Q2 2022 SentinelOne Inc Earnings Call
Okay.
Any forward looking statements made during this call are being made as of today. If this call is replayed or reviewed after today. The information presented during the call may not contain current or accurate information, except as required by law. We assume no obligation to update these forward looking statements publicly or to update the reasons actual results differ materially from those anticipated.
The forward looking statements, even if new information becomes available in the future. During this call unless otherwise stated we will discuss non-GAAP financial measures. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in today's press release and in our shareholder letter.
These non-GAAP measures are not intended to be a substitute for our GAAP results. The financial outlook that we provided today exclude stock based compensation expense, which cannot be determined at this time and are therefore, not reconciled in today's press release and with that let me turn it over to Tomer Weingarten CEO a sensible one.
Welcome everyone and thanks for joining our first earnings call as a public company.
As the stores open.
Formative boom, we really trust and transparency.
Pizza Moodle do so as a public company.
This is our first earnings call I'd like to give some background on our journey and how we go to you I.
I will then turn to weaken due to provide some highlights from our most recent quarter and outlook.
We launched an income of one 2013 with the idea that cyber security is still accretive faster speeds greater skew higher accuracy and most importantly, do this through more dimension.
We created an opponent cyber security platform to deliver our vision.
Texas threats are becoming more sophisticated and more common in legacy solutions and human defensive just couldnt keep up Luca.
<unk> further then we'll do ransomware attacks. Unfortunately, this isn't new.
Going away and it's impossible to ignore our.
Our mission to particular customers in a way of life has never been more important in a digitized world.
There are several structural forces at play that will drive long term and sustained growth for us and our industry. The growing threat landscape is just one of the mix the digital enterprise environment, where devices more places more data requires updates to critical inventory.
The structure and done, including new attack surfaces, such as containers and workloads.
At the same time, we need to a hybrid work environment. This is the new normal, forcing the revolution of how we work where we work from and fundamentally how we secure the future of work.
The only way to ensure safety and security is good viewer trust.
Across the entire enterprise from endpoint to cloud companies.
Companies, one partners and platforms Siloed solutions are opening xdr approaches, hoping unify the entire enterprise view from data to device to cloud <unk>.
Putting all this together cyber security has never been more critical and with challenging for the enterprise.
That gives me tremendous confidence in the long term growth potential in front of center in one.
Over the last eight years at Samsung one we've developed AI and machine learning models.
Maintenance storyline technology and created an in house cloud data platform.
We knew from the beginning that the best solution would have to harness the power of data and AI and.
And as a result, we're delivering real time industry, leading threat detection and response from endpoint to Iot to cloud.
To us prevention is a fundamental component of wondering day cyber security equally critical as machines be detection response and remediation.
We've achieved many important milestones already this year certainly the IPO as part of them at the same time top scores from Mitre attack the industry standard for Edr is always the highest scoring the gartner critical capabilities for each buyer type of hub.
Build credibility and industry recognition operationally, we've expanded our board of directors and instituted an advisory board and.
And with an eye to the future, we just announced that we'll be opening an R&D facility in the Czech Republic to support our growing scale and global presence.
Finally, delighting, our customers I'm, especially proud that our net promoter score or NPS because there is in every single quarter in the past year. It jumped in Q2 above 70 that puts us well above the ranks of many consumer and technology companies and ahead of category defining technology loved by users such as the iPhone.
Our customers choose us as their cyber security partner and we take the responsibility entrust seriously we're helping our customers stay ahead of our adversaries prevent breaches Thomas we respond through innovation.
Turning to the business.
In Q2, <unk> growth accelerated to 127% year over year, and our revenue was up 121% I want to pause on that for a second our business is expanding well into the triple digits, both for <unk> and revenue in our guidance for Q3 shows that we expect that to continue our growth is very well balanced across.
New and existing customers as well as large and midsize enterprises enterprises and represents about two thirds of our business today and were gaining even more traction in Q2, we added the highest number of customers with over $1 million compared to prior quarters. We're also expanding with existing customers to securing more devices and surfaces.
Along with bringing new security control and visibility modules on net retention rate was the highest its ever been to 129%. Our channel partners are bringing us into an increasing number of opportunities, giving our sales teams access scale and reach around the globe. Nick will talk a lot more about our differentiated go to market and how thats fueling.
<unk>.
I am proud of the technology and the innovation, we're bringing to customers through our singularity xdr platform.
We sold three platform peers core control and our most comprehensive and popular tier compete these tiers enable us to bring our technology to a diverse set of buyer types and organizations for medium sized businesses all the way to the world's largest fortune 500 enterprises.
We also for more than 10 modules that extend our platform value to more enterprise need from Iot discovery and security to cloud and container workload protection, our modules have customers with today's critical management prediction in visibility challenges in Q2, we enhanced our capabilities around automation.
<unk> and data.
First automation automation is key to neutralizing threats effectively and in real time security teams simply can't analyze and respond to billions of events every day. The response pieces, especially important human powered 160 benchmark as a legacy model our customers want real time response.
In protection.
This is why our credited storyline technology is so important as Monty doors and contextualize is all events across an enterprise. It's machine speak that means fewer and more accurate alerts based on data. It also means of tunnels remediation taking machine delivered responses to a whole new level of automatic efficiency.
The Chief Information Security officer, or a fortune 500 oil company captured it well, saying centered on one storyline technology fundamentally changes edr instead of people having to manually assembled data points. The technology assemble stories for us and even makes decisions in real time game changer.
We listen to our customers and even more automation capability.
In Q2, we added storyline active response or scar, which star security teams can now create custom detection and response rules and deploy them in real time in other words right. The rules once the knitted trigger automatic alerts and instantly sponsored enterprise wide.
Thats more control and more automation and more prevention.
The second area of focus is around zero Trust every.
Every edge of the network must be secured we did this in two ways in Q2, tackling robot Iot devices, and expanding zero Trust partnerships.
And enterprise can predict what it can see including Iot and unmanaged devices. One compromise printer can quickly become an inverse series homebase for an attack.
The solution for the Iot on a managed device challenges our Ranger module.
Ranger identifies and tracks all rolled Iot devices, and we've just release total deployed our new order deploy capability tackle as one of the oldest problems in enterprise it.
Quickly deploying protection to unmanaged, and sometimes unreachable assets with EPS range.
The range also deploy takes us into one endpoint and enables it to transmit protection to any and all on many devices surrounding this is a first and.
And we're already seeing demand photo deploy which helped secure a million dollar customer win in Q2, where we replaced legacy and one of our other major nextgen competitors.
Also extended our marketplace ecosystem through new partnerships with these killer in cloud, they're partnering with other zero Trust leader strengthens our customers' security postures.
Finally, we're focused on data <unk>.
Cyber security is fundamentally a data problem, we use AI to parse petabytes of data identify anomalies and autonomously mitigate attacks in real time.
Earlier this year, we acquired scalar enhancing our ability to ingest index free data at scale from structured and unstructured sources. Our goal is to optimize for scale performance and cost. We're excited about the future go to market synergies. We've also begun transitioning our data back into scalar for new proof of concept deployments.
Onboarding new customers escape.
Before I turn it to Nick and Dave I want to say I am excited about what we've achieved as a company I'm proud of the scale of our business and to triple digit growth rates. We've now delivered for two consecutive quarters.
This is truly a testament to the hard work of the entire team at central one thank.
Thank you to all of our employees and also our customers and partners your feedback and plus puts us on the winning side of cyber warfare everyday.
I'm, even more excited about what we can do from here.
The endpoint security market is large and growing and we're just at the beginning cyber defense should be even more holistic and it has to be flexible and automate it and that means not just across the endpoint operating systems, but also Iot devices servers cloud workloads and data. So this is xdr, we our xdr.
And with that let me turn it to Nick Warner Our Chief operating Officer.
Thank you Tomer and I'd also like to welcome everyone.
Been at Sentinel won for over four years now.
Everyone here has a lot to be proud of especially how quickly we scaled in just the past year alone. We've built a go to market flywheel of sales and marketing our channel and technology partners together, our brand and market traction is reaching new highs.
Let's discuss the business <unk> of nearly $200 million and growing a 127% is nothing short of astounding looking back it took over three years to reach $100 million, an IRR and just three quarters to nearly reached the next $100 million.
Our future is unbounded.
That's because of vision execution and listening to the needs of our customers.
Over 5400 customers use our singularity xdr platform.
That's over 2000 more than last year.
I'm delighted to help protect that many businesses.
Our customers are diverse in size scope and geography.
Our focus on automation speed and accuracy is critical to any enterprise in fact, all enterprises.
We're protecting even more mission critical businesses in Q2, we added one of the largest telecommunications and mass media companies in North America, and we also added one of the world's largest global financial institutions as well.
Make no mistake. This is a competitive market we go up against incumbents and next Gen players all the time.
When I think about how we're doing in the market three things capture it most effectively.
One are 97% gross retention rate, which means our customers are happy and staying with US too we don't compete with our channel partners. So they are able to lead with our technology platform, we enable and embraced the channel and three we win more than 70% of POC against the competition.
The significant majority of competitive wins and displacements against any and all competing vendors.
Let me share some more detail from the quarter, we're making tremendous progress with large enterprises, which represent about two thirds of our business.
We grew customers with <unk> over $100000 by 140% versus last year.
We added the highest number of $1 million our customers this past quarter and the past year, we've more than tripled the number of customers with <unk>.
Over $1 million.
It's clear from both of those points that were succeeding with larger customers and landing larger deals.
Our net retention rate was 129% a new record for our company.
Fantastic execution from our sales and go to market teams.
We're helping customers expand agent deployment access more functionality with packaged tears and adopt new module solutions.
When it comes to our modules are innovations help enterprises do more just looking at our modules that cover Iot cloud and data. These grew more than six <unk> year over year in Q2 and represent over 10% of the quarter's new business. We're still early with our modules and see this as a long term lever.
For our business.
Next I will share some insights on our go to market.
Our internal sales and support teams combined with our diverse and growing partner ecosystem gives us an incredibly vast reach earth.
Earlier this year, we rolled out our new channel partner training and accreditation program feedback has been positive and we've issued over 2000 accreditation to date.
Our strong channel metrics, our leading pipeline and traction indicators.
We partner with managed security service providers MSP managed detection and response providers Mtr's and incident response, IR partners, we equip them with industry, leading capabilities and in return we get tremendous market access and scale, we don't compete with them.
We support and enable their business.
We're rapidly expanding this ecosystem and it's driving meaningful growth for us.
I want to double click on our incident response partnerships driven.
Driven by the rising wave of ransomware attacks breaches have become pervasive for businesses around the world.
In the unfortunate, but often common case of accompany being breached IR partners. Our call then to identify and remediate the attack they use our technology to understand whats going on stop the attack and remediate the network our ecosystem of IR partners are armed with the best technology available when it comes to rapidly recovered.
From a breach.
After seeing the immediate value of our technology, we see extremely high adoption rates post breach as post breach enterprises standardized on Sentinel won as a modern approach to cyber security.
In Q2, we added over a dozen additional IR partners and are bringing more online in Q3 and beyond.
It's not just quantity or quality and.
In Q2, we added world renowned IR partners like crawl, Alvarez, and Marsal and group IV.
These and others are global leaders with extensive enterprise relationships. These are the go to experts cyber insurers and boards call. When there is a branch in fact, our IR partner ecosystem is our fastest growing channel.
For all of us at central what our values and goals align on protecting customers and putting them first from sales to support marketing to channels business development to customer success vigilance MTR to central Labs. Our go to market organization is world class and I am proud to work with this.
Global team of relentless sentinels, each and every day.
Thank you and let me turn it over to Dave Bernhardt, our CFO.
Nick Kilmer, Thank you and thank you all for joining us today and hopefully in the future.
I'll touch on a few of the highlights before we open for Q&A. There is a lot more detail in our shareholder letter, which I welcome you to view on the Investor Relations section of our website.
We are very excited about our performance in the second quarter.
Looking at our Q2 results, we achieved record revenue of $46 million increasing 121%.
Fueled by new customers and existing customer expansion, we delivered <unk> of $198 million in the quarter accelerating 127% year over year.
Even after backing out the $10 million in acquired Anr from scalar our organic growth was still well into the triple digits.
Obviously, we're very enthusiastic about our top line drivers.
Now I will discuss our cost and margins and then provide our guidance outlook.
Our non-GAAP gross margin in Q2 was 62% and expanded 900 basis points to healthy pickup from last quarter.
The biggest benefits are coming from our increasing scale and business expansion. Additionally, we're also starting to see benefits from our renegotiated cloud hosting agreement, which we signed earlier this year to align with our expected growth.
Looking at the rest of our P&L, we're investing for growth and it's clear that it's working once again reflected in our triple digit topline growth rate.
During the quarter, we made strategic investments in preparation for becoming a public company enhancing our product and scaling our go to market.
Our non-GAAP operating margin was negative 98% an improvement over negative 101% in the year ago quarter, even as we prepared for our IPO.
In the shareholder letter, we've reiterated our long term margin targets. These are the same targets that we shared during the IPO.
The key point is that as we progress to our long term targets, we intend to invest in growth, while also improving our margins and profitability.
A recent example is the diversification of our R&D footprint outside of Israel and Silicon Valley.
We just announced that we'll be expanding our engineering excellence into the Czech Republic.
With all of this opportunity in front of US fiscal 2022 remains an investment year.
Now for our outlook for Q3, and the full fiscal year.
In Q3, we expect revenue of $49 million to $50 million, reflecting growth of 102% at the midpoint for.
For the full year, we expect revenue of $188 million to $190 million or 103% growth at the midpoint.
We expect the strong momentum we saw in Q2 to continue next quarter and our structural tailwind to persist.
Find with ongoing benefits from our product innovation improved brand awareness and continuing to scale. Our go to market. This collectively supports our triple digit growth outlook.
We expect Q3, non-GAAP gross margin to be between 58% to 59% and full year gross margin of 58% to 60%.
Most importantly, this remains well above 53% we reported in the first fiscal quarter this year and at or above 58%, we delivered in fiscal 2021.
We are benefiting from increased scale cloud hosting agreements and processing efficiency gains reflected.
Reflected in our guidance is our plan to migrate existing customers to our scalar back end in Q3 and Q4.
The migration will result in some duplicative storage and processing costs as we ensured data and performance continuity.
This is intended to further improve data processing for the future and unlock long term platform and go to market synergy.
Excluding the redundant costs for the scalar migration, we estimate fiscal 2022 gross margin will be roughly similar to our gross margin we achieved this quarter.
Finally for operating margin, we expect negative 96% to 99% in Q3.
Our full year operating margin guidance is for negative <unk>, 99% to 104%. This is an improvement upon our fiscal year 2021 operating margin of negative 107% we.
We see tremendous opportunity for growth and the investments, we're making today will put us in a position to succeed for the long term.
Finally, we have two quick housekeeping items. Both of these are included in the shareholder letter with more detail as well. The first item is share count. We ended Q2 with total basic shares outstanding of $265 million. This is the base run rate going forward.
The second item is the lockup, we have two triggers the first is on September 28.
If the stock price remains at current levels. It will unlock up to approximately 40 million outstanding shares as of July 31, 2021, excluding vested equity awards. The remainder of the lockup will expire subsequent to our Q3 earnings report in.
In closing Q2 was an excellent quarter with strong execution and we're expecting that momentum to continue into the second half of the year I want to thank you for attending our earnings call and for starting this journey as a public company with US operator can you. Please open up the lines for questions. Thank you.
Certainly we will now begin the question and answer session.
You'd like to ask a question. Please press star followed by one on your Touchtone Keypad is there any reason you would like to remove your question. Please press star followed by team again to ask a question press Star one.
Pause here briefly to allow questions to generate in Q.
The first question is from the line of Hamzah firewall.
Morgan Stanley. Thank you you May proceed.
Hey, guys. Thank you for taking my question and congrats on your first quarter post IPO.
Just on maybe a question for either Nick or Komar I wanted to dig into some of the partnership announcements you guys have made in recent months, particularly with the.
Zee scalar and cloud software.
What do you think.
One for tomo.
To what extent does that validate your technology.
Technology given.
Given that you're partnering with other next gen vendors on the network security side and then.
From a go to market perspective for Nick.
Type of incremental benefit will these partnerships.
Yes, thanks for the questions on billings and for US it's really about.
Really stepping forward towards a more inclusive open xdr approach and also.
Kind of producing a more zero trust ecosystem around simply one singularity platform.
Really fusing together endpoint, which is kind of the edge of the network with the cloud now identity and the user as well.
That's really the Trinity.
Forms zero Trust and Thats why we are partnering with these vendors what we see.
We find them in more and more accounts that we sell into.
So that also becomes something that our customers are asking us to do so all in all I mean, it just really kind of falls in line with both of our Zero Trust strategy in our open xdr approach and the idea is over time to continue and in just more data from all of these adjacent solutions in the enterprise into our opening our platform.
So to us and again, it really falls into this strategy.
We took up by enabling our customers to pick any vendor.
Build on top of the singularity platform.
Hi.
Nick here from a go to market perspective, what it means for our customers as we really allow them.
To realize even greater ROI on previous solutions that they purchased so the average enterprise has a few dozen different vendors covering various parts of their security enterprise and with our vision of xdr being opened being inclusive being easy to use what we're really doing is up leveling the.
Capabilities.
<unk> traditional and already installed products.
Adding tremendous value with a singularity platform, but we think that all in together to complete and holistic view of security, which is really the promise that we are delivering upon with xdr.
Got it thank you.
Thank you.
The next question is from Brian Essex with Goldman Sachs. You May proceed.
Hi, good afternoon, and thank you for taking the question and congratulations on another.
Really nice quarter of acceleration here.
Maybe <unk> I would love to get your feedback on I think in your prepared remarks, you talked about two thirds of your.
Businesses.
Enterprise focus.
Is the mix in the quarter and what do you anticipate going forward for larger enterprise mix.
I'd say the landed cost per new logo is certainly much higher than it was last quarter. So just trying to think about the trajectory there and maybe the most fundamental thing that changed in the quarter to drive that improvement.
Yes.
For us it really is a good mix I mean, we feel like our traction in the enterprise differently, 140% growth year over year, and 100, K deals and above.
It's a good reflection of the home how much bigger with landing in accounts, 225% of $1 million deals again, a good reflection of our traction in the enterprise, but at the same time, we feel.
<unk> presence into Martin in the mid market is important.
It's something Thats actually is a very efficient go to market for us. So we like that mix, we feel it's a good mix for us will continue to drive it and drive it definitely on the enterprise side, we're seeing more land with our complete tier.
Actually with more attached ranger more attached to vigilance of more attached data retention solenoid, we're seeing massive adoption.
Really kind of what is now becoming our premium tier which is complete but in total debt to the add on module that we have and we have.
Tend to do the same also.
The mid market, where we enable our channel ecosystem to carry more than just endpoint protection until so cloud security. So all in all we feel that makes us a healthy one and one that we would like to carry into the future.
Got it and maybe just a quick follow up for Dave You mentioned real quick.
Duplicative costs associated with the scalar migration when might we see that abate.
<unk>.
Maybe the market might be able to maybe better accelerate off of the conclusion of that.
Sure it's predominantly in the second half of this year, so you'll see it in Q3 Youll see it in Q4 and then it should dissipate beyond that we're working on getting our largest customers over first which is why you see the debt that we're expecting in the second half but.
Forward, we think we should have a baseline of around where we're at right now barring any other efficiencies.
Efficiencies began the product as we continue to advance it.
Got it very helpful. Thank you very much.
Thank you Jack.
The next question is from <unk> Kalia with Barclays. You May proceed.
Okay, Great Hey, guys. Thanks for taking my questions here and Echo my congrats on becoming a public company.
Tomer, maybe maybe for you.
I was wondering if you just talk a little bit about kind of the broader distribution channel a bit I guess the question is how do you sort of judge the scale of your channel and where do you see it kind of going in the next year coming off the IPO.
Yes.
So it's a great question, because we look at our channel in a very very inclusive manner.
Kind of look at the distribution channel reselling channels, but the window a little bit more classic the security is going to Covid incredibly strong game and at the same time the ability to also take the same platform license. It to MSP providers gives us to tap into a completely different part of the Tam and as Nick mentioned in the prepared remarks are.
<unk> to now a sign up most of these industry slows providers most of the leading it instead as opposed to providers of <unk>.
<unk> is providing for another channel that kind of expense the gamut of what we see.
There is a market opportunities. So all in all we feel pretty good about our market presence in the channel ecosystem, we're growing.
Making more accreditations were training the channel better we're expanding globally. So to us I mean, we feel like we've built a really strong foundation in the channel, but now they are just growing and accelerating and at least be enabling the channel preparing more modules.
As another tier in our ability to unlock this doing the vast opportunity into channel ecosystem.
This is Nick here, what I'd also add to that is uniquely with Sentinel won.
Strategic decision to enable and not compete with the various multi dimensional of channel partners out there, whether thats mtr's msp's or Internet response partners, obviously as well as your traditional retail partners and what that's really driven by enabling their business and not competing is incredible loyalty.
And and brand loyalty with Sentinel won and that's something we've been working really hard on for the last several years. So we're really starting to see that that flywheel kick in in all the different facets of our go to market channel partner ecosystem.
Got it that's really helpful. David maybe for my follow up for you.
Sorry, I sort of talked about this just briefly on the last question, but I was wondering if you could just double click a bit on the mix of customers across the different singularity tiers, specifically core control and complete what are you sort of seeing in terms of new customers and existing customers in terms of the tiers that <unk>.
Theyre sort of opting for it.
Sure so about half of our customers still use core our control.
With the larger enterprise customers, obviously, using the that complete solution.
Yes.
There is a mix across all of them, but there is certainly an opportunity for us to continue to see the customers and core control to expand up to the more complete offering.
As well as add more modules etcetera, etcetera, I think that goes into why youre seeing a 129% IRR, we're seeing customers not just expand their footprint in terms of endpoints, but also expand into a much more robust offering.
Very helpful. Thanks, guys.
Thank you.
Next question please from Europe.
Line.
I apologize one moment please.
Thanks, Rob Owens you May proceed.
Great and I. Appreciate you guys, taking my question I think building a little bit on sockets question, but I wanted to touch on the net dollar retention rates and is this coming from an expansion in <unk> is this coming from the peers that you talked about upsell within the base or is a lot of that growth coming from adjacent.
Modules.
It's actually all of the above and we definitely focus on basically providing the customer the choice.
License counts naturally organically.
Over time, we see that time and time again, but at the same time, it's very clear that we are much more in the back today versus maybe a year ago and customers want to procure more from Cisco one they want to cover more surfaces. They want to use more abilities through opening up for our services. So on and we're seeing traction all across the three different vectors, which would be.
Again.
Seat count expansion more modules different peers, who.
And we see that timing.
And we like that net retention rate I mean, we feel is going to hover around these rates.
For the foreseeable future and we like the contribution.
And as we look at customer acquisition typically who are you going up against are you still seeing a lot of replacement of legacy out there, which would imply that there is still a long way to go in this market or is the battle coming down to more of the nextgen providers. Thanks.
Yes, I think it's 99% displacing an incumbent it's always going to be competitive.
One other nextgen competitor, but.
But outside of that I mean, we are doing displacements here theyre very anecdotal, but we have those.
But the vast majority of what we see.
Absolutely taking market share from the incumbents, it's always a displacement.
We've had multiple.
Years' loan customers of Symantec, and Mcafee switching over to simply one this quarter as it has been with the past quarters as well. So we think the <unk>.
Market momentum in customers understanding that they need to change the mindset.
Move over to Nextgen offering is not really mainstream and I think that comprises the vast majority of our pipeline.
Thanks for the color tumor.
Thank you.
The next question is from Brent Thill with Jefferies. You May proceed.
Thanks, Tim or you mentioned Iot cloud and data center.
Really good uptake.
Curious if you could just talk through.
How you look at the next couple of years in this segment.
What youre seeing I know you mentioned in one of the Iot wins drove multi drove a $1 million plus win can you just maybe help shape whats happening when these when these transactions are getting involved in what youre seeing with overall.
Spansion of deals.
Absolutely.
Ranger for us has become truly a competitive advantage our ability to not only discoverable devices on the network, but now also to automatically deploy and help customers reach all these devices in a complete automatic manner is something that is incredibly unique in this space and it's driving more adoption and driving.
More seat count and all in all.
This ability for customers to shift away from their incumbent vendor.
So it took only about protecting those attack surfaces.
About ease of deployment and simplicity of use so we're seeing massive traction with that we're seeing the ability for almost every customer that we have today to go in and provide that functionality. It's zero additional deployment, it's completely cloud delivered so it's incredibly easy to consume.
Ranger is one of our fastest growing modules and same goes for data retention. We're now seeing it think about the white house executive order that mandates low collection data retention and the ability to keep security data input telemetry for longer is actually fueling customers to procure more and more data.
And archiving directly from our platform is something that is highly unique to us.
Second part of the reason why we've expanded our offering and knowledge scalar is a data analytics backend. So the ability to re address all of these new opportunities in cyber security that might have been there a couple of years ago are now not only an opportunity, but also a competitive differentiator that we have.
Great. Thank you.
Thank you.
Next question is from Tal <unk> with Bank of America.
You May proceed.
Hey, guys congrats on a great quarter.
<unk>.
A few questions I wanted to speak about competition.
Can you characterize your competition between you highlighted 70% win rate can you characterize the competition how is it going versus legacy players.
And what drives.
Corporates that were on legacy system for a long time, what drives them now to migrate and then also the competition versus the new players like crowd strike and others.
If you can talk about Europe.
We know we spoke about product differentiation, but I wanted to talk about the.
The value of automation, how is that coming to play and also pricing differences. We are hearing that you are quite cheaper than the competition nextgen competition. Thanks.
Yes.
I believe for US it's really about the holistic approach, we're taking that allows us to win both against incumbents and against Nextgen peers.
The ability to give us full spectrum solution, a full spectrum platform between just from bits of wheat prevention, all the way to detection and response and remediation all of that's in a complete uniform autonomous manner.
Different from what the others are doing in this space, we feel like for a lot of these customers.
More and more press rate fluctuated.
This need to simply put down fires and for US I mean, if you take a more prevention first approach you can actually stop these fires some actually ever happening.
Just drive efficiencies and I think if youre looking at.
All of these incumbent vendors incumbent footprint, obviously, there is massive massive amount of breaches there even fortinet peers I mean, we're seeing a lot of their customers and we've had a multi million dollar displacement.
This quarter for a customer that grew increasingly frustrated with the multiple infections with inefficiency on protecting server environment and they wanted a more dramatic solution. They wanted a solution that can actually remediate it clean.
Clean up all the infections they were seeing but at the same time turn into more of a preventative approach where I'm not saying that you can prevent everything but you can absolutely do a better job on prevention and really stopped at firefighting mode or improve it significantly and that is what our platform is incredibly unique in that the advantage will be.
And machine learning and I think Thats the reason why were winning.
Both against incumbents.
That does not only provide.
<unk> deep protection piece, but also think about hardening think about anti temporary these are all things that our platform can cover today, it's incredibly holistic again in nature and once again, we look at the peers, they're focused on detection and response, that's what they do the bundled service with it for US it's about technology.
It's about creating a more secure endpoint and the most holistic way possible.
Got it.
Pricing is it.
As being cheaper than the Nexgen competition is strategic.
The kitchen go for you I mean, how do you tax our ACO pricing versus competition.
Yes, I don't think were cheaper than the competition I think if you look at it apples to apples you will see that the prices are pretty much similar I think we take a different approach I think we've taken much more transparent approach and we don't force customers to opt into tiers, we don't.
Forced them to use our service so all in all I mean, they can actually choose what they want to procure from us, but again apples to apples I think youll see that prices are very very similar don't think we're cheaper by by any degree.
One thing I would add to that this is Nick here.
From a budget perspective, what we don't try to do is hijack your customers' security budget into forcing them to buy.
Reams of services hours to support.
Non automated products, what we're bringing is automation and machine learning ease of use and really we're democratizing very advanced technology with that enables customers to do is achieve the outcome, we're driving for them and our prospects and customers, which is protection and prevention and so from an apples to apples perspective.
Typically at or higher from a technology perspective, but we enable customers to best put that money to use buying technology and more importantly, really implement that technology fully to get the best protection and visibility on the planet.
Great.
A quick one if I can squeeze it in if not I'll ask you privately.
Crowd strike highlighted on the last call that they won workday from you and they highlighted false positives and reasons why they said the discussed and a switch to them I think you just fair to ask the question. If you can refer to their statements and announcements on discussed thanks.
Yes, I mean, I think it's it's something that Youll see anecdotally happening I mean, we've had some.
Excess of $1 million HCV displacement this quarter as well for a fortunate 500 company and they cited the same so I think it's different.
Different environments, you might see different difficulties I think a lot of it is sometimes about relationships, but I think what can be incredibly interesting about the customers that we display is.
Referenced they made to the amount of infections, they have to deal with which to US is really what youre, bringing in cyber security solution.
You want to prevent these infections from happening so to us I mean, both positive performance. It's always something that you deal with I mean, they deal with that we deal with that is something that we'll deal with that forever, but again infection that is something that's unacceptable.
That's why you see customers' fixed.
Scale again, multimillion dollar hcv's shifting away and Thats kind of what we've seen in the space today and this is Nick hear time and time again, what we've seen for several years now as folks go with Sentinel won for really a unique combination of prevention.
OS coverage and support automation and then lastly, as tumor had mentioned efficacy so our ability to protect to prevent and to keep our customers safe.
Great. Thank you.
Thank you.
The next question is from Andrew Nowinski with Wells Fargo. You May proceed.
Great. Thank you and congrats on a very good quarter.
Two quick questions for you.
A number of vendors are talking about the start of another firewall refresh cycle, but given the comments you've made today it sounded like youre, indicating that we're also at the start of an endpoint refresh cycle.
As more enterprises rip out their aging legacy solutions. So I'm just wondering if thats the right characterization of the strong demand that youre seeing or do you think the ransomware attacks that we've seen over the last nine months, maybe fueling the momentum.
I'm, just really trying to get a feel for how long.
This exceptionally strong momentum can continue.
I think it's a combination of quite a few factors.
Definitely some tailwind.
<unk>.
The hybrid work environment and to replace those cycles through increased need of abilities to the government pointing out Edr solutions as one.
Become mandatory in environments. So I think there are many different drivers to what we're seeing right now in endpoint security.
The road is long and I think what really is important to understand about our platform is we're much more than endpoint security. So for a lot of these new accounts that we're winning net new logo motion that we have is already going into other adjacencies in the enterprise, whether it's Iot security or cloud security. So.
Only the endpoint creep recycle, but is actually something that drives an overall look at your entire cyber security posture, and we're becoming the trusted partner for these enterprises to actually continue and grow up and down the stack and in different surfaces. So all in all I mean it drives.
I think a complete overhaul of the cyber security stack I wouldn't call it necessarily a refresh cycle, just because they're assuming different secular trends that are pushing it towards just modernize environments and the ability to extend into every part of what is now a completely flexible parameter versus the parameters that we've seen in the past.
This was mainly kind of firewall bound to date, it's completely dissolved two data device to cloud.
It's really what's driving massive motion in our market.
I think what we're seeing really is best characterized as a generational shift away from signature based approaches to machine learning in automated driven protection and visibility and Thats what were experiencing were still in early innings, but its massive it's macro and it's global.
That's great. Thank you and just my follow up question.
As it relates to some of the $1 million or customers that you landed.
I'm wondering if you could just give us any more color in terms of maybe how many agents.
Those deals typically involve or how many modules they typically purchase.
I'm just wondering ultimately how much of an opportunity there is that those customers for additional purchases.
Down the road are they buying everything in maxing out their purchase on the initial purchase to get to that million plus spend or is there a big opportunity with those going forward.
We feel it's far from it and it can vary significantly.
We see the ability to expand into other footprints in the enterprise in almost every account that we learned we're also putting more and more modules.
This quarter, we were actually added two new modules into our into our roster and portfolio of capabilities.
All in all we feel pretty good about our ability to continue and grow in these customer accounts, both in terms of covering more footprint, but also in terms of selling more modules.
Really seeing better adoption for our Ranger module as I mentioned, but again, we got so many different abilities right now and we're seeing the beginning to ease.
Innings of attraction with a lower with a lot of our newer modules and it's kind of a game that we saw a film that we already saw and we see it growing over time. So all in all we took the potential is quite significant.
Okay. Thanks, guys.
Thank you.
Next question is from Patrick Colville.
So each bank you May proceed.
Thank you for taking my question.
So sequential AOR grew 37 million Bucks, if I'm not mistaken just a kind of housekeeping item I presume scalar because that closed in the first quarter about $10 million you called out of inorganic <unk> right. So Ah study 7 million that you guys did this Q was organic is that right.
That's correct.
We got $9 million when we acquired scalar now turn our focus with scalar has obviously been on implementing the technology not on and really pushing our go to market. That's something we will advance once we get it completely tied into the Sentinel won backend.
So yes.
37.
Okay.
Sorry, just for clarity.
And was it <unk>.
<unk> and <unk>.
And <unk> one.
$1 billion incremental between Q1 and Q2 for our scalar so we acquired them and Theyre currently 10.
Okay, that's great color.
Just I guess follow on about the Quebec to environment.
Alex.
Going public.
In the enterprise.
Or I guess landed kind of ballpark.
Si partners is.
As the.
The publicity and profile of being a public company and in that or is it actually kind of question. When you guys are already seeing pre IPO.
I think we're definitely seeing an elevation of the brand and we're definitely seeing more more market presence I think the tack that we choose to be very transparent about what the company does this build I think a lot of the misinformation that was there.
<unk> market, mainly fueled probably by competition.
For US right now, we feel better traction, we feel better competitive environments more it that's for sure.
And that's not only fueled by our IPO, but also a great performance in the Gartner Magic quadrant, where we were singled out the vendor with the most critical capabilities every vendor out there for any buyer type.
It just comes to show that film prevention, and all the way through detection response and remediation.
<unk> holds the most capabilities, but if any other platform out there. So all in all I think again multiple factors come into play the IPO shining a spotlight on all of them and now we're seeing I think of just increasing increased and accelerated traction across the board or through partners and with customers.
Sales cycles and with competitive win rates.
Great. Thank you so much.
Thank you the next.
Question is from.
Now <unk> with.
With Cowen you May proceed.
Thank you.
<unk> guidance on the strong data quarter.
Dave when we think about Europe check with public R&D facility.
Is that driven by global lack of talent driven by higher R&D costs in the West Coast Tour.
Or in Israel oriented training methodologies above and how many people are you planning on adding any.
In the Czech Republic facility.
So we obviously look for global talent.
One of the reasons.
In fact Republic.
Excellent.
Right.
Sure.
We don't have to.
So.
For area.
Yes.
Well.
Sure.
Product innovation.
Obviously there are areas.
Economically more viable long term strategy.
Continue to monitor that and we'll do that.
Future.
Got it got it.
Tom.
Maybe a question on cohort analysis.
Not too early.
You talk to us maybe from a crunchy Ada, but maybe just from a quantitative perspective on the LTV of cohorts over the past.
A few quarters now.
A few years, specifically on the hill or the <unk>.
That Europe deals greater than 1 million have been fantastically on the rise as of late.
This is Nick here so.
We really think about.
Growing the business from.
A new logo perspective, as well as lending in Spain.
Someone asked the question on that the answer is yes, we're doing both what we've seen and <unk> talked about this.
The tremendous innovation and introduction of new module.
Surfaces to protect new problems to solve.
London expand opportunities and in fact, 50% of our customer base with running our core or control packet upgrades those folks to complete.
Many modules to cross sell and up sell what we're also finding it.
Hi.
For new customers.
Landon.
A complete package with other models as well so we're really seeing a combination of both of those things driving our average deal size or enter our retention all of those things are up into the right.
Four.
I think the last thing.
Excellent.
Market momentum awareness and adoption of our technology is one.
It really.
We can do.
A big Big way and so that's also driving a lot of the adoption.
Got it. Thank you so much good luck.
Thank you.
Thank you. The next question is from Roger Boyd with UBS you May proceed.
Yes.
Terrific. Thank you very much for taking my question.
Yes.
I guess relative to the impressive.
Net retention results.
You called out the success with tears in modules wondering if you could talk about the.
The impact of cloud workload protection, where you think you are in that opportunity and any sense of the penetration of that product has the customers today.
Yes.
Looking differently to extend more and more into cloud security and specifically when we talk about flex security, we talk about workload protection platform and brought back protection.
Today, I think we've shared that it's already about 10%.
Contribution into our revenue is coming from the cloud and server protection piece that we so we're seeing more and more traction in cloud security and to US. We also continue to bolster the capability set there we've added Cif benchmarking capabilities, just a couple of quarters ago.
Doing better and better adoption.
We introduced our cloud.
Cloud Oracle protective platform as an integral part of the AWS marketplace.
That drives adoption as well so all in all we're definitely seeing an opportunity that's almost completely greenfield there and we feel like a lot of our customers.
Going back to us now that youre, starting to transition into the cloud and they're deploying into their kubernetes environment in to make a cloud environment.
The product that is completely agent tap.
Tap into the grid.
Propylene and immediately cover or containers.
So all in all we feel well positioned to continue to capture market share in the cloud workload protection platform.
And to US again, if you couple that with the platform approach with everything coming back to the same security data.
Then you're going to start unlocking synergies and allow security teams to re ask a question one and get an answer from every part of their enterprise network.
From the endpoint or to the cloud and that becomes very unique proposition.
Very helpful. I appreciate the color. Thanks.
Thank you. The next question is from Alex Henderson with Needham You May proceed.
Great. Thank you very much.
That was a great question from Roger but I wanted to go into a slightly different angle.
The cloud architecture that you bring.
Certainly.
Selling too.
Okay.
DIR.
Partners in selling to another.
Sps and.
The vanish correct.
People you end up having to integrate them into your platform can you talk a little bit about.
The degree to your cloud structure.
Our ability to integrate micro services.
Cloud native.
Characteristics.
Differential advantage and to what extent.
That partnership integration make sure.
Your partner's more sticky.
Overtime.
Amplifies that loyalty.
Yes for sure.
Our platform is 100% cloud native I mean, we started in the cloud.
It's something that has to be built in a complete multi tenanted way, which is actually something that's relatively unique in our space and it also.
Enables these partners to basically deliver their services in a much more effective manner.
They get up and running and second they get a complete cloud tenant for themselves. The immediately deploy using our discovery and deployment services and then they leave the platform there for us to come in and monetize and once again all of that is a 100% pure cloud motion, which not only enabled.
Speed, but once again ease of use ease of deployment.
It turns out to be and much more efficient model than the platforms that <unk> been using in the past, which obviously, we're more on trim down so to us again being completely cloud native being multi tenanted is.
Competitive depreciate differentiator, we have done.
That part of the market, but also you can you can probably.
So until we see the same type of buying motion in the enterprise as well, we're conducting a DSD deploying the platform is becoming easier and easier.
And our cloud delivered fashion.
I realize we're running long here, but I wanted to add a second question.
Could you talk about your hiring plans for sales.
What type of capacity.
<unk>.
Okay.
Going forward.
In terms of your ads for the next couple of quarters and then.
Whats the availability look like and what is the cost look like are you seeing escalation and the prices of our labor are there enough people out there too.
Phil your needs.
Yes, hi, there.
We are definitely investing for growth.
As an enormous opportunity out in front of us. So we're going to continue to invest and build and grow our go to market team.
Sales reps sales engineers.
Channel managers and really investing in our go to market engine, but at the same time, what we have been also able to yield.
Increasingly greater sales efficiency so.
We've been really maniacally tracking sales efficiency and that has been improving quarter. After quarter. So we're going to actually have each quarter, a bigger sales team that is ultra more efficient helping us continue.
To drive growth, but the last thing and this is not to be underestimated with our unique go to market business is that multi dimensional channel that we've talked about massive sales forces at various channel partners in the MTR space MSP partners IR partners traditional resellers and distributors and so.
That's the right way to think about our global field presence.
Adding all of those folks up and understanding that each time, we are adding a partner behind that are hundreds of sales reps. During 2000, plus accreditation to date, that's really building that flywheel, but we're absolutely going to continue to invest in our own central one personnel as it relates to go to market.
On the cost and availability.
Well, what we're finding.
This sort of goes back to a question before around some of the benefit that we've seen.
With our IPO is that that brand recognition doesn't just extend the channel partners and customers. It importantly extends to the best talent in the market and so our ability to get really really good folks who can.
<unk> hit the ground running bring tremendous yield that's enabling us to have.
Attracting and appeal to get the best talent in the market.
Great. Thank you very much.
Okay.
I would now like to pass the call back over to Thomas Wang guidance Tem and Tien Tsin Huang you May proceed with your Linux.
Thank you and thank you all for joining us today.
Look forward to talking to you again in the near future. Thanks, a lot.
That concludes the conference call. Thank you for your participation and enjoy the rest of your day.