer.

In 2024, they said that is not an option, and they believe absolute kinetic warfare is the only way to unify the peninsula, and that is their #1 goal is North Korean regime. We then see this pick up even more speed as 2024 plays out. We see North Korea send tens of thousands of troops to fight in Ukraine along with Russia. This is the first time in decades, North Korea has sent troops abroad. They are able to pay for this. They are able to pull this off, and they are willing to go to a higher level of aggression geopolitically on an international stage. And as we look at that, we also see this recently. In the last 2 months, for the first time in years, North Korea sends representative to the UN and their entire message is we are going to become more aggressive.

They are not going to give up nuclear weapons. They are not going to give up ballistic missiles. They are not going to give up sending their troops somewhere else. So as an international community, we're kind of stuck to say, why are they able to do this? Why are the sanctions not working? And we think that will be the scene setter for our third major needle mover. Before I dive into how we think all of this is going to manifest on the actual cyber threat landscape, I think we owe all of you an explanation on how SentinelOne sees the world. It's great being up on stage talking about politics, but I can't load doctrine into a firewall. I can't take a public statement from the UN and make that go find something on EDR. That's not the way this works.

So let's walk through how SentinelOne converts this and how we see this playing out across the world, and then we'll dive into what we think are going to be the really large landscape shifts in the coming years. The first thing that we talk about is we see the world through you. Our clients are our visibility. This is how we interpret everything that we talk about when we look forward. We have about 14,000 clients in about 80% of the world's countries. We're not in North Korea. They're not a big fan of ours. We don't have a lot of agents deployed in Russia. I don't think anyone would be surprised at the 155 countries that we're in, but this is the space we're at. This is ultimately the highest level view that we have is through your organizations. That manifests one layer down by our access to about 40 million endpoints and about 2.5 exabytes that we can hunt and move across. In essence, this is where we test our theories.

This is how we say, we think the world works this way. Let's go look and verify. I'm not a math guy. My undergrad is an Anthropologie. So millions and trillions and billions confuse me pretty easily. But just to give some context here, if every one of you was a SentinelOne EDR agent, it would take 73,000 rooms to equate how many endpoints we have access to right now. All I know about exabytes is it has 18 zeros. That sounds like a lot. If I converted that to my Spotify playlist, that playlist would be 2.5 billion years long. I'm not saying we know everything. I'm saying we believe we have enough data to make qualified assessments on where the threat landscape is going.

If we take that down one level, it's a difference what we can see versus what we know. How do we test these ideas? And there's our detection engines, there's our hunts. In this case, we just took indicators, it's tangible. We can openly talk about how many things we see, how many groups we are tracking. This is what we apply across the visibility you as our clients provide to us as an organization. But all of this ultimately comes down to outcomes. Outcomes are where we actually get to assess how the landscape is changing and where we are going. And if we look at just some examples here, ransomware, I'll come back to ransomware. It turned out I was super wrong in 2016. We did not solve the ransomware problem in 2016.

In the first 9 months of this year, we have stopped over 1,000 attempts to deploy ransomware actively inside of client environments from more than 65 distinct threat groups. This is now where we start making our assessments. This is really where the rubber meets the road, and we synthesize down that combination of what we can see, what we're testing and then what we know. And that synthesis is really where intelligence comes in. I'll just take one example from our MDR organization. The first 9 months of this year, they triaged about 26 million alerts. Nobody cares. Absolutely, nobody cares how many alerts we looked at. There is no inherent meaning in that. What happens is we synthesize that and crush that down to about 15,000 incidents.

Incidents are where we can make decisions. This is actually what matters. That synthesis is how we talk about intelligence and how we create our world view. So now that we've given a little bit of geopolitical context, we've given a little bit of synthesis and how we see the world, let's dive into what we think these 4 major shifts are going to be across the threat landscape. Number one, let's go back to Russia. We started with Russia. I think it's the first place for us to start. What we look at is if Russia invades a second country inside of Europe, what's that going to look like? We know what happened with Ukraine. So let's start with that. We got to see in 2022 when Russia invaded Ukraine, the first real cyber war.

We've debated this for decades. We've talked about it. We've got papers written. We actually got to see it with our own eyes in 2022. And what Russia did that I think are important for takeaways are 4 things. First, they synchronized their military operations with their cyber operations. They did not view cyber as a silver bullet. They did not view it as stand-alone. They viewed it as part of their overall warfighting capability. Second, they did not just use their nation state programs. They did not just use APT28 and APT29. They leveraged their own inherent organic programs. They leveraged all of the cyber criminals that they have allowed to operate [indiscernible] inside of Russia, they had expectations for them. Those bills came due in Ukraine. So we saw cybercrime as an active component of Russia's push against Ukraine.

And then we saw the exact same thing with hacktivist communities. Russia applied a full spectrum of their overall capabilities against Ukraine. Third thing we saw, and this is one that if you would have been in a conference with us 4 years ago, this is all we would have talked about. We have never really seen destructive cyber, actual destruction on the ground. Any intelligence analyst as recent as 4 years ago could have told you exactly every single time we saw destructive events because there was like 2 of them. Like there just was not that many, so they matter greatly. In the first 6 months of the Ukrainian invasion, we saw 9 distinct destructive tools. And then it became so prevalent, we kind of lost count.

And I would love to tell you we have all these absolute answers. But as an intelligence community, we don't even agree. We kind of threw our hands up at dozens. So the reality of will nation states use destructive cyber? Russia will. They absolutely will. And then the last part, for the first time ever with any country and any conflict, we got to see the endurance of a country. We can talk about intrusions in isolation, but that's what it is. It's a one-off. We actually got to see in Ukraine how long and how deep and how persistent could the Russian cyber efforts be? And the short answer is, yes. Short answer is all of those things. They did not have to stop running intrusions in other parts of the world.

They did not stop innovating, and they were basically daily drivers going after Ukraine day after day after day for 3-plus years in counting. They have the endurance to execute these programs on multiple fronts. We expect all of this will happen when Russia invades a second country in the next 3 to 5 years across Europe. Here's what we think will be different. We have a list across the international community of like the most 2 to 3 likely countries Russia will invade. All of those countries are either part of the EU or are a member of NATO. Those will make the next conflict inherently more complicated. And that will start with Article 5. Article 5 inside of NATO is, in essence, a call for common defense. You attack one NATO country, you attack all NATO countries.

So now this will not be Russia versus Ukraine. This will be Russia versus a country and then all of NATO, EU involvement. This battle space will get incredibly complicated very, very quickly. That's difference number one. Difference number two, Russia has a much broader target surface. Ukraine is not that big. It just really isn't. They will have the ability to go after entire swath of the globe to produce their impacts. That will impact our business. Third, Russia is deeply integrated with the European economy and also Russia struggles with sanctions, both that interdependence will produce impacts and sanctions will produce impacts.

We think that will drive a more immediate extreme reaction from Russia. They will need to have an incredibly severe kickoff versus a 3-year prolonged event. We expect to see a much more widowmaker-like type initial event because they're racing the economic clock. And then fourth, before the Ukraine invasion, no one would have assessed Ukraine as a very cyber-resilient place. That wasn't what any of us had on the scorecard. Ukraine turns out as incredibly cyber resilient. They've impressed whole swaths of the cybersecurity industry. We then compare that with the European countries, on paper, they're far more resilient. They are far more secure. That is likely to be stress tested.

Our entire way we think about resilience is likely going to be stress tested when Russia invades the second country. Ultimately, for our businesses, we think these are what you need to pay attention to. We should expect everything we saw in Ukraine, except it will be applied at, at least, a regional scale, if not a global scale. What is happening to Ukraine now is what we should prepare our businesses to, especially if we work inside of Europe. Second, we should expect an extreme event very early, and then we have to find a way to survive through that. And then these last ones really all kind of go together. It's going to be complicated.

There's going to be multiple countries with their own competing priorities, their own assessments, all having to come together to figure out how to work against this threat. I've been lucky enough in my own time, I've spent some time working with NATO. It's complicated. For any folks that have had to work with allies, the only thing worse than going to war without allies is working with them every single day. Allies are hard, like that's just the reality. Ukraine is simple. It's Russia and Ukraine. And our cybersecurity entire industry is largely supporting Ukraine. That is highly likely to be very different when we have this first needle mover with Russia.

The second needle mover is going to be China. I mentioned how China is the easiest thing in the world. China as an intelligence analyst is also the hardest thing in the world. And here's why. It is almost impossible to talk about the scope and scale of China's cyber program without sounding like a crazy person. Like you just sound like you're making stuff up. You sound like you're saying just crazy stuff that no one can believe. So let's just baseline with one thing. In the last year, we've seen significant media, government and industry reporting on only 2 Chinese cyber groups going after telecoms.

Let's quick refresh. China has dozens of cyber programs that we're aware of. These 2 alone have compromised more than 80 telecoms with access going back at least 12 months. The U.S. government assesses every single U.S. citizen has been impacted in that effort from these 2 groups. And oh, by the way, most of those intrusions go back at least 3 years. This is just a baseline. And the telecom piece is not unique. This is what they do in every industry and have been doing for at least 20 years. This is not a one-off. So when we think about that long-term access, that espionage event, all of a sudden becoming an invasion. Guess what happened? China told us exactly what they're going to do.

They have every intention of using cyber specifically to infect and influence multiple global populations, so countries stay out of the war. They do not want the U.S. involved. They do not want NATO involved. They do not want Japan involved. They do not want Australia involved. So their intention is to use cyber to make the home population so uncomfortable that governments have to stay out of this conflict. We think on our best assessments, this will go on for 18 to 24 months globally. That's how long we think it will take them to accomplish their invasion. That will be a mix of highly targeted attacks against specific places, widespread espionage, just like they're doing now. And then the third bucket, information warfare. We really haven't dealt with this.

Outside of Taiwan and some dissidents and some other areas, we have never really encountered China's information warfare apparatus. We assess it to be significant, and we will now have that problem to deal with along with everything else. If we look at this, what are these likely outcomes going to be? These are the things that we think companies need to be prepared about. You have to assume they already have access. They are spending years and years preparing for this scenario. They are telling us they're preparing for this scenario. They are telling us they will go after water supplies. They will go after trade routes. They will go after ports. They intend to shut down communication. Let's talk about the comms piece alone. Every time there's an AWS outage, I find out because like Roblox is down, my kids can't get on their programs.

And oh, by the way, all of our stuff goes down. That happens for a 2-hour AWS outage. That happens when Azure goes down. Imagine when the intention is to put down massive communication capabilities for weeks to months. We will have to operate our defenses without having all of our capabilities in that. And then also the last couple here, China wants to influence the population. Of all the access China has had and all their intrusions, they have never leaked secrets. Russia has, Iran has, North Korea has, ransomware has. China has access to material that will undoubtedly change the way people look at their governments. They have access to data that will undoubtedly reveal things that we do not know about our own governments, and they have every intention of using that.

So not only will be dealing with intrusions and impacts and information warfare, we will also have to navigate this through. This goes from being a CISO job to like your CMO is now part of this. Your CMO is now going to have to answer questions. Your comms people are going to be involved. So we think about what these mean. We think these are the things that we're looking at. And ultimately -- and this is where Russia -- or this is where China makes it sound inflammatory a little bit. We think this has the potential to be the single most important cyber event we've ever seen. That sounds dramatic, but we think it will be that important. We think if China invades Taiwan, it will be unparalleled across the cyber threat landscape.

Third one is North Korea. I can talk North Korea all day long. I promise I won't. If you've read anything North Korea in the last year, it's been about IT workers. I want to use this as just a quick baseline. We know as an international community, North Korea has 10,000 North Koreans that log in every day and get paid by IT companies to do an actual IT job, like they're actually working and they're actually getting paid because it generates between $400 million to $600 million for the regime. If they're willing to put 10,000 people every day on generating $500 million because they need it, that's important, and we'll come back to why that's important.

Just for some examples here at SentinelOne, we put some research out from our Sentinel Labs team. The first 6 months of this year, we were successful in stopping more than 360 personas apply for more than 1,000 jobs against SentinelOne. They're not interested in SentinelOne. International reporting has this happening at about 6,000 companies where they've actually been hired and their actual employees. I'll kind of point to another session. Tom Hegel is going to give a great talk on how we've gone about this, highly, highly recommended. But this is pennies compared to crypto theft. We have become snowblind to crypto theft from North Korea because it's been happening nonstop since 2017.

Can I tell you definitively, North Korea started stealing cryptocurrency at wholesale because of sanctions? I cannot. I can tell you it started happening 60 days after sanctions went into place. I can tell you they've doubled down on it every single year, and it's gone up 28x since they started in 2017. To rotate the problem a little bit, 2/3 of every cryptocurrency stolen was stolen by the North Koreans. This is how important this is. And if they're willing to put 10,000 people on $500 million, what do we think they're going to put on $2 billion and counting for this year alone. This matters as a needle mover because it just provides huge returns for them. We compare it against traditional crime.

You can see it's not like a 2x, a 4x, it's 1,000x. It's 100x return on their investment. And the bottom line here is the most important part. We know they're doing it. We absolutely know they're doing it. They're being attributed, and it does not impact them at all. So they're just going to keep doing this more. So I mentioned earlier, MetCalfe's law. I'm going to take a swing here at Steve Stone's Law. I'm going to try my own little math formula here. So this is patent pending. No one steal this. It's a $100 bill plus EUR 100 times [ fakeair ] is greater than Bitcoin. That's Steve Stone's law.

And what this really means, when we talk about why North Korea matters and why it will shift the landscape, this has always been a criminal regime. They are so good at crime, the U.S. government and the EU had to completely rebuild the $100 bill and the EUR 100 because they were the top counterfeiters in the world. Oh, by the way, both organizations had to do it twice. This is how persistent they are at generating criminal money for their organization. [ fakeair ], I hope this is the only [ fakeair ] presentation you've ever been in. This is their #1 export. The #1 export out of North Korea is [ fakeair ] at $170 million a year. Their entire GDP is $15 billion a year.

They're generating at least $7 billion in stolen cryptocurrency alone, more than $2 billion this year. They've made more money still in cryptocurrency than 12x their top export of [ fakeair ] and 5x more than their total export list. Oh, by the way, if we just look at their GDP, we assess that their cryptocurrency theft is about 15% of their total GDP. This is how they are funding their regime. This is how they are able to be as aggressive as they are, and this is going to produce 3 major things that we look at. First, they are sinking those gains right back in. They are investing their returns and they're making it work.

That is then allowing them to be very aggressive geopolitically. That will have consequences on a geopolitical stage. Third, at some point, we will likely get to a point, just like it did with counterfeit money, where they are injecting so much doubt into this system that we start questioning the actual system itself. And cryptocurrency is already under doubt. That has the potential to have profound ramifications across the globe. We don't know what that will be. The last part, these guys are really innovative. Like they're using AI to become valid workers. No one saw that coming. The methods they're using is still cryptocurrency are really innovative, and they're just sinking more and more resources back into that.

We really actually don't know what they're going to do next. They are the actual wildcard out there. And then the fourth needle mover that will hit, there's no way we're not going to talk about AI-facilitated malware. I want to kind of level set real quick on where we're actually at today. Let's just talk about 4 quick things. We have LLM created malware, technically feasible. Like it's happening a little bit, but it's not meaningful. We are having LLLM embedded and post-runtime cases. It's real. Mal Terminal's example. Ely will talk about that a little bit later on. We're seeing LLM invocation at a local level, it kind of works a little bit.

And then we're seeing prompt injection and data exfil using AI. This kind of went from 0 to where it's at, say, in about 12 to 18 months, but it's brittle, it takes humans and it's pretty unstable. We don't think that's the forever answer, though. That's where it's at today. If we look forward, we think all 4 of these areas are going to change demonstrably. The first, we think will be the operationalized LLM-assisted payloads. We're probably a year away from that being really common. The offline LLM malware, the only thing keeping that back right now is the packages are too big. Technology always shrinks the packages. We think that, that will be there.

The third one, AI augmented social engineering at scale. The only reason we probably really haven't seen this, we haven't been in the right geopolitical situation yet. This is almost undoubtedly a matter of time. And then the fourth one, the real bogeyman that we all talk about is autonomous chained attacks. This is limited by a couple of things: cost, compute and just more experience. This is not happening today. Although we are seeing multiple governments research it, we are seeing cyber criminals try it. This is inevitable. It will happen.

Our assessments are we're probably 3 to 4 years away from that happening. But we've been talking about the future. This is all heady stuff. It's hard to get our brains around. I want to kind of go back to how we see the world. I want to give you one specific example. How are we actually seeing the world shift on the wire? And I can't think of a better person to walk us through that than Drea London, our Head of Incident Response -- sorry, we've got some slides missing there. I apologize. Drea will come out and walk us through how we're actually seeing Evil AI operate inside of these environments.

Wow, you guys know you're going to wake up and be terrified. First day. That's what we're doing. So I'm going to tell you a story today about a threat that we're seeing, and it's not going to create global cyber warfare, but it might be a little more accessible. It's something that we see rampant right now running around and a lot of customers of ours. So Evil AI is a -- it's a malware family that's basically using AI and efficiency tooling to disguise itself and using the human interest in AI to basically create lures, right? So we know that in the world that we live in today, AI makes us more efficient. It makes us, frankly, not have to work sometimes, right? It makes everything so much easier.

And so that creates an element of trust. So looking at the question of how is AI being used by threat actors today. If you look back to Black Hat last August, I was on stage in our beautiful booth basking in the fact that I have one of those gorgeous booths at Black Hat, all the lights, and I've got Benji and our marketing team asking me all these questions about how are threat actors using AI today? And I get that question a lot, pretty much all the time. And I gave the same answer that I always give to him, which is like, we're really not. Okay? We're really not, not so much. We see them using natural language models in phishing and things like that, making malicious code seem more relevant or reasonable or trusting, but we're really not seeing it day to day.

There's no polymorphic malware running around the universe that we've all been afraid of from publications and things like that. But little did I know that at that exact moment that I was speaking, we were, in fact, experiencing or several customers of ours were experiencing AI being used in a very novel way that we had not seen before. And it's -- again, it's not polymorphic malware, but it is new and interesting and really capitalizes on the human element of AI technology.

So how does the story start? Mid-September, we get a phone call from a customer of ours, a very large customer, one of my favorite customers. I'm sure they're in here somewhere. I can't see any of you with this light. But we get a call. And usually, unless I'm on the phone call trying to sell you something, if I'm on a call or in a room, it's probably not your best day, okay? So I'm on this call. We're evaluating the incident with a customer. And this is a large customer. They have a very sophisticated security team of their own. So they've already been sort of performing their analysis. They're providing us with the information that they've gotten to date. And we recognize that this is something that's quite prolific in their environment. Again, mid-September, we get engaged, DFIR team is on the phone, scoping an incident.

And there were several files that we knew were likely bad. The first one that we reviewed is file -- an installer for an application called JustAskJacky. Now JustAskJacky is an AI assistant. And if you were to install JustAskJacky on your computer, you will be presented with this beautiful little cartoon character [ bluntly ]. I kind of picture here like 1950s, like she can be vacuuming and with her Martini glass at the same time, she can do anything you want. She's here for you. Andrea, I'm here for you. What do you need? What can I do for you? And she does it. And this is the difference from other trojanized malware that we have seen in history is that she is actually completely capable. She does what she's supposed to do and so then she solicits trust in you.

You believe that she is a legitimate application because she is doing what she said she's doing, right? She's answering all your questions. Oh, you want this recipe. Oh, you want me to fix your picture for you, make this more clear. I'm here for you, Andrea. I can do whatever you want. And I can also drink a Martini and vacuum at the same time. She's doing all these things. But in the background, Jacky, is kind of naughty. She's not actually just doing good things. She's running some auto runs and registry key and setting up what will be a large scale global account information stealing campaign. So JustAskJacky is the first piece of software that we start to look at.

We then identify another piece of software appsuite.msi. Okay. This is actually very similar to Jacky, but she's he, she, whoever is written a little bit different, different type of code. appsuite.msi purports that it is a PDF editor. Have you guys ever tried to edit a PDF? Not real fun, but how you want to spend your time, okay? We have evolved, but it's not a good use of your time. So it is not surprising that the population when presented with a beautiful Google ad or a phishing lure that's like, I can help you edit your PDF. You're like, yes, please. Oh, I meant it actually does. It does what it says it's going to do, and therefore, even now you trust it. So appsuite.msi, again, another loader, very similar to Jacky, different purpose, fully effective. This is what is different than trojanized malware that we remember from history, right? Like we look back at Trojan and we think, oh, I remember Excel spreadsheets that were meant to help me be more efficient, it's a Trojan. This is the same type of mentality and purpose that we have seen in history, but using AI and productivity because that is the place that our minds are in today. That's what interests us today.

Interestingly enough on appsuite.msi, so just as Jacky got a clean bill of health from VirusTotal, appsuite did not. Viruses were like, [indiscernible], I don't think so. I think you're a [ pub ]. I don't really like you. I'm going to go ahead and classify you. And the threat actor that created appsuite.msi, frankly, same threat actor that created Jacky, submitted a ticket to VirusTotal. They said, no, no, no, that's a false positive. [ Mine hour ] is safe. That's a bold move. That's not something we see very often. And I don't know if VirusTotal just didn't look at the ticket or didn't care, but they have continued to persist that yes, just kidding. You are, in fact, not good.

But all of this is spread via malvertising campaigns, SEO poisoning, Google ads, phishing lures, very typical strategies that we see in cyber crime today. It is not focused on any industry or segment or geography. It is anyone -- anyone and everyone.

So moving right along. What we've determined after reviewing these 2 pieces of malware is that their actual intention was to deliver TamperedChef, which is an information stealing module within these applications. And it's whole purpose is basically steal cookies, credentials, secrets, whatever it can from the endpoint that it's living upon.

What's super interesting is its life cycle was exactly 56 days. Now I did not know this. I learned this as a part of this research. That 56 days is the exact amount of time that a Google ad is active. So what it's essentially doing and intentionally and purposely is collecting every single amount of information it possibly can over the exact amount of time and then detonating itself 56 days later. And this is interesting because when we start to look at the time line of how this all manifested this last summer/fall, you can see that execution on that time line in effect.

Okay. So OneStart.exe, this is another file that we looked at, and I'm not trying to just give you guys follow names, IOCs. Honestly, there's like hundreds of them. But just to kind of give you a picture of how all this comes together. OneStart.exe is a piece of the puzzle. It's one of the files that the loaders, Jacky or Appsuite install on your computer that essentially perpetuate, right? It launches TamperedChef, it perpetuates the collection of the malware. It really is kind of just like one piece in the middle of the puzzle.

What's interesting in OneStart.exe is it's one of the first things that we see when we start to go back in time being tested. And it also kind of connects all these pieces together because we can use that executable as the connective tissue between different pieces of malware that might be written in different types of code but have this exact same [ C2 ] or command and control language within them. And so it allows us to kind of put all of these things together. This is, again, end of August, is when we see this in this one specific victim environment.

Okay. So mid-September, September 11, we see the first publication of EvilAI. And this is written by Trend Micro, it was actually very good write. I definitely recommend reading it. And it's the first time that we see the industry really putting all of these pieces of the puzzle together. We've been seeing them kind of independent. But this really provided an understanding of how everything worked together and create this entire life cycle. And it goes forward and really explains to us as researchers and industry professionals, how the threat actor is exploiting AI, branding to deliver this persistent backdoor and steal credentials. It's really using the concept of AI and how -- what it means to individuals to essentially lure them and be effective.

So as one does, whenever you have a cybersecurity incident, well, in this case, one where we know we need to introduce detection. At SentinelOne, we take all the research we have from our breach responders within my team, within the other customers and partners that are sharing information with us and we built a bunch of platform detections. We were already detecting this from a behavioral aspect early, early, early on. But I think that we didn't exactly know what it was that we were detecting.

And so we -- this is me telling you, don't be scared, we did good things. We're here to help you. We did. We did. We immediately deployed these protections and sent them out to all of the end points that SentinelOne was protecting. And then we started to look back in time. In breach response, I mean, I would never give you in this life cycle presentation, but we all know what the missed life cycle is, right, and part of that is our postmortem analysis. And so looking at our postmortem, we said here, we're really skeptical of this timeline, we weren't really sure. And like ma'am this seems like only been going on a couple of months, but it's super prolific. And so, fortunately, this victim, again, one of my favorite customers if you're in here, please, had really, really good data retention.

We had to like a lot of time that we can search through. And we started looking, and we found evidence dating all the way back to February of 2025 of parts of this campaign. And at that point, it was very low noise. The threat actor was in a testing phase. But it just shows you that conceptually, they had a plan, and this is a multi-month plan. A lot of times in cyber crime, you're kind of in and out in a hurry, right? This was very thoughtful. It was very broad, and it obviously impacted hundreds of thousands of people all over the world.

But so we find our first evidence, dating all the way back to February and then continuing our research between March and August. So we had like our first detection in February, next detection kind of mid-March. Between March and August, we have 36 independent versions of AI -- or EvilAI-related malware in this one single victim, which -- that's not good, right? But what it allowed us to do was really get an idea of the entire life cycle of how this malware evolved and developed and what it did. And so what we started to see is January -- sorry, February, March, very low noise. We're just testing stuff. We were purchasing domains. We're creating our trojanized installers. We're refining our infrastructure.

But then by late June is when we really started seeing the campaigns on Google ads, this is one that's getting a large global rollout. And then you have your 56 days, right. We were dormant for 56 days. So by late August, that malware that had been laying dormant for 56 days at TamperedChef, completely executes and start sending secrets back to its control server. That's when larger-scale compromise is assumed. That's when we can start seeing -- the utilization of those credentials are secrets. We can start to see them being sold, et cetera, massive data exfiltration, et cetera.

So at the end of the day, again, not here to just try to scare you. You have a whole conference full of like AI-related conversations and information and all the reasons why we can protect and secure you. And we can. And we did all the way back to February, these detections were detecting and that's great. But the point is, I was wrong the first week in August, when I sat on stage at Black Hat and I was like, no, no, no, we're not really seeing AI being used by threat actors in breaches. And I didn't think that this is how we would start there, okay? We are all afraid of -- you saw it o Steve timeline, what is it, 2029 and 2030 when we start to see completely autonomous delivery of malware.

What we're seeing is the human element, the same exact human element that we've seen in trojanized malware forever, which is simply between the keyboard and the chair, how do we make your life easier? How do I make you more effective and efficient but now I can do it easily and in a way that actually works. So I solicit trust. So we're not seeing polymorphic malware, but we are seeing malware being used by AI. By the way, all of these installers, we believe, are written in AI. You can tell by the obfuscation techniques that were used that not only did AI likely create these installers, but they're also again soliciting the human element of AI interest.

And that is it for me. I bring Steve back.

All right, folks. We talked a lot here. We covered the globe literally and figuratively. Our real hope here, we're not trying to scare anybody. We're trying to give 3 things. One, we want to give visibility into how we interpret the world. Two, we want to give context for the things that we are looking forward to. And then three, our real hope is to be a scene setter for everything else that comes to OneCon so we can set the stage for why we are building what we are building, why we are pushing the way that we are. So you can see our goals and ideally how we can help to secure your environment.

Thank you very much for your time, everyone.

So the next 30 minutes are going to be all about what we've been building, what we've been doing and how we actually make tangible progress towards that vision that we set out to build into usher into this world. So I'm going to be joined by quite a few leaders and we're going to talk about how we're taking all of these different components that we have in the platform today and those that we've just added either through acquisition or building or partnerships. We're going to show you how these innovations come together to create the autonomous SOC vision.

Now what's important to understand is that a lot of what you're going to see in this session is actually either already available on the platform or coming in the next, let's call it, 90 days. So these are all tangible real things that you're going to be able to do with our platform, some you can also already do today. So that showcased some of these pivotal steps that we've been taking to solidify SentinelOne as the leading AI security platform.

I want to first open with data. As we talked about, when we think about creating that innovation entire fabric of cybersecurity, it has to start with bringing the data in, which is why I'm incredibly excited to invite to the stage Gurjeet Arora to tell us more about how Observo AI and the Singularity platform are coming together to put data into one place and action it.

Gurjeet?

Thank you, Tomer. It's a profound privilege to be part of the SentinelOne team. One month in, and I can already feel it, this team runs on innovation. Together, our shared passion for customer impact and innovation will define the future of cybersecurity. At Observo from day 0, we are focused on one clear mission, empower security teams with the right data at the right place at the right time. This chart from Gartner shows the exponential growth in machine data we have seen in the last 2 decades. What used to be terabytes just a decade ago, it's petabytes today. That's 1,000x growth in the last decade. In practice, most teams can't even capture all this data and even if they do, the signal gets lost in the volume that is [ noise] . The net result is exponential increase in costs, while the overall security stance of the enterprise deteriorate rapidly. This problem of noisy data impacts every single security team out there. This is the problem we are solving.

Let's see how we solve this problem. To solve this problem, we have built the industry's most advanced data pipeline. This data pipeline uses [ 4 ] specific machine learning models to deeply classify and denoise data. Further, to make data operations easier, we have created Orion, our agentic data engineer. Today, Orion has become a go-to tool for security teams. They are automating day-to-day time-consuming operations like data enrichment and data classification using Orion. In terms of scalability, today, large organizations like Bill.com, Alteryx and Harbor Freight are using our platform at petabyte scale.

What's the most clarifying to me is the value that customers are getting from our platform. So on an average, our customers are getting more than 50% in cost savings while improving productivity by more than 40%.

Let's see how easy it is to adopt the Observo platform. We basically ship in 2 configurations, 2 very simple configurations for our customers. The first configuration is applicable if a customer is currently not using the Singularity AI-SIEM. In this configuration, Observo becomes the central vendor-agnostic data engine that crowds data from any source to any destination. Further, all features of the Observo platform are available in this configuration.

The second configuration is applicable if a customer is currently using Singularity AI-SIEM. In that configuration, the enriched data from the pipeline turbocharges the Singularity AI-SIEM, further features like Purple AI and Singularity hyperautomation work exponentially better.

To wrap up, our teams have worked relentlessly to create the industry's most advanced security platform. This platform seamlessly combines the power of streaming analytics with deep agentic analysis in a single system. What this means for you is, we can deeply classify and transform your data, your noisy security data into actionable insights. That's really how we accelerate the path from manual threat hunting to autonomous defense.

Finally, I'd like to invite you all to visit us at our booth to experience the platform in action and to see how it can turbocharge your security dreams. Thank you.

Thank you, Gurjeet. So simple, easy, complete, getting data into the Singularity platform has never been easier. And with AI native pipelines, you can take any source and put it ideally into our Singularity platform data lake or routed into any other destination that you want. That is the power of this unity. That is the power in data pipelines. That is the ingredient that allows us to start seeing everything that you have in your enterprise environment, collect, classify, enrich data, optimize, filter it, make sure you're taking what you need and putting it to action.

And as Gurjeet mentioned, this is actually a substantial cost saver for all of you. A lot of the data that's beaming between systems today is actually not optimized. A lot of it is redundant. We're building AI capabilities to immediately introspect your data sources to give you an immediate analysis of what you need, the cardinality of data and how distinct is the data source you're interrogating. These are all incredible capabilities to help you gain better control over all of your data sources no matter where they come from, network, e-mail, identity, it doesn't really matter. With Observo, we opened up the gates to put data into the Singularity platform.

So what's next for us? We're going to now talk about how we extend the Singularity platform to secure AI, which obviously is a complete new attack surface for all of us. And to talk about that, I want to invite to the stage Itamar Golan, the co-founder of Prompt Security.

Thank you, Tomer. Pleasure to be here. Guys, we are living through one of the most exciting times in history. Organizations everywhere are adopting AI at the pace we've never seen before. Every team, and I mean every team, is already adopting AI, marketing, finance, legal, everybody is using it. And if not yet, they are experimenting, testing, learning, but with this incredible wave of innovation comes the all new set of challenges, security teams, well, you guys, you find yourself at the center of it all, facing threats.

We could not even imagine a few years ago, prompt injection, jailbreaks, data leaks. The rules have changed and we are all trying to figure out how to stay secure in a world that is moving faster than ever. So the main question is that, how do you enable AI innovation, but safely, securely and at scale?

Well, that's exactly why we build Prompt Security, a comprehensive AI security platform that weaves together security, governance and privacy for every AI interaction. From day one, our mission has been simple but powerful. We would like to help organizations like yourself adopt the incredible power of AI without compromising data privacy, security or governance. That mission, by the way, extends to everyone, to the employee using ChatGPT, Gemini or Claude, to the developer using GitHub Copilot or Cursor and to the innovation and R&D teams building AI agents from the ground up, Prompt Security is what makes that possible.

We make sure that the AI revolution doesn't just move fast. It moves safely. The Prompt Security platform, as you can see now in the demo behind me, can show you the entire AI footprint of the organization, which AI applications are being used, who is using them, which data is being shared. You can also configure specific granular policies to your business contextual needs and you can even apply them as you wish, on a combination of specific AI users, AI applications and content.

The screen behind me is probably familiar to most of you. Imagine one of your employees going to some random AI and revising an e-mail, but unfortunately, sharing sensitive information. Prompt automatically detects this sensitive information, alerts the user about his violation, educating him, making him better for the next time and behind the scene sanitizing all the sensitive information. But there's the magic. We're not blocking him. We are enabling to use it safely and responsibly, and that's our mission at Prompt to find the sweet spot between governance, security and privacy and employee enablement.

Thank you. What you just saw on the screen, guys, this is only one example, pretty simplistic one, of Prompt stopping sensitive data from leaking into an AI application. But the platform we've built, it's much more comprehensive. It protects the entire AI ecosystem, AI sites, AI components, enterprise tools, copilots, code assistants, MPP servers, you name it, we protect it all. And if you are interested to learn more, please join me afterwards to my product session, I'll dive into any one of our Prompt Security offerings.

Guys, SentinelOne has been the most powerful platform to harness the power of data and AI to protect every attack surface. And now with Prompt Security, we take it to the next frontier, securing AI itself. Thank you.

Okay. So securing AI, this is, as you've seen one of the most complete platforms on the market today. It doesn't stop with securing only employees from the usage and data acceleration that may happen when they're leveraging AI at work, either for sanctioned usage or unsanctioned usage, but it also helps you protect AI agents, all these building studios that you have out there, all the new workflows you're putting into work and in MCP environments as well. Obviously, AI adoption is accelerating across every team and across every facet of your organization. Security has to keep pace, Prompt is how you do it. It gives you immediate visibility into every AI bound action you have in your enterprise.

Deployment is incredibly easy. Again, emphasis on simplicity, completeness of visibility and completeness of control. Find AI, see what it does, put a policy, done. That's how AI should be managed in the enterprise. That's how you facilitate your workforce to work securely and to adopt AI at the pace that they need.

Okay. So earlier, I talked about how agentic AI needs to actually work, how we can harness it to potentially accelerate what we do in cybersecurity. Well, it isn't an empty promise. We're well on our way to create that reality for every customer out there. No more bolt-on AI, no more workflows, no more specific agents to tweak and to configure and to test and to have no idea what the outcome would be. We're moving into a complete integrated AI, agentic AI into the existing security operation fabric that you all use today, which means full context, fully tailored actions and complete human oversight which is one of the keys to actually be able to use agentic AI in mission-critical environments.

So to share more I'm really excited to introduce Rachel Park and Heather Phipps to the stage.

Hi, everyone, welcome. We are so excited to be here today to discuss the topic we feel very deeply about and has real-world consequences. So 2 months ago, researchers discovered PromptLock, a malware prototype that can generate new ransomware code in real time. No command and control server, no script kitty. Just an LLM that could write and immediately implement unique Lua scripts, so every infection looks different.

In less than a year, we've gone from early AI malware prototypes to credible demos of fully autonomous attack chains. One example, Ransomware 3.0, showed an LLM executing every stage of an attack for reconnaissance to payload creation to even ransom negotiation. When attackers can automate at this pace, when the code itself can adapt, we defenders cannot afford to stay manual. At this point, autonomous security isn't really optional now. It is how we stay protected.

So how do we shift the advantage back and equip our analysts with agentic AI to unleash what we believe is our greatest weapon, human ingenuity.

Rachel, we're here to answer exactly that. Life in a SOC is intense. Endless alerts, too few people, newer enough time. Triaging, investigating, responding at scale is tougher than ever. Proactively improving security posture fields nearly impossible. Our mission is to flip the script to place AI directly in your hands so you can stay ahead of the most sophisticated attackers. This is why Purple AI exists. It's your proactive partner for true autonomous security.

Exactly. Look, Purple AI is the brain of the Singularity platform, unifying intelligence, proprietary models and threat data into a single adaptive system for modern security teams. It shifts the paradigm from human work assisted by AI to AI work approved by humans, so you can focus on the actual critical high state incidents requiring creative expertise. To us, humans are the mission commanders. You lead a strategy, let AI handle the chaos.

But Heather, can you help us make this concrete? And can you show us how Purple helps at every stage of the SOC analyst workflow?

Let's dive in. In the console, my infinite queue alerts me to a potential identity compromise. With one click, I launched the investigation. But Purple AI has already been working in the background, surfacing alerts, correlating data and investigating for you. Normally, this sort of alert sparks chaos. Is it an identity compromise or an insider attack? How widespread is the threat? Analysts spend hours digging through logs, connecting dots, tracing the attack path. But with Purple AI, this looks completely different.

When I took on the incident, I get a complete summary of the agentic investigation from the initial discovery and alert correlation to impact analysis and recommended actions. Purple AI dynamically planned and executed this investigation tailored to the specifics of the incident. It formed hypothesis, tested them and adapted instantly as new contexts emerge.

This is Purple AI agentic auto investigation with dynamic context-based reasoning across any alert any data. And Rachel, I would like to share this is coming next quarter.

Okay, this is important. Purple's AI agents figure on what to do when novel info comes in, but the playbook isn't obvious. Where other vendors really love to count their numbers of agents, at SentinelOne, we are focused on orchestration and outcomes for you. Now earlier, I called Purple the brain, and that is because it reasons, it learns. And it clearly demonstrates its logic for the human analysts approval. So our end-to-end agentic investigations give you scale, automate across every alert free from the limits of static playbooks.

Adaptability. Purple learns and pivots dynamically with high accuracy; and transparency, that means full explainability with you in the commander seat.

Let's take us in action. Purple AI kicks off the investigation from an Okta in possible travel alert. It asks, Who is the user? Where do they log in from? It identifies James Sabalo with a suspicious login from an unknown location. From this, Purple hypothesizes that we may have a compromised identity. It queries often Workday from our background on James. Purple AI's seamless integration with singularity hyperautomation, lets it act quickly and safely. It instantly reaches out to James on Slack and confirms the log-in was unauthorized. This is Purple AI integration with Singularity hyperautomation, also coming soon.

Next, Purple AI investigates how James' identity was compromised. It pulls in proof point data to confirm evidence of phishing and it identify suspicious [ SCC ] overwrite linked with his credentials. Finally, Purple AI assesses the blast radius. It queries, EDR, Zscaler and cloud trail logs confirming that this attack is isolated with no evidence of lateral movement. In seconds, Purple AI has traced the complete attack chain from the original phishing e-mail to identity compromise to data encryption, all agentically without any human configuration, giving you clear evidence for decisive action.

Look, our AI doesn't stop at investigation. Of course, it also drives response. Purple AI agentically surfaces preapproved recommended actions via Singularity hyperautomation, rotate AWS credentials, block the attacker IPs, restrict S3 access and immediately suspend the user in Okta. Done, just like that. This is how Purple AI delivers you an agentic SOC. It is thinking through the problem, crafting its hypothesis. It is investigating, trying to validate that hypotheses and then only taps into preapproved workflows to execute approved response actions. And then finally, it documents everything in one clear auditable view.

But, Rachel, Purple AI doesn't rest even once the threat is contained. With one click, you can close the loop, instantly creating a detection to identify and stop similar threats before they spread. No more manual rule writing, no more missed chances to incorporate what you've learned. Every investigation instantly strengthens your defenses. Remember, the original overwhelming SOC workload that we started with, imagine no endless alerts, no brittle playbooks and fewer but far more targeted manual investigations. At every phase of the SOC workload, Purple AI and hyperautomation deliver true autonomous security, working tirelessly and accurately while keeping you firmly in control.

Rachel, this is a transformation that every SOC needs from reacting to threats to anticipating them from barely keeping up to staying ahead.

Okay. So speaking of staying ahead. We do have one more exciting announcement for you. We've just shown you turnkey agentic workflows inside the platform but we know many of you are also experimenting with your own LLM and custom models. So today, we are extremely excited to announce the Purple AI MCP server, a secure bridge between SentinelOne's live intelligence and real-time context and your AI ecosystem. Now you can create your own custom agents, rooted in S1 data and able to reason using your security context. Whether you're using OpenAI, Anthropic, Gemini or other internal models, you now have the freedom to innovate securely and at scale. And look, this isn't just another integration. This is about the future of autonomous security. It's giving you the power to extend the Singularity platform truly as far as your imagination will go. And the best part is the Purple AI MCP server is open source. You can actually get started today on GitHub. We cannot wait to see what you build.

Okay. I'm very excited about this. I mean we just saw a complete cycle from alert to immunization and prevention happen within a few seconds, minutes with a human in the loop. But how do we scale it now? How do we do it across thousands of alerts? And I'm not just talking about SentinelOne's alerts, I'm talking about any alert that comes from any connected product, be it Okta, Microsoft Defender, Splunk, whatever it is. How do we take what we've just seen for one alert and we do it across the board, asynchronously for everything that's happening? That's the goal with the next release of Purple.

But to do that, you also need to scale the human control. You also need to scale the ability to make sure there's somebody monitoring the system at any given moment. And that is exactly why we are launching Wayfinder services. Not only we're launching Wayfinder services, we're also teaming up with Google Threat Intelligence to make sure that we can funnel real-time threat intelligence, best-of-breed threat intelligence directly into the Singularity platform and action it with Wayfinder's AI-powered human services.

So this is how you scale AI. This is even when you don't have enough workforce, enough analysts to go after any alert or every alert, we have that supplemental force. So before I invite Steve and Vijay to the stage, let's quickly recap. Agentic auto investigations, Singularity hyperautomation, automatic actions, custom detection rules and the Purple AI MCP server, which is obviously an insane bridge to everything you want to build, this is the world's first fully agentic AI SOC. You have all the components, all the ingredients to basically unleash the power of AI to make your SOC infinitely faster and more productive and you don't need to code it. You don't need to configure it, you don't need to build it. You don't need to invent it, you don't need to grapple with it. It's there, turnkey, click and it happens. That is the future that we envision for cybersecurity.

So let's jump to Wayfinder. I'm really, really excited with this partnership. It's taking the world's best threat intelligence and fuses it with elite defenders 24/7. I want to welcome to the stage Steve Stone and Vijay Ganti.

All right. Thank you, Tomer. I appreciate it. Vijay, thank you for joining us here.

Thank you.

So we've spent several hours here talking to you about tomorrow. Let's take a step back. Let's talk about today and some ground truth. I live and die in the services world. We have to solve problems now. We work with clients every single day who are struggling with legacy technology. It's often just jointed, complicated workflows and ultimately, blind spots. When we go back and look at what has made us successful at SentinelOne in our almost 8 years of delivering services, it's when we are connected and it's when we are coordinated not just with our clients, but other organizations in our industry that our clients also rely on.

Based on this, as Tomer mentioned, as of today, and you can get it this month, this is not coming in 6 months, this is now. We are relaunching our services with a real focus on 3 things: how do we combine artificial intelligence with our human expertise and world-class threat intelligence from both SentinelOne and Google Threat Intelligence. As we look at how we expect this to operate, our ethos remains the same. We are not changing the spirit and intent of what we've done so far. We are here to work with clients preventing intrusions, reducing risk and being there in that critical moment in that breach moment, we will still do that.

The difference with Wayfinder is we will provide more capabilities around that, and that will be the next evolution of our services. We will take our existing managed detection and response, our incident readiness and response and our threat hunting and combine them into a seamless client experience. Additionally, we are combining what you see upfront with what's happening behind the scenes are detection engineering to ensure that as seamless as well. And then we're going to provide outcomes across whatever data you put in front of us. You apply the surface, we will apply the expertise.

And the point I want to just really kind of drill down on here, why we have Vijay with us is the threat intelligence piece. I mean -- you heard me talk about this earlier. I won't go back and recap all that 45 minutes. But this is foundational to us. That threat intelligence is what allows us to move its scope and scale. It allows us to provide the right outcomes, and this is ultimately where Google Threat Intelligence comes in.

Thank you, Steve. And you had mentioned this morning that attackers are innovating, attackers are collaborating. We as defenders must do the same, it's time. What's unique about today is that 2 reputed top cybersecurity companies are coming together to deliver intelligence to our customers. But this is not just about shared intelligence, it is about actually delivering actionable outcomes to our customers, which is what you talked about. The visibility that we have together, the capabilities that we have together, actually will eliminate the blind spots for our customers.

So let's talk a little bit about what Google Threat Intelligence is. It's actually a combination of Mandiant, VirusTotal, and Google Insights. Let me just elaborate on that a little bit. With Mandiant, what you get is frontline threat intelligence that we get from responding to thousands of security incidents every year. With Mandiant, you get curated threat intelligence from 600-plus researchers who are looking at threat landscape. With VirusTotal, you're getting the best cloud source and open source threat intel out there. And with Google Insight, you're getting visibility into threat landscape that Google has as it protects billions of consumers and thousands and thousands of businesses. But it's not just about sharing data here. We don't just collect threat data. What Google does, it has the analytical infrastructure to curate, enrich and contextualize all of this to deliver actionable threat intelligence. And what happens because of that is that you will actually get active security.

Now let's look at MDR, managed [ detection ] and response. And that essentially starts to deliver these outcomes to our customers.

I appreciate it. Thank you for that rundown. I think as we look at this, I think this is where we really at SentinelOne see, this is where our unified platform shines. And we combine our services with that, which was delivered across our platform. Every single services client will benefit from the combination of Google Threat Intelligence and SentinelOne automatically.

Let me give just a little bit of context on how important we're taking this. You will not be able to engage Wayfinder services and not receive the benefit of GTI. We are bringing this into the core of what we are doing, combining it with our intelligence, our findings and then applying that across our clients, all at the benefit of speed and scale. Bringing these 2 organizations together, I'll be honest, I still don't know how we got the bosses to sign off on it, but it's too late, patent-pending, legal paperwork all signed.

So what I would leave with is this, this is how we are going to approach this on behalf of our clients. We're not here to sell intelligence. We're not here to send you a PDF of what to think about. We're going to take this intelligence, combine it with ours and then move it through our artificial intelligence and then present that in front of our human expertise that allow us to work at scale. We will be applying that. We will be taking the actions, and we will be responsible for ensuring the right parts of intelligence are applied across their environment all while we will provide rapid onboarding and near immediate outcomes as soon as we are enabled.

This is how important we think this combination of SentinelOne and Google Threat Intelligence will be. Not just when we find more threats and find them sooner, we can respond faster and more precisely. And you've heard us talk a lot about AI today. I know AI can get real [indiscernible] real quick. We talk about human expertise much the same way. But this is how we think about it here at SentinelOne. We think about it in this concept of a flywheel. And this is why this is so important to us on the services side. We use artificial intelligence to drive that human expertise. It allows us to see more, move faster, it makes our people better and then in return, this is what makes our AI better. It is being trained 24/7, 365 by human experts and the combined intelligence of our 2 organizations and every single incident, both SentinelOne and Google Threat Intelligence experience.

Yes. I was going to say AI, what is that [indiscernible] just kidding. I think this human AI collaboration that you talked about is probably the most exciting part. It creates this virtuous cycle that creates a learning system, which is so important for us. Imagine this Google Threat Intelligence provides context to Purple AI. Purple AI drives actions and decisions for security analysts. Security analysts provide feedback into Purple AI. And that's the virtuous cycle we're talking about. It is a learning adaptive system that we're delivering, which is absolutely world-class.

I completely agree. I really appreciate it coming out and join us with this. I know you've got a lot going on. And just what I would say to all of you in the audience, if you want to know more about Wayfinder, we have multiple sessions throughout today and tomorrow. We'll be talking about this for the foreseeable future. We are incredibly excited to build on top of years of experience serving you, thousands and thousands of incidents and now also the added benefit of Google Threat Intelligence. Thank you so much. We appreciate your time.

Thank you. Hi, everyone. I think I have the best job in the company because I get to see how our solutions are helping customers solve real-world problems. In this industry, when we talk about cybersecurity, it's often about the technology. We talk about the platforms, automation, AI and all the things that, that technology can do but it's really never about the tech. It's always about how the tech is empowering the people behind it. And that's what today's session is about.

You're going to hear from some of our customers that talk about how they're using our solutions to solve problems that they couldn't before. So without further ado, please join me in welcoming our panelists to the stage.

Okay. Let's start with some intros. [ Angel ], why don't you kick us off?

Sure. Hello, everyone. Very excited to be here. My name is [ Angel ], Director of Software Engineering at DirecTV. For those who are not really familiar with us, DirecTV is about delivering that premium content with unforgettable customer experiences to millions of homes across the country, and we're especially proud of our superior sports packages that's really put our fans in the front of the game, they care about the most. So in a world where media technology and AI has been evolved so fast, our challenges are really clear. How do we deliver secure and scale that digital experience without miss a beat? And that's exactly where my team has come in. We're sitting right in the intersection of cybersecurity, observability and automation. And I'm really fortunate enough to lead a group of very talented individuals and who are always looking forward and asking how do we prepare for what's next, not just reacting to what's happening now.

So that's why I'm very excited to be here, share some stories and pick up the new ideas. And just have a great conversation about where our security operation is going to head in next.

Absolutely. Thanks, Angel. My name is Jörn Graf, I'm Team Lead of Endpoint and Application Security Team at Schwarz Group. So for those who don't know Schwarz, Schwarz is 1 of the top 3 retailers in the world. Besides retail, which is our core business, of course, we also operate our own production facilities. We operate a recycling facility, shipping line, cargo line. That makes our infrastructure-wide a bit complex. Currently, we are talking about 600,000 employees all over the world. And yes, I'm really enjoying to share some stories out of our daily business. I think a lot of you in the audience also can identify with.

Hi, everyone. I'm [ Shrishti Chatterjee ]. Thanks for having us here. Actually, I'm a global lead for security architecture and cyber defense at Thoughtworks. Thoughtworks is actually a global technology consultancy. We are located in multiple locations in the Asia Pacific, India, Middle East, Europe, in the Americas, LATAM and North America. We actually work more on the providing -- delivering software to our clients and making sure we are delivering with AI because AI is now top of everyone's mind right now. So providing modern design with AI and engineering, keeping in mind and security all the time.

So for us, security isn't just an internal function where my role sits between engineering, having some strategic roles for continuing to improve our architecture in security and at the same time also working as an incident commander in the cyber defense team helping and understanding how we can continue to improve our security structure.

A lot of the work is not just internal function, like I mentioned. We do have a bunch of things that we have to do for our clients. So keeping security in mind for our clients actually having that implemented into our development design and also continuing to improve our business with security as well.

And good morning, [ Mike Francis ], Director of Cybersecurity Advanced Threat Wyndham Hotels & Resorts. We are the world's largest hotel franchise here. We have over 9,500 hotels across 22 brands worldwide. In my role, I'm responsible for all things cyber threat intelligence, digital forensics, incident response and detection engineering. So my day-to-day role consists of very closely aligned to all the stuff that Steve was talking about, keeping on top of our adversaries, keeping on top of the threat landscape, informing our stakeholders, influencing strategic business and tech decisions and when something does arrive, running that into response kind of similar to [ Chatterjee ].

Wonderful. I'm going to do a complete icebreaker, right? I'm going to throw you guys off. I've got a little question. I'd like for you to describe your job by using a movie title. And then just explain quickly why and bonus points, if you don't say the Titanic. I'm going to start with you, Michael. We'll just come back down this way.

Sure. I'm going to go with my favorite movie so far this year, which is One Battle After Another. So kind of what I just spoke about, right? We have a very complicated threat landscape involving both cybercrime and nation state actors. So it literally is day-to-day one battle after another with adversaries varying TTPs and keeping on top of that evolving threat landscape is complex. And then as part of that movie, the resistance network, I think about. And I think about how we as defenders just all need to have solidarity for each other, share that information, defend as one. So that's what comes to mind with that.

Okay. That's really good. Very thoughtful. I hadn't even heard of that movie. Let alone the movie of the year. I guess I'm behind on my culture. Tristy, what about you?

I'm thinking the Avengers, kind of thinking of like you're kind of -- there are a lot of movies, obviously. You're kind of an elite team always looking at things that you have not seen. Anything will be there on top of your screen right there. So there are new threats every day, which we don't know about. So yeah...

Yes. Very good there, you got to like it.

So literally, the Avengers was the first thing which came into my mind also, but more thinking about we have all those individuals in our cybersecurity landscape in our teams, and I think also here in the audience. And everybody has a very specific skill set at the end, which overall comes together as a team to defend our world.

In our case, it's our infrastructure, our customers, whatever. And I think that wraps it up. So we just need to protect everybody, and that's -- that's what I think.

All right. I got a couple of movies I need to watch on the plane ride home. What about you, Angel?

I'm sitting between Top Gun and the Hidden Figures.

Hidden Figures and Top Gun.

I think our team is always challenging the status quo and always thinking about what's next and very inclusive about the idea. Now we talk about things, we discuss and we're always thinking what can we do better right? How can we step one -- how can we stay one step ahead, right? There's a lot of things going on right now with the AI and the cybersecurity as well.

Yes, especially that Top Gun, you definitely need to have like speed and precision and all of those things.

Yes.

Well, good. Well, I -- we're all anxious to hear about your SentinelOne deployments and how you're using us today to solve problems. [ Yaron ], you've been a customer the longest. Why don't you tell us a little bit about what you have deployed, how your journey started?

Sure. So yes, we are customers since 2020, so late 2020. We did the evaluation during the year. And in the meantime, we protect around about 450,000 endpoints.

450,000 endpoints.

It also includes like cloud workloads and the likes. So when did we start? We analyzed the entire market. So we ended up having a short list. I think most of the audience here can identify with 3 vendors, Microsoft, CrowdStrike and [ on ]. And at the end, we did our technical analysis because even if our company is that big, we are still -- the technical teams are still kind of taking decisions. And so we had a very great cooperation with the account team, so shout out to everybody of our account team back then. So yes, at the end, that's the phrase a lot of companies throw out, which means customer focused.

But I can totally agree that SentinelOne is living customer focus. That's a thing -- I'm in the company for 17 years now. I saw a lot of -- did some projects globally with a lot of tech companies. And well, that's outstanding for me, at least. Yes. And well, our first broad deployment started when there was with our old antivirus solution. We had a breach in some of our remote locations and somebody was like, "can we just deploy SandinOne?" Yes, sure, we can. So we provided the installer. So they provided the site token and they went ahead. And somehow, our management was like, so we did that now for branch office, I think 100 to 500 endpoints or something. And we were like, yes, sure, why not?

So we went ahead, and it was close about Christmas that year. And during the holidays, there were a lot of people offline, but we decided to go ahead and install immediately on the first wave of our clients, which replicates like 20,000 endpoints. So -- and after 3 months, we reached 40,000 endpoints.

40,000 in 3 months. What took you so long.

Yes. Well, obviously, our testing and change requirements. But at the end, we forced it. And within 6 months, we reached the 100,000 endpoints.

That's fantastic. And quadruple from there. That's amazing.

Thank you. Tristy.

I need a question back. I can think I forget.

Your S1 deployment. Tell us how you're using it.

Yes. I think we're a heavy Mac shop. So we have like at least about 11,000 endpoints. So it was a clear win.

That's great. We're super strong in Mac.

I know, I know. This was -- it was giving us -- we get like full-on deep visibility on anything we want in Mac. And we do have Windows machines, too, but Mac was our thing we're looking for. In addition to all the EDR functionalities that we get, we also had more visibility with what's happening, plus all of the auto remediation and the user-friendly interface that you get.

Everything is farle, but we love it. It's really -- it's more like you don't have to spend a lot of time trying to understand what you're trying to figure out. It's much easier for anyone was learning first time also to pick up on the work. Obviously, you do need to do some little bit of groundwork before that was done to make sure a lot of the automations are done. The open API that's there, which allows us with a lot of the integration for our SIEM and other tools that we want to integrate with, collect some of the data that we need to and send it over wherever we need.

I'm also looking at the browser extension now. I didn't know it's all there, but that's another thing that's getting me excited now moving forward.

Wonderful. That's see. We're moving pipeline at the same time that we're working. I love it. Angel, why don't you tell us about how DirecTV is using SentinelOne?

Yes. There's obviously many things you're looking for where you're trying to pick as security partners. At the time when we look into SentinelOne, our biggest challenge is how do we have that clear unified view across our super hybrid environment. And at DirecTV, we have data come from everywhere from cloud, application, EDR and our legacy environment. And they're kind of leaving the silo, didn't really talk to each other. And that made it really difficult to detect the things earlier and for the security team have to see the whole picture. At the time, we're also evaluating a few other vendors.

We're evaluating [ Strong ] SIEM, Google SIEM and some open source tools as well. But it all come with very heavy teaming and load operational work that we are not really need to go for and/or it doesn't really integrate very well with our existing ecosystem. So SentinelOne really stood up at that time is it's not just another data lake to us, is it integrates really well with our existing system and the AI-driven insight and the hyper automation that's really the game changer to us is we're able to using the natural language, create the security data and trigger the automation, really made the process so much faster and make that visible to the teams that beyond just the security. So -- and also, I think really important, like I think -- and [ Yaron ], you touched that point is that what's really set SentinelOne apart is a partnership. Your team has been incredibly transparent and responsive to our need and really invest and believe the success of DRTV. And the result is really clear. We are able to reduce our data onboarding by 30% and cutting our automation development time by almost 50%. So in the end, for us, choosing SentinelOne is not just about what's solving our problem today, but more building that intelligent security operations that we wanted to really operate on for DRTV. So that's one of...

That sounds fantastic. I love it. You guys are really making us all happy here, hearing how great our teams are. Michael, how about you?

Yes. So our journey with SentinelOne actually goes back to 2017. We did an EDR bake-off back then, and SentinelOne was one of our finalists, just didn't have everything that we were looking for at the time, to be honest. There was some core functionality that was missing. I think the company overall is a little bit different than they are today. I should say a lot different than they are today. So we selected a partner in cyber reason. They served us well for 6 years. Let's didn't really innovate.

I don't think cyber reason even exists anymore. And we had to do another bake-off in 2 years ago. And as Jorn said, it was the same top 3, CrowdStrike, SentinelOne or sticking with Cyberason and seeing what happened. And really, it was the team and a big shout out to Victoria, who really just directly became an extension of our team almost immediately even during the presales phase. It was just a wonderful partnership. You guys were incredibly humble about Wyndham. You fit so well into our company culture, what we wanted to do. The way you guys viewed threat intelligence and how we viewed hunting, how we viewed remediating threats and tackling these problems was huge for us. The efficacy testing also blew us away as well. I mean my team is highly technical. I specialize in malware analysis and reverse engineering. We threw a ton of malware at it, stuff that we were pulling live, live off our endpoints are live from our sandbox and it proved out really, really well.

The biggest differentiator for us, though, compared against your competitors was just the simplicity of the UI, the consistency of it, we have a fairly junior SOC team. And I think that, that really proved out in the testing that the team, even though they're not super technical, was just so comfortable within SentinelOne, and that really went a long way. And then adding on top of that was the Purple AI functionality, which really sealed the deal for us, just being able to translate needs and asks and wants in human readable format, bouncing that off Purple AI, getting those results back, even adding tweaks and to those results, that really was a for us, and we've been extremely happy. And as of last week, we closed AI SIEM. So we are now an AI SIEM customer. as well.

Thank you. Thank you for that.

Yes, absolutely. We're super thrilled. We're coming off of a Splunk Cloud deployment that, as I mentioned, the team that's kind of running that today, not as technical. We are considered a small enterprise. So there's not a lot of hands to go around. And those of you that know Splunk know it's -- there's a lot of carrying and cheating that needs to go into it. And we just wanted to get out of that. It just wasn't serving our needs. And SentinelOne came in during the POC, blew us away, everything is production, and we're carrying that right through. So it's been terrific.

That's awesome. Thank you for that. You talked a little bit about when you rolled out our data, our AI SIEM in your environment. What were the challenges that you were trying to solve when you were looking at our solution for that?

Yes. Definitely, I was -- like we mentioned earlier that, that unified view of all the data come in, right? We want to make sure we have visibility into the application security login to the network, to the infrastructure, our legacy environment, cloud environment, all that needs to be combined together as one comprehensive view for our security team. Not only that in the extension is we want to make sure that information can be useful for other team beyond just the security as well. And I think that's where the SentinelOne really come in. And give us that capability and able to using the like AI, Purple AI and hyper automation, the team is going to be so excited about it and we reduced our pretty much automation development time by half.

That's impressive. That's absolutely impressive. One of the things that I always love to see is when by the adoption of our solutions, there's a culture or technology shift that occurs within your company. Do you have any examples of how using SentinelOne may have broken down barriers or changed your team's day-to-day productivity?

Yes. I can take that to start. I think with us, the biggest thing at Wyndham is definitely our culture. We have a no-silos cybersecurity team. And with that, we have a terrific relationship with our IT team and being able to onboard our IT team directly into SentinelOne. So they're working the problems with us or troubleshooting the agents with us. I think that's just been terrific for the partnership because they're getting much more comfortable with what SentinelOne is doing, right? A lot of these EDRs, sometimes to these technical teams are just black boxes. Sometimes they don't understand why they do the things that they're doing and why they're making the decisions that they make. So for us, we decided to bring them in on this go around just with the flexibility of the role-based access control that's allowed us to do that. We didn't have that in our prior product. And I think that's really helped to just get folks comfortable with SentinelOne as we've started this journey.

Fantastic. [ Yaron ], anything to add from your perspective?

Well, we kind of did it the other way around because our old antivirus solution was like very decentralized. We had around about 140 whatever servers to deploy the pattern updates and the like. And our countries around about 35 countries overall. We had a lot of administrators, which were doing something, exclusions, whatever else. we totally busted it.

So rolling out SentinelOne, we -- currently, my team contains 4 full-time people taking care of the operation of SentinelOne for that scale. And we just limited our permission. So we are the only ones who can set up any exclusions besides the SOC. Our SOC team, yes, is asking us or is forwarding us requesting exclusion to be set based on their analysis. And it was tough to get all the administrators in the countries convinced that, that's the right way. But well, we did it in 2020. And until now, there's the ISOs and the SOC team and us having role-based permissions and it works. So it was quite the other way around, but it was a huge shift for everybody. But as they always complain about too much work to do for the countries. Well, we took work away. And I don't have any numbers to give you statistics, but yes, they don't have to do that much anymore.

That's fantastic. Fantastic. [ Srishi ], what's top of mind for you these days?

There are a lot of things. Right now, I think we can say AI is definitely on top of our mind. There's an AI battlefield going on. What's happening now? What's the next malware that's coming out. That's definitely on top of everyone's mind. We actually focus more on like, I would say, like I could divide them into like 2 or 3 things.

One of those AIs and the other one would be more like focus on human risk. Even if AI is doing something, unless someone clicks a button, nothing is going to happen. So how do we continue to improve our human risk, like that could include insider threats, it could include data leakage prevention from that and protection from that in general. And then the other one is like how can we quickly remediate and recover from what has happened.

So we are -- that's actually going to be more of our focus also, but we look into if something -- if there is a problem, if there is a virus, it shouldn't happen to anyone. If there is a malware, it has done whatever damage it has to do, how quickly can we come back? And that's one of the things we want to be good at. There's no way of saying it won't happen.

Yes. That's true. It's what happens when it happens.

And how quick can we get back to it?

Yes, what's top of mind for you these days?

Yes, I'm sure everyone is going to have AI is there part of their answer, right? I mean for us, we have several business practices -- business projects in place right now involving both generative and Agentic AI. So it's just wrapping our hands around that, getting in front of the project team and making sure that we build a secure foundation before the business comes in and starts building these products out. We're also going through a major website replatforming. So we're completely rebuilding our whole website and mobile app right now, and that's gotten a lot of attention, obviously, a lot of cybersecurity focus.

I want to bring it back to deployment. Yaron, you talked about how quickly you could get us deployed on the endpoint. Angel, what was it like when you guys made the move from Splunk to AI SIEM? Can you tell us what that deployment was like?

Yes. Our environment is very super hybrid environment. So we have data from our legacy data center to the cloud and to some hybrid cloud environment as well. So when we look at the data onboarding, we're like, wait a minute, how can we get all this data in so fast. And your team is right there, providing the right solution there, give us, hey, you know what, for these applications, we can using the existing EDR bring the data in, and we can also using the Scalar agent bring the data in that we're able to deploy within our system and collect the data really, really, really fast for us.

So that -- and your team is right there with us not only provide the right solution, but also make sure that validating all the integrated test cases and give us the knowledge that we need to run fast and also ensure our entire pipeline going to production running very smooth. And that is a huge success for us. Yes, we definitely were not able to do that fast without you guys' expertise there to help us and really, really make the big success for us. Our team will be route there and completely agree with me on that.

That's awesome because one of the biggest barriers that we see when customers want to adopt our ASM technology is their Splunk environments, their existing SIEM environments. They're very sticky. They're very customized, lots and lots of dashboards, and they have a lot of fear of migrating those dashboards or even migrating how they search in one repository today to how they'll search in ours. Any -- I know you're about to join that -- join the journey, but you obviously did a POC. What do you think about those challenges? And how are you going to get those people on board with this?

Yes. I think from a deployment strategy, I think what worked really well for us is that we invested when we did Splunk in a data pipeline solution in Cribl. So that did make kind of moving the data over from one tool to another worked really well. Like we were -- we had full production visibility in our POC instance, I think, within the first 30 days of deployment. That said, we're a lot smaller than Schwartz in DirecTV, but I'm sure we have a lot of the same technical complexities.

Yes. And I think what was interesting going from Splunk into SentinelOne is it allowed us to kind of rethink what we wanted to do from a metrics perspective. So from those legacy dashboards to legacy reports, what were we doing before? Shifting that whole paradigm. So I think we're -- honestly, we're going through that now with that reimagining effort, but going into it with open eyes. Yes.

Were either one of you putting your EDR data into your SIEM before -- so now you have a...

Bringing that data together is really what's the driving factor and being able to see a full attack lifeline go from endpoint up to the application layer through the network and having that all in a single pane of glass, potentially even through a single story line. I mean that just makes my job so much easier.

That's fantastic. How important is to you, the research and staying on top of the threats with the data? I know you are a student of the game, Michael, and you as well, [ Srishi ], but how important is the data that you get from SentinelOne in that regard?

Huge, absolutely huge. I mean just the talk before us with the merging with GTI, I'm super excited for that, having the Mandiant Intel baked in. We're not a Mandiant shop, so being able to get that -- or Mandiant GTI shop, I should say, but being able to get that baked into the product, I think, is awesome. I think SentinelOne has the right approach to staying on top of what really matters. And so yes, we couldn't be more excited for that. And for us, how do we stay on top of these threats. It's a lot of reading. I read a lot of news, but also, we work closely with our ISAC, big shout out to RH-ISAC, any members in the room. Fantastic organization. There's one thing I can't stress enough to follow offenders in the room, seek out who your local ISAC is and join it, they will be a force multiplier for you.

Yes. We -- actually, one thing I was thinking like we are actually multi-tenant. We're global, right? Although we're trying to have everything in one place as well in one dashboard, but then there are certain places sometimes the client will be like, can we ensure that this laptop or these machines or these [ pough workers ] actually have like a policy added to it. We have that flexibility that we can do per client per region if we have to. And that's like one of the things which gives us more -- we're not on AI SIEM yet or it doesn't mean we can be, but we definitely get that pushed data over. It can help us detect those customer needs at that time. And we can -- like maybe for us, it's maybe we might be saying, oh, suspicious, this is suspicious. But for our clients, it might be malicious. So we have to make sure it's put up according to their client policy and requirements. And that flexibility, we get that S1. Sorry, I'm used to calling an S1.

Yes, that's fine. That's all good. You can call us any nickname you want. That's fantastic. Yaron, you've been a customer for several years, and you continue to invest in us. Anything that stands out that you would want to share with the audience today?

Well, yes, I'm not a SOC analyst. So -- but I can fully agree with what Mike just said. Our SOC analysts were very, very, very, very happy when we had this opportunity to have all the data, which they needed to collect from one system to another or from another and running through the world wherever they need to pull that data to identify, okay, is that a real threat? Or what does it do? So -- and out of the sudden, I can recall discussion or a talk I had with one of our senior SOC analysts when we just rolled out the first phase, he was like, well, that's -- that just took me 5 minutes, what I just had to do in more than half an hour before, right? And I think that's the great opportunity SentinelOne provides you with all that Purple AI today, if you have like junior SOC analysts, our stock is around about 40 to 45 people right now, not only senior analysts, but also like junior analysts. And I think that approach to include AI, not to replace anybody because at the end, you need some human interferes.

But at the end, that was a big winner. And at the beginning, they were like, no, that's our work. We need to do that because yes, we are the analysts, but I think they will adopt soon. So yes, that's a great thing. So as already mentioned, it's a great solution technically. And having this kind of a partnership is unique, I would say. So...

That's wonderful. It's been so great to hear about the partnership on the human level as well as with the solutions. And I know you're going to be on stage later talking about your cloud deployment. So we're going to hear a lot more about it. Just in closing, first of all, I want to thank you guys. We've talked about Purple. We've talked about the EDR. We've talked about hyperautomation and of course, our AI SIEM. I would -- just let me turn the mirror on yourself. If you had to give some advice to your younger self, what kind of advice would you give to your younger self, Angel?

I will probably teach my younger self to be more mindful of this. Like I don't have to be the one who have the answer for everything. Okay. Is more open-minded to have the team contribute together. And I think that is the most powerful thing we can come out and how we can innovate on top of that as well.

That's very insightful. That's very insightful. Yaron?

Well, the question kind of makes me feeling old. So, but at the end, I think I had quite a nice session last week with a colleague of mine, and he was like, it's kind of a life lesson. So if you drive 200 kilometers or miles per hour on the highway, you can't just look into the back mirror, right, or the rear mirror. So it's all about looking forward, don't care about what has been in the past, all this legacy stuff we still might have to handle, but just go ahead, use opportunities like new tools, AI, whatever else there is and go ahead and go for it, give it a try.

Fantastic. [ Tristy ]?

I would say I'm still struggling with this. I can't say trying to be perfect on everything. It's like everything has to be the way this is. And I think I'll go back and tell myself and still tell myself like it doesn't have to be perfect. And things can go the other way, and it's totally fine. You just learn from it.

Perfect. Michael.

Hold NVIDIA stock longer than I did. In all honesty, probably trusting my gut more. I think throughout my career, it's been 17 years now, my entire formal working career. And I've seen a lot, I've experienced a lot. And I think with that, just trusting your assumptions because they worked out more than anything.

We're glad you trusted your gut with SentinelOne.

That was definitely one of them.

Well, thank you all for being here today. This has been a lot of fun. Thank you for sharing your story.

Good afternoon, everyone. It's incredible to see this community of defenders, our customers, partners and friends gathered here in Las Vegas. You are the reason we're here. Every attack you stop, every risk you contain, that is our shared purpose. And our mission has always been unchanged to help you defeat cyber adversaries and enable true cybersecurity resilience. But the world is changing. And over the next 10 minutes, I want to show how we can adapt together in this changing world and how our platform will help you defend differently in the age of AI.

So we're going to start with a little recap. We're going to start how things are changing for the attackers. And as you heard this morning from Steve Stone and Triya, the pace of innovation for our attackers have gone into hyperdrive. Attackers are using AI to discover zero days faster, to automate malware builds and even to start to generate new types of malware. One example of this comes from our very own Sentinel Labs. They recently discovered a new strain of ransomware called MalTerminal. And with MalTerminal, instead of having a static payload like traditional ransomware, it actually calls ChatGPT APIs once it's installed.

They will send natural language commands like create code for this operating system for a reverse shell and now create code to encrypt this directory. With MalTerminal, every execution is unique and no 2 payloads are alike. This means that traditional detection methods, signatures, static analysis, heuristics will not work. Ultimately, it means that we're fighting adversaries who rewrite their playbook with every move, and they're doing so at machine speed. But attackers are not just using AI, they're targeting it. AI workloads are the hottest new attack surface. This reminds me a lot of the early days of cloud adoption. Back in 2015, you'd read the news headlines and every week, there will be an example of an Amazon S3 bucket left wide open to the Internet, exposing sometimes millions of sensitive data records.

Well, thankfully, we've moved beyond open S3 buckets, but now we're seeing the advent of prompt injection attacks that trick AI systems into leaking data. One recent example of this is the Salesforce force leak vulnerability. With this vulnerability, an attacker can discover a publicly accessible Salesforce leave form and put in it a malicious prompt. And then when the Salesforce AI assistant processes that lead, it's directed to start sending out sensitive information via tiny image speaking. So with this type of prompt injection attack, all takes is one public exposed field, one malicious prompt and then you have the potential for massive data exposure. This is the new frontier. It's evolving faster than any technology wave before it.

So what do we do? How do we defend in this new era? We go back to first principles and focus relentlessly on outcomes. Everything we do at SentinelOne can be tied back to 1 of these 6 outcomes. First, comprehensive visibility. This means all your data, endpoint, identity, cloud, now AI logs, unified and searchable at any scale. Second, hardened attack surfaces. This means fewer exposures anywhere an attacker might land. Third, detection of all threats. No blind spots, no noise, even against the latest AI-powered threats. Next, faster investigations and remediations because resilience comes from action, not just alerts. And then lastly, less administrative overhead because security tools should simplify your lives, not complicate them. This is the modern mandate. Fewer tools, faster action, stronger outcomes. So to achieve these outcomes, we've revamped the Singularity platform. It now consists of 7 integrated layers. First, our core platform. This is our new and improved auto scaling cloud-native architecture deployed in 10 regions worldwide, including our latest region launching next month in the Kingdom of Saudi Arabia.

The reliability, scalability and resilience of our platform is job 0. And this is something that we're continuously focusing on and improving. The next layer, our data platform. This is petabyte scale search and performance, now powered by Obsero AI for intelligent log collection against any data source. Getting data in now takes hours, not weeks. And the Singularity graph automatically correlates this data for graph visualizations and analytics. On top of this, we have our detection platform, 10 different AI-powered detection engines and now nearly 2,000 out-of-the-box detection rules that chew on those logs going into our data lake. We're also now producing new detection logic with unprecedented speed and precision by using Agentic AI internally by our detection engineering teams. Next up, we have our analyst platform.

This is our new singular operations center experience. This is the default experience for all new customers. It brings together unified asset inventory, unified alerts, unified exposures, plus modern dashboards and reporting to make triage and investigation easier. Next up, our attack surface protection products. This includes our core products around endpoint security, identity security, cloud security, plus our new prompt security suite for AI workload protection. At the very top here, we have our AI and automation tools. At the core of our platform's AI strategy are Purple AI and hyperautomation, working together to turn intent into instant action. The vision you saw here, which you actually saw both in Tomer's talk and in the innovation talk with Heather and Rachel is that Purple AI reasons, plans and acts autonomously, while hyperautomation deterministically executes response actions at machine speed. This allows defenders to focus more on strategy instead of just tax. Lastly, on the side here, we have our revamped Wayfinder managed threat detection and response services launching today. You heard about that a bit this morning.

We're going to go in more detail in just a bit. But the key here is that we're merging human intelligence with artificial intelligence to more effectively find people. This platform, these 7 integrated layers is what let us outpace even AI-powered adversaries. It's an integrated platform that's learning its fast as adversaries evolve. Okay. Let's s out now. From AI-driven malware to AI-targeted attacks, there's one truth, speed and autonomy now define cybersecurity. And the Singularity platform is built on a philosophy that turns that truth into action. You can think about this philosophy as 3 concentric circles. First, at the outer ring, we will protect every attack surface, endpoint, identity, cloud and now AI. In the middle ring, we will use AI, data and automation to act faster and smarter. At the center, we have people.

This is human expertise, yours, ours, our entire community of defenders because AI cannot win this battle alone. It must be guided by the wisdom of humans. We'll use these guideposts throughout the product talks today, so keep them in mind. So that's the story from evolving threats to outcomes matter that matter to the platform and philosophy built to deliver against those outcomes. The same forces transforming our attackers are also transforming cyber defense. And SentinelOne is leading that AI defense transformation. We're not just reacting to the age of AI. We're defining how to defend within it with the #1 platform for autonomous security.

Lastly, before I move on, I think you'll hear thank you a lot throughout the day today. But I want to give my personal thank you to our customers. Your partnership and trust is what makes SentinelOne what it is. You don't just use our platform, you shape it and now I'm going to hand off to my very talented [ TAM ] leaders to walk you thorough the details that how we can defeat adversaries together.

Hi everybody, I'm Braden, and I'm really excited to be here with all of you today. And I'm especially excited to share with you our vision for endpoint and identity. In a few moments, I'm going to bring a special guest onto the stage, but I'll introduce him when the time comes. We're at a kind of pivotal point in cybersecurity. We've established a new front lines in cybersecurity. And I think that together, we are redefining them.

Today, every vulnerable endpoint can quickly cascade into a breach. But these endpoints don't exist without a human or a nonhuman or an agentic AI entity, identity interacting with it. And I believe that we're uniquely positioned to deliver the necessary security and the protection in this convergence of the space, these 2 mission-critical attack vectors, endpoint and identity.

So when we think about this, I'm confident that with the right platform, unified, autonomous, empowered by AI, we're going to continue to stay ahead of attackers. And in my next 30 minutes or so, I'm going to walk you through how we help you stay ahead, how we help you defend better, how we help you outpace threats and how we help you get more out of your teams. Today's endpoint isn't just a desktop sitting within the 4 walls of your office. And defending that is a tale as old as time.

A lot of vendors are trying to solve it in the same old ways using the same old methods, not realizing that the attack surface is changing. They're not addressing the core source of the problem. That endpoint within those 4 walls, it expands. That endpoint can now be a mobile device. It can be a server in the cloud. It can be a developer's laptop sitting at home. It's a critical OT or an IoT system. It's a point-of-sale device. And at the same time, attackers are shifting their focus. They're not just trying to install and detonate malware on a system, right? They're focused on identity abuse. They're stealing credentials. They're using those credentials and elevating their privileges. They're moving laterally. And that's why our job cannot just be about detecting malware anymore either. We need to ensure that we're protecting every device, every identity and every connection in between them.

So I'm going to start with the story. And I'm sure it's a story that you've all heard before. Hopefully, none of you have experienced it yourself, but I'm sure you've heard it. An employee is on his way to work, really busy, really busy morning already at home, and he gets an urgent text message from his Chief Financial Officer. She needs them to approve an invoice ASAP. It sends in caps in the text, ASAP as soon as possible. So he knows it's important. There's a link in the text message. So he's going to be a hero. He's going to get to the office. He's going to have it approved. He's going to be the guy that saves the day. He clicks the link, Sees the login page, enters his user name and password, get some weird air message, doesn't think about it, maybe he lost connection or something on his mobile device. He'll figure it out when he gets back into the office. What he doesn't know, but I'm sure all of you do, that, that was a fake login screen.

He's entered his real user name and password and just basically handed them to an attacker. Now you have a bad guy looking a lot like an employee in your network. That attacker proceeds to move laterally, elevates its privileges, moves laterally again and lands on its objective, its target asset, compresses and steals credit card information or ransoms the entire environment. The company has been compromised, and it all started with a text message. That's why our mission is simple. We prevent every attack and respond with speed and intelligence. The endpoint is and will continue to be our focus, and we're not letting up. With the integration of identity, the advancements in our protections and the ability we can meet you where your infrastructure is, deploy in the cloud, deploy on-premise, deploy in hybrid environments in FedRAMP.

We have a really exciting future ahead. But before I talk about that future, let me talk about a few of the recent releases that we've had. First and most recently, we released day 0 support for macOS Tahoe. We pride ourselves on being able to support the latest operating systems as soon as they come out, allowing your users to upgrade, make sure that you can stay protected while your employees stay more efficient. We also really understand that we can't just rely on process and registry telemetry to identify these advanced attacks. So we just released enhanced network visibility. This provides advanced visibility on the network but from the host using that same agent that's already installed. It captures what the operating system misses.

It catches DNS running on nonstandard courts, and it flags evasive network behavior. We also understand that, that visibility shouldn't be just for our SaaS customers. On-premises and self-hosted customers need that same visibility, too. So we've enhanced our endpoint data gateway that allows you to maintain control of that data. You can now ship on-premises endpoint telemetry to our Singularity AI SIEM or any hack compatible platform like a Cribl or a Splunk. We've also made management easier with tag-based exclusions. We've given you control over live security updates and allowing you to control the local agent upgrades. But our ability to stop threats is why you continue to come back. You heard Steve Stone talk about the threat landscape this morning, and he threw out a stat. We stopped over 3 unique ransomware attacks per day. That means that by the time we all leave Vegas this week, there is a very good chance we would have stopped ransomware at least one of your organizations. And we're only doubling down. We're enhancing our static and behavioral AI detections to detect unknown threats, both known and unknown. In the past year alone, we released over 2,500 new detections to keep you protected.

These include things like privilege escalation, protecting against credential attacks, blocking malicious drivers. The list goes on and on. We don't just react. We anticipate encounter. When you're responding, milliseconds matter, and that's why we rely heavily on AI and automation. We're able to automatically kill and quarantine files so the infection can spread. We can also automatically roll back a system to its last known good state.

So you maintain continuity of operations throughout your response actions. All that telemetry that I talked about before, we stitch all these events together in a single storyline, so you know exactly what happened and how far an attack may have spread if it wasn't prevented. And by combining endpoint and identity, we allow endpoint detections to trigger instant remediation, and identity alerts can trigger policy adjustments or isolation. But what's the ultimate accelerator? You might have heard of Purple AI. Purple AI allows us to detect earlier, to respond faster and to stay ahead of attackers.

With Purple, you don't need to learn new query languages and feels like every vendor has their own. You don't need to have to memorize a 3-page query in order to type it into your system. You just ask a question. Hey, Purple, was anybody running malicious power shell or suspicious power shell in my environment? Is anybody trying to exploit this MITRE tactic or technique? Please write me an e-mail of your findings. Oh, I have a team in South America.

Can you translate that to Spanish or Portuguese? Purple is not just answers. It provides context, and it's not just fast, it's smart. In fact, our customers that use Purple AI on average, are able to manage 61% more endpoints. This ensures that your entire fleet remains protected. And we also believe that it's not just a nice to have. It's foundational. And that's why Purple AI Foundations is included in Singularity Complete. No extra SKUs, no per query charges and no limits. This is necessary to fulfill our vision of empowering every single analyst. And speaking of AI, Prompt security provides us a way to redefine data loss prevention. What do you do when the data leak isn't a file, but it's a conversation between a human and an AI or an AI agent and its tools. That's why you need AI-aware DLP to monitor every AI interaction because that could lead to a potential data leak. We do LLM traffic inspection to monitor the flow of data between users and AI and intercept potentially leaky prompts. It's not just mistakes that we're worried about either user mistakes. We need to defend against the list activity as well. So we stopped prompt injection and other jailbreaks.

And finally, you need to have visibility in your environment. And that's why prompt is able to discover shadow AI. So find all the AI that's in use within your environment, sanctioned or unsanctioned and put the proper controls in place so that you can make your employees more efficient while keeping yourself safe and compliant. This is how you harness AI confidently, unlocking innovation while keeping your data secure. So the next time you're asked, are you down with DLP, you can confidently say, yes, you know me. Thank you. I thought if I got one laugh, it would be worth it. We got more than one. All right. So now I want to bring this to life. I'm going to welcome on stage Travis Baguso, Senior Security Engineer from Hawaiian Airlines. Travis. Travis, thanks for being here. So I know you and I talk quite often, but I'm really excited that we're going to be able to share a lot of the innovation that your team is doing leveraging SentinelOne. Before we get into that, I kind of want to start at the beginning. Can you talk a little bit about when you were looking to replace legacy security vendor, what were you doing? And why did you choose SentinelOne.

Thanks for the introduction. In 2018, we were then customers of a legacy provider. And we were in the market not only to improve our defensive posture, but we also wanted a product that would provide us the telemetry to be able to make use of our threat intelligence feeds and other intel that we were receiving for small items like being able to retroactively look for IOCs in the environment going back an entire year to be able to detect or see living off of the land activity before anything serious comes to fruition.

One thing I would like to also mention is when Ranger now Network Discovery was released, not only was it critical for that to meet certain regulatory requirements, but after using the product or using that capability, we were able to detect other rogs on top of the network like vendors connecting to a docking station, knowing, of course, they weren't supposed to, to endpoints being on top of wireless networks that are reserved for certain applications and, of course, kind of to bypass security controls. So that's kind of a short intro to our origin story with SentinelOne, where we then became customers in 2019.

And thank you for that. And I'm sure you still face challenges today, and maybe some of our audience can relate to them. Can you talk about some of the challenges you face, maybe unique to your industry, but maybe not?

So much like the manufacturing and the health care industry, the transportation industry where the airlines fall under is no exception to its uniqueness. There are several applications from vendors specific to airlines that don't like process injection for that enhanced modern capability. There are certain applications that have extremely high readwrite, execute and delete these text files with one line of critical data that happens with thousands -- hundreds of thousands of transactions. And of course, with the agent monitoring everything that's going on, this, of course, will increase CPU memory resource utilization on top of the endpoint. A credit to my colleague, Steven Arroyo Sandoval, that has helped the organization -- my organization along the way to help addressing a lot of these issues.

One of the -- and for the incident responders for the SOC folks in the room, one uniqueness for my industry is that our -- well, it's unique to others, but it's -- our workforce is globally dispersed. We have pilots, flight attendants, also employees flying for business that can log in, in one location and show up in another merely hours, even in 30 minutes later. For example, we have an employee or a flight attendant checking their e-mail coming out of Honolulu right before a flight to Haneda in Japan. And of course, on our airplanes, we have Starlink, so they are able to connect. They could check their e-mail, an employee or a flight attendant could check their e-mail an hour later. And of course, once you hit a certain point over the Pacific, satellites are going to change. So now their activity will look like it's coming out of Honolulu that instant, it shows up like it's showing up in Japan.

Now for the incident responders, we, of course, see this, hey, that does not look right. Unusually, it screams compromised account where one log in here, another log in suspiciously almost across the world. So that would be one of the uni unique items for the -- for our organization. One of the things that we did do is when custom detections were released, what we now call [ SAR ] rules and credit to Gregory Santee and Emily Koh, who spearheaded this effort within Hawaiian Airlines is using custom detections to reduce the noise so we can stay on top of the signals that we're receiving and address some of these items that are unique to geographically dispersed organizations. And to that, we were able to zone in and stay on point and reduce the mean time to respond for events.

It's interesting. In our industry, we refer to the impossible traveler problem as a classic example of like an identity-based attack, something log in from different areas. But in your world, it's a possible traveler problem.

Every day.

And I'm glad to hear how customization has helped you with Star rules. That ease of use is something that we take very seriously. And I think one of the ultimate ease of use things we have is Purple AI. Can you talk about how Purple has advanced your team?

So when we were able to start -- or to begin using Purple AI, one of the great benefits is, especially with alerting and events is the summary that it provides. For a lot of the seasoned analysts out there, it does -- it can even take just as quick as a few minutes to be able to figure out, hey, what happened, who's the 5Ws, where and why? But with Purple, we get an upfront summary of everything that is going on, on top of the exit telemetry provided on top of the platform.

Has this been seen elsewhere? And then being able to use Purple to now expand on that blast radius, where else has this been seen in the environment? Or are there any indications of this about to happen elsewhere in the environment. That would be one of the use cases. And everybody has heard it before, Purple AI, being able to build these queries, sometimes -- especially for you, junior analysts, power queries may be a little bit intimidating, but it does provide that customization to be able to see what you specifically need for your use case. We can use Purple. We've used Purple AI to help build these queries and then from there, build that base query, modify it to our specific use cases to be able to provide that extra telemetry, summary or any -- or the conclusion to be able to then action as needed. Those would be -- and that would be one of the other ways we've used Purple. And hey, if you want a quick spot check like seeing if anything is being explored in the environment, even something as simple as, hey, what are the last Chrome extensions that have been installed in the environment in the last 7 days, it creates that query, provides you the results, you can then export it. And of course, you get those extension IDs and you can cross-reference what those extensions actually are and be, hey, that -- yes, that extension doesn't -- that definitely doesn't belong in the environment. And then you can work with your respective teams or we've worked with our respective teams to be able to action that to make sure that our environment stays as pristine as possible. As we all know, it's an ongoing effort. It's job security, but Purple AI has definitely helped us along that route.

Cool. Yes. I just have one more quick question for you. I mean I talk about it, maybe it's a bit self-serving, but I think we're seeing a lot of convergence or consolidation happening, whether it's attack services or tools or platforms. How is that consolidation playing with you and your teams?

So one of the things I like about SentinelOne is every time a new feature is released, a lot of -- before this would scream another agent. Now, everything is being combined into one platform, one unified platform. Having that extra agent, especially with the new capability that you're going to get, it just causes friction with your other IT teams having to justify and explain, oh, another security agent, in their mind, oh, it's another security agent on top of our systems that could take up memory system resources or potentially causing issues.

Now -- especially with identity, having everything combined into one unified platform, all you need to do is either upgrade -- upgrade the agent to enable the capability, but it's already there for us. There's no extra having to install something else, go through the -- well, you have to go through a change, of course, but it's not the long process of trying to introduce a new agent to your environment. Everything is already there, and that definitely has helped the use or the acceptance of a security platform being broadly used in the environment.

Awesome. Well, I really appreciate you coming out. And more importantly, I appreciate you being a long-time customer of ours, partner of ours. Your feedback has directly made our product better, and I hope we can continue this relationship for a long time.

Of course.

All right. Travis, thanks so much. All right. So Travis just told you how we're currently protecting his environment, all the things that he's using. But what are we going to continue to do for you over the next 12 months? I'm going to give you just a few of the highlights that are coming. We do have a dedicated road map session tomorrow that I hope you're all able to attend on endpoint and identity. But here's just some of the highlights.

First, we're going to be releasing application control. Application control will allow you to set default deny policies and only run the software that you approve to run on an endpoint. This helps you increase compliance and make sure that you stay protected.

Second, I talked about that network visibility earlier that we've already released and you have available. We're going to be building really advanced network-based detections, but on the host for you. So being able to identify communications with C2, advanced lateral movement, or people trying to hide their communications on the network, attackers trying to hide their communications on the network. You're also going to see a lot of improved management capabilities. Just a few are around exclusion hygiene or hit counts for your exclusions, auto exclusions, so you don't have to write these things anymore. We're going to identify what's happening in your environment and give you the exclusion, so you don't have to worry about it. Again, ensuring that your operations remain efficient as we protect you. Those are just a couple of the highlights, and I really do encourage you to join our road map session tomorrow, but we'll go deep on both the endpoint and the identity road map.

Speaking of identity, we know that attackers don't just stop with that initial intrusion on the device. In fact, we know that they want your credentials. Identity attacks have surged over 70% in the last year alone. And now more than half of the attack, or techniques, that are defined by MITRE are identity focused. To protect against these types of attacks, most organizations are forced to manage different disparate tools. So you have console hopping that introduced mistakes that introduces risk. That's why I'm really excited to introduce to you today our new Singularity Identity Solution.

Our new Singularity identity simplifies identity protection at the identity layer. If you're familiar with our identity products today, you know that we have 3 separate use cases that we support. Identity detection and response, identity for identity providers, identity for IDPs. And number three is identity for security posture management. That is now all going to be delivered into a single SKU.

One thing to buy, making purchase so much easier. It's also going to be delivered in that same agent. Travis talked about this, a single agent that gives you protection across all of those use cases, making it easier to deploy. And it's all managed by the Singularity platform, one platform. Making it easy to use. So for you, our customers, makes it, again, easier to deploy, easier to use and more powerful protection delivered in that single agent.

And we're not stopping there. We've recently introduced policy-based conditional access. It's currently in beta. Policy-based conditional access gives you granular control over policies and for your identity behaviors. You're able to define risk-based rules that in the moments we see suspicious activity happening, we can stop it. For you, the security teams, this means continuous adaptive protection, and the confidence that identity attacks are stopped in real time and on your terms.

The convergence of endpoint and identity is the new front line. And that's why we're always thinking about not just the device, not just the endpoint. But the human and nonhuman identities that are interacting with it. The AI agents that may be running or query, and we protect against all of it. So let me go back to that story that I talked about at the beginning.

I think it's plainly obvious because you're at a SentinelOne conference that, that was not a SentinelOne customer. Because if that was a SentinelOne customer, as Ely mentioned earlier, we protect across the entire attack surface. That initial mobile phishing text, that phishing text, Singularity mobile stops it. Stolen credentials, elevating privileges, moving laterally, Singularity identity stops it. Data exfill, ransomware, singularity endpoint security stops it. Again, we protect against across the entire attack surface. The attacker doesn't stop at the initial intrusion device, and neither do we.

One final point here is that it's technology and people together that stop threats. Our AI and automation makes human analysts better, and makes them smarter and it makes them faster. And we're going to continue to innovate in this area so that you can stay protected and have the most effective, efficient protection available. And we're building more than features. We're delivering a unified autonomous platform where endpoint and identity and mobile, they're not separate domains. Where telemetry fuels intelligent decisions. Where response is instant, and where people, the analysts, you, are always in control. Thank you very much for your time today. I really appreciate you listening to me. I'm hoping that I get to see all of you throughout the rest of this conference, go to our road map session, go deep on our detections, they're all going to have sessions tomorrow. Thank you very much. Have a great rest of the show.

Please welcome Senior Director of Product Management for Singularity AI SIEM, Adriana Corona.

Everyone. I'm so excited to be here. And last year was a highlight for me. But I'm even more excited this year because we get to talk about all the progress we made since then. And it was actually here at [indiscernible] that last year, we introduced the autonomous security maturity model. And it wasn't just a product vision and it wasn't a product road map. It was actually a new way of thinking about how security teams can transform how they work over time. And since then, it's gotten really wide adoption. It's changed the way that the industry thinks and talks about AI-driven security. Also since then, we've just been really hard at work just building it. So today, it's going to be more about what it's like in practice.

On my team, our mission is for security practitioners to love their work. And that means for us, when we talk about real AI innovation, what we mean is how are we impacting how security practitioners are working? Are we making it more efficient, but hopefully, more enjoyable as well. And that is why I won't just be here alone on stage today. We're going to bring out the practitioners, the experts and the customers who are driving this transformation with us. We're going to hear from our own customer zero, our SOC team. And we're also going to hear from a customer about their journey from a legacy tool to AI SIEM.

But before we bring them on the stage, let's just recap briefly what is this maturity model all about. The maturity model is a road map to help organizations chart their course toward a more autonomous future. And it starts with some levels of manual and rule-based approaches, followed by AI assisted, then partial autonomy and finally, high autonomy. And what you're seeing at each stage is more advanced AI and automation that will save you time, and it's doing more of the work on behalf of the analyst, so that your security teams are freed up to be more proactive and more strategic.

What we want is a future where the SOC analyst is actually supervising, monitoring the work that is done by the AI systems. And our vision, for security operations, is to elevate the human analysts. We're not here to replace the human analyst. In fact, we believe that it should be a symbiotic partnership between the human and the AI systems that we're building.

And we've been doing this for over a decade, by the way. In fact, if you are a current customer of Hyperautomation and Purple AI, you may not realize this, but you can already operate at that Level 3, or the partial autonomy. You're way beyond the manual and rules-based approaches. And really, what we're trying to do is shift the balance of power back to the analyst. That way, the analyst can focus on the critical tasks.

I really liked how Rachel put it. If you heard her in the innovation session. She said, you focus on the strategy, let the AI take care of the chaos. And that's really the vision that we're working toward. But I also want to mention this in action. What does autonomous security look like in action?

Starting with extended visibility. For us, that means a streamlined AI-powered data pipeline that actually eliminates 80% of the noise before it even reaches your team. That also means 100x faster querying than a legacy SIEM. And teams adopting this model for working, they're already seeing results. They're detecting faster, in fact, 63% faster. They're responding 55% faster.

But the most important part, and we've been reiterating this throughout the day, is the core. At the core of this model is what matters the most, the analyst expertise. And like I mentioned, the goal is not to replace the human analyst. The goal is to arm and empower the human analyst. We're amplifying human intelligence.

Now let's talk about this in practice. I mentioned that's going to be the theme of today. Autonomous security, it's not just a theory, a vision, or a model. It's actually a new way of working. And it's actually how we're already operating today. So you'll even see some examples of that in action on this stage. So how do we actually get to that Level 4, or the autonomous -- highly autonomous security?

It's not just a collection of products. It's actually a strategy that we've built in multiple layers. So let's build it together right now. It starts with the foundation of full data visibility. You can see that as the foundational layer here, and it fuels the entire system. That's where we have a single intelligent data stream that is now powered by observo.ai and with built-in intelligence. And if the data is actually the fuel, agentic AI and automation, that's the brain of the system, where AI SIEM is your security workbench, Purple AI is your smart analyst that's responding and investigating, and Hyperautomation is executing the actions.

Both of those layers are reinforced by the topmost layer. That's where we actually have governance and control, where we can protect your endpoints, your identities, your cloud assets and now with the introduction of Prompt, also your AI applications. But the most important thing is that all of these layers are there to elevate and amplify the most critical ingredient that we mentioned earlier, the human analysts and the human expertise.

So these are the ingredients. Let's talk about them each one at a time, starting with that foundational layer of data. So we knew, because our customers have so much data, that actually it's cost prohibitive. Our customers already could not afford the visibility that they need. And so for us, solving that fundamental data problem was just not negotiable. We knew we had to go beyond simple ingestion, and we needed an intelligent data streaming platform that could deliver data faster but also at a lower cost. And now over the summer, you may have noticed like splashes in the news in the market about acquisitions in this data pipeline space. And the only thing I will mention about that is that while the competition was focused a lot on the headlines, we were just heads down on technical evaluations.

So we did a deep technical evaluation over months of 11 vendors. And after that evaluation, Observo AI was undeniably the top, the winner. It was the only platform capable of actually powering that foundational data stream that's going to power our autonomous SOC. And as you heard earlier today from Gurjeet and Tomer, Observo AI is now available. We're also hoping that customers will want to use our integrated beta, and this is the integration of Observo AI into our AI SIEM. What you get with that integration is actually out-of-the-box pipelines that are already optimized for SIEM, and they're actually feeding data directly into the core of our AI SIEM. You're also going to get better visibility and transparency, with really easy-to-use dashboards for health monitoring of your data pipelines. So you'll be able to see data volume by source. Even if there's anomalies in the data volume, you'll be able to see the cardinality of different data properties and measure things like CPU or memory utilization.

And we know that the challenge with data is actually not just the volume of data. The challenge is that the types of data have also fundamentally changed from high cardinality fields, to millions of assets, and a very diverse ecosystem of cloud logs. So that's just the new normal. And what that means is that legacy SIEMs are being rendered obsolete. And that's why I'm also very excited to announce that we're releasing an industry-leading improvement to the query scalability on our platform. And I'll tell you what that means in practice. What you're getting is a 20x improvement in high cardinality concurrent queries.

And just to give you an example of what that might mean. Imagine that you're searching like show me every instance for each user of a failed login event. Now in a very large enterprise, the user property, that actually can have millions of fields, millions of values, and you've all maybe experienced this in your own organizations. So that means a query like that would be very, very slow, or it would have a huge memory footprint. But more than likely, what happens is it times out, or it fails. But with our new introduction of scalability, our AI SIEM will be able to answer that same question within minutes or seconds. And that's even with the highest cardinality data even over months and even under peak loads. So that combination of AI SIEM, powered by Observo AI data pipelines, and our 20x improvement in query scalability, that brings massive advantages.

Starting with Observo AI acting as the smart filter. It filters out the noise and optimizes the data for use downstream with AI SIEM. It also prepares it for our index-free architecture. And it's that architecture that allows us to have really fast, high cardinality queries at scale. And of course, both of those elements actually compound benefits. You have better, smarter, faster data being fed into your AI SIEM, and you're able to query it at scale faster than on any platform. And those two things lead to faster response and the ability to automate response faster.

And great. Of course, when we talk about response -- when we talk about autonomous security, right, you can't talk about it without talking about action, without talking about response. That's where Singularity Hyperautomation comes in. Now we believe that complex automation should not be done only by advanced programmers or dedicated specialist teams. And that's why we built an easy-to-use no-code canvas. It's embedded directly in the platform. It empowers your teams to build flexible automations with confidence, even really complex automations. That really frees your analysts to focus on what matters because they're not doing that manual work anymore. And the combination of Purple AI with Hyperautomation, it's there to fundamentally up-level your teams. So they can worry about what they do best, things like targeted threat hunting, being proactive, being strategic.

Of course, it goes without saying, we're building out-of-the-box agentic actions and workflows. Those will do the work for you. But at the same time, we're empowering builders and partners. Those who are ready to push the limits of what's possible with agentic AI. And as Heather and Rachel announced earlier, we're so excited that as of today, our open source Purple AI MCP server is available on the GitHub and you can use it now.

And I'll tell you a little bit about how to think of this MCP server by analogy. In the past, you'd use maybe brittle, API calls, one-off API calls when you needed the context of your full ecosystem. An example would be like trying to learn a new concept by reading a book line by line. That's the old way. The new way is like having access to the author of the book that you can ask questions of at any moment. That's the new way with Purple AI MCP server.

So imagine creating your own agents using a framework like maybe Amazon Bedrock or Google Agent development kit. Then imagine using whatever foundation model you want, maybe OpenAI or Anthropic, maybe something that you've built yourself. Then imagine giving that access to Purple AI MCP server, which actually grants access to the full context of the Singularity platform to make decisions. So instead of imagining, let's go through an example.

In this example, what we're going to go through is trying to secure your software supply chain. So here, we have a developer, let's call him Alex. He's about to make a bug fix. So he's merging code to fix a bug, or at least that's what it looks like to us. What we don't realize is it's not Alex at all. It's an adversary trying to inject malicious code knowing that your CI/CD pipeline has automated merging. But the good news is you can have an action triggered with GitHub actions that calls our Purple AI MCP server and asks questions in real time. Questions like what device is Alex using? Is that device showing any signs of infection? Does it have open EDR alerts? Does it have any critical vulnerabilities that are not -- that haven't been patched? And if the answer is yes to any of these questions, you just actually block the merge. So what that means is you stop the attack before it began.

And now I want to point out that's different than the traditional sense of when we talk about shifting less in security because it's not just scanning code. What we're doing is actually validating the integrity of the developer's environment in real time when it matters the most.

And that's just one of many examples of what's possible with Purple AI MCP server. The possibilities are limitless. And I'm sure we appreciate that example. But what I'm most excited about is seeing it in action. So we're going to bring out our own SOC team to talk about how we've been transforming security operations at SentinelOne using exactly these techniques.

So please help me welcome to the stage, Carter Church. He is the master mind. He's the architect behind the autonomous transformation of SentinelOne's own SOC team.

Welcome, Carter. Well, I have to say I've been hyping you up. So we better get to it really quickly because everyone is anxious to hear how have we been transforming our SOC?

Let's do it. Yes. So our own security team, the ones on the front line here at SentinelOne, we've been on a journey to build a truly autonomous defense. We've used our own products, things you're all familiar with that we've talked about all day, AI SIEM, Purple AI and hyperautomation, to build a framework that's saving our analysts thousands of hours, and fundamentally changing the way that we approach security.

And what can you tell us about SentinelOne's environment?

Yes, it's really complex. We aren't just a typical enterprise. We're a prime target for the world's most sophisticated adversaries. And every day, we ingest and analyze an enormous volume of very granular telemetry. And that data is the ultimate prize.

By compromising a security vendor, a threat actor gains access not only to high-value targets, but also to the various systems that we use to defend against them. It's the ultimate supply chain attack. So all this means that having the capability to tame today's data explosion isn't optional, right? It's a strategic imperative that directly impacts global security and trust. And so all of this requires more than just standard enterprise tools. It requires foundational scale.

For SentinelOne, we operate a massive hybrid cloud infrastructure. We generate petabytes of security telemetry. We ingest events from thousands of unique sources. And so before we could even think about some of these things, we had to solve this data problem first, right? This is exactly why AI SIEM is the cornerstone of our operations.

The performance and scalability you mentioned earlier, Adriana, are just critical for us. It means that our analysts can run massive complex queries across petabytes of high cardinality data and get answers in seconds, not hours. So having a powerful data foundation isn't just some nice to have. It's truly the only way that we can hunt at the speed and the scale that our adversaries operate.

And while being able to search at scale and quickly is obviously essential, but that doesn't actually stop any attack. For that, you have to respond. So what's the next step for you.

Yes, it's a good question. So all that data is just fuel for the Hyperautomation engine that I'm about to show you. When we think about traditional automation solutions, they typically involve building individual workflows for every single alert based on its type.

But long term, that approach just doesn't scale and creates a lot of technical debt. And so instead, we started by defining these broad functions that could be reused across a variety of alert and response scenarios. And this meant that instead of just building new workflows for every single new alert that we onboard, we could just reuse these already existing functions.

But after this, we had a realization. So once we had these functions, we needed something that could understand which of them to call for each unique alert coming in. We needed something that could look at each alert, like an intelligent engine that could look at an alert based on all of its fields, not just on some alert type, but on all of the details that make that alert unique, and then determine the exact enrichments or actions that specific alert needs for response. And so we built that.

A Singularity Hyperautomation workflow that loops over an alert that gathers context from sources like previous alerts and relevant playbooks, and even telemetry from AI SIEM. This all feeds into a model that decides exactly which of these enrichments to call and what parameters to pass.

That's incredible. And I want to reiterate something you just said because it's the model that's deciding what action to take. It's working on its own to make those decisions. I also know you were one of the earlier adopters of the Purple AI MCP server. So how have you been using that.

Yes, we're pretty lucky. So Purple AI's new MCP has been one of our most exciting integrations so far. With this, we can leverage all of the intelligence of Purple AI in our own customizable and automated response. And this means we can do things like build, or query, or summarize, or even do AI SIEM data lookups for the analysts before they even begin their human response. And so it's just been a total game changer for us. We love it.

One thing that I find inspiring and fascinating is that our own SOC team, they were facing the same challenges that I hear every day from our customers. So being burdened by alert fatigue and a lot of manual actions to see the transformation in our own team has been incredible. But I'm sure if everyone here has also faced that challenge, I'm sure you're all very interested in the results. So can you tell us what's been the outcome of that transformation?

Yes, absolutely can. So this system saves a ton of time. We're saving over 100 hours a week of manual analyst effort. And that's time that we can give back to our analysts directly, right, for all the things that you talk about, with being able to do kind of higher order and more complex tasks.

On a per ticket basis, we're reclaiming over -- or sorry, we're performing about 75% of all regular investigation steps. But most importantly, when an analyst comes in, all the information is already there, ready for them to do a final check, not to kick off an extensive investigation. This is the difference between 30 minutes of manual analyst effort on a ticket and 30 seconds of due diligence.

30 minutes to 30 seconds is incredible. Now I just wonder what it's like to be a SOC analyst at SentinelOne today? When I show up and the majority of the work is already done and the system sometimes even escalates to me what to do. I know you're going to give us an example of an action.

Yes, we've got an example right now kind of going on the screen. So in this case, analysts would have come in and seen a weird Okta alert for a user resetting their password from an anomalous location. And all the analysts in the room know that we could spend countless hours investigating that and comparing and cross-referencing context from so many disparate sources.

But instead, our system surface all the relevant details, including the fact that this employee had no recent approved work travel to this location. But we didn't stop there. We can integrate with Slack. So we reached out to the employee on Slack and asked them, "Hey, are you aware of this? Have you been traveling?

And of course, they responded, no, I have no idea what this is. So what may have otherwise just set in a queue, until an analyst came in and performed some manual investigation, was immediately investigated and worked. And those findings meant that it was prioritized for response first.

That's incredible. And I have to say the first time I've seen people like watch some of this in action and see it come to life and work. Their response is usually like that head explosion emoji, because it is remarkable how much time you're saving. And it's great to see the technology spring to life here.

Right. Yes. So it's just really cool. Honestly, it's been such a cool system. What you can see on screen right now is what we would actually reach out and surface to an analyst. And so this is as an analyst, you're coming on to something that's already been investigated. Where this information has already been brought to you. And again, it's your job to make that final determination.

That's amazing. Thank you so much for being here and sharing this, Carter.

Thanks so much for having me. And for those who want a much more technical deep dive into how this all works, we have a dedicated session tomorrow at 2:15. So hope to see you all there. Thanks again.

I'll definitely be there. I'm sure it's going to be very popular.

Let's do it.

Thank you, Carter.

Thanks so much Adriana.

Well, I have to say that I feel very lucky because at SentinelOne, we get to build tools for security practitioners. But we also have incredible security practitioners in-house, like Carter, like our SOC team, also our MDR analysts and investigators.

Some of them are in the audience here. Our detection team, our threat hunting team, our incident response team, these are all examples of people in the front lines at SentinelOne, who we consider to be our customer zero. And sometimes they're the very first users of our new features.

We're also very lucky because we have a thriving beta and UX Insiders program. And if any of you have participated in that, that means you've gotten early access. So from ideas to prototypes, sometimes you're the first to use a feature. So I also want to thank any of you who have participated and helped us learn and helped us be better. And needless to say, we really try to keep the practitioner and focus here when we're making decisions. So in that spirit, I'd love to bring a customer up to talk to us about their experience and journey.

Please help me welcome Rod Goldsmith from YKK. He is a cybersecurity leader. Welcome, Rod.

Thanks for having me.

So you all may not know this, but you're probably a customer of YKK because YKK is the leading manufacturer of zippers and fastening products.

That is very true. We actually produce enough zippers to go around the world 80 times per year. We are located in 72 countries. And outside of zippers, we actually produce products such as buttons and a competitive product to what most people know as Velcro as well.

Wow. And I know when we first met, you weren't running AI SIEM at all yet. You were actually on a legacy endpoint tool. So just curious what was that tipping point or what was the pain you were feeling that made you realize the legacy tools just weren't -- they were a roadblock? They weren't working?

Yes. Pretty much our legacy vendor were not really focused on innovation too much. So we had a legacy tool that wasn't giving us the security value that we needed. We had agents deployed, but we didn't know if the agents were working. So it's really like a back and forth trying to see if that value was really there for us. So after doing a gap assessment, identifying all the critical gaps that we had, we look for a solution that could give us a better outcome and SentinelOne was that product for us.

That's great. And I know you were also -- you've been a customer for about 18 months, that's right. You were looking for a data platform as well in SIEM. You also kind of skipped over any of the legacy players. You went straight for AI SIEM. So I'm just curious, how is it going so far?

Well, the change for us has been immediate. We've seen the value immediately. We have a fundamental visibility of a lot of critical resources now. So I'm very happy about that. Our Internet-facing devices are critical applications. We have all of that rolled into a central platform. So that value for us has been critical, critical, very critical.

And your team is also using Purple AI. What have you seen? Have you seen any time savings? Has it changed the way you've been working?

Yes. So our team is very lean and our security program is very new as well. So Purple AI has helped us a lot in just having that real-time information on those alerts. Our analysts are able to have more trust in what they're seeing. And for the sort of episodes where there's a question to what we are seeing, we have expertise on site as well to help with that sort of that gap fill, too.

Yes. And we were talking about AI and automation earlier, not just Purple AI. I was actually kind of surprised by your response because you said you think autonomous security is inevitable. So I'm just wondering why do you think it's inevitable?

Well, threat actors are using AI at a very constant and increasing pace. They're finding a lot of use cases. So it's going to be hard for humans to keep up with that level of volume that's coming in. So having automation to help us minimize those alerts, minimize that noise and see what's really out there is going to be crucial for our long-term security posture.

That's great. And we've also been emphasizing throughout the day the importance of human expertise. So how do you think that fits into your SOC and your team?

Yes. Like I was mentioning a moment ago, AI is perfect. It's not going to be a silver bullet for everything, but having that expertise on site for when there are those rare occasions of something being questioned, we can have that extra level of comfort knowing that we are -- we can believe what we're seeing or if we need to take other actions, we can do that as well.

Great. And what do you think -- looking forward, what do you think is your biggest opportunity to use AI or to use automation?

Well, I'm very excited about Hyperautomation. I was looking into that before coming to this conference, but that was also a big reason for me being here as well to get more ideas on how we can make use of that. So I love the information that Carter Church presented to us today. And also, I think his name is Sean Stugart yesterday as well. I gave a lot of good information, too. So very excited about that. And I think that will help us be more efficient, maintain a lean team and also push our posture ahead.

Yes. Like you mentioned, seeing what Carter's achieved with our SOC. I think we're also excited to see what our customers are going to do with the same types of techniques, especially now with the MCP server release.

Yes. Looking forward to making use of that, too.

Well, I want to thank you for being such an active participant in our community and helping us learn from you as a customer. Thanks for being here, Rod.

Thank you.

Well, if there is one thing I hope that you take away from the last 30 minutes, it's that autonomous security, it's not a theory, a vision or a road map. It's actually real. It's a new way of working, and it's a way that we're already operating today at SentinelOne, and the way our customers are operating as well. So let's just recap what we've announced over the last 30 minutes.

Firstly, Observo AI integrated with AI SIEM, and we're looking for customers who want to be first to test it out. We also increased the query scalability by 20x for high cardinality queries. And like I mentioned earlier, by the way, this is an industry-leading update. And finally, we launched Purple AI MCP server. So that's going to help everyone here who's ready to embrace agentic AI approaches to start using that for your own workflows.

Now we believe that using AI is not actually just about doing more with less, which I think is a common misconception. We think it's about doing more but with more intelligence. So we imagine a future where automation is reducing the noise and automating a lot of the mundane tasks, so that it frees up your security teams to do what they do best. And we also believe in a future where that human expertise, it's not just at the center, or the core. It's actually the driving force of security operations. And so far, what we've been talking about is how SentinelOne is using AI to build tools for security practitioners. But now it's time to talk about that other side of the coin.

Over the last 2 years, as I'm sure everyone is well aware, businesses have been racing to adopt AI in their organizations. So for everyone here who has seen that change and that revolution, you've also noticed that double-sided coin. Where on the one side, it is the incredible promise of using AI to accelerate your teams and your organization. But on the other side, there's a hidden risk. Because the very AI models that our businesses have grown to depend on, they are now our new and most critical attack surface as well. And the dangerous truth is that in this race for innovation, very often securing AI has been treated as an afterthought.

But at SentinelOne, we believe that's actually a false choice. The only way forward is with an end-to-end platform where we're using AI, not just in the front line, but we're also providing the tools for governance and control to secure and protect the AI that our businesses have grown to depend on. And after the break, we're going to hear from Itamar Golan, and he's going to walk us through that next frontier of securing AI. Thank you very much.

[Break]

I messed up my ankle, so I'm sitting today if that's ok. Nice to meet you. I'm back. We talked already about AI. AI is everywhere. Everybody using it. It's baked into almost everything we do. So that's a no-brainer. I want to skip that slide and talk with you about something else.

AI is moving so fast, but as AI adoption accelerates, there is one question, I think, we don't ask enough. Are we building all of this innovation on a secure foundation? Question mark. Because in the rush to move fast and deliver more and build more, many organizations have made a silent trade-off. They've chosen convenience and speed over security. And that choice has created something new, a new attack surface where the most sensitive data lies and where traditional security tools simply can't see.

So what does this new attack surface look like? It's not theoretical. It's not a future concern. It's happening right now. We hear it from customers every day, all the time. They ask us questions like, how do I stop my source code from leaking into AI model? How do I know that the AI agent I'm using is not poisoned? How do I protect my AI apps from prompt injection or jailbreaks? Those aren't science fiction scenarios. They are the new front lines of cybersecurity.

We've all seen the headlines. Even the biggest tech companies already suffered from data leaks. Some employees, I'm seeing my employees doing it all the time, pasting sensitive data into AI models. But it doesn't stop there. Researchers have shown that a single carefully crafted prompt can hijack an entire AI system, tricking it into ignoring its own safety rules and doing things it was never designed to do. Those aren't isolated mistakes. They are symptoms of a deeper problem, a lack of security at the very core of AI adoption.

The role though is starting to wake up. New governance and compliance frameworks taking shape. Take the OS Top 10, for example, by the way, co-authored by members of the prompt team, a framework designed to help organizations embrace the power of AI and find the most critical threats of AI. And luckily, it's not alone. We have also the NIST, AI risk management framework, along with others around the world, helping enterprises build the foundation for responsible secure AI adoption. It's clear now. The world luckily, isn't just excited about AI anymore. It's becoming accountable for it.

And it's not just frameworks. Regulators, although it takes them time, they are catching up too. From the EU AI Act to California's new AI law and many others, by the way, on the horizon that I'm familiar with, governments are beginning to set real boundaries around AI can be used. That means security risk and compliance teams now have to answer some really tough questions. Questions like, how do I stop my sensitive data to get into AI application? Which AI applications my employees are using? And most importantly, do I have enough visibility and policies to enforce in place?

The good news, I'm not only talking about challenges and problems and issues. We are already solving this. Our AI security problem has helped dozens of organizations around the world to embrace confidently AI. And today, I couldn't be more excited to share some big news with you guys. Prompt security offerings will be available on the SentinelOne price list as early as next week. And thank you, guys. And that includes prompt for employees, prompt for AI code assistance, prompt for homegrown AI applications and prompt for agentic AI. Now we will dive into those. We can start from prompt for employees.

That solution gives organizations across the company complete security visibility and governance over how AI tools are being used, empowering employees to use AI safely without slowing them down. And that's the key. Some employees, by the way, and the data shows that are using today more than 50 different AI applications on a weekly basis. That's crazy, often without IT, or security even known.

Many of those tools, by design, train on the data they receive, which means that an innocent copy paste can easily become part of the next AI model. That is fueling the rise of shadow AI, in my opinion, quickly becoming one of the most serious threats for enterprise security.

It all starts, like always, in security with visibility. You cannot protect what you can see. Prompt instantly detects and monitors every AI tool used across the company, revealing shadow AI, spotlighting the riskiest apps and users, and giving security teams the clarity and confidence to act. Out of the box, it supports more than 15,000 AI applications.

Next is data privacy. Prompt automatically prevents data leaks in real time with privacy enforcement. So sensitive information never leaves the organization no matter what tool or prompt is being used. And because security isn't just about control. It's also about education. I'm a huge believer of education. Prompt delivers real-time employee awareness through gentle in context coaching. When someone, when your employee takes an unsafe action, prompt doesn't just block it. It explains why, helping them to learn, to adjust and build safer habits over time.

Next, prompt for AI code assistance. With that organization can embrace tools like GitHub Copilot and Cursor and Tab9 and Windsurf, unlocking developer productivity without compromising on data security or compliance. I must tell you, AI code assistant is not a trend. It's a revolution. Gartner predicts that by 2028, 90% of the developer will use AI code assistant, delivering an increase of more than 30% in development velocity. So it's no surprise that this is becoming the benchmark, the baseline for any modern development team.

But with that comes a whole new set of challenges. Sensitive data like API keys, secrets, PII can be unintentionally exposed. And in some cases, end up even use the next model behind them, the LLM behind the scenes. And on the other side of the equation, I'm not talking only about the input on the output, AI-generated code can introduce new vulnerabilities and risky dependencies straight into your code base. That's where prompt steps in. It automatically reacts and sanitizes code in real time, preventing the exposure of any sensitive data before it ever leaves the environment, so developers can work faster, safer and with complete confidence.

I want to move to prompt for homegrown application, our third use case. There you go. Almost any organization these days is already building some applications, some software powered by AI. Whether it's a simple support chatbot, or a complex AI agent, AI is key for any business to stay relevant and competitive. But like previously, that introduced a whole new set of risks. Things like prompt injection, jailbreak, adversarial attacks, data leaks and many more. Those didn't exist before the age of AI and traditional tools simply not built to handle them.

Prompt makes it easy to protect AI apps from all of those threats I've just mentioned. With Prompt, app developers get real-time protection right at run time, and it takes only one single line of code to set up. We also address data protection. If you are building an AI app and connecting it directly with third-party LLMs, we make sure nothing is leaky. Put simply, we ensure your AI apps do not disclose information they aren't supposed to even when prompted to do so, no pun intended.

Next is content moderation. We want your AI application to speak only about what they are supposed to speak about. Therefore, Prompt continuously monitors AI outputs to block inappropriate, harmful or off-brand content before it reaches users. This helps preserve trust brand reputation and user safety. And now although this is in early availability, I want to give you a sneak peek into our solution for Agentic AI.

Agentic AI, of course, represents a major shift. Those systems no longer just analyze data. They are taking action, powered by the model context protocol aka MCP. Agentic AI can execute tasks, trigger workflows and interact directly with your environment. Prompt for Agentic AI. With Prompt for Agentic AI, organizations gain real-time visibility, risk assessment and control at the machine level. Prompt for Agentic AI is currently in early availability, and we cannot wait to show you more about our MCP gateway. This will be the first comprehensive solution to secure, monitor and govern Agentic AI in real time.

Our mission, like I said before, is to help you embrace AI's incredible promise with confidence. We want to give you the tools to innovate boldly, knowing that you have the right partner to secure your AI journey. But don't take our word for it. Customers around the globe are also -- are already embracing AI with the confidence that they are doing so in a secure and compliant way.

If you want to get a quick recap of all that I've mentioned today, please make sure to scan the QR code behind me. It will take you straight to a 5-minute overview and demo, and you can schedule some time with us directly. Lastly, I want to make sure that we Prompt with SentinelOne are taking this revolution to the next frontier, securing AI itself. Thank you very much.

Please welcome Senior Director of Cloud Security, Nick Davis.

Hello, everybody. All right. Well, there's still some energy left in the day. This is great. The reality of cloud security is changing. Cloud adoption has not stopped. It is still driven by multi-cloud architectures and containerized workloads, even further now driven by generative AI innovation. And the pace of change in that environment is absolutely staggering, as I'm sure you saw from asmr just now.

But what we see as exciting attackers see as a new opportunity to exploit our environments. So this ever-changing, ever-expanding attack surface is a real challenge, right? As cloud adoption increases, so does complexity. And with complexity comes issues. I feel like every day, I'm reading a new article about an attack, or breach, that slipped through the cracks. And so as we try to wrap our arms around this cloud security challenge, we also need to face another practical reality, which is that attacks aren't starting in the cloud.

You heard Braden talk about this a little bit earlier, but most attacks are starting with a compromised endpoint, or a stolen identity. Attacks are, however, increasingly ending in the cloud. And that makes sense, right? The cloud is where most of your crown jewels live. It's where your critical assets are hosted. And so as threats move laterally from endpoints to identities, up to cloud infrastructure and applications. Treating cloud security as an isolated attack surface just doesn't cut it anymore.

To put it more simply, I think you and your teams are caught between two really key challenges. On the one hand, you have an endless backlog of risks to prioritize and fix. And on the other hand, you have attacks that strike with little to no warning and demand immediate response.

To meet the first challenge of endless risks, we've built unified exposure management. This is all about an attacker's perspective on your environment so that you can understand a little bit more about what their valuable target is and you can focus on fixing the issues that really matter. Unified exposure management is how we prevent attacks before they ever happen in the first place.

The best way to win a fight is to avoid it. But we all in this room know that not every fight is avoidable. Eventually, an attacker can, and will, come knocking. And so that is why we've also built cloud runtime protection. Do you have what it takes to defend your cloud infrastructure in real time against a multitude of threats, known and unknown? We'll come back to that question in a minute. But for now, let's focus a little bit more on exposures.

I'm sure none of you in this room have a lack of exposure findings, whether it's vulnerabilities, or misconfigurations or exposed secrets. But I think some of you may have a lack of clarity, a lack of clarity on what to fix and why you should fix it, maybe even how to fix it? So this is why we've unified exposure management across all of the attack surfaces, all the way from the enterprise to the cloud because you need to see how these things work together, and get that attacker's eye view of the landscape to cut off their attack path and to cut off that foothold. So how does this work?

I think if I put myself in your shoes, typically, I think a lot of you are working backwards. There's a couple of key questions to ask. And it starts with what is that valuable mission target in an attacker in your environment that attacker is interested in? How might they get access to that target? Where does it live?

Let's go back here for a second. There's a second question that you need to answer as well, which is once you know what the mission target is, you have to ask yourself, where is an attacker going to land, right? What is that first foothold, or initial access that they might have in your environment, that they can then launch their campaign against you and find that mission target. So let's work backwards ourselves today. We'll start with mission target. I'm sure some of you can probably guess what the most common mission target is in your environments, but I won't hold you in suspense. It is almost always data.

Data has always been valuable to attackers, but today, that is more true than ever before. The value of data is skyrocketing in the age of generative AI. Your organizations are collecting more and more data, and the value and sensitivity of that data is also increasing. So to understand mission target, we need to understand where is my sensitive data stored, how sensitive is it? And how might it be exposed or accessible within the environment? This is why we're super excited to announce data security posture management today.

Data security posture management will automatically discover your data stores across all 3 major cloud providers, classify your data and protect it in real time.

This continuous protection gives you an always up-to-date understanding of where that data is and how it might be accessible in your environment. And don't worry, I'm not trying to sell you anything new. This is available to all of our CNS Pro customers. It's in beta today and will launch generally available very soon. So that's mission target, the data. But we still have to solve the second half of the problem, which is how might attackers leverage different interconnected vulnerabilities and exposures to reach that mission target.

So we also today are announcing Cloud Attack Paths. This will help us close the loop and connect the dots between initial access and mission target. Cloud Attack Paths leverages dynamic graph analysis and advanced analytics to tie together multiple different exposure findings like vulnerabilities and misconfigurations, with multiple different assets and entities across your surfaces. And we can detect both pre-compromise and compromised attack paths so that your teams can investigate and understand the root cause and the blast radius of said attack path quickly and easily.

So 2 major new capabilities for cloud security. Let's talk a little bit about how these things work together to allow your security teams to level up and prevent attacks before they can even start. When you enable DSPM, will automatically begin detecting data stores and classifying sensitive data. You'll see that sensitive data in a number of places like in misconfigurations where you can see that a sensitive data S3 bucket doesn't have versioning enabled. You'll also see sensitive data context in the inventory. This is where you'll see a real-time view of all of your data stores, what we've discovered, which ones are being actively protected and which ones we found sensitive data in.

When we find that sensitive data, we support a number of different data classifiers out of the box, whether it's social security numbers, credit cards or cryptographic keys. And we'll show you redacted evidence and samples of that sensitive data so you can get an understanding of the shape and breadth of that data in these data stores. Of course, this is also available on your graph. So you can ask questions like show me data stores with sensitive data and what other resources might be related to those data stores. And because all of this is in the graph, we can fully operationalize this mission target context with cloud attack paths.

Like I mentioned earlier, cloud attack paths are continuously evaluated, and we can find and detect issues like a publicly accessible EC2 instance leading to sensitive data access in S3. As you can see, we have a publicly accessible EC2 instance with a pretty severe vulnerability. And if an attacker exploits that, they then gain access to an IAM role. And that IAM role will give them access to sensitive data where they can do data exfiltration, ransomware or usually both. Attack paths include remediation steps that you can follow. They also include MITRE TTP mappings. You get both your own internal context and attacker context in one place.

So what do I do from here? Well, you can manually follow our remediation guidance to cut off this attack path before it becomes an issue or better yet, leverage hyperautomation to automatically orchestrate response on your behalf. So this is just the beginning of unified exposure management, a proactive approach to stopping critical cloud threats before they ever happen. But no, there is no tall enough wall and there is no deep enough moat. So attackers can and will get in. It is unfortunately today inevitable. This is why protecting those resources and those workloads at run time is equally important.

What happens when these attackers get in? They will. This is where cloud workload security takes center stage. We are incredibly proud of our ability to block attacks at run time at machine speed, and we've been working incredibly hard on evolving workload protection over the last year, focusing in 3 main areas: number one, improved correlation. Cloud workload security does not stand alone. We tightly integrate cloud workload security alerts with other security signals from the control plane and from the data plane, leveraging platform detections. This means that you get less noise, more precision, better context-driven alerts. And speaking of alerting, none of that is possible without best-in-class detection engines.

We've introduced multiple AI-driven detection engines, everything from behavioral AI to drift detection to help you see what's happening not just at the host, but at the container layer and beyond, again, bringing all of that together. And finally, the absolute foundation of workload protection is performance. These security controls do you know good if you can't deploy them in your environment and if you can't build trust with your infrastructure and application teams. That's why our EBPF-based agent provides maximum protection with minimal resource impact, allowing your applications to run smoothly, while defenses work for you behind the scenes.

So let's take a look at what this looks like in practice. Before we do, I do want to tell you a little bit about the future. I'll share more at another time. But just to tease it, right? This space is changing. The attacker landscape is changing, the way attackers are coming after your cloud resources and your applications is changing. And over the last year, we've seen the line between infrastructure and application blur more and more and more. Attackers don't think about the operating system versus the application. Their attacks move seamlessly up and down the stack, whether they start in the application and end at the host or vice versa, it doesn't matter as long as they can get their mission target done.

So we're moving to a future where workload protection detects, not just host and container layer activity, but understands your applications, how they behave, how they access data, how they interact with other services, all together in a single pane of glass. The future of cloud workload protection is seamless, intelligent, autonomous defense of the applications themselves, and we're laying the foundation of that today.

All right. I'll leave you with one final demo before we switch up the session here a little bit. I'd like to show you workload protection in action. We'll start with a completely fresh console and a vulnerable application. Now if you're anything like me or some of our threat hunt challengers out there, you'll drop a malicious payload into this vulnerable application, and you'll get access to the host, right? We've -- now we've downloaded a malicious script. We've executed on the host. And immediately in SentinelOne, you will see Christmas lights appear.

Let's take a quick look at the web shell detection that fired. First and foremost, you'll get immediate Purple AI summary for human readable intelligence. But beyond that, of course, you need all of that cloud and container context, understanding where this happens, what tags might have existed, what the application was running in that Kubernetes deployments and more. On top of just the actual infrastructure and application context, it's important to understand why we thought this was such a terrible threat. That's why we also include for all of our detections, AI-based or otherwise, human readable indicators of exactly what we thought was strange about this activity. And of course, we have our storyline technology, building out a graph of all of the host container and application activity, so you have a full understanding of what's happening in the environment.

Now when it comes to investigation, we are incredibly proud that SentinelOne has the best workload telemetry collection on the market, collecting far more raw data for you to use and ask questions of than anyone else, whether it's process, network, file or other types of information, it's available at the tips of your fingers in our cloud scale event search systems. So that's called workload security, but I think you've heard enough from me. Let's hear from people on the front lines who are actively protecting cloud environments every single day.

And for that, I'd really like to invite my friend. Jörn and my partner in crime [ Cam ] on to stage to tell us a little bit more.

Wow, what a great set of keynotes so far.

Jörn, thank you so much for being here with us today. I've been waiting for this. I can't wait for everyone to hear your insights from the cloud security journey at Schwarz. But I feel like a good place to start is at the top. So can you just share a little bit about yourself and your role at Schwarz?

Sure. Thanks for having me again. I already explained a bit who am I or who I am. It's Jörn [ Kraft ] being the team leader of Endpoint Application security at the Schwarz Group. Schwarz Group is one of the top retailers in the world. You now see the logo, which is Schwarz Digits. That's kind of our digitalization brand or branch we have. So Schwarz IT is part of that. So we are the internal service provider for the entire Schwarz Group.

Yes. Well, my team is 11 people. I already mentioned that earlier, 4 people are full time on protecting our 450,000 endpoints. And yes, that's our team. That's our job, and I'm happy to share some insights today because I hope it's useful for everybody in here just to see what happens in companies, the day. So that's the input I always love about this kind of conventions or conferences.

Totally to hear it firsthand, and we're going to get into that. So I think Nick gave us a really good backdrop of the cloud security landscape today, the prolific adoption, the increasing complexity, the rapid evolution of attacks and defenses. So with that backdrop, can you just help us understand what is cloud security at Schwartz really like?

Well, I would start with less a technical thing than an organizational thing. For us, coming from a kind of historically grown enterprise, we had the policy on-prem first. So that was kind of what we did the past years. Cloud was always like, let's see, not yet. But yes, there was a mind shift because, obviously, without cloud, that's not working anymore. So what we did is we started to educate our people, right? Because our mission or our aim is to complete a cloud transition for the entire infrastructure by 2030.

So it seems like it's 5 years, but well, it's 5 years only, right? And at the end, we implemented kind of like educational part. So we tried to educate if it's system owners, if it's engineers, if it's employees, which might be responsible for specific software, just to tell them, hey, that's the difference between on-prem, what you know since years and cloud workloads and especially what's the difference about protecting, right? So that was the first thing.

And the second thing, what we implemented is kind of a cloud transition teams, which driven internal consultancy for every system owner, which has to do a transition from on-prem to cloud with their applications, right? So that helped to, yes, get people wrapped up. And I think that's the main part about the preparation for a cloud transition before you start technical stuff.

Yes, absolutely. So a key theme of this cloud session has been that you really do need both unified exposure management and runtime security to secure your entire cloud attack surface end-to-end. So Jörn, what are some of the big initiatives that you're focused on to secure Schwartz's cloud environment end-to-end?

Yes. Well, technically, we -- it started somewhere else, right? So as soon as somebody announced, hey, we have to do the full cloud transition until -- by 2030, a lot of people were, I would say, concerned, how can we get there? And there was also excitement because a lot of systems or products have been like SaaS-ready or name it. And it happened that system or product owners were going ahead by best means, no harm. So they started to go to the cloud, right? And at a specific point that kind of got a bit tricky at the end because everybody was, as I mentioned, as best means or by best means. So they did whatever they thought is right, right?

At the end, we reached a point where that was kind of chaotic. So that was the point where we decided to implement kind of a staging platform, if that makes sense. So if you're a product owner, which wants to order or to install any cloud services. You can go to that platform. It's called One Digital Journey, right, ODJ. So you can go there, you can add any tooling you want. So if it's Azure, if it's GCP, if it's our own public cloud stack. So you can decide what you need or what you obviously need or want. But the way more important thing is that we created a security baseline for that, so a guardrail. So that means every cloud project, which is provisioned by this platform will get predefined set of, if it's specific DevOps tools or if it's security tools.

So that was something the security department, cybersecurity and our cloud service teams were deciding what is the baseline. So we just ensure that every single cluster, every single node at the end pops out with what you have defined as a product owner or a system owner, but also the predefined security guardrails, right? So as an example, you deploy Kubernetes nodes for your application. You go there, you click, I want to have that and that service or tooling. And right after it has been provisioned by the cloud service provider, the SentinelOne pots are being automatically deployed by pipeline, right?

So rest assured, you can scale whatever you want. You can select whatever you want, but there's always the security measures in place because that was the part where we had a lot of cloud workloads already installed without having a proper protection or different protection thing is installed or provisioned. So that's the core where I see technically, we quite made a good job.

Yes. What a great story from a company that owns their own public cloud, right? I think other than maybe AI, cloud is the most prolifically adopted technology, at least in my lifetime. And it sounds like at Schwarz, which I'm sure is true for most of you in this room that, that prolific adoption simply led to a lack of security standards across so many silos in your organization.

But at Schwarz, you all have addressed that with the One Digital Journey or ODJ program, where you really have centralized and standardized those cloud security controls. But I think what is really brilliant is that process approach that you took because you didn't slow down adoption. And I think that's the balance that everyone in this room that we have to balance every day is there are the security controls, but also making sure we don't get in the way of innovation and adoption.

So I appreciate you sharing that. But hey, we're going to get a little more technical for a moment. You're in backstage, you were telling me about the over 3,000 Kubernetes nodes that you currently have deployed with SentinelOne. Can you just help us understand what it's like to manage cloud security or container security at that scale?

Well, as usual, it's complex. But at the end, having this baseline, I was just talking about that, so to ensure everything comes out of the box at the end, like predefined, that's kind of a main thing. I mentioned earlier in the customer panel that we set a lot of centralization. Even we have like 35 countries and a lot of people who would love to do something, we try always to get their input to get our products better because more people have more knowledge at the end. And yes, that's the point where we started. And I think that's the point where -- that's something we want to keep on, right?

So as an example, we plan for 2026, we plan to roll out another additional 15,000 case nodes to our stores. This is because we want to provide edge cloud services there. So talking about that process and talking about security by design, and that's I think everybody wants to achieve here, we have been implemented or included in that design process from the very beginning on, right? So we have a quite of a complex operating system environment. If you talk about case nodes, we have Thales, we have Ubuntu, we have Flatcar.

So having a majority, you know which is installed everybody, that really helps. And at the end, that was the point where we have been implemented from the beginning. We designed what kind of Kubernetes nodes will be used there. And yes, they are kicking it off, I think, beginning of next year. And that's quite of an exciting project there.

So we love to see security by design. We are praying that for years, and I think there's a lot of players in here in that room for the same purpose. But now that worked out, and that's quite a really good feeling because if they now deploy 5 nodes, 500 nodes or 15,000 nodes, we don't care. At the end, yes, there's more workloads protected. There's more maybe detections also for the SOC side. But from an operational side and from the efforts we have to put in, that's a game changer.

Diversity and complexity sounds like Kubernetes to me. But hey, we're going to switch gears a little bit and talk about arguably the most important topic in cybersecurity, and that's people. People are the backbone of everything we do in cybersecurity. I think you've heard that a few times today. You're going to hear a few more because it's true. People are the backbone of everything we do in cybersecurity. So Jörn, let's talk about your people. How have your team and the teams you partnered with? How have they responded to the tools and processes that you've implemented?

Well, for my team, it was a quick win, right? So at the end, it was like cheers, we made it because now my team can focus on the more complex parts like going into troubleshooting for specific issues which might appear. I mean, we are all real-life security guys. So we know there will be, at a specific point, some issues or some performance topics. So we can focus on that besides or instead of chasing any system owners to secure their workloads properly because we have this security baseline. And talking about system owners or yes, system owners, I think everybody can agree here if you deploy security software or any other software in a scale, you will also always run into cost concerns and performance stability concerns, right?

Talking about cost concerns, I'm really happy that our management covers our back because at the end, seriously, yes, obviously, if you deploy any additional workload to any kind of system that will increase resource usage, and talking about cloud workloads, yes, that will increase costs. So there's no discussion, right? So they need to charge it to customers. If I now talk about customers, I talk about internal customers, so the customers which are consuming that services.

So we have that kind of agreement and back up from the management. Talking about system owners and performance concerns or stability concerns, I don't know how many hours we spent upfront when we had this situation where we had existing cloud workloads, which has not been protected by what I just mentioned, our baselining.

And then it comes to, hey, there's a deadline, we need to deploy the SentinelOne protection on your workloads until then. They were like what to do. But I think there's a point, and we adopted that from our legacy environment. So we kind of joined forces. We are not working security versus product owner or system owner. We work together. We are kind of consultants for them. We tell them, hey, you have a test stage, you have a queue stage. Well, test stage might not reflect one-on-one what happens in production. But I think the broad environment, having a test stage is very useful and required.

So we went into that discussion, we were consulting them. We were just teaming up with them. And then we were able to show, okay, test stage worked, go for productive first stage, whatever, how many stage that are -- that those are. And yes, at the end, it turned out that our initial rollout, I think it was 800 nodes at that time. It worked out nearly flawlessly, so -- and that's a big benefit.

Awesome. Now Jörn, I got one more question for you. We're having this conversation a year from now. I'm talking with future you, future Jörn. What does current Jörn, hope future Jörn says about cloud security at Schwarz?

Well, if I start to talk to myself within the next year, I would go for, first of all, talking about that 15,000 and some more because there are other projects, additional Kubernetes workloads or nodes we want to deploy. I would be very happy if we could keep our pace. So go fast, having the stability we have and still don't lose the agility like you mentioned earlier, right? So that would be a top point of what I would -- what would make me happy and everybody else.

The second part would -- and we saw a lot of great keynotes today about AI. We definitely should be able to protect advanced workloads a bit more or not more, we need to protect them. We need to go forward. And I think the third point would be and that's kind of -- should not be an advertisement, but, well, as we mentioned, we run our own public cloud, so the Sovereign European Cloud. So -- and that was the announcement with SentinelOne and Schwarz recently in August, I think, that we joined forces. We have a great partnership there.

So -- and the aim is to provide all those security services we like adopted for ourselves, but also provide them to potential SentinelOne customers, stacked customers out there. So spreading the security thought and spreading the security itself also to our customers, external customers. That's it.

Jörn, I think this conversation and your insights have really brought to life everything that Nick covered, the importance of exposure management, of course, the importance of runtime security. But I think you really highlighted how you've been able to achieve that with the partnership with SentinelOne. So again, Jörn, thank you so much.

Thank you for having me, and was blessed to be here, and the entire event is really, really great. So thank you for that opportunity.

Awesome. Thank you.

Thank you.

Okay. Can we get one more big round of applause for Jörn, please? Okay. It is really not every day that you get to hear from a security leader responsible for securing their own cloud provider. I think that is pretty cool. All right. I'm not going to keep you very much longer. I want to wrap this up. But I do want to bring this back to sort of our key themes from the day, right? It's been a long day, and I just want to remind us about this. We've talked about a lot of stuff today, exposure management, runtime security. And really, unified exposure management is about complete attack surface protection, end-to-end regardless of if it comes from the enterprise, or the cloud, where it starts and where it ends, we want to provide complete protection.

And the only way for us to do that is to harness data, AI and automation, whether it's finding sensitive data in your environment or computing attack paths, these are our core capabilities. And of course, humans are at the center of everything that we do, like you've heard time and time again this week. It is SentinelOne's human expertise that enables us to build the products that we do to protect your environments. And most importantly, it is you, the humans that our platform aims to enable and aims to protect. So with that, I want to say thank you. And I want to say that we've saved the absolute best for last.

I would love to invite my friends and our threat services leader to the stage, Hackim Farrell.

Good afternoon, beautiful people. So I think the word on the street is we announced some pretty cool services this morning, right? This morning, we heard from Steve how the threat landscape continues to accelerate. We also heard how AI is redefining the playbook for adversaries and defenders alike. But here's the truth. The challenge has evolved. The tools that once kept us safe are no longer enough. At SentinelOne, we have an unmatched approach to protection. So customers cannot only stay ahead of adversaries today, but also into the future.

Our ethos is clear. True resilience comes from when you fuse the best of threat intelligence, AI and human expertise. That's why today, we are launching Wayfinder Threat Detection & Response. Thank you. Thank you. So Wayfinder is the next generation of services that delivers proactive, adaptive defense so that every organization can stay ahead of modern adversaries so that they can move faster, see farther and act smarter against modern threats. These new services are a manifestation of our mission here at SentinelOne.

In every service level, customers get the benefit of comprehensive threat intelligence, the power of Purple AI and our human experts around the globe. This combination gives you the strategic advantage of not only eliminating blind spots, but also reducing the noise, transforming your organizations from reactive firefighting to proactive adaptive defense. This is the future of resilient, effective threat management amidst relentless change. These new services. So let's dive deeper into these new services, starting with threat intelligence.

First, we know the attackers are not standing still, right? The threat landscape continues to evolve at record speed. Now defenders need threat intelligence that is relevant and ready for action. That's why our partnership with Google is such an absolute game changer. Let's take a closer look at how this sets the foundation for a new standard of threat intelligence. This new standard is what we call Applied Intelligence. It's not about more feeds, it's about speed of actionable insights. Unlike legacy vendors that bolt-on feeds to their platform. At SentinelOne, we bring this to life.

Google Threat Intelligence provides SentinelOne with access to Google's unrivaled global visibility. We're not overwhelming teams with low fidelity signals. Every indicator of compromise is jointly vetted and validated by SentinelOne experts and Google Threat researchers alike. Automation ensures that intelligence moves at the pace of attackers, but every signal is checked before it enters our customers' environments. Together, this trusted partnership closes critical gaps that others will simply miss. The spectrum of opportunistic cyber criminals to complex nation-state actors like PurpleHaze is just too complex for any single source. This multifaceted approach that we have taken of combining multisource intel with the richest in SentinelOne Telemetry is what makes a difference.

We're talking about open-source intelligence, SentinelLABS forward leaning research, feedback from our customers and partners. This is what exposes adversary tactics that others will simply miss. This is what helps those organizations move from reactive to proactive, reducing alert fatigue and strengthening their security posture. With Wayfinder Threat Detection & Response, we've integrated Google Threat Intelligence in every one of our MDR tiers, which means organizations get access to Google's unmatched global visibility.

Every Wayfinder customer benefits from the full force of world-class threat intelligence and expertise at scale. Threat intelligence for us sits at the core of our Wayfinder services. Still, we know intelligence alone is not enough. It's how we bring it to life with AI and human expertise that makes a difference.

Warwick, why don't you take us through how SentinelOne differentiates itself in this area?

Good afternoon. That's right. So my name is Warwick Webb. I lead Managed Detection & Response Services here at SentinelOne. The core mission of our team is to detect and respond to evil. It's as simple as that. But how do we deliver on this commitment to our customers? Well, it starts with detecting attacks early in the kill chain. Our MDR team leverages the advanced threat detection capabilities of the Singularity platform.

Singularity endpoint, identity and cloud workload protection, along with detection coverage for third-party identity providers, cloud service providers, e-mail security platforms and network infrastructure. But we're not just reacting to alerts. We are proactively hunting for emerging threats and new and novel attack techniques powered by the latest Google and SentinelOne Threat Intelligence. And those hunt findings are all surfaced directly within the Singularity platform, enriched with all the latest threat intelligence so that our experts and your team have the context they need to make informed decisions.

So that's Wayfinder Threat Detection. But we don't just detect threats on behalf of our customers. Our MDR team leverages the full power of the Singularity platform to respond at machine speed. Our AI and hyperautomation delivers scale. Wayfinder hyperautomation workflows automatically respond to alerts that don't require human attention. Meanwhile, Purple AI contextualizes and summarizes the remaining alerts in real time, making sure that our defenders get actionable insights fast.

From there, our experts step in. They provide oversight and guidance. They review and validate the analysis performed by Purple AI, dive deeper as needed and perform the necessary containment and remediation actions to protect our customers. It really is a virtuous cycle, right? The actions performed by our analysts serve as valuable training data for our AI models, which in turn, service force multipliers for our human experts.

Now I've talked a little bit about our always-on managed threat hunting and managed detection and response services. But we also have a world-class incident readiness and response team that is there for you when you need the most, leading the response to complex cyber attacks, performing detailed forensic investigations and delivering comprehensive incident reporting, including root cause analysis and lessons learned. So with that in mind, it's important to note that, that same team also partners with your organization to ensure that they are battle-tested and ready for action with a wide range of breach readiness services from incident response workshops to attack simulation exercises.

But now let's talk a little bit about the people that are powering Wayfinder. Our global team delivers security expertise at scale to thousands of organizations from small businesses and schools to large enterprises and government agencies. Whether it's threat research, hunting or rapid response, we are the first in and the last out. Our SentinelLABS team is on the bleeding edge of threat research, identifying new and novel attack techniques in order to accelerate our detection and response capabilities.

Our hunters, analysts and investigators are delivering 24/7 threat detection and response across all modern attack surfaces. Our threat advisers partner closely with our customers from initial onboarding to ongoing engagement and guidance. And of course, our IRR team is there when you need the most. Together, this global team of experts, combined with the power of the Singularity platform, provide organizations with a full turnkey detection and response program from a single trusted partner.

So what is this? The best part about this? You have an elite team of practitioners available to your organization as a core capability of the Singularity platform. So what does that mean for you? First, turnkey onboarding. Traditional managed service providers can take days or even weeks to onboard, not Wayfinder. Our service is up and running in just a few clicks within the Singularity platform. No rules to tune, no threat intelligence feeds to integrate, just to find your notification preferences and authorized response actions. And you've got a 24/7 team up and running protecting your environment.

Second, transparency and context. Our Wayfinder services are not a black box. Our threat hunting dashboards provide details of IOCs and TTPs that we are actively hunting for in your environment. And our MDR dashboard provides full visibility into all the work performed by our analysts, including all alerts actioned and all incidents responded to, along with our performance on key service level objectives.

And finally, extended visibility across the modern enterprise. Our team leverages Singularity endpoint, identity and cloud workload protection. But as you integrate additional telemetry with the SentinelOne platform, our team leverages that additional visibility to more effectively detect and respond to threats on your behalf. Look, we believe that effective defense and depth requires advanced technology paired with human expertise. AI and curated threat intelligence delivers scale and speed. but it's the collaboration and partnership of human experts that turns great technology into meaningful security outcomes. But don't just take my word for it.

Let's hear from Sara Griffith, CISO of Euronet on how her team partners with us to stay one step ahead of adversaries. Welcome. Great. So Sara, thank you for being here.

Thanks for having me.

Maybe we can start just if you could share a little bit about Euronet. I mean even for those who aren't familiar maybe with the name, it's likely that you've probably like made it easier for them to make a purchase or perform some other financial transaction.

Perfect. So I'm Sara Griffith. I've actually been with Euronet for 20 years. So what we are, we're a publicly-traded financial transaction processing company and global payments processor. So we have 190 entities that we own and we have offices in 50 countries. We operate in 200 countries globally, but 90% of our 12,000 employees are outside the U.S. So we serve consumers, banks, fintechs and some governments.

So we do everything from ATM transaction processing. We run ATMs for hundreds of banks. We also do debit and credit card processing, POS transaction processing, or money transfer processing, digital wallets, you name it. So a lot.

Sounds pretty important. Well, look, my first question I want to ask you is that when -- I know you've been a partner of ours for several years. And when Euronet was first evaluating SentinelOne, I know you looked at both our products, but also our services. And I'm just curious why it was important to you to really evaluate both of these areas together and why you ended up selecting SentinelOne?

Sure. So at Euronet, we have a pretty rigorous evaluation process when we're looking at new vendors or even major renewals. And we -- our team set all the criteria because as most of you know, there's thousands of vendors out there. And we set a bunch of criteria. We want to look at who are the vendors in the space, who's innovative. What -- we had some things we were missing from our prior MDR vendors. And so we set that and one thing that was a nonnegotiable is we had to have managed services.

I mean that was some -- not only did we want that 24/7 support to support us globally all over the world, but we also -- obviously, the detection capabilities and aperture of what you guys are looking at is extremely critical to us. But we also wanted a managed services team that wasn't outsourced. I know there were some vendors that use outsourcing and maybe those teams were looking at CrowdStrike and SentinelOne and various platforms and they weren't -- we didn't know if they were going to learn our environment or know the tool really well to dig into alerts. So that was important for us.

But in the end, we chose SentinelOne, the user interface, obviously, the telemetry, the visibility to that and the alerts, reporting, filtering, et cetera. So I guess when we also nerted it down to our top 2 prospects when we were looking at SentinelOne, they scored the highest we did ethical hacking on the efficacy of what they were detecting, which was -- that was probably the #1 thing for us. But yes, and in the past, like several people have said, everything was a black box. So we were hoping those vendors in the past were looking at our most critical alerts.

But even with one of them, we knew some alerts have been changing or going down and we questioned what's your aperture. They had been bought out by someone and they admitted to us their aperture had changed. And -- but we couldn't see that. We couldn't see what they were looking at. So it was critical to us to have that visibility.

And that's such an important point, and it's something that I talked about a few minutes ago. We really see transparency as a prerequisite for trust, right, which is why with our managed services, you can see everything that our analysts are doing. And I'm just curious from your perspective, how has that visibility really helped you kind of -- you and your team gain confidence in the work that we're doing your behalf?

Yes. I mean it's huge. I mean we've gained -- our team gained trust with SentinelOne and our employees over the years. But obviously, we love the user interface and the capabilities and transparencies, but it was better than any prior vendor we had. Like I said, we could see what your team was doing. We could see what they're looking at. We could see the notes in the platform. If the managed services team escalated stuff to our teams or depending on different escalation layers like you mentioned, we could see and communicate with them and open cases if we need to or at least have that visibility. So to us, that was key.

Like I said in the past, we just relied on we hoped they were looking at everything that was critical, but now we can actually see it in the platform. So that was big. And the 24/7 eyes on alerting, I think for me, and I can speak for all of our technical security team around the globe, we don't have that expertise. And we don't know the platform as well as you guys know it. So that helps us sleep better at night, knowing there's eyes on in addition to the AI and everything working in the background, looking at these alerts and helping us prioritize what do we need to focus on or prioritize or contain, et cetera, if it wasn't automated.

That's great. So you also have a dedicated threat adviser from SentinelOne that meets regularly with your team, providing regular updates on service delivery, operational metrics, briefings on emerging threats. How does that sort of ongoing engagement really improve the effectiveness of our partnership?

Yes. I mean, at least for me, when I'm not -- I used to be in the beginning, the first few years involved in the day-to-day alerting and implementation and everything. But even when we would have to go -- we'd have our executive team asking or the Board, I mean, having that communication with your team at least on a monthly basis, that gives us the summaries that we used to have to go pull down Excel spreadsheets and look at what alerts we were getting from prior vendors and try to analyze that ourselves.

Now we have all of that summarized for us by SentinelOne, nice dashboards. We can take that and discuss it, whether it's myself with executives or the Board, but -- or our teams that are in different geographic locations or in different business segments, they can discuss it with management. What are we seeing there?

So is this something affecting just this geography or this entity or what kind of malware are we getting? Why are we getting targeted? But also from the managed services team, they also educate us on here's other threats or emerging threats we're seeing around the globe, not just at Euronet. So that's really important for us, and it's been really valuable. So...

Right. Great. Well, and we've talked a lot about threat detection and response. But breach readiness is also critical, right? Left of boom, being ready. And I know that our incident readiness and response team has had the opportunity to perform several breach readiness exercises with your team at Euronet. So just curious about your experience with those engagements and how they've really helped prepare your team for whatever comes next.

Sure. So I'll call it [ DFR ] , I don't know. But since we've had our contract, we had these [ DFR ] hours that obviously are there for forensics or incident response and knock on wood, if you don't need it. There are these ancillary services that the [ DFR ] team provided that we've taken advantage of for sure. So typically, you'd have to pay a third party, but we, for instance, had them review our global incident response plan, go through it in detail, tell us -- they're the experts in incident response. Are we missing anything? Is there anything in our workflows or our processes that we should enhance or improve? So we've used them for that.

Even more recently, about a year ago, those of you that are publicly traded know this, but the SEC has new cybersecurity disclosure requirements. So we even took a addendum where we had our legal team and help draft part of that instant response plan. And we wanted to make sure, hey, can you look at this and tell us, do you think we're addressing everything that we would need for instant response to address the SEC requirements. So that was the service we also used.

I know our technical teams have also done some playbooks and instant response tabletop exercises, which is always beneficial, and you always learn a lot, and it's good to have a third party do that. And even if you go with cyber insurance renewals, that's also something that always comes up you. Your breach readiness, have you done tabletop exercises. So those are just some of the services we've used that have been very beneficial. And typically, you might have to go pay a third party for and if you're not using their forensics, at least you have these other services you can use.

Fantastic. Well, we've talked a lot about our partnership as it pertains to threat detection and response and services. But obviously, Euronet's relationship with SentinelOne extends far beyond that. So I'm just curious in your experience, how would you describe your overall partnership with SentinelOne over the years?

Sure. And I'm not saying this because I'm sitting up here, I'm not getting paid for this. But I mean, honestly, SentinelOne has never wavered at all in consistently building their relationship with me and others on the team. A lot of vendors or your sales team or sales engineers, they get you to sign the contract and then they pass you over the implementation team, and you might hear from them again at renewal. And I can -- shout out to Justin and Stuart if they're in the room.

But over the last 4 years, they're consistently staying in touch, seeing how we're doing. They attend some of our customer success calls. We have these biweekly calls with the customer success team. We have the monthly calls with the managed services team. And I think everyone just goes out of their way to build that trust and relationship with us, and that's not the norm. I mean I think most CISOs probably know some vendors a little better, some you never hear from once you buy their product. So I would say it definitely goes above and beyond what a lot of vendors in cybersecurity do. So we really appreciate it.

And I know at one point, there was a -- your regional sales director when he would meet with me at a meeting or something or run into me and we'd have a meeting, I always got a personal e-mail from him with follow-up steps and everything that we addressed and anything that we are asking for enhancements and just a personal e-mail, which that's huge. You don't see that a lot. And you have opportunities to meet with Tomer or your product development leads at Black Hat or RSA, and they really listen to our feedback and they've taken our suggestions, and I know we've even talked about.

So we appreciate that. And when you're looking for a long-term partner in a vendor, that's really important. Those relationships are key. So I'm not just saying that you guys really do an excellent job, and it's been a great relationship.

Well, we're humbled by that feedback. We definitely don't take it for granted, and we're going to continue to really work to keep and earn your trust every day. So thank you so much, Sara, for coming up here to talk today. Appreciate it. All right.

Yes, thank you.

All right. Thank you, Warwick, and thank you so much, Sara, for joining us on stage. Let's give them another round of applause.

So as we face another inflection point in the threat landscape, we're challenged to evolve our defenses to be even faster, smarter and be relentlessly focused on reducing complexity. The great thing is you don't have to face these challenges alone. We're with you, protecting every attack surface from endpoint to cloud to identity to data, closing critical gaps before they are found. We will supercharge your organization with industry-leading tools like our threat intelligence partnership, AI and automation. Data gives us insights. AI will provide us scale and automation will give us the speed to act, giving you the advantage over your adversaries each and every time.

Now most importantly, whilst technology may power our defenses, it's our people, our analysts, our hunters, our responders, our partners, that bring human expertise. Together, these set the foundation for resilient defense, comprehensive protection, intelligent automation and human mastery. With Wayfinder threat detection and response, we paved the way for modern security. Now let's redefine what's possible together. Thank you.

And now welcome back Chief Product Officer, Ely Kahn.

What a journey. You all made it. Thank you for staying here for us. Over the last 2 hours, we've covered every frontier from endpoint to cloud, from AI-powered defense to managed response. And through it all, there was one truth that stood out, SentinelOne is redefining what it means to defend in the age of AI.

And to recap, this morning, we started out with how things are changing in the age of AI. Adversaries are moving at machine speed and new AI attack services are appearing overnight. And just to showcase how quickly things are changing, I've been sitting in backstage for the last couple of hours going through Slacks and e-mails. And our friends at Google Threat Intelligence just published a blog while we're all sitting here, talking about a new strain of malware called Prompt flux that calls the Gemini, Google Gemini APIs every hour to fully rewrite its code. Polymorphic malware is here. The future is now.

But then we went through endpoint identity security, and Braden showed us the unified vision, one agent, one platform, one AI brain to protect both devices and users. Nick then walked us through cloud security innovations and showed us some of the new features launching today, Cloud Attack Paths and Data Security Posture Management. The key message is that with this new visibility in analytics, we can help you stop breaches before they start by giving you an attacker's eye view into your cloud environment.

All right. Then Adriana and Carter pulled back the curtain on autonomous security. They showed us that autonomous security is not some far off distant vision or future. It's here now. With AI SIEM plus Purple AI plus hyperautomation, today, we can offer you faster detection, faster investigations and automated remediations. And then Itamar showed how we're securing the next frontier, AI itself. Prompt security is the most comprehensive platform for both securing AI systems and securing the data that goes into them. This means that we're ensuring that AI for security is also coupled with security for AI.

Finally, Hack and Warwick brought it home. They showed us the new Wayfinder threat detection and response service. It's really a fusion of 3 things: Google Threat Intelligence; Agentic AI capabilities; plus human expertise and judgment. That's the key partnership in the age of AI, machine precision guided by human wisdom. And you can see here with SentinelOne, you don't just get tools, you get teammates.

So to summarize, across all these stories today, the pattern is clear. With SentinelOne, we will protect every service, endpoint, identity, cloud and AI. We will harness AI data automation to outpace adversaries and we'll empower people because human expertise is still the core of cybersecurity. That's the singularity difference, technology that learns, adapts and acts, powered by people who care, think and create.

So as I leave you here today, remember this, please. The age of AI does not belong to attackers. It belongs to defenders bold enough to innovate faster. Every attack you stop, every risk you contain, that is our shared purpose. And together, we're proving AI can protect the future. So thank you. Thank you so much for being part of OneCon 2025, and thank you for trusting SentinelOne with your business. Enjoy the rest of the conference and keep defending boldly. Thank you.