SentinelOne Inc (S) 2023 Q3 法說會逐字稿

Good afternoon, and thank you for attending today's SentinelOne earnings conference call. My name is Jason, and I'll be the moderator for today's call. (Operator Instructions) I would now like to pass the conference to your host, Doug Clark.

Good afternoon, everyone, and welcome to SentinelOne's Earnings Call for the Third Quarter of Fiscal Year 2023 ended October 31. With us today are Tomer Weingarten, CEO; and Dave Bernhardt, CFO. Our press release and the shareholder letter were issued earlier today and are posted on our website. This call is being broadcast live via webcast. And following the call, an audio replay will be available on the Investor Relations of our website.

I would like to remind you that during today's call, we will be making forward-looking statements regarding future events and financial performance, including our guidance for the fourth fiscal quarter and full fiscal year 2023 as well as certain long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that the actual events or results could differ materially.

Please refer to the documents that we file from time to time with the SEC, in particular, our annual report on Form 10-K and our quarterly reports on Form 10-Q, including our filing for Q3. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements.

Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons the actual results could differ materially from those anticipated in the forward-looking statements, even if new information becomes available in the future.

During this call, unless otherwise stated, we will discuss non-GAAP financial measures. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results is provided in today's press release and in our shareholder letter.

And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fiscal third quarter earnings call. We reported another quarter of triple-digit revenue and ARR growth combined with significant margin expansion, meaningfully ahead of our guidance. Once again, we achieved the Rule of 60, and we are raising our full year revenue and margin expectations.

While the impact of macro challenges has become more pronounced, cybersecurity remains mission-critical. Most importantly, our autonomous technology is best-in-class. Our platform is purpose-built for leading efficacy, cost efficiency, scalability and ease of use. We remain well positioned to help enterprises stay protected and realize a superior return on their cybersecurity spend.

On today's call, I'll focus on 2 key areas: one, details of our quarterly performance, including customer growth and expansion, as well as the broader demand and macro dynamics; and two, the actions we're taking to enable our path to profitability and execute in today's environment. Financially, we've taken a more prudent approach to investments like moderating new headcount growth. And operationally, we're streamlining our teams to unlock higher productivity and performance.

Let's first turn the discussion to our quarterly performance. We once again delivered triple-digit revenue and ARR growth fueled by the adoption of our Singularity XDR platform across endpoint, cloud and identity. We're taking market share, and we achieved the Rule of 60 again in the third quarter. We've consistently combined rapid growth with meaningful margin improvement, showcasing strong unit economics and scalability of our business model. We've expanded operating margin by over 25 percentage points year-over-year for 5 consecutive quarters. We expect that to continue in Q4.

Let me highlight some of the key strengths of our business from the quarter. Around the world, we're protecting more enterprises than ever before. We added over 600 new customers in the quarter. Our customer base now exceeds 9,250. That's well over 3,000 more businesses added in just the last 12 months.

Our customers with ARR over $100,000, grew nearly 100%, reflecting continued traction with larger enterprises. For example, an iconic media brand chose SentinelOne for our superior performance across endpoint, cloud and data retention. In another example, a global consumer brand consolidated on SentinelOne's cloud-native platform, replacing several legacy and next-gen competitors. We continue to secure wins across a significant majority of competitive situations based on our platform performance and technical capabilities.

Building on our partnership with CISA, we also extended our success in the federal arena by securing 3 new agencies during the quarter. Our land-and-expand strategy is working. With existing customers, our net retention rate remained extremely strong at 134%. This is driven by footprint expansion and rapid adoption of our adjacent solutions by our 9,000-plus customers.

Q3 was a record quarter for Singularity Cloud, which once again remained our fastest-growing solution in Q3. We're seeing strong adoption of cloud security among new and existing customers, reinforcing the ease of deployment and superior protection from our Cloud Workload Security solution.

A leading software company selected Singularity cloud despite having deployed a competitive next-gen EDR solution on their endpoints. Separately, a large existing customer expanded coverage for the third quarter in a row. The continuation of these trends over the past few quarters highlights increasing demand for our cloud workload protection.

Given the breadth of our platform and expanding customer base, we believe we're still in the early innings of a very large expansion opportunity. NRR is proving to be resilient regardless of macro conditions. Our customer retention remains extremely high. We expect NRR to continue to drive a healthy base of growth.

Our momentum with channel partners continues to shine, especially with our strategic partner ecosystem, including MSSPs and Incident Response providers. Our partners and customers want automated solutions that reduce reliance on human intensive processes while offering best-in-class protection.

Many small- and medium-sized businesses are increasingly turning to managed security service providers. It helps them address cyber talent shortages, gain cost efficiencies and offset potential economic challenges. We've designed our platform to support multi-tenancy, fully customizable role-based access control and a full set of open and documented APIs.

These product-driven differentiators fuel ease of deployment, scaled management and unprecedented integration capability. We don't compete with our partners but enable them. This makes SentinelOne the partner of choice for MSSPs across the globe. We're partnering with most of the leading MSSPs. Our MSSP exposure continues to drive meaningful and resilient growth as SMBs shift to more flexible security models.

Let's turn the discussion to the demand environment and the trends we're seeing in our market. Consistent with many other software companies and even our competitors, we're seeing higher cost consciousness and prudence around IT budgets. That's leading to elongated sales cycles and limited budget availability. These factors are most pronounced in larger deals and they require higher level of evaluations and approvals.

Customers are more focused on the most critical and immediate security needs while taking a spend later approach for other areas. And finally, foreign exchange presented an incremental headwind in EMEA. While we price in dollars, foreign exchange can impact the purchasing power of international organizations. Together, these factors contributed to a softer net new ARR than we had expected and decelerating growth. Still, we are growing at a very healthy pace with ARR growth over 100%.

There are clear signs that demand and our competitive positioning remains strong. While we're not experiencing deal cancellations, we are seeing elongated deal cycles and budget adjustments. We continue to successfully close these deals. For instance, several large deals that pushed beyond Q3 have already closed in Q4 with some closing just days after the quarter ended. That was several million dollars of secured deals that simply didn't close in time.

Also, pricing remains healthy and our technical win rates remain extremely strong. We believe these macro factors are temporary, and there is no change to the long-term opportunity for our leading next-generation security. Our pipeline once again grew to a new high, giving us confidence in the opportunity in front of us.

We're also encouraged by extremely strong customer retention and the expansion from our installed base, with net retention north of 130%. And newer solutions like cloud and identity are opening even more opportunities with some of the largest enterprises in the world.

Shifting gears to the second key topic, the steps we're taking to increase productivity and to enable our path to profitability. We're streamlining our teams, elevating executive leaders and ramping our sales reps. We believe we can elevate our execution further regardless of market conditions. We moved quickly to hire a lot of terrific talent over the past year. Nearly half of our sales reps are newer and still ramping.

As these reps ramp up the maturity curve, this should deliver meaningful productivity gains and improve our execution further. We're putting more focus on performance management across all functions as we seek scale and efficiency company-wide. This is a routine part of growing and optimizing the business. Our employee retention remains better than industry average as a result of our dynamic and inclusive culture that is highly valued by all Sentinels.

Next, to further accelerate our new customer growth and shortened sales cycles, we have combined sales and solution engineering under 1 organization to improve velocity of execution and customer engagement in every region.

And finally, a more tactical change, replacing a higher emphasis on the largest account opportunities in our pipeline. We've made significant progress in the past few years winning Fortune 500 and Global 2000 accounts. Over 2/3 of our ARR comes from large enterprises and customers with ARR over $1 million grew by more than 100% year-over-year in Q3. This is the right next step to drive further success with the largest enterprises.

It's clear there's a slowdown going on, and no one can fully predict the extent of the impact. Based on what we're seeing and the steps we're taking to adjust to evolving conditions, we are well positioned to deliver seasonally strong growth in Q4.

Our growing pipeline demonstrates that customer intent is there and enterprises need security. We are gaining share across multiple large market segments: endpoint, cloud and identity. We remain confident in our long-term growth potential and are in the early innings of a large and expanding addressable market.

We're pairing that growth with a commitment to profitability. We're increasing our focus on cost management and productivity and calibrating our investments with the pace of growth. Our investments are largely elective, which allow us to be flexible.

Over the last 2 quarters, we've adapted to evolving market conditions, taking a more prudent approach to investments. As a result, we've delivered significant margin upside for 2 consecutive quarters with over 25 percentage points of improvement in Q3.

As we saw the early signs of macroeconomic challenges, we started to adjust investments accordingly, such as moderating the pace of hiring. Going forward, our focus as a team is to ensure that our time to profitability does not deviate across different economic or growth scenarios.

Our third quarter results and raised full year margin expectations demonstrate our ability to balance compelling top line growth with consistent margin improvement. We will continue to calibrate investments to support high growth and reach profitability in FY '25.

Taking a step back, over the past few years, we've built a truly disruptive and technically superior security platform. We've challenged the status quo of legacy and next-gen security vendors alike in the pursuit of enterprise trust, collaboration and protection, and we're succeeding.

Our Singularity platform truly stands out from all other solutions in the market. Customers overwhelmingly choose our technology whenever they evaluate or use it.

In addition to best-of-breed security, customers can optimize their total cost of ownership by consolidating on our Singularity platform. We designed Singularity to be a cost-effective solution with leading performance. This value proposition is compelling, especially in a higher cost-conscious environment. We're the only company with leading results in all 3 MITRE evaluations across endpoint, identity and managed services, which demonstrates platform superiority of our product and services.

Cybersecurity is mission-critical and remains a must buy for all enterprises. We're committed to innovation, listening to our customers and empowering businesses with the best security resources.

Today's market requires a relentless focus on optimizing and efficient execution, as evidenced by our improving margin profile and strong Magic number. We believe the opportunity in front of us across endpoint, cloud and identity security is larger than ever before. We're taking market share every quarter, and we can do even better. We're sharpening our focus on cost discipline and driving productivity throughout our organization.

I want to thank all Sentinels for delivering leading technology and strong growth even in today's macroeconomic environment. I also want to thank our customers for their trust in SentinelOne as their security partner.

Before concluding, I'd like to recognize Nick Warner for his excellent leadership and dedication to SentinelOne. After more than 5 years of building the business, Nick has made a decision to transition from President of Security to an advisory role. I'm pleased that Nick will continue to support SentinelOne and our customers and look forward to continuing to work together with him.

With that, I will turn the call over to Dave Bernhardt, our Chief Financial Officer.

Tomer, thank you. I'll discuss our quarterly financial highlights and provide additional context around our guidance for Q4 and fiscal year 2023. As a reminder, all margins discussed are non-GAAP unless otherwise stated.

We once again delivered high growth combined with meaningful margin expansion, showcasing the efficiency of our business model and strong unit economics. We are raising our full year revenue and margin expectations again.

In the third quarter, we achieved year-over-year revenue and ARR growth of 106% and ARR grew to $487 million. We had a net new ARR of $49 million in the quarter, driven by a combination of new and existing customers.

Compared to our expectations, the lower net new ARR was largely due to macroeconomic conditions impacting the timing and size of new enterprise deals. In general, these are not lost opportunities. In many cases, we have either closed the deals in our fourth quarter or secured technical wins and are awaiting deal closure. We saw similar dynamics across geographies with international markets facing incremental FX-related pressure.

Nonetheless, we are still delivering significant growth. We achieved a healthy mix of new customer additions and existing customer renewals and upsells. Our customers with ARR over $100,000 grew nearly 100% year-over-year to 827, much faster than the total customer count. And growth from customers with ARR over $1 million grew even faster.

One reminder on customer count is that we count each MSSP as a single customer. Therefore, with some direct SMB customers facing budgetary pressures, much of that impact is offset by the strength and shift to our MSSP ecosystem.

Our ARR per customer increased sequentially, reflecting the strength of our business among large enterprises and the adoption of more of the Singularity XDR platform in spite of recessionary concerns.

There were no outsized large deals in Q3. Our net retention rate remained north of 130%, driven by strong subscription expansion and cross-sell of adjacent solutions. Growth from our installed base has proven to be quite durable and should continue to fuel a solid base of growth regardless of broader conditions.

Turning to our cost and margins. Our gross margin in Q3 was 71.5%, an increase of 5 percentage points year-over-year. I can't overstate the progress we've made on gross margins, improving nearly 20 percentage points since the beginning of last year. We're benefiting from our land and expand strategy and platform unit economics where we collect data once and enable more and more capabilities. We're seeing continued benefits from economies of scale, data processing efficiencies, now including a DataSet back-end, and module cross-sell.

Looking at the rest of our P&L, we delivered substantial operating margin improvement, expanding 26 percentage points year-over-year to negative 43%. As market conditions evolve throughout the quarter, we became more selective with our investments. As a result, we outperformed our EBIT margin guidance by 14 percentage points.

On a dollar basis, we also reduced our operating losses compared to the prior quarters of fiscal 2023. We're achieving scale, leveraging our channel and globalizing our talent pool. Our Magic number was over 1.2x. These results signify our ability to maintain a balance between compelling top line growth and progress towards our profitability targets.

Moving to our guidance. In Q4, we expect revenue of about $125 million, reflecting growth of 90% year-over-year. For the full year, we're raising our revenue outlook to $420 million to $421 million, reflecting 105% growth. This is up over $4 million at the midpoint versus our prior guidance. While we don't specifically guide for ARR being a subscription business, our year-over-year revenue and total ARR growth tracked closely. We expect that relationship to hold in Q4.

To be clear, we expect Q4 net new ARR to increase by at least 20% sequentially compared to the third quarter. We believe this is a prudent view and reflects a continuation of the macro headwinds we experienced in Q3, yet we are in a position to deliver a seasonally strong end of the year.

Fundamentally, there is no lack of demand for the Singularity platform. Our pipeline reached a record high as we exited Q3. At the same time, we want to be mindful of enterprises prioritizing cash preservation. Cybersecurity remains a top IT priority and our AI-based autonomous Singularity platform is optimally positioned to deliver superior enterprise value.

Turning to the outlook for margins. We've taken a major step forward as a company, operating above 71% gross margin and moving closer to the long-term gross margin target of 75% to 80% or higher. We're benefiting from platform data efficiencies inherent in our business model and our platform approach. We expect Q4 gross margin to be about 72% and we're increasing our full year gross margin guide to 71% to 71.5%. This is up from prior fiscal '23 guidance of 70.5% to 71% and up about 8 points year-over-year.

Finally, for operating margin. We expect Q4 operating margin of negative 39%, up 27 points year-over-year and implying a Rule of 50 for the quarter. At the same time, we're improving our full year margin outlook to negative 51% to negative 50%. Our updated operating margin guidance is a 6 percentage point improvement at the midpoint from our prior range. It is also an improvement of 35 percentage points compared to last year.

Our long-term margin targets remain intact. And our goal is to reach operating breakeven for fiscal year 2025, which is primarily calendar year 2024. We're making excellent progress.

Thinking longer term, let me shed some light on our growth drivers and our path to profitability. Over the past several quarters, we demonstrated the ability to remain dynamic and deliver significant margin outperformance even as growth moderates. We're confident in our time line to profitability across different economic scenarios.

While growth is slowing because of macro conditions in the near term, we remain confident in our ability to deliver high levels of growth next year and beyond. We expect to continue to win market share and outgrow the competition.

Based on a prudent view of the current economic environment and expectations of further macro deceleration, we believe we will deliver at least 50% total ARR growth in fiscal year '24. This is also based on our growing pipeline, strong win rates, high retention and expansion rates and the enterprise need for security.

From a bottoms-up perspective, expansion from our installed base of over 9,250 customers remains durable. On top of that base of growth, we're securing hundreds of new customers every quarter. We see tremendous potential in endpoint, cloud and identity and expect to continue to take market share and expand with our existing customers.

And our strategic channel partners like MSSPs give us a unique exposure to fast-growing portions of the market. As we cross $0.5 billion in ARR, a milestone for any company, our focus is on continued growth and profitability.

Indeed, we are looking carefully at our cost and parts of the business that can be more operationally efficient. We're increasing our focus on profitability and cash flow. We don't intend to sacrifice growth, but we are moderating the pace of our investments and focusing on the most strategic areas.

We're increasing performance accountability and aligning several teams to improve velocity and execution. We have a very strong balance sheet with $1.2 billion in cash, cash equivalents and investments with no debt. That's substantial. It provides longevity, flexibility and ample runway to achieve positive cash flow generation.

When thinking about our path to profitability from here, consider our Q4 margin guidance. We're on track to exit fiscal year '23 with 2 quarters of about 25 percentage points of year-over-year operating margin improvement.

Continuing this progress forward, we expect another 25 points of operating margin improvement in fiscal year '24, and our goal is to achieve profitability in fiscal year '25. We're laser-focused on execution to stay ahead of evolving economic conditions. Our strategy is to dynamically invest in our technology and business while enhancing our path to profitability.

In summary, Q3 was another strong quarter despite the near-term turbulence. The demand for cybersecurity remains intact. We expect the secular headwind supporting our business to continue, and we believe we have the best technology to protect the modern enterprise.

Thank you all for attending our earnings call. We're now ready for questions. Operator, can you please open up the line? Thank you.

(Operator Instructions) Our first question is from Saket Kalia with Barclays.

Tomer, maybe just for you, a lot of helpful commentary around the macro and clearly, it's hitting everyone. So probably not much of a surprise either. But I was wondering if you could just talk a little bit about the competitive landscape a bit. And in particular, Microsoft. I'm wondering if you see them more in customer evaluations and how you think customers are viewing a Microsoft Defender option versus a specialist tool like Singularity or like other next-gen solutions out there. Any thoughts?

Yes. I think that, by and large, the competitive dynamics stays relatively the same as we've seen in the past few quarters, past couple of years. All in all, folks look at best-of-breed security pretty much in the same token as they've had. It's also worth mentioning that while Microsoft's offering as it pertains to the software piece might be included and perceived as free, if you look at integration costs, management costs and MDR services or any affiliated service, that actually bumps up the price in a pretty significant manner. So if you look at the overall TCO, it stays relatively comparable with best-of-breed offerings.

The second dynamic I want to highlight is that we've seen more and more Microsoft displacements, customers rebounding from Microsoft's offering, some citing it as eventually -- in eventual cost terms, the most expensive solution they had to manage over the years.

So we feel the competitive environment versus Microsoft is relatively sustained. We haven't seen any major shift. And again, if at all, we're seeing more displacement. And we feel that best-of-breed security, even in an environment where people focus on cost, will still prevail in a lot of the cases.

Got it. Got it. That's really helpful. I was going to direct this next question to Nick. I'm not sure if he's on the call, but my congrats to him on his next phase. So Tomer, maybe I'll make the follow-up for you as well. A lot of good stuff to talk about there with the MSSP channel. Can you just talk about to what extent are they selling some of your newer emerging products? And what kind of revenue opportunity could that be?

Of course, and we wish Nick all the best. He's not on the call. MSSP for us, again, it's a highly strategic go-to-market motion. We haven't even started to unlock the other revenue line possibilities we have with the MSSP ecosystem. For the first time, we've actually enabled them to sell new modules: that happened last quarter for the first time. So it's just the first innings of that opportunity. Right now, we're still laser-focused on addressing core security needs like EDR and EPP. We're now extending it to Ranger and MDR as well as a resell.

So all in all, we feel that's going to be a sustained and resilient part of our business, especially as you see SMBs trying to avoid not the technology and software costs, but really the overhead in recruiting more and more headcount into their security teams and are looking to offset that by procuring direct services, scaled services from the MSSP ecosystem. Obviously, that bodes well for us. We have a complete multi-tenanted solution for that MSSP ecosystem that actually allows them to be more productive in what they do. So again, even in this environment, MSSP is definitely a shining point for us.

Our next question comes from Alex Henderson with Needham.

You gave a guide -- preliminary guide, I guess, is the right way to say it for FY '24, 50% ARR growth. The question I have for you is really without giving a forecast, can you give us some sense of the way you're thinking about the OpEx spend in that environment? Will you still produce at a 50% type growth rate with the same or a similar degree of leverage? Or do you think the leverage becomes a little bit more muted as a result of the slower growth before the reacceleration?

We think that the ARR, let's call it, tentative guidance for next year, is really a floor. When I think about it, we believe it's conservative. We're looking at it as something we can build from.

In terms of our OpEx spend, we've always said, and you've definitely seen this over the past couple of quarters where we beat by 17% and 14% in terms of operating margins, a lot of our spend is highly elective and we'll invest when it makes sense, and we'll pull back when it doesn't.

We're always going to map towards our long-term projections in terms of profitability. So if you look, we've made great strides in the years past. We basically cut down our losses by about half every year. And I would anticipate that to continue into next year. Our long-term goals and our path to that is unchanged, no matter what the growth is.

The second question I'd like to ask is, can you talk a little bit about the linearity of demand over the course of the quarter? It seems like business is really decelerating very sharply from September to October and then October into November, broadly. Is that consistent with what you're seeing? Or is the resigning giving you some variance from that?

What we're seeing is that a lot of the linearity -- generally, linearity is something that is also under our control. So when we look at our deal inspections, when we dive deep into what we see in the pipeline, we reckon that at the end of the day, a lot of the ability to progress linearity lies within our hand. It's something that we can, to an extent, mitigate by just performing better. And it's something that as we kind of enter Q4, we see it as something that is much, much healthier than what we've seen in previous quarters.

Some of it is also our changes, what we're doing to actually make sure we can achieve linearity even under decelerating macro conditions. So to us right now, we feel pretty confident in the guide that we gave for Q4. To us, it embodies every factor that we have seen in the past couple of quarters. And once again, is, we feel, given our seasonality, given our linearity is something that we can stand behind.

Our next question comes from Hamza Fodderwala with Morgan Stanley.

A couple of questions. Tomer, I think you alluded to some deals that slipped out of Q3, but closed in fiscal Q4, and these were some pretty large deals. Can you help us quantify how much those deals contributed or would have contributed to Q3?

And then secondly, for Dave, you mentioned operating profitability in fiscal '24. I just want to be clear, is that for the full year of fiscal '24? And would you expect free cash flow breakeven to precede that by about 4 quarters?

When we look at the deals that slipped, several millions closed in the days that follow. To us, we kind of saw 2 different dynamics. One are these deals that slipped. They contribute somewhat to the next quarter, but I think what is safe to assume is that now we're seeing this as more of a part of our business and not just slipped deals.

The second one we're seeing and oddly enough, we've actually added more and more large deals this quarter than ever before. More large logos than ever before. But at the same time, deal sizes have changed in nature given to the pressures on budget. So all in all, we kind of feel like we're recalibrating around the new realities in our market. But once again, we feel highly confident that we can continue to operate in this environment.

And Hamza, to answer your second question, we've talked about timing of free cash flow, creating free positive cash flow. We're still expecting that to happen at the end of next fiscal year. And then what we're hoping for and really working to achieve is how to get breakeven in fiscal year '25. So the following year. So we do expect free cash flow to hit before profitability. And then those 2 will be much more mapped together.

Our next question comes from Jonathan Ho with William Blair.

Just wanted to start out with maybe a little bit of additional color on how you think about driving more productivity out of your existing sales teams while also driving this additional cost savings. I just want to understand how do you think about sort of balancing that effort and your confidence level around being able to achieve both.

I think we've mentioned that we've just recruited a ton of great talent in the past year. And a lot of these folks, especially on the sales side, are actually ramping and still ramping. We're now working to enable them faster. We're working to get them productive sooner. And naturally, as they progress down the line, as you can imagine, people that have been in the company less than a year are not as productive as people that are in the company for 1.5 years or 2. So naturally, we expect more productivity.

With that, we've also combined the solution engineering and sales engineering to create a more -- sorry, and the sales organization to create a more curated experience for customers. We put a new leader in North America, and we're putting more and more emphasis on how we sell to the highest enterprises, to the largest logos that we have in our pipeline. All of those have already started to show great signs of success, and we'll continue doing that. As more and more of our business is moving upstream, that to us remains, again, a strategic go-to-market element and avenue that we feel is just getting stronger and stronger for us.

Again, there are many other initiatives that we're taking. But all in all, the ramp, enablement and eventually the changes we've made in our go-to-market organization are already yielding results for us, and we're going to continue and drive that into the future.

Got it. Got it. And then just in terms of a follow-up, can you talk a little bit more about the deal resizing that you're seeing out there? Like are these deals typically more being phased in? Are they being reduced in size and scope? Or are you actually seeing anything in terms of renewals, durations changing at all as well?

The most prevalent dynamic we're seeing out there is really just rightsizing by customers. I mean, they just want to procure for now versus any aspirational note counts that they might have planned for the future. And that, to me, is the prevailing dynamic. I mean, we're not seeing multiphase deployments. People buy for what they need and they come back for expansion. That, to me, once again, is the main thing we're seeing out there.

We're also seeing it is really more of a future upsell opportunity. I mean these customers are now choosing the core components of our platform. And later on, as they progress with time, we have the ability to go back and upsell them on adjacent models, on more seat counts and really stay true to what customers need in this environment versus just trying to sell them more and more. That's our entire philosophy.

Our next question comes from Fatima Boolani with Citi.

Tomer, I'll start with you just with respect to some of the items that you itemized around the go-to-market and sales operations changes. So the first one is I'm just curious about a potential succession plan post Nick's transition and how we should think about his transition in terms of overseeing the broader operations of the sales organization impacting the way you thought about the 4Q execution and the top line guidance.

And then, Dave, for you, kind of building off the last question, you talked about cash conservation and cash management sensitivity in your customers. So when I look at your deferred revenue performance, it was a little bit lighter than we were looking for. So if you can maybe shed light on what you're seeing from a contractual and invoicing behavior standpoint as it relates to that cash management sensitivity, I'd really appreciate it.

Yes. So on Nick's succession, you might recall about 6 months ago, we've added Vats Srivatsan as our COO. And by now, largely, we moved a lot of these functions that were under Nick, under Vats as well. The second part is that, obviously, I'm taking a more active role in the go-to-market organization. And as a whole, we've put more emphasis on executive sponsorship throughout the entire process. So we're putting go-to-market front and center. It is the topmost priority for the company right now and for myself. So we kind of worked through that succession both in terms of continuing the transition that we started about 6 months ago, but at the same time, we also remain opportunistic and if we feel like we can inject another highly tenured sales executive, we might opt to do so in the future.

And Fatima, to answer your second question in regards to free cash flow, I think you're seeing 2 dynamics. You're seeing, one, where customers just aren't prepaying for multiyears, which was more prevalent in the past. And then you're also seeing the shift to MSSP, where they tend to be paying quarterly versus larger upfront deals. That dynamic we expect to continue for a while.

Our next question comes from Brad Zelnick with Deutsche Bank.

Great. It's good to see the strong execution in this kind of environment. I've got one maybe for Tomer and a quick follow-up for you, David. Tomer, I was intrigued by the customer win you mentioned that chose Singularity Cloud despite running a competitor on their endpoints. Can you maybe mention who the competitor is, what was the circumstance? And is this something that we can expect might be more common in the future?

Absolutely. We've seen that dynamic now play for a few good quarters. It's a strategic go-to-market avenue -- yet another one for us -- where we go in and unlock accounts that otherwise have been running somebody else on the endpoint side. And as you can imagine, we've got 2 main competitors, you can pick each one of them that you wish for the purpose of illustration. But at the end of the day, it allows us to come in with a truly unique offering right now for cloud workload protection that is far superior to what any other endpoint vendor can provide on the cloud side. And on those merits, we come in, we secure the cloud environment.

It's not the first one. We've had quite a few of those in the past couple of quarters, and it remains, again, a competitive advantage that we have, not only in our own existing accounts, not only is it now a wider platform, wide offering that spans endpoint and cloud and serves as another differentiator, but once again, in the stand-alone situations, you're sometimes looking at footprints that are in the cloud that are actually bigger than the footprints on the endpoint side.

So for us, more cloud deals and the more cloud deals that we can do, it's incredibly serving to our go-to-market motion. Cloud was again our #1 fastest-growing module. And we just invest more and more in an offering that right now is a leg above what anybody else can offer in the space.

That's really helpful. And David, just a follow-up for you. I appreciate the color you gave for Q4 and ARR for at least 20% sequential growth. Others in the broader market are calling for no seasonal budget flush, no Christmas this year, even sequential declines in Q4. And I know you have a number of benefits, including the deals that pushed from Q3, strong net retention trends, ramping sales productivity and a really strong value prop. But is there any way to maybe further frame and characterize the confidence that you have that underpins your view into Q4?

Well, we're assuming that the macro conditions continue and persist into Q4. We're still expecting to grow sequentially. This 20%, it's due to a few things. One, we have a higher concentration of larger deals historically in Q4. Two, we have a record pipeline. We just need to go out and close deals. We're highly confident in the 20% sequential growth. And we're hoping to outperform that. We believe this is historic -- this is much better or much more conservative versus our historical guidance.

If you looked traditionally, we were about 40% sequential growth. We're assuming it's about half that. And I think that that's how we're looking at this to reflect more conservative guidance around Q4, and we're hoping to build off that.

Yes. Just to add to that, I mean, we feel like we've got all the raw materials to get there. And right now, we're just kind of re-rating on our ARR. So to us, it feels like we're taking the right step to make sure that we're guiding towards what we feel is absolutely doable. That's the right thing to do. And with that, as Dave mentioned, record pipelines entering into the quarter, better linearity than last quarter that I mentioned just a few moments ago. All of those give us increased confidence that we can hit the Q4 number, potentially even do better.

And I think another thing to consider is that we've never been benefits of a budget flush. I think we've just traditionally seen deals that closed. We've never been a company, I think, that have companies just come to us and say, "Hey, I've got a bunch of budget I need to spend it." When customers work with us, we're trying to do what's best for the customer, and we're trying to make sure that we provide a solution for them. So the idea of a budget flush just isn't something that we're expecting will affect us.

Yes. I concur, by the way. We've never seen that phenomenon for better or for worse.

Our next question comes from Gray Powell with BTIG.

So a lot of good detail in here so far. So when we think through your outlook for 50% ARR growth next year, how do you think linearity plays out relative to this year and prior years? Should we expect that the net adds next year to be more back-end loaded?

I think generally, I mean, it will be typical to our business. I mean I wouldn't expect any major departure from how we've been operating in the past couple of years. It might be a bit more smoothened out. But again, at large, I would say it remains relatively the same.

Okay. Great. And then just my other question would be, I know you're not breaking out Attivo anymore, but just how has growth there been relative to your original expectations? And as you get that product more into your sales motion, do you see an opportunity to accelerate growth in the product from that original 50% growth rate that we were talking about at the beginning of the year?

As we look into next year, we believe that's going to be one of our stronger propositions. I mean to us, being still in the early days of our integration, we believe we haven't fully unlocked the potential in that acquisition and in identity security in general. We've generated record pipeline for identity security this past quarter. So we feel better about the overall prospectus of what this could look like in the years to come.

With that, obviously, macro impacts everything and identity is no different. We always expect highly and we maybe expected more. But generally speaking, as we go into next year with a fully-integrated offering, we feel that's the best way to unlock the identity perspective, both in terms of the go-to-market and our sellers being able to sell identity as a holistic part of the platform.

And also technologically speaking, the product will be completely integrated into our endpoint technology. So it wouldn't require any additional configuration, and that would again unlock and remove more friction.

Our next question comes from Joseph Gallo with Jefferies.

Really appreciate the question. How should we think about macro impact at the lower end of the market? I know you said the large deals is where it was more pronounced. Is the lower end of the market seeing strength? Or is that partially being masked by the MSSP channel?

It could be. It's a bit hard to tell. I mean, just given that dynamic that MSSP to an extent masks some of these things from us. But as we look at our own direct contribution in MSSP, it remained relatively in line with past trends. So we haven't seen anything too dramatic going in, in SMB. But what we've definitely seen is MSSP on the rise, MSSP taking more customers from the direct business. So even if you look at kind of our customer count as an example, a lot of these customers that we've added in the quarter are actually masked by 1 master MSSP service provider that basically onboards all of these customers. So all in all, we feel that between MSSP and our direct strength in SMB, we've seen largely consistent execution. And we feel that should continue into the future as well.

Awesome. I appreciate those comments. And then a lot of the convos we've had with cyber professionals, has just been around -- the next real frontier is IoT, which remains the Wild West. Can you just give an update on Ranger? And is that viewed as a must-have or a nice to have in an intensifying macro environment?

Sure. If you ask me, it's a must-have, I don't know that's the same in the eyes of customers just yet. I think there's still a lot to still work on in terms of security fundamentals and EDR and EPP are still not prevalent enough. In the frontier, the real frontier is still with EDR and EPP. With that, we are seeing good traction with Ranger. We have been seeing traditionally good traction with Ranger. I think market education always lags a tiny bit the threat landscape. But we believe that as you kind of go into more and more of this need to actually map out your entire asset environment, all your devices and get a grasp on your entire network, Ranger is one of these imperatives that can help customers fast to map out their environment and then provide for better protection and better hygiene. So it remains, again, a leading module for us and one that I hope we'll see even more contribution in the next couple of years.

Our next question comes from Roger Boyd with UBS Securities.

Tomer, lots going on with macro, but I'd love an update on what you're seeing in terms of customer interest around the broader XDR strategy and the DataSet product. And as we look to calendar '23, where do you think those kind of security analytics projects stack up in terms of CSO priorities?

Absolutely. It's actually one of the top most priority for a lot of enterprises out there just on the account that these XDR projects when they deal with true data ingestion, like the proposition that we have with Singularity XDR, are actually means to offset cost away from legacy data processing solutions. So we have a lot of conversations out there to leverage the already preexisting platform that they own in Singularity XDR and into a full log ingestion mechanism that offsets costs away from traditional SIEM providers.

So especially in this macro environment, for true XDR data down solution, and especially if it's one that already exists in your environment, if you are a user for Singularity XDR or for our EDR or for EPP, you can start ingesting data into it and save cost.

We're now building more and more into a holistic business value proposition that ranges from endpoint protection and consolidating away the endpoint security controls that you have now and all the way to cost saving on the log analytics side for security analytics. So expect more of that to happen. Still very, very early in that cycle, still applicable to just a narrow band of use cases. But as we go and execute towards next year, we're adding more and more use cases for customers to be able to enjoy the cost benefit. But now also make sure that there's a business outcome that's associated with it across security and all the way to finance and business operations.

Our next question comes from Andrew Nowinski with Wells Fargo.

Okay. So I have a question on the FY '24 guidance. So you talked about gaining market share, seeing more Microsoft displacements, your pipeline is at an all-time high, yet your preliminary outlook for ARR suggests that net new ARR is only going to grow about 8%. Can you just talk about the factors that you think are going to get worse next year than they were this year to where that net new only grows 8%?

Yes. I mean, a, we're really, really looking to put some form of a conservative prediction at a time where we don't believe we can predict anything really. We don't have a crystal ball. We don't have a way to know how the economy would look like. Our assumption is that things are not going to get better anytime soon. And just on the account of that, we want to make sure that we don't put too aspirational target out there for our growth.

And as Dave mentioned, to us, we've always been incredibly nimble, incredibly agile in how we spend and how we extract growth, and we'll continue keeping an eye as to when we can maybe press more on the gas pedal and maybe accelerate growth versus taking a more prudent and conservative approach to our growth. So all in all, this just to us means that we want to make sure that we're being responsible custodians and are giving the conservative view of the most that we can see. And right now, to be perfectly honest, there's not much that we can predict to next year. So we're taking that view.

Okay. Fair enough. And then on the Fed side, you said you secured 3 new agencies. I'm just wondering, are those agencies exclusively using SentinelOne for endpoint protection? Or might they be using other vendors as well? I'm just trying to understand the magnitude of those 3 deals in the Fed you mentioned.

Of course. Each one of them is slightly different. Some of them do use another vendor out there. Some of them use us exclusively. For all of those, I mean, this is an initial land. I mean, obviously, these agencies are sometimes just incredibly sizable. And for us, I mean, even the initial land is a massive deal but all of them are just initial lands that will grow over time. For some, there's another vendor out there. But to us, it's just a massive, massive win, and we continue to see traction in the federal, which is the most important part.

Our last question comes from Rudy Kessinger with D.A. Davidson.

Really just one for me. You talked about customers kind of rightsizing deal sizes and taking the number of endpoints they really need today as opposed to kind of buying more endpoint coverage based on some prediction of what they'll need in the future. But I guess I'm curious, are you also seeing customers maybe taking Singularity Core or Control as opposed to Complete? And then as you look at the emerging products, it certainly it sounds like cloud security remains very hot. But if you just had to look at cloud, identity, Ranger, IoT, data protection, just kind of rank order which products are still seeing the most demand versus which have seen maybe a bigger impact due to the macro and are getting pushed to the side.

Singularly Control is still the #1 package we have, and we haven't seen people shift away to Singularity Core or -- I'm sorry, Singularity Complete is the #1 package that we have. We haven't really seen anybody move into Singularity Core or Control. To us, it really is about the adjacent modules on top of Singularity Complete but sometimes folks would choose to not spend on right now. These could be adjacent capabilities like remote script execution, endpoint firewall controls, that are not always the bare necessities. But when you look at the core needs, obviously, EPP and EDR remain front and center.

And the second part there is that, obviously, anybody that has transitioned or started transitioning to the cloud and is now using the cloud as a production environment must deploy workload protection, run-time protection into those. So those become a must-have. So across these 2 functions as well as more demand for MDR services and managed services. Those are kind of the, call it, the bread and butter of what we sell on today.

Data retention is one that I highlight as well. Again, that's actually a cost saver to many folks out there where they can retain data with the Singularity platform versus maybe putting it in another costly data lake. So those to us have seen the most success and continue to grow. I think for some of the other offerings that we've had, especially as you kind of look into endpoint management, that's where sometimes people choose to pause and really focus on the ones that matters most.

And our final question is from Tai (sic) [Tal] Liani with Bank of America.

I have 2 questions. The first one is, if I look at prior down cycles, there was always an issue for smaller companies to maintain the pace because some customers are looking at balance sheet strength and are looking at cash flow, cash burn, losses and are shifting business to companies who are more financially stable. Your case is a little bit different because you're a leader in your space. And I'm wondering if you had this kind of discussion with your customers or if you had this kind of concern, how you address them if it's a consideration at all? That's my first question.

My second question is about large customers. We are seeing across the board that companies are talking about slowdown from smaller customers or push outs, and push out is always the first step before slowdown. And the question is, are you concerned that what you're seeing today is only the short term, meaning smaller companies just react really quickly to what's happening in the market and slowing spending, and we could see larger customers doing the same thing at the beginning of the year. So that means we haven't hit the bottom yet in terms of spending.

So the question is as much as you can say, it's not qualitative -- it's not a quantitative question, it's more qualitative. As much as you could see, how do you -- what's your view of larger companies, those who are working on annual budgets, what kind of discussions you have with them when it comes to how will next year look like?

First, on the first question, honestly, we haven't seen that. And our cash balance is incredibly strong by, I think, any degree. So we haven't heard that from customers at all. I think customers still look at us as a very cost-effective solution and one that on the TCO perspective helps them more than almost any other vendor out there. And that comes again on the back of a public company with transparent financials and that has been, I think, just a stellar force in cybersecurity.

To the second question, I think we are seeing large enterprises react and they react by really rightsizing. I think if you couple the pipeline, you really understand that the customer intent is still there. Cybersecurity is not something they can push or punt. They actually want to buy it, but they want to optimize on costs at the same time. So if you couple the pipeline strength and you couple the trends in deal rightsizing, I think that's the right dynamic that you're going to see. And it's something that we've seen, I think even starting a little bit last quarter, it did show up this quarter even in a more pronounced way. And now we're kind of factoring it in.

So all in all, I don't feel like you're going to see large enterprises saying, "I don't want to spend on security." They have to spend on the security, whether it's with the incumbent that they currently have, or with a new vendor that can supply better security, probably right around the same cost structure, they're going to have to spend it. So I don't foresee any further tapering or any further slowdown in how they're thinking about purchasing. I think we will see a continued trend to rightsize deals. And I think that SentinelOne is very well positioned to deal with that. We've always been the more cost-optimized solution in the market. It bodes incredibly well with our business model. That's why you see us, even in this macro environment, improving on gross margin. That couldn't have happened if we haven't had really robust and healthy pricing to couple with that.

There are no more questions. I'll pass the call back over to the management team for closing remarks.

Thank you, everybody. Really appreciate your time today.

That concludes the conference call. Thank you for your participation. You may now disconnect your lines.