Is SentinelOne Watch List Worthy?

SentinelOne (S) makes money primarily through a subscription-based model for its cybersecurity solutions. The company offers its Singularity Platform, which provides endpoint protection, detection, and response capabilities, along with other security features like cloud security and identity threat detection. These services are sold on a per-device, per-year basis, allowing businesses to scale their subscriptions based on the number of devices they need to protect. SentinelOne's revenue grows as it acquires new customers and as existing customers upgrade to more comprehensive plans or increase the number of devices under protection. Additionally, SentinelOne has expanded its offerings through strategic acquisitions, such as Scalyr for cloud-scale data analytics and Attivo Networks for identity detection and response, which contribute to its revenue by enhancing its product suite.

Does it have rising, recurring revenues?

Nearly all of SentinelOne's revenues are recurring, stemming from its subscription-based business model. Its 3-year compound annual growth rate is substantial at 88.3%, and analyst estimates range from 19-25% annually over the next 5 years. The endpoint security market is about $20 billion at present, growing at nearly 8% annually to reach $30 billion by 2029. SentinelOne only commands 4% of the market at present.

Does it have durable moat characteristics?

SentinelOne's Singularity Platform integrates various security solutions into one, making it more challenging for enterprises to switch to other providers. This integration across endpoint protection, detection, response, and other cybersecurity tools creates significant switching costs due to the complexity of changing systems, retraining staff, and potentially disrupting security operations. There are some semblance of network effects too. As more organizations use its platform, the data collected enhances the AI-driven threat detection, making the platform more effective for all users. Its most recent net revenue retention figure of 115% is a testament to how the firm both retains and grows with existing clients.

Management / Finances

CEO Tomer Weingarten founded SentinelOne in 2013 and has been instrumental in shaping SentinelOne's direction, product strategy, and overall vision. He has led the company from its inception through its public listing on the NYSE in 2021 and remains on top today. While he owns a meaningful stake in the firm (1.53%), it isn't as high as many founders. SentinelOne has a strong balance sheet with no debt. However, the firm has been cash flow negative until just this year (2024), where it is barely eking out positive cash. Management expects 2025 and beyond to be cash positive.

Risks

Endpoint security is a very competitive market with many established, larger competitors including CrowdStrike, Palo Alto Networks, and Microsoft. Winning new business will require significant expenditure on marketing and technology. This risk is compounded by SentinelOne's valuation, which relies on continued rapid revenue growth. Operational risks are also keen in this space, as any failure of cybersecurity tools can be devastating to clients and reputation. A good example of this is the 2024 CrowdStrike update issue which affected tens of thousands of large organizations across the world for days.

Conclusion

Like CrowdStrike (an earlier Green Screen pick), SentinelOne's business is attractive, with a large growth trajectory, recurring revenues, and high switching costs. We have founder CEO leadership, along with a solid balance sheet and improving cash flow metrics. SentinelOne makes the cut as a "green dot" stock. Expecting about 25% annual growth over the next 5 years, and a free cash margin approaching 23% (still well under CrowdStrike's ~35% figure), I see the stock worth about $20.50 per share. It trades slightly above that so we will add it to the Watch List and wait for a better price.