SentinelOne Inc (S) 2022 Q3 法說會逐字稿

Good afternoon. Thank you for attending today's SentinelOne Q3 2022 Earnings Conference Call. My name is Selena, and I will be your moderator. (Operator Instructions) I would now like to pass the conference over to our host, Doug Clark, Head of Investor Relations at SentinelOne. Please go ahead.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the third quarter of fiscal year 2022 ended October 31. With us today are Tomer Weingarten, CEO; Nick Warner, COO; and Dave Bernhardt, CFO. Our press release and the shareholder letter were issued earlier today and are posted on our website. This call is being broadcast live via webcast; and following the call, an audio replay will be available on our Investor Relations section of our website.

Before we begin, I would like to remind you that during today's call, we will be making forward-looking statements regarding future events and financial performance, including our guidance for the fourth fiscal quarter and full fiscal year 2022 as well as certain long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that the actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our S-1 and our quarterly report on Form 10-Q. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements.

Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons actual results could differ materially from those anticipated in the forward-looking statements even if new information becomes available in the future.

During this call, unless otherwise stated, we will discuss non-GAAP financial measures. These non-GAAP financial measures were not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in today's press release and in our shareholder letter. These non-GAAP measures are not intended to be a substitute for our GAAP results.

The financial outlook that we provided today excludes stock-based compensation expense, employer payroll tax on employee stock transactions and an amortization expense of acquired intangible assets, which could not be determined at this time and are, therefore, not reconciled in today's press release.

And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fiscal third quarter earnings call. This was another excellent quarter, and I'm extremely proud of the entire SentinelOne team. Our ARR growth accelerated to 131% year-over-year in the third quarter, our third consecutive quarter of triple-digit growth. We continue to scale our business on the back of leading endpoint protection, machine speed DDR, XDR innovation and our powerful partner supported go-to-market strategy. The demand environment remains incredibly strong.

Before digging deeper into the details of our quarterly performance and results, I'd like to share some perspectives on the cybersecurity landscape. I'd encourage you all to also look at our shareholder letter we have on our Investor Relations website, which provides a lot more detail.

We're still early in the generational shift in cybersecurity led by the ongoing digital transformation of the enterprise. There are millions of cyber attacks inflicting trillions of dollars in damages every year. This is unacceptable and a growing risk to enterprises across the world.

The increasing number of attacks and sophistication clearly shows that enterprises must deploy best-of-breed solutions that enable them to stay one step ahead of attackers. Take the current state of ransomware. Attackers have shifted from simply holding operations hostage to actual data compromise and infiltration, infiltrating both legacy and unprotected devices.

That's where SentinelOne comes in. We pioneered the world's first purpose-built, AI-powered XDR platform to make cybersecurity defense truly autonomous from the endpoint and beyond. We believe it's essential to protect all parts of the enterprise estate, such as unknown devices, cloud workloads and the data itself. We focus on data to provide enhanced visibility and advanced analytics. We protect our customers in real time at machine speed, empowering human operators with the speed, scale and precision of technology.

Our approach is resonating with our customers. We received the highest overall rating in the 2021 Gartner Voice of the Customer Report for endpoint protection platforms where 97% of reviewers would recommend the SentinelOne Singularity XDR platform. I'm very proud of the work we all do to keep our customers secure, engaged and delighted. We focus on putting our customers first.

Let's turn the discussion to how we're executing. During our IPO earlier this year, we outlined 5 key aspects to our growth strategy. Our third quarter results demonstrate success and progress against each of these. First, we continue to innovate and enhance our cybersecurity and data platform. Automation is a top priority for SentinelOne. Machine speed automation can help counter instantaneous cyberattacks and enable under-resourced IT teams. Last quarter, we introduced Storyline Active Response, or STAR, for customized dynamic detection and response rules. This quarter, we began offering Remote Script Orchestration, or RSO, to instantly investigate and triage threats on multiple endpoints across entire organizations remotely. Together, these 2 capabilities deliver increased level of automation as well as help enterprises consolidate legacy workflows in tooling with the Singularity XDR platform.

I want to dig more deeply into RSO. We designed RSO to transform endpoint management for incidence response providers and enterprises. We're offering complete remote control and orchestration across endpoints. It's a scalable way for security providers to not only detect and respond with existing endpoints but also manage and control the entire deployed footprint. It's like having a security analyst on every single endpoint at all times. Our customers and partners are already realizing the benefits of the advanced capabilities of RSO. One of our incident response partners said RSO helps eliminate time-consuming efforts to collect and consolidate forensics data in rapidly contained attacks, enabling us to minimize adversary impact. On the customer side, a Fortune 500 wholesale company added RSO to help ultimate threat hunting capabilities, making SentinelOne more powerful and integral to their security posture.

In addition to automation, we believe a true XDR platform must be a comprehensive and open platform that provides visibility, protection and response across the entire enterprise landscape. Customers have been asking us to provide mobile protection to complement our leading protection capabilities. And just this week, we announced Singularity Mobile. SentinelOne customers can now manage mobile device security alongside endpoint, cloud workloads and IoT devices. Singularity Mobile brings behavioral AI-driven machine speed protection, detection and responds directly to iOS, Android and Chrome OS devices.

Putting this all together, we were recently recognized as a strong performer in the Forrester New Wave Extended Detection and Response Providers report. Forrester highlighted that SentinelOne Singularity XDR platform is the best fit for companies that want customizability and to grow into XDR. We were also named Best Innovator in SE Labs' Annual Report.

The second part of our strategy is to protect more enterprises every day. In Q3, our ARR grew by 131% year-over-year, and our revenue was up 128%. Our business is performing exceptionally well. We added over 600 new customers sequentially. We grew our total customer count by over 75% to over 6,000 compared to a year ago. Customers with ARR over $100,000 grew 140%, and we continue to see a growing mix of large enterprises within our business.

In addition to expanding our global presence through direct sales teams, our channel remains a source of scalable growth and differentiation. With our partner-friendly approach, we're succeeding by further expanding our scale with incidence response in managed security service provider partners. Nick will touch on this in more detail later on.

Third, we're unlocking further product adoption within our existing customer base. In the fiscal third quarter, our net retention rate reached 130%, a new record for our company. This growth was driven by strong license expansion, platform upgrades and customer adoption of our new capabilities. We're early in our module strategy, but we're seeing great customer interest and adoption. Our emerging products such as Ranger IoT, cloud workload protection and data capabilities are all growing at impressive triple-digit rates. In particular, our cloud workload protection product delivered the highest growth during the quarter, a testament to the demand for our real-time run-time protection for cloud workloads and containerized environments. In one case, a leading book publisher selected SentinelOne for cloud workload protection because of its ease of use, simplicity of deployment and having a true EDR in one console to manage their cloud-native Windows, Linux and Kubernetes environments.

The fourth element of our growth strategy is to further expand our global footprint. Revenue from international markets grew 159% year-over-year. International markets now represent 33% of our total revenue, up from 29% a year ago. As an example, in Q3, we secured a European conglomerate by replacing over 20 different antivirus products. This shows how our platform can help with vendor consolidation while also delivering leading performance. We're growing our sales coverage and channel presence in international markets. Last quarter, we talked about opening a new R&D center in the Czech Republic, and I'm excited that we're hiring great talent in this region. These initiatives will continue to strengthen our international presence.

Fifth and last, we're well positioned to expand our total addressable market through both acquisitions and strategic investments. We further strengthened our leadership team with the appointment of Rob Salvagno to lead Corporate Development. As we consider acquisitions, we evaluate prospects that align with our product, customer and strategic market opportunities. Over time, we intend to use these opportunities to extend the reach of our XDR platform into adjacencies that complement our offerings.

Our strategy also involves making minority investments. We recently made 2 strategic investments in early funding rounds for Laminar and Torq, companies that align with our approach to automation and APIs. Investments in emerging technologies will allow us to constantly enhance the SentinelOne platform in areas that may be of future interest to us. These investments reflect our long-term commitment to innovation, automation and securing data wherever it resides with a front-row seat into cutting-edge cybersecurity technologies.

Finally, as part of our XDR road map, Scalyr is performing extremely well and has continued to grow year-over-year and quarter-over-quarter. Scalyr is integrated into our technology backbone, and we're using it to redefine XDR. At the same time, we're onboarding all new customers on our revamped back-end seamlessly. We've begun migrating select existing customers. By using Scalyr, our customers are enjoying faster performance and advanced analytics capabilities.

Before I turn the call over to Nick, I want to discuss our people and our culture. Our true competitive advantage comes from the employees of SentinelOne. We've invested in talent across sales, marketing, engineering and corporate functions while cultivating an inclusive and diverse workplace. We've grown rapidly in the past year, and our number of employees has gone from 600 to about 1,100. This has been no small feat, and we're continuing to grow and expanding the team.

We work very hard to foster a productive and inclusive culture, and our efforts are showing up in results. As part of the 2021 Great Places to Work certification, 96% of responses from employees said SentinelOne is a great place to work. We received several other awards during the quarter that recognize our workplace culture.

With the combination of our differentiated technology and dedicated team, we're helping our customers stay ahead of adversaries, prevent breaches and autonomously respond to innovation. We're helping our customers reimagine cyber security. I'm excited about what we can do from here. Thank you to all Sentinels and our customers and our partners.

With that, I will turn the call over to Nick Warner, our Chief Operating Officer.

Thank you, Tomer, and welcome, everyone. Our go-to-market flywheel of sales and marketing, channel, and technology partners resulted in another outstanding quarterly performance across the board. Strong demand for our Singularity XDR platform is evident by our third quarter results. Our customers are clearly choosing SentinelOne as a partner and technology of choice.

In Q3, we reported an impressive ARR growth of 131%, reaching $237 million compared to last year. This growth was driven by a healthy combination of new customer additions, existing customer renewals and upsells. Today, we are protecting over 6,000 customers through our Singularity XDR platform. That's total customer growth of more than 75% or almost 2,500 more customers compared to last year.

Our focus on automation, speed and accuracy is critical to any enterprise, in fact, all enterprises. I want to be clear. This is a competitive market. The environment has not changed, yet we've maintained incredibly strong win rates in all competitive situations against legacy and next-gen vendors.

With every new quarter, we're protecting more and more mission-critical businesses around the world. In Q3, we added a leading global financial exchange in a 7-figure multiyear agreement. This was a true platform win. They selected SentinelOne for endpoints, cloud workload protection, remote script orchestration and data applications.

It's telling that we're getting so much attention by our competitors, which speaks to the traction we're having in the market. We're winning more and more customers, and our growth rates speak for themselves. What enterprises need is automated security, not repackaged legacy AV and crowd-powered protection. Our mission is to elevate security for our customers through a relentless focus on innovation. And our customers are happy with 97% gross retention rate and the highest score in Gartner's Voice of the Customer survey. That's hundreds of customer reviews, and that speaks volumes compared to any single customer example.

Let me take a step back and share some details around our customer and business mix. We grew customers with ARR over $100,000 by 140% versus last year. Our business mix from customers with ARR over $100,000 continues to grow driven by our success with larger enterprises, strategic channel partners and increasing module adoption.

In addition to protecting new larger customers, we're seeing strong retention and expansion within our existing customer base. Gross retention rates remained consistent with prior quarters. Our net retention rate was 130% this quarter, a new record for our company. This record NRR was driven by license expansion, platform tier upsells and adoption of emerging capabilities. In Q3, 2 of our Fortune 10 customers renewed with multiyear deals, and both expanded their use of the Singularity platform, adding modules such as Ranger and Remote Script Orchestration.

I'd like to talk more about our channel partners. Our partner ecosystem helps magnify our market access and significantly extends our reach and efficiency. We do not compete with our partners. Instead, we equip them with industry-leading capabilities like multi-tenancy and open APIs. In fact, we're expanding our partner ecosystem, and this is driving significant growth for us.

Let me double click on our managed security service provider partnerships as an example. MSSPs provide outsourced monitoring and management of security devices and systems. Our growing and highly scalable partnerships with MSSPs give us robust mid-market and large enterprise coverage. Together, we have fueled significant new customer and business growth over the past several quarters. We're proud to partner with companies like N-able, AT&T, Pax,8, Continuum, Kroll and many others. To demonstrate the momentum we're seeing, in our third fiscal quarter, ARR from our MSSP channel increased by 300% year-over-year.

In addition to MSSPs, our incident response partners leverage the SentinelOne platform for their breach response services, making us an integral part of their capabilities. Last quarter, we talked about our commitment to support even more IR partners through our Singularity platform. In Q3, we built upon that progress and further expanded our network of IR partners. We added KPMG as a global go-to-market partner for incident response and proactive cybersecurity services. Our growing network of IR partners continues to help secure businesses. As an example, during the quarter, we won a large airline customer in Asia through one of our IR partners.

Finally, I'd like to share how we're putting our customers and partners first. We recently hosted our first ever customer conference called OneUP. Participation and response has been incredibly positive. We've also hosted partner conferences throughout the Americas and EMEA. Our goal is to educate on our latest innovations and continue to build on our momentum. Over the last few quarters, we've also received great feedback on our accreditation programs. We added continuing education courses to complement our accreditation programs. These courses keep our partners up-to-date on new capabilities and modules, which in turn support our growing scale and platform reach.

We had around 2,000 accreditations in June 2021. We've made amazing progress since then and now have surpassed over 6,000 accreditations across our sales and presales courses through the end of November. This tremendous improvement illustrates the growing attention we're seeing in the channel.

I'm proud to work with our global team of relentless Sentinels every day. I'm excited about our future. We will continue to deliver on our vision with focus on execution and listening to our customers.

Thank you again for joining us. And let me turn it over to Dave Bernhardt, our CFO.

Nick, Tomer, thank you, and thank you all for joining us today. I'll touch on the financial highlights from the quarter and then provide additional context around our guidance for Q4 and fiscal year 2022. After, we will open the call to your questions.

Our third quarter results exceeded expectations across the board. Our revenue and ARR growth both accelerated in the quarter. Our performance strength was broad-based, coming from a healthy mix of new customers and existing customer expansion. It also balanced across geographies and customer sizes. We achieved revenue of $56 million, increasing 128% year-over-year and delivered ARR of $237 million with growth accelerating to 131% over the same period.

Turning to our costs and margins. Our non-GAAP gross margin in Q3 was 67%. This was up 9% year-over-year and up 5% quarter-over-quarter. The biggest benefits are coming from our increasing scale and business expansion, including modest benefits from module and platform upsell. Costs associated with the migration of existing customers to our Scalyr back end were minimal in Q3. This contributed to the gross margin upside relative to our prior expectations. I want to provide more detail here.

Scalyr is a critical part of our XDR road map and future innovation, giving us enhanced data storage and ingestion capabilities. We are balancing our product road map with our migration of existing customers. We will follow the optimal cadence for our customers and our business. In Q3, we took a more measured approach to migrations, which had less of an impact to margin. We anticipate migrating more customers in Q4 and the first half of next year. That said, when I look at our Q3 gross margin of 67% and how far we've come in just the past few quarters, I see [evidence] of scale and efficiency in our model.

Looking at the rest of our P&L. We're investing for growth and achieved triple-digit growth rates in ARR and revenue again this quarter. Our non-GAAP operating margin was negative 69%. We're continuing to make strategic investments that enhance our product and scale our go to market. Even still, this is a significant improvement from negative 102% in the year-ago quarter and also from negative 98% last quarter, showcasing the potential for leverage throughout our business model. We remain in investment mode in the near term, which is the right strategy given the vast opportunity in front of us.

Now for our outlook for Q4 and the full fiscal year. In Q4, we expect revenue of $60 million to $61 million, reflecting growth of between 101% to 104% year-over-year. We're raising our full year revenue guidance from $199 million to $200 million. This implies full year growth of 115% at the midpoint.

The structural tailwinds of digital transformation, hybrid work environment and an evolving yet persistent threat environment are here to stay. We're executing extremely well. Our product innovation, increased brand awareness and scale and go to market are giving us favorable opportunities to engage with existing and prospective customers.

We expect Q4 non-GAAP gross margin to be between 62% to 63% and full year non-GAAP gross margin to be between 61% to 62%. Our Q4 guidance implies a minimum of 8% non-GAAP gross margin expansion year-over-year as we're benefiting from increasing scale, improved cloud hosting agreements and processing efficiency gains. Our guidance also reflects the migration of existing customers to Scalyr, which we expect will continue into the first half of next year.

Finally, for non-GAAP operating margin, we expect negative 83% to 80% in Q4 and negative 91% to 90% for the full year. We see tremendous opportunity for growth and the investments we're making today will put us in a position to succeed for the long term.

Additionally, as a reminder, our IPO lockup expires and vested options and outstanding shares can be traded starting December 9, 2021. This is a continuation of late September's 15% lockup expiration.

In closing, Q3 was another excellent quarter with strong execution company-wide, and we're expecting that momentum to continue into the end of our fiscal year. I want to thank you all for attending our earnings call. Operator, can you please open up the lines for questions. Thank you.

(Operator Instructions) The first question comes from Saket Kalia with Barclays.

Okay. Great. Appreciate it. Tomer, maybe just to start with you. Can you just touch a little bit on the mix of customers on different packages? Clearly, beyond winning new customers here, you've talked about the higher value opportunity with higher value packages. Can you just touch on where we stand there and how you feel about that going forward?

Of course, yes. The vast majority of what we sold this quarter was the Complete package. I think that we're seeing just overall standardization on the Complete platform. People are opting for a Complete EDR package. I think what I can also say on top of that is just increased adoption of our cloud modules. We're just seeing increased demand for cloud workload protection. And given that our platform is one of the best-of-breed platforms right now in the market, it's something that we're seeing more and more.

On top of that, I'd add that with Complete we also have about 10 [expanse story] modules. Data retention is one of them, and that is something that we're also seeing more and more adoption of. So to kind of sum it up, I think Complete and EDR is becoming the standard for us going forward. And on top of that are the expansion modules that we're providing to the market.

Got it. Got it. That's very helpful, Tomer. Dave, maybe for you. You talked a little bit about the Scalyr migration. And I understand, I mean, there's some timing considerations around that and -- but it was great to see the gross margin expansion in the quarter. How do you think about the long-term gross margin benefit after completing the migration to Scalyr? Does that make sense?

Yes, sure. I think what you're seeing a bit is kind of a new baseline that we have on a go-forward basis. Scalyr was not as much of a migration this quarter as we had originally expected. We told you guys, I think, during the IPO road show and as well last quarter that, that transition's about a 4% hit to cost of goods sold in that period. So I think what you're seeing now is really the benefit from the business expansion, the benefits of scale, the higher revenue. We're seeing the efficiencies from the Scalyr products for our own back end. And then you're also seeing some of the benefits of the cross-sell and the AWS renegotiation we've done. So all of that is -- are great tailwinds for us going into the future.

I think we haven't changed anything in regards to our long-term goal, which is in the 75% to 80-plus percent. Being at 67% when we were substantially lower than that a year ago, you're already seeing great strides from everything we're doing to execute against that. So I see this to be depressed for a couple of quarters as we finish this migration, and then I think we'll be back in this range and operate for improved margins from that going forward.

The next question comes from Alex Henderson with Needham.

I was hoping you could talk a little bit about your thoughts on -- I know when you're growing at the pace you're at, it's difficult to talk to, but seasonality and particularly given the sales organization going into your fiscal first -- fourth quarter here and then going into seasonally, I would assume, somewhat weaker fiscal first quarter. So can you talk a little bit about how the seasonality might be impacting your thoughts on growth and whether we should be factoring that into our assessment of the next couple of quarters?

Sure. Good question. Q4 is our strongest quarter. I think that, that has been the case historically. I think if you look at broader buying trends in the security industry, Q4 is the most active quarter. We expect to have very strong Q4 in terms of where our pipeline is at, where deals in the flow are sitting right now. And so I think your assessment is accurate.

And I think we go down a bit with just the guidance -- us guiding Q4. We feel very confident in where our revenue is going to be. So as you would expect, we know that seasonality, and that's why you're seeing us -- with the tailwinds and the momentum we've had right now, you're also seeing us increase the guidance for Q4 and the full year.

So with the expansion of the distribution, the incident response, the MSSPs, all of the other players that are driving your product, does that tell us that we should be a little bit more cautious on the direct sales force contribution going into 1Q given you look like you're significantly beating internal targets, therefore, obviously, [risers] and sales force compensation push in the fourth quarter.

No, the way that we really view it is it's all part of the flywheel, and that flywheel is picking up momentum by the quarter. And in fact, if you look at our MSSP or incident response ecosystems, they work in conjunction with our own SentinelOne sellers. So in the case of -- let's take an example within the IR space. An incident response partner will deploy our technology platform to uncover, mitigate and eliminate an active threat within the customer environment. At that same time, a sales motion kicks off. And especially if you're talking enterprise side deals, our own sales force can be deployed within that account to assist in pricing, closing the deal, et cetera. So it's really selling in cooperation with incident response partners.

As it relates to our managed service providers, many of those customers are in the mid-market. A lot of them are in the large enterprise. And I think the same sort of waiting holds true where within larger enterprise deals, our great team of SentinelOne sellers can and do get involved as needed in those deals; and often, they're in their shoulder to shoulder with our partners.

But what it really means for us is it's lead gen. It's really improving the quality of leads, and it's giving us really this flywheel and gear effect in terms of coverage because we're essentially engaging and building these force multipliers around the world of channel partners, MSSP folks as well as incident response companies all working in conjunction with SentinelOne to help improve security for companies around the world.

So less-than-normal seasonality then would be the case given the expansion of the distribution. That's great answers.

The next question comes from Brent Thill with Jefferies.

You have Joe on for Brent. Really appreciate the question. It's great to hear that ARR from MSPs grew 300% year-over-year. I guess how much of total ARR is from the MSSP channel? And then what is the real differentiator there? Is it awareness? The noncompetition? Pricing? Or is there a technology differentiation?

Yes. So we don't break out MSSP numbers, but I can definitely speak to the technological advantages that SentinelOne Singularity platform has as well as, really, I think, our go-to-market culture, which is very different. So talking about technological advantages, we have unique capabilities like true multi-tenancy. And that's incredibly important if you think about the way a managed service platform works with hundreds or thousands of customers under one central tenant.

So SentinelOne is really leading that set of capabilities in the space. We also have unique capabilities like RSO, or Remote Script Orchestration, which really lends itself to having an automated way for folks at the managed service provider level to take meaningful real-time action on each and every machine.

And then switching gears over to sort of go-to-market differences. A fundamental decision that SentinelOne made a few years ago as we're building out our go-to-market motion was really, philosophically, we decided to have a posture of enablement and not competition. So we don't compete with our managed service providers. We don't compete with our incident response partners. And that really means everything when you're talking about having a long-lasting business relationship that's founded on trust and cooperation.

That was really helpful, Nick. And then maybe just staying with you. Could you just talk through your hiring plans, maybe how many incremental sales reps we expect going forward? And any update on total quota carrying reps?

Yes. We're not disclosing exact numbers in terms of hiring. But as you can imagine, we're really still investing in the business as we continue to enjoy tremendous growth. And so we're really going to continue hiring across the board, whether or not you look in sales, sales engineering channel, both in the U.S. as well as outside the U.S.

I mean, I think it's pretty remarkable if you look at our sustained growth in the international markets, where you're looking at 159% growth. And now today, international represents 1/3 of our global revenue. And so we're going to continue to invest, and we're really investing in people around the world.

Yes, I'd just like to add that the reach that we're unlocking throughout all these different ecosystems via MSSPs, IRs and now international, I mean, that becomes real differentiator for us. I mean we're using, in a good way, all of these partnership ecosystems to really unlock parts of the TAM that we feel some of the other vendors can't really reach. And that gives us a very sustainable advantage as we kind of unlock growth over time.

The next question comes from Brian Essex with Goldman Sachs.

I was wondering if maybe you could touch on the rate of migration to Scalyr. What are the dynamics of that migration and the impact that it has on revenue for customers that adopted? How far through your installed base are you with that migration?

Yes. To us, it's a very gradual approach that we're taking. I mean we kind of split it in 2. A, all new customers are already onboarded on the Scalyr back end, and that just creates a new cost saving element for us as we look into the future. When we look at the existing customer base, it's a very elective approach that we're taking. We're basically any customer that asked to be migrate -- can be migrated. But moreover, we're taking this new approach to XDR that we're unlocking over time, where we're actually offering better capabilities for each and every customer that uses the Scalyr back end as their own back end right now. That creates another avenue for us to continue and monetize over time.

As you're probably well aware, our approach to XDR is an open one, and we're starting to allow our customers to ingest data from any other product they have in their ecosystem. And you can imagine that, that will be monetized by actually monitoring data ingestion, and while allowing these customers to take that data, put it in and retain it for longer, it will again create better economies for scale for us and again, more avenues to monetize.

We are seeing, I think, increased demand for XDR capabilities as the entire market is seeing. I think our approach is different. And I think we're looking at a singular, consolidated singular platform that can ingest all data unlike most of the other vendors that are really coming in with media on one end and XDR on the other. So to us, I mean, it's just this gradual execution for our XDR road map that comes in tandem with our migration of customers.

Got it. That's super helpful. Maybe to follow up, I'll take elements of Saket and Alex' question and maybe approach new logo seasonality. It looks like, over the past few years, 3Q has been a lighter -- a seasonally lighter quarter for new logo adds. Maybe if you could unpack that dynamic a little bit and help us understand the mix of customers. It looks like you nicely went up into larger enterprise deals. ARR per customer is certainly growing really nice. So that's great to see but maybe just how you're approaching the customer mix that you're bringing onboard and how we should think about logo adds going forward.

Yes. So I think you stated it well where really the most important element of our customer mix is that 140% growth of customers over $100,000 of ARR. And I think if you pair that to what Tomer had said, where the vast, vast majority of customers, new customers, in particular, are going with Singularity Complete, inherently, that means they're utilizing the Singularity and SentinelOne platform for more, which makes us more sticky, more involved, more touch points within various parts of an enterprise. And I think as part of that, also what we're really seeing that's exciting is increased module adoption and attachment at time of sale for new customers. And that's a very different motion than, say, 1.5 years ago, and we're really excited by that.

So if you look at overall growth, from a high level, it's great. If you look at customer mix becoming increasingly weighted to the enterprise, those signals are also there. And then if you look at the product mix, all of those are trending in the right direction from our perspective.

The next question comes from Patrick Colville with Deutsche Bank.

I guess one of the questions I wanted to ask you we get a lot from investors is how fast through the displacement of antivirus are we as of, what, December 2021? Is there still a lot of McAfee, Symantec and any of these companies left? Or is that kind of process now largely complete? Just go out to, I guess, help us frame that opportunity or what's left of it.

I think it's safe to assume that it's far from complete. I mean, 1 data point to point towards that is the fact that pretty much every deal that we closed this quarter and in past quarters, always had an incumbent vendor in the mix. So they're obviously still there. They obviously still are the vast majority of what we deal with when we go into environments.

And I think that even if we take a very conservative view at the overall TAM, I think it's safe to assume that about over 50% of it is still in the hands of the incumbents. Looking at our pipeline for Q4 and the out quarters, that doesn't seem to change. So to us, that cycle is still ongoing. It's a pretty big TAM that we're serving. And obviously, if you look at our mix today, also going into the cloud security opportunity kind of further compounds it, and it's something that the incumbent vendors never had to offer. So that makes the entire buying cycle really more sticky, more inclusive and just overall more important for the enterprise. So it becomes part of the picture. But again, in almost every account that we go into, call it high 90s, we see an incumbent vendor, so we don't see that tapering away anytime soon.

The next question comes from Gray Powell with BTIG.

Great. And congratulations on the good results. So yes, a couple on my side. Maybe just to start off, I just want to follow up on Scalyr and gross margins. So you beat the Q3 gross margin guidance by a little over 8 points. Is it fair to say that roughly 4 points of that beat was due to the timing of the Scalyr migration and then the rest of the upside was just sort of natural leverage in the business model?

Yes, that's correct.

All right. That was easy. And then my other question would just be -- so you highlighted that emerging products like Ranger, cloud workload protection and data capabilities, they all grew well into the triple digits. I guess can you give more color there? I mean the entire business grew triple digits. So I'm just curious like how much faster are emerging products growing versus the core? Or can you give us a sense as to like the mix of new sales that are coming from emerging products?

Yes, significantly faster than the macro growth rate of the business. And cloud is definitely the leading product line there. And that's something that we see building over in our pipeline as well. We're starting to actually generate pipeline per product line. So we're seeing major traction in each one of these emerging modules. We're seeing the attach rates for those on the rise. Our MDR service that we launched about a year ago is now really starting to gain complete scale. So all in all, we kind of see this as additional growth vectors in the business that will help carry our growth rate into the years to come.

The next question comes from Andrew Nowinski with Wells Fargo.

I want to start with the Vigilance service. So can you just give us any color in terms of what the attach rate was of that service to your new deals and how much of a revenue uplift it provides when a customer adds Vigilance?

Yes. Vigilance, for us, something that we started selling about a year, 1.5 years ago. It's about 1/3 of enterprise customers that are adopting Vigilance today over the first few tiers. We actually got 2 new tiers that have been added to the Vigilance service. We're seeing adoption for those as well.

Okay. And then as it relates to net new ARR, it's increased triple digits for the last 3 quarters. As you think about how to model Q4, can you just talk about how your sales capacity compares to last year and what other factors might influence the year-over-year growth in net new ARR?

I think it's relatively very linear for us. I mean if you look at our business in the last couple of years, ARR growth has been very, very linear and very much according to our expectations really no matter what happened to the market. To us, we're just continuing and scaling our business. We're, I think, unlocking more capacity on the sales side while we're expanding our partner ecosystem. So to us, I mean, we are continuing that, again, flywheel effect that Nick was talking about. And we're just continuing our growth. You've seen our guidance for Q4 and for the year. We feel that's very sustainable.

The next question comes from Hamza Fodderwala with Morgan Stanley.

Dave, I just wanted to follow up on an earlier question that was asked. I think last quarter, you mentioned something like 10% of the net new ARR came from securing cloud workloads and IoT. Was that right? And do you have an updated metric there at all? I mean it probably doesn't change much quarter-to-quarter but just curious.

Cloud still remains our fastest-growing module. About 10% of endpoints are covered by cloud and servers. It has been our fastest-growing module for some time. Cloud is a piece of the business, I think, that we think will expand greatly in the future. We anticipate that, at some point, it will be the similar size to the endpoint market.

Yes. And when we look at all of our emerging products together, it's well over 10% contribution for every given quarter; and we definitely see that on the rise. So to us, I mean, when you kind of look at emerging, we look at data, IoT and cloud. And again, all of those are just showing great, great progress.

Got it. And there seems to be a lot of focus on the growth algorithm for the top line between new logos and then average revenue per customer. Just going forward, how should we think about that? Should that be more weighted on ARR per customer? I know I mean, based on my math, right now, it's about $40,000 ARR per customer across your base. How do you think about that going to $50,000 or maybe even $100,000 over time?

Yes. I mean, obviously, as we've seen module expansion, as we've seen customers take step-ups from Core to Control or Control to Complete, we're seeing higher price points from customers. So I'd anticipate that, that will continue. And as well, we're obviously bringing in new customers that are of substantial size. So I think you'll see continued growth from us in both vectors. We're excited about our guidance and where we continue to think we'll execute to in the future.

The next question comes from Roger Boyd with UBS.

Congrats on the results. Going back to cloud workload protection, can you just talk about how often you're seeing that show up in new logos versus upsell and to the extent cloud security is becoming a bigger consideration in endpoint protection purchase decisions?

Yes. We definitely see it a lot in new logo motion, I think even more than what we concentrate on, on the retention and upsell side. It's definitely this, I think, mainstream awareness that you now need basically the same type of protection that you have years had on the endpoint and server side, now onto your cloud workloads in run time. It's actually also a very different competitive set that we see on the cloud workload side where the vendors that we meet most often in cloud workload protection opportunities are going to be Palo Alto Networks and a slew of start-ups.

It does impact what we kind of call a joint cycle between selling endpoint and cloud in tandem, even though we also address cloud-only opportunities with our cloud workload protection platform. It's regarded as one of the leading offerings in the space right now. So to us, again, cloud just represents a very exciting new opportunity. We've been working on Linux servers, Linux environment, which is really kind of an adaptation of what you're seeing right now in the Kubernetes platform, and we've devised a complete cloud-native platform to address that opportunity and is showing great traction right now.

The next question comes from Shaul Eyal with Cowen.

Congrats on the strong results and the guidance, guys. Tomer, I have a product-related question. Your Singularity platform is being integrated with Microsoft Azure Active Directory, where SentinelOne provides endpoint and identity solutions, and correct me if I'm wrong, under your conditional policy solution. So should I be looking at this integration as Microsoft potentially cannibalizing its own Defender platform in the long term? Can you maybe double click on that specific integration?

Yes, sure thing. And I think, to us, obviously providing for conditional access in this zero trust world is a much needed ingredient for a lot of these enterprises out there. And you kind of see what other vendors are also doing in the space around identity protection. And what we found is that their offerings are incredibly narrow and one that we can actually deliver to the customer by just integrating directly with the identity providers. Now it just happens to be that one of these identity providers is Microsoft, and Microsoft is also obviously a competitor in this space. But I wouldn't say that one really touches the other. For us, it's just a great way to deliver more value for our customers without the need to really attach another module or provide another capability but really just giving them out-of-the-box integration for conditional access, which is actually something that our competitors are charging for.

So to us, just again, just a great way to address the much-needed capability in the space in a completely native way by directly integrating with Microsoft. Another integration would be with the other identity providers that's coming soon. All in all, once again, a seamless way to deal with zero trust.

The next question comes from Rob Owens with Piper Sandler.

I was wondering if you could touch a little bit just around the linearity of the quarter and how it played out. And want to drill down into the extension receivables and days billings outstanding. Is this a function of larger customers moving up market? Or is this a more normalized range here that we should expect it to remain in?

Yes. I don't think there's anything that we're forecasting differently. I think that there are larger customers, which we anticipate will continue, so we'll see the benefit there. But I think it's also just we're getting better at operating business. So I anticipate that those numbers would be similar.

The next question comes from Tal Liani with Bank of America.

I want to go back to something you said on the prepared remarks. You mentioned that there is competition with both new and existing kind of antivirus players. And if you look at -- in the last year, if you look at the competitive landscape, do you see any significant change in pricing or aggressiveness of other players? Are the -- there are some concerns that the pricing environment is deteriorating on the basic product or the initial footprint, and I'm wondering if this is something you're actually seeing in the market. Or that's more just a high-level concern?

We're not seeing that. And in fact, year-over-year, our prices -- our land prices are rising. And that's a function of product enhancements, the innovation that we show, our customers as well as our module attach rate. And really, SentinelOne competes and wins because of the differentiation of our data and AI-driven technology.

In this space with enterprise buyers, no customer selects a security vendor based solely on pricing. That just doesn't happen. And so I think what we're really seeing is a combination of a few factors. One, folks are relying on and going to the best technology that provides an automated and easy-to-deploy solution. The second thing is we have a number of highly interesting modules that customers are consuming. And the third is the surfaces that we're protecting are increasing.

So if you look at what we just announced with Singularity Mobile, that opens up an enormous amount of adjacent surfaces for us to protect. If you think about what Tomer talked about with cloud workload protection, combined with the already vast number of only legacy-protected devices in the enterprise, really, there is an amazing amount of opportunity for us, both within new customers but also existing customers to continue to grow our ASP and our price per node.

So we are not seeing that. We'll see, within any given account, there could be one-off price pressures. But in terms of macro trends, we're really not seeing that.

Overall, what I'd just like to kind of add to what Nick said is that it's becoming increasingly hard to do any type of apple-to-apple comparison in this market just because of the number of moving pieces, different modules, different offerings at each and every vendor into the market. So I think it's something that is highly dependent on the deal composure for any given deal.

And again, if you put a layer on top of it, a consumption usage-based module that we'll start introducing as well and we're already introducing with our data retention modules, that becomes even harder to really slice and dice and figure out exactly. But to Nick's point, I mean, our [VPN] is on the rise; and all in all, we're very pleased with our progression with new lands and the price points there.

And Tomer, is there -- initially, when you went public, some distributors or resellers were saying that your price level is lower than that of CrowdStrike. Is this still the case? Are you winning also on price? Or did the -- because of what you just said, we can't compare pricing levels?

Yes. I think it was never the case. I don't know if it's no longer the case. Again, the way that we price is -- or the fair system that we found to monetize our platform, I think it's very competitive. I think in certain cases, you'll see it's more expensive than the competition. In some cases, you'll see the competition actually coming in and discounting deeply to try and win against us.

I think the dynamics in our market are very account and sales cycle dependent. As a whole, again, if you look at our entire business, [VPN] is on the rise. We like our price point. Look at our margin. I mean that would not have been possible without a very healthy price point for our offering. So to us, I mean, it's incredibly healthy.

One thing I would add is commonly our public company peer competitor force bundles in a myriad of human-powered services into their deals. And so often when folks are looking for an overall outcome of better visibility, better protection, and if they're comparing apples-to-apples, well, if the other bunch of apples also has some oranges in there, that ends up being a higher landed cost and really a much higher operational cost.

So I think one thing that constantly delights our customers is that they're able to get automated technology that doesn't require heavy handed services to deploy and maintain. And that overall return on their investment, they get higher ROI and they get to that much faster with the Singularity platform.

There are no additional questions registered at this time, so I'll pass the conference over to Tomer Weingarten, CEO, for closing remarks.

Thank you, and thank you, everybody, for joining us today, and see you next quarter. Thank you.

That concludes the SentinelOne Q3 2022 Earnings Conference Call. Thank you for your participation. You may now disconnect your lines.