SentinelOne (S) Q2 2027 Earnings Call Transcript

SentinelOne reported Q2 revenue of $292M (+21% YoY), total ARR of $1.218B (+22%), and record net new ARR of $56M for a fifth consecutive quarter. Profitability surged with non-GAAP operating margin at 10% (+820 bps YoY) and non-GAAP diluted EPS of $0.08 (up from $0.04), alongside $1.7B of RPO growing 45%. The company raised FY27 guidance to revenue of $1.202B–$1.207B and operating income of $124M–$128M (≈10% margin at midpoint), driven by strong demand/retention for AI security (Prompt Security and Purple AI) and improved go-to-market efficiency.

Analysis

This print improves the bear case less by proving a new TAM and more by showing S can monetize an adjacent buying cycle before the rest of the sector fully prices it in. The key market mechanism is mix shift: if AI-security, data and sovereign deployments keep pulling larger land-and-expand deals, S can widen its gross dollar retention and compress sales cycles while still adding operating leverage. That creates a credible path to multiple expansion because the market tends to pay up when a former “story stock” starts looking like a durable-rule-of-40 compounder.

Second-order, the pressure lands hardest on legacy endpoint and bundle-heavy suites that rely on broad platform discounts rather than runtime differentiation. MSFT Defender remains the long-duration structural substitute in cost-sensitive accounts, but the nearer competitive pain is for point vendors and suite vendors exposed to regulated, air-gapped, or on-prem buyers; those customers are where S’s deployment flexibility matters most. MSSP/channel partners like LevelBlue become an accelerant, not just a distribution footnote, because they can shorten adoption friction and turn S into the control plane for remediation, not only detection.

The contrarian risk is that the AI-security narrative may be ahead of booked dollars. If the next 1-2 quarters fail to show continued NRR improvement and sustained large-deal conversion, the stock can give back gains as investors reclassify the story from “emerging category winner” to “still a mid-20s growth cyber name with execution risk.” What would falsify the bull case is any stall in RPO/NRR momentum, or evidence that AI-security attach is winning headlines but not materially lifting renewal economics. Near term the setup is positive; over 6-18 months the real question is whether S becomes a platform consolidator or remains a niche beneficiary of the AI security theme.

Key Decisions for Investors

• Buy S on any post-earnings consolidation over the next 2-3 weeks; use a 3-6 month call spread to express the thesis that the market will re-rate S as a profitable AI-security platform rather than a pure endpoint vendor. Risk/reward improves if the stock gives back the initial gap but holds the prior breakout zone.
• Pair trade: long S / short ZS over 1-3 months. The relative bet is that sovereign/on-prem and runtime AI-security demand will show up faster in S’s bookings mix than in ZS’s more commoditized security posture story; stop if ZS shows comparable AI-security monetization in its next update.
• Use S as a tactical long vs the cyber suite leaders only if you expect multiple expansion from operating leverage, not outright category dominance. On that framework, long S / short PANW is the cleaner expression for 1-2 quarters, but only if the next print confirms continued deal-size expansion and retention gains.
• Watch item, not a trade: compare next quarter’s RPO and large-customer retention against current momentum. If either stalls, fade post-earnings optimism and rotate into higher-quality mega-cap cyber beneficiaries instead.