Is SentinelOne the Next CrowdStrike?

The article argues SentinelOne could mirror CrowdStrike’s shift from endpoint tools into a broader cybersecurity platform via its Singularity platform (cloud security, identity protection, security analytics, and AI-powered security). It cites CrowdStrike revenue of $1.4B in the latest quarter versus SentinelOne’s $277M (~5x gap), highlighting SentinelOne’s smaller scale and slower trust/enterprise adoption. The piece frames AI adoption as a tailwind for cybersecurity demand while noting the competitive head start remains a key risk.

Analysis

The economic winner from “AI-driven security demand” is not the company with the best narrative, but the vendor that already sits inside the security workflow and can upsell at low incremental CAC. That favors the category leader with broader module adoption and switching costs; smaller challengers typically get lower share of wallet gains because buyers default to incumbents when attack surfaces expand. In that sense, the most likely second-order loser is the smaller platform aspirant: it may see more top-of-funnel interest, but converting that into durable NRR and enterprise standardization is a much harder sell than adding features.

For S, the bullish case is mostly a 1-3 quarter execution story, not a multi-year “AI wave” trade. The market will care less about feature breadth than about evidence that cloud, identity, and analytics attach rates are improving and that deal sizes are moving enough to offset the trust gap versus CRWD. If those metrics do not inflect, AI-enhancement talk can become margin-dilutive—more R&D, more marketing, same competitive position.

Contrarian view: the consensus may be overestimating how much AI expands the market versus how much it simply reshuffles share toward the most trusted platforms. Large enterprises typically buy fewer vendors, not more, when threat complexity rises. That argues for CRWD as the cleaner beneficiary and for S to be treated as a show-me story; the thesis is falsified if S fails to accelerate subscription growth/NRR over the next two reported quarters or if CRWD continues to widen the revenue gap and attach-rate lead.

Key Decisions for Investors

• Pair trade: long CRWD / short S into the next earnings cycle. The spread is attractive if enterprise buyers keep consolidating around the category leader; cover the short if S shows two consecutive quarters of improving net retention and module attach.
• Avoid initiating a standalone long in S until management proves the platform transition with hard numbers: accelerating subscription ARR, dollar-based net retention above the prior trend, and cloud/identity contribution to growth. This is a watch item, not a buy-the-story setup.
• If you want exposure to the AI-security theme, own it through CRWD rather than smaller challengers. CRWD is the higher-conviction beneficiary of incremental security budgets because it monetizes platform expansion with less execution risk.
• Set a falsifier on S after the next two earnings prints: if revenue growth and billings do not reaccelerate materially, the AI narrative is likely fully reflected and the stock should be treated as a multiple-risk name rather than a compounder.
• If seeking a broader basket, use a cybersecurity ETF proxy rather than single-name risk; the trade should express secular spend growth while minimizing company-specific execution risk in smaller platform names.