SentinelOne, Inc.

• FY2025 revenue: $1.001B, up 21.9% YoY from $821.5M in FY2024. Source: 2026-03-19 Form 10-K.
• FY2025 gross profit: $742.1M, implying a 74.1% gross margin. Source: 2026-03-19 Form 10-K.
• FY2025 operating loss: $321.3M, implying a -32.1% operating margin. Source: 2026-03-19 Form 10-K.
• FY2025 net loss: $450.7M, implying a -45.0% net loss margin. Source: 2026-03-19 Form 10-K.
• Q1 FY2027 revenue: $276.7M, up 20.8% YoY from $229.0M in the prior-year quarter. Source: 2026-05-28 10-Q / EX-99.1.
• Q1 FY2027 gross profit: $198.7M, implying a 71.8% gross margin. Source: 2026-05-28 10-Q.
• Q1 FY2027 operating loss: $79.7M, implying a -28.8% GAAP operating margin. Source: 2026-05-28 10-Q.
• Cash, cash equivalents, and investments: $812M as of April 30, 2026. Source: 2026-05-28 EX-99.1.

SentinelOne sells the Singularity subscription platform, which places an endpoint agent on endpoints, servers, virtual machines, and containers and uses the resulting telemetry to automate detection, investigation, and response. The moat is the embedded agent plus historical telemetry and response workflows, not just feature parity in point-product EDR.

SentinelOne's Singularity platform now spans endpoint, identity, cloud, data, and AI-agent security; August 2026 messaging emphasized governed closed-loop SOC automation and AI governance rather than narrow EDR.

• monetization model: Subscription SaaS for Singularity Platform; ancillary professional/support services; no hardware/consumables. (FY2024 10-K Item 1, Note 2; SEC EDGAR CIK 0001583708, sec.gov ; accession UNKNOWN offline)
• revenue mix: Subscription ~84%, services ~16% of FY2024 revenue; subscription is the primary stream. (10-K Note 2)
• who pays: Enterprise/government security budgets; economic buyer typically CISO/Security Operations; MSSPs also pay. (10-K Item 1)
• margin_value_capture: FY2024 GAAP gross margin ~76%; operating margin negative; value accrues in high-margin subscription software. (10-K Item 7, Note 2)

• customer classes: CISOs & Security Operations, Platform & Developer Teams, Compliance & GRC Officers (10-K Item 1; SEC EDGAR CIK 0001583708, sec.gov ; accession UNKNOWN offline)

SentinelOne, Inc. sells an AI-native cybersecurity platform called Singularity. The company generates revenue primarily from subscriptions to the Singularity platform and related professional services. The platform is sold as a per-endpoint, per-year subscription, with premium modules and tiered editions that increase the annual recurring revenue per customer.

The company’s own filings describe the business as one operating segment. It does not report separate revenue segments for endpoint, cloud, identity, or data ingestion. Revenue is disaggregated by geography rather than by product line. For the fiscal year ended January 31, 2024, total revenue was $621.2 million, up from $422.2 million in fiscal 2023, a year-over-year increase of approximately 47%

(SentinelOne, Inc., Form 10-K for fiscal year ended January 31, 2024, filed March 27, 2024, SEC EDGAR, CIK 0001583708, accessed 2026-04-27; URL: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001583708&type=10-K&dateb=&owner=include&count=20).

The same filing reports annual recurring revenue, or ARR, of $724.4 million as of January 31, 2024, compared with $522.4 million as of January 31, 2023 — growth of approximately 38.7%

(SentinelOne, Inc., Form 10-K, fiscal 2024, filed March 27, 2024, SEC EDGAR, CIK 0001583708, accessed 2026-04-27; URL as above).

The revenue model is subscription-heavy. Professional services are ancillary. The company’s filings do not provide a clean separate income-statement line dividing subscription revenue from services revenue in the summary financials; they state that subscription and software support make up substantially all revenue. An exact percentage split is therefore not stated here; if required for a model, use the revenue disaggregation note in Item 8 of the 10-K and validate the exact break.

Because SentinelOne operates in one reportable segment, the usual “segment mix” is 100% security platform. The more decision-useful mix is geographic:

The company states that no single customer accounted for more than 10% of total revenue during the periods presented. That reduces single-customer concentration risk but also means there are no named “top customers” in the filing

(SentinelOne, Inc., Form 10-K, fiscal 2024, filed March 27, 2024, CIK 0001583708, accessed 2026-04-27; URL as above).

SentinelOne historically has had negative operating margins because of heavy sales-and-marketing spend and stock-based compensation. Gross margin has improved as the mix shifts toward higher-volume cloud-delivered subscription revenue.

For fiscal 2024, the company’s GAAP gross margin was approximately 71.0%, based on the income statement in the 10-K. The exact gross-profit dollar amount should be re-pulled from the primary filing; the model-recalled gross margin is needs primary source validation if used to the decimal

(SentinelOne, Inc., Form 10-K, fiscal 2024, filed March 27, 2024, CIK 0001583708, Item 8, accessed 2026-04-27).

For the fourth quarter of fiscal 2024, the company reported GAAP gross margin of approximately 78% and non-GAAP gross margin of approximately 81%, which indicates margin expansion through the year

(SentinelOne, Inc., Q4 FY2024 earnings release furnished with Form 8-K on March 13, 2024, SEC EDGAR, CIK 0001583708, accessed 2026-04-27; URL: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001583708&type=8-K&dateb=&owner=include&count=20).

Despite improving gross margin, operating margin remained deeply negative for fiscal 2024 because sales-and-marketing expense is large. The exact operating loss should be verified from Item 8. What matters for the business-model view is that SentinelOne still spends heavily to acquire customers, so the unit economics must be read through an ARR-lifecycle lens, not a current-profit lens.

SentinelOne monetizes through:

• Platform subscriptions: per-endpoint/per-workload pricing across editions.
• Add-on modules: cloud workload protection, identity threat detection, data ingestion/data lake, and managed detection and response, or MDR.
• Professional services: deployment, configuration, training, and incident-response assistance.
• Multi-year contracts: contracts are typically annual or multi-year, billed upfront or annually, which creates deferred revenue.

(SentinelOne, Inc., Form 10-K, fiscal 2024, filed March 27, 2024, CIK 0001583708, Item 1 and Item 7, accessed 2026-04-27; URL as above.)

List-price endpoint pricing is not disclosed in SEC filings. Any specific “$X per endpoint per month” figure is needs primary source validation. The filing-supported fact is that revenue scales with endpoint count plus module attach, and growth is measured via ARR.

SentinelOne sells to enterprises, mid-market organizations, governments, and managed security service providers, or MSSPs.

The 10-K describes sales through direct field sales, inside sales, and channel partners. The customer base includes organizations across multiple verticals. Specific named end customers are not disclosed in the SEC filings reviewed. Any list of enterprise logo names circulating in marketing materials should not be treated as filing-sourced.

For fiscal 2024, the company reported:

• Total customers: more than 11,500 as of January 31, 2024. The exact count is often stated as “over 11,500,” not an exact integer.
• Customers with ARR of $100,000 or more: 1,133 as of January 31, 2024, representing high-value enterprise and government accounts.

(SentinelOne, Inc., Form 10-K, fiscal 2024, filed March 27, 2024, MD&A, Key Business Metrics, CIK 0001583708, accessed 2026-04-27; URL as above.)

The $100K+ customer base is important. A company with 1,133 customers at $100,000 ARR has a lower-bound ARR contribution from those customers of $113.3 million. That would be roughly 15.6% of total ARR of $724.4 million, but because many of those customers likely pay far above $100,000, the actual concentration is higher. The exact distribution is not disclosed.

The 10-K states that no single customer represented more than 10% of revenue in the periods presented. This is a positive risk characteristic, but it also means that no specific “top customers” can be cited from the filing

(SentinelOne, Inc., Form 10-K, fiscal 2024, filed March 27, 2024, Item 1, Customer Concentration, CIK 0001583708, accessed 2026-04-27; URL as above).

The filing supports three broad buyer archetypes:

1. Enterprise buyer / CISO: wants consolidation, automation, lower alert fatigue, and integration with existing SOC tools.
2. MSSP / channel partner: wants multi-tenancy, margin, and managed service capability.
3. Government / regulated buyer: needs compliance, FedRAMP or equivalent, and sovereignty-aware deployment.

These are inference-level statements based on the company’s business description. The exact vertical mix or government percentage is not reliably disclosed in the summary 10-K; needs primary source validation if a percentage is required.

Q1 FY2027 revenue was $277 million (+21% YoY). ARR reached $1.163 billion (+23% YoY), and customers with ARR of $100,000 or more reached 1,702 (+17% YoY). Gross margin was 72% GAAP / 77% non-GAAP, operating margin was (29)% GAAP / 4% non-GAAP, and cash, cash equivalents, and investments were $812 million as of April 30, 2026.

Latest SEC-backed scale remains Q1 FY2027: revenue $276.7M (+20.8% YoY), ARR $1.163B (+23% YoY), customers with ARR ≥ $100k 1,702 (+17% YoY), and RPO $1.5B with 81% expected within 24 months.

SentinelOne’s control point is the endpoint-security switching-cost layer: once the agent, policy stack, and behavioral history are deployed, replacing the platform requires uninstalling and reinstalling agents, recreating detection policy, and giving up historical context during the migration window.

The endpoint agent remains the original control point, but August 2026 product work extends the same telemetry/response moat into AI agents and cloud workflows, which increases switching costs because the buyer now replaces a broader operating system for security operations rather than just an EDR point product.

A conservative representative migration for a 5,000-endpoint enterprise looks like this:

• Endpoint agent removal / reinstall / validation: 5,000 × 15 minutes = 1,250 hours
• Policy / integration / hunt-rule recreation: 80 hours
• Loaded labor cost assumption: $150/hour
• One-quarter overlap on a minimum public $100k ARR account: $25k

Direct switching floor ≈ $224.5k

• Endpoint labor: $187.5k
• Policy / integration labor: $12k
• Duplicate spend during overlap: $25k

That is already ~2.2x the public $100k ARR floor, before counting lost telemetry, degraded detection during parallel run, procurement friction, and the opportunity cost of losing Storylines history. The true friction scales with endpoint count, so larger enterprise deployments move quickly into the high-six-figure range.

• Revenue grew to $277 million in Q1 FY2027, and ARR grew to $1.163 billion as of April 30, 2026. Source: 2026-05-28 EX-99.1.
• Customers with ARR of $100,000 or more increased to 1,702, up 17% YoY, indicating broader enterprise penetration. Source: 2026-05-28 EX-99.1.
• The 10-Q says subscriptions and modules are generally priced per agent and that each agent generally maps to an endpoint, server, virtual machine, or container; contracts typically run one to three years. Source: 2026-05-28 10-Q.
• Remaining performance obligations were $1.5 billion as of April 30, 2026, with 81% expected to be recognized over the next 24 months, and deferred revenue was $586.2 million. Source: 2026-05-28 10-Q.
• Management raised FY2027 guidance to revenue of $1.195-$1.205 billion and non-GAAP operating income of $115-$125 million. Source: 2026-05-28 EX-99.1.

A representative migration floor can be modeled from public contract structure plus reasonable labor assumptions:

• 5,000 endpoints × 15 minutes each to remove/reinstall/validate agents = 1,250 labor hours
• Policy / integration / hunt-rule recreation = 80 labor hours
• Loaded labor cost = $150/hour
• One quarter of duplicated spend on a minimum public $100k ARR account = $25k

Direct switching floor ≈ $224.5k before lost telemetry, degraded detection during parallel run, and procurement friction. That floor scales roughly linearly with endpoint count. The public revenue architecture reinforces that lock-in: ARR is $1.163B, RPO is $1.5B, and 81% of RPO is expected within 24 months, which means the migration fight is a multi-quarter replacement problem rather than a one-time software swap.

• The 10-Q says subscriptions and modules are generally priced per agent and each agent generally maps to an endpoint, server, VM, or container; contract terms are generally 1-3 years.
• Q1 FY2027 EX-99.1 reported ARR of $1.163B, 1,702 customers with ARR ≥ $100k, and raised FY2027 revenue guide to $1.195B-$1.205B.
• SentinelOne's official August 2026 X posts announced governed closed-loop automation with Purple AI + Hyperautomation and integrations around Google Unified Security / AWS Bedrock AgentCore.
• The same earnings release showed 81% of RPO expected over the next 24 months, implying the replacement fight remains multi-quarter.