SentinelOne Q2 Preview: Breaking Out From CrowdStrike’s Shadow (NYSE:S)

Investment Thesis

Cybersecurity company SentinelOne, Inc. (NYSE:S) is slated to announce their Q2 FY25 earnings next week on Tuesday, August 27th, after markets close.

The company’s results will come a day before its larger peer, CrowdStrike Holdings, Inc. (CRWD), reports the most anticipated earnings report of this earnings season on August 28th, where industry watchers and markets will closely follow updates & commentary from CrowdStrike’s management following their global outage last month.

SentinelOne’s Q2 earnings report will be critical for the company to demonstrate if the Mountain View, CA-headquartered company has grabbed the opportunity from CrowdStrike’s outage and won some of its customers over.

This will be crucial for SentinelOne stock, which still lags the market and some of its peers for the year.

I believe SentinelOne trades discounted to its peers and to the market as it heads into earnings next week, leading me to reiterate my Buy rating on the company.

Q2 Preview: Watch the tape on SentinelOne’s ARR

I have covered SentinelOne a couple of times this year already, where I recommended buying the stock due to its strong growth momentum despite peer pressures.

SentinelOne operates in two major end-user markets, XDR (Extended Detection & Response) as well as SIEM (Security Information and Event Management), that are used by enterprise SOCs (Security Operations Centers). Both of these end-user markets are highly competitive, with large players such as CrowdStrike, Palo Alto Networks, Inc. (PANW), Microsoft Corporation (MSFT), etc. competing for a share of the markets. But SentinelOne considers CrowdStrike its largest and most formidable competitor due to the large overlap in the XDR market.

In fact, SentinelOne’s management used the recent CrowdStrike outage as an opportunity to explain how SentinelOne differentiates from CrowdStrike in terms of the architecture of its product platform as well as the broad-based features its entire cybersecurity product platform provides. The company has been pushing its Singularity platform, which encompasses cybersecurity offerings across endpoint security and CNAPP (Cloud-Native Application Protection Platform), an emerging cybersecurity end-user market.

The growth from SentinelOne’s Singularity platform is key for long-term growth. This is especially true since I had noted in my earlier coverage that the overall XDR market, while still important, is maturing and cybersecurity vendors are looking at emerging areas such as SIEM and CNAPP for future growth.

In SentinelOne’s case, growth can be seen in its ARR, which is growing at a respectable 35% y/y based on its last earnings report. On the other hand, its peer CrowdStrike is also reporting a growth pace that is normalizing to 33% y/y growth after a small blip of sequential growth it saw in the previous quarter.

The million-dollar question for management to answer is: Can SentinelOne continue to report strong double-digit growth in their ARR, especially if the pace of that growth outpaces CrowdStrike? The ARR growth pace will also help markets evaluate SentinelOne’s revenue pace and its market penetration in the three end-user cybersecurity markets I mentioned earlier. Currently, SentinelOne is clocking a ~40% growth pace in its total sales.

During the past quarter, the company has deepened its growing relationship with Alphabet Inc.’s (GOOG) Mandiant, with SentinelOne now becoming the “strategic endpoint vendor” of Mandiant’s cybersecurity services. This is after SentinelOne partnered with Mandiant to provide Threat Intelligence capabilities to Mandiant’s customers. As part of the partnership, Mandiant’s customers get access to SentinelOne’s Singularity Platform.

Plus, SentinelOne is adding more capabilities to its Singularity Platform by adding Managed Detection response, in addition to the CNAPP capabilities, its autonomous SOC AI agent, PurpleAI, and Data Security services that are already available on the Singularity Platform. The geographic availability of Singularity in Europe should also be a boost to SentinelOne’s growth.

While watching the ARR and revenue growth, what is also of paramount importance is tracking the company’s NRR (dollar-based Net Retention Rate) which remains in an expansionary state as existing customers spend incremental security budget dollars on SentinelOne’s products. So far, the company says their NRR is “north of 110%” based on their comments from the last earnings call.

Can SentinelOne Post a Surprise EPS Surprise?

While SentinelOne has been growing at a robust pace, I believe markets would expect management to demonstrate more operating leverage through the back half of the year. That can be seen in market expectations of the company’s EPS, where consensus estimates peg the company to breakeven this quarter while guiding for its first cent of EPS in the Q3 FY25 quarter.

The company has demonstrated good progress on reaching breakeven at some point this year, with operating margins contracting by far less on an adjusted basis, as noted in Exhibit D below.

The company is still guiding its operating margins to stay in the negative territory of -6% in Q2 while being between -6% and -2% for the full year. If the company’s growth prospects drastically improve on the upside, there is scope for the company is being conservative, and SentinelOne breaks even between Q2 and Q4 this year.

Valuation Shows SentinelOne Trades Discounted Before Earnings

Markets expect SentinelOne to grow its revenues at a 30% CAGR between 2023 and 2025, or FY24 and FY26. That is marginally higher than the 27% CAGR that CrowdStrike is projected to grow at. Note that the market’s expectations of SentinelOne are mostly in line with my prior expectations of midterm growth that I had estimated in my previous evaluation of the company. This suggests markets are not yet pricing in any potential upside from the CrowdStrike outage.

However, when comparing the EV/revenues forward for FY26, I see that SentinelOne is valued at half the premium that CrowdStrike is valued at, with SentinelOne’s forward EV/revenues at 6.7x versus CrowdStrike’s forward EV/revenues of 12.6x. This suggests that there is tremendous upside in SentinelOne, but I suspect some depression in premiums due to the highly competitive environment of SentinelOne’s target market and, more importantly, the ability of SentinelOne to demonstrate operating leverage.

Another way to reasonably evaluate SentinelOne is to compare its ~30% growth pace through next year with the ~5.5% growth pace projected for the S&P 500 over the same period. This implies a forward sales multiple of 10-11x for SentinelOne, which, per my estimates, values SentinelOne at ~$32 per share, implying a 25-30% upside from current levels.

3 Things To Look For In SentinelOne’s Q2 Earnings

Q2 Estimates: Markets will be expecting SentinelOne to break even on its earnings on a per-share basis. Revenues are expected to slow down sequentially to 32% growth, with total sales worth $197-198 million in Q2, slightly above management’s own Q2 guidance of $197 million.

Q3 and FY24 Guidance: Consensus estimates put SentinelOne to guide its first quarterly EPS profit of 1 cent per share for Q3 on revenues totaling ~$210 million, growing ~28% y/y. For the year, markets expect SentinelOne to guide its first full year of positive earnings per share growth of 4 cents per share on revenues of $814 million, growing 31% y/y. The market’s revenue expectations are marginally elevated, given that management was still guiding about a 4% operating loss on an adjusted basis on revenues worth $808-815 million for the full year. This suggests markets are optimistic about management raising its full-year guidance, especially on the earnings front, so investors should brace for volatility if management’s guidance disappoints markets.

Commentary on competitive pressures: Since SentinelOne operates in a highly competitive market with prominent peers such as CrowdStrike, Microsoft, etc., as I mentioned earlier, I will be curious to see if SentinelOne’s recent product positioning towards their Singularity platform is boosting the company’s growth prospects. This will become especially important to see, in my opinion, since CrowdStrike’s outage may provide some relief from theoretical peer pressure. Any hints from SentinelOne’s management about the benefits of the outage will propel the stock forward.

In addition, investors must watch for CrowdStrike’s earnings report the day after SentinelOne reports on August 27th next week.

Takeaway

I believe SentinelOne is priced at an attractive valuation before its earnings. Markets appear to be neutral towards any potential upside SentinelOne may have had following CrowdStrike’s outage event last month. Any indication from SentinelOne’s management about competitive benefits will boost the outlook for SentinelOne, with markets viewing this name as a winner from the outage fiasco.

SentinelOne trades at a compelling sales multiple before earnings, and I reiterate my Buy rating on this name.