SentinelOne
AI-driven endpoint security vendor selling detection and response software to enterprises.
The call
SentinelOne holds real enterprise telemetry and clearance advantages while Microsoft pulls share and lawyers, CFOs, and guidance keep churning underneath it.
SentinelOne sells security software that watches for threats deep inside company computers, using code that runs at the kernel level (the core of the operating system) and collects detailed data about what's happening on those machines. It is hard to replace because SentinelOne has built up real customer relationships with 1,700+ large companies, has government certifications that take years to earn, and competitors cannot easily copy the detailed threat information it has collected over time. However, Microsoft is bundling similar security tools free inside its Office 365 product that companies already buy, and CrowdStrike is a bigger, more established competitor doing the same job. The one thing that could change the picture is whether Microsoft's free option captures enough customers that SentinelOne's growth slows further or stalls, or whether a major acquisition (like Cisco buying the company) reshuffles the competitive landscape.
Why
01
AI pressure: None apparent. AI labs like Anthropic and OpenAI supply models inside SentinelOne's own Purple AI tool rather than replace the product. Could AI do the core job? Unlikely.
02
Bigger players: Microsoft Defender. Defender ships bundled into Microsoft 365 at near-zero extra cost, and sales calls increasingly cite losses to Microsoft. Could a giant copy it? Yes, easily.
03
What protects it. Kernel-level agents sit in 1,700+ paying enterprises with FedRAMP and GovRAMP clearance, data that is costly to rip out.
What would change this call
SentinelOne's y/y growth rate in next two earnings reports (Q2, Q3 FY2027). Falling below 20% would show Microsoft/CrowdStrike share capture is accelerating.
Rigrodsky class-action docket outcome (settlement, dismissal, or ARR finding). A finding validating ARR overstatement would confirm reported growth is unreliable.
Confirmed acquisition announcement involving Cisco or a private equity buyer. Would show the company's independent path was capped by a takeover instead.
Rigrodsky class-action docket outcome (settlement, dismissal, or ARR finding). A finding validating ARR overstatement would confirm reported growth is unreliable.
Confirmed acquisition announcement involving Cisco or a private equity buyer. Would show the company's independent path was capped by a takeover instead.
Key numbers
- ARR hit $1.16B, up 23% y/y
- Stock fell 17% on soft guidance
- Cutting 8% of staff, ~$25M charge
Named risks
- Active shareholder class action alleging ARR overstatement and weak internal controls.
- Microsoft Defender bundled into M365 continuing to capture EDR share at near-zero marginal cost.
- Leadership instability with three CFO transitions within six months.
- Growth deceleration to ~20% guided vs 23% y/y, with soft guidance triggering 17% stock drop.
- Potential acquisition (Cisco or PE take-private) could cap or crystallize equity terms outside employees' control.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Microsoft (Defender) | losing to | Documented taking EDR share for years; ranked #1 in endpoint security market share 3rd year running, Aug 2025 |
| CrowdStrike | losing to | Cited by SentinelOne management as larger pure-play EDR/XDR leader, May 2026 earnings call |
| Palo Alto Networks | contesting | Rumored acquirer of SentinelOne for $7-10B, July 2025; also a direct EDR/XDR rival |
| Cisco | contesting | Reported as leading potential acquirer amid stalled Cisco security revenue, July 13, 2026 |
| Cybereason | contesting | Sued a former product lead over trade secrets allegedly taken to SentinelOne, litigation ongoing |
Questions people ask
- Is SentinelOne profitable in 2026?
- Not on a GAAP basis. SentinelOne posted a GAAP net loss of about $76.2M in Q1 FY2027 (ended April 30, 2026), though non-GAAP operating income improved to $10.5M profit versus a $3.9M loss a year earlier, per its May 28, 2026 results.
- Is SentinelOne losing market share to Microsoft?
- Microsoft Defender is bundled into M365 at near-zero marginal cost and has been documented taking EDR share for years, including ranking number one in modern endpoint security market share for the third year running as of August 2025, pressuring SentinelOne's growth.
- Could AI replace SentinelOne's product?
- Unlikely directly. SentinelOne owns proprietary security telemetry, kernel-level agents across 1,700+ enterprises, and FedRAMP/GovRAMP High certifications; its Purple AI Agentic Investigation, launched June 17, 2026, embeds Claude and GPT rather than being replaced by them.
- Is SentinelOne laying off employees in 2026?
- Yes. On May 28, 2026, SentinelOne announced an approximately 8% workforce reduction with a one-time restructuring charge of about $25M, redirecting spend toward AI, data, and cloud investment, alongside soft Q2 FY2027 guidance.
- Who is SentinelOne's biggest competitor?
- CrowdStrike is the larger pure-play EDR/XDR leader, while Microsoft Defender, bundled into M365, is the incumbent taking documented share; Palo Alto Networks and Cisco are also cited as active or potential rivals/acquirers as of July 2026.
- Could SentinelOne get acquired?
- As of July 13, 2026, reports increasingly cite Cisco as a leading potential acquirer, citing SentinelOne's FedRAMP High status and zero debt, with private-equity take-private also floated; no deal has been signed as of this reporting.
Timeline
- 2026-07-13Reports name Cisco as leading potential acquirer; PE take-private also floated
- 2026-06-17Launched Purple AI Agentic Investigation using Claude, GPT, and Ultraviolet models
- 2026-05-28Q1 FY2027 results: revenue $276.7M (+21% y/y); soft guidance sent stock down ~17%
- 2026-05-28Announced ~8% workforce reduction and ~$25M restructuring charge
- 2026-02-23Guggenheim cut price target to $24 after CFO Barbara Larson's exit news
- 2026-01-26Company obtained GovRAMP High and FedRAMP High certifications
- 2025-09Announced intent to acquire Observo AI telemetry pipeline platform
- 2025-08Agreed to acquire Prompt Security for approximately $250M
- 2024-01Agreed to acquire PingSafe cloud security posture management for over $100M
- 2021-06-30IPO on NYSE under ticker S, priced at $35/share, raising ~$1.2-1.33B
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- SentinelOne Q1 Earnings Beat (2026-05-29)
- SentinelOne S Q1 2027 Earnings Call Transcript (2026-05-28)
- SentinelOne provides tepid quarterly forecast, to cut 8% jobs (2026-05-28)
- SentinelOne Posts Q1 CY2026 Sales In Line... Stock Drops 16.8% (2026-05-28)
- SentinelOne Announces First Quarter FY2027 Financial Results (2026-05-28)
- SentinelOne Employees (3,168): Headcount Trends 2026 (2026-07-14)
- SentinelOne Opens Purple AI Agentic Investigation... Bringing Frontier AI Directly Into the SOC (2026-06-17)
- Did SentinelOne's Interim CFO Shift... (2026-01-26)
- The $6 Billion Cybersecurity Prize Tech Giants Are Circling (2026-07-13)
- Guggenheim cuts SentinelOne stock price target to $24 on CFO exit (2026-02-23)
- SentinelOne (S) Gains Attention Following Cyber Threat Warning (2026-07-16)
- Rigrodsky Law, P.A.