SentinelOne, Inc. (S) Q4 2022 Earnings Report, Transcript and Summary

Good evening. Thank you for attending today's SentinelOne Q4 2022 Earnings Call. My name is Hannah, and I will be your moderator for today's call. [Operator Instructions]. I would now like to pass the conference over to our host, Doug Clark, Investor Relations of SentinelOne. Please go ahead.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the fourth quarter and fiscal year 2022 ended January 31. With us today are Tomer Weingarten, CEO; Nicholas Warner, COO; and Dave Bernhardt, CFO. Our press release and a shareholder letter were issued earlier today and are posted on our website. This call is being broadcast live via webcast, and following the call, an audio replay will be available on the Investor Relations section of our website. Before we begin, I would like to remind you that during today's call, we will be making forward-looking statements regarding future events and financial performance, including our guidance for the first fiscal quarter and full fiscal year 2023 as well as certain long-term financial targets. In connection with our recently announced definitive agreement to acquire Attivo, management will provide additional information as to the benefits of the acquisition. However, we'll not factor the planned acquisition into our fiscal '23 guidance at this time. We caution you that such statements reflect our best judgment based on factors currently known to us and that actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our S-1, our quarterly report on Form 10-Q and our annual report on Form 10-K that we filed. These documents contain and identify important risk factors and other information that can cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during this call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons actual results differ materially from those anticipated in the forward-looking statements, even if new information becomes available in the future. During this call, unless otherwise stated, we will discuss non-GAAP financial measures. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in today's press release and in our shareholder letter. These non-GAAP measures are not intended to be a substitute for our GAAP results. The financial outlook that we provided today excludes stock-based compensation expense, employer payroll tax on employee stock transactions and amortization expense of acquired intangible assets, which cannot be determined at this time and are, therefore, not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fiscal fourth quarter earnings call. This was another excellent quarter, and I'm extremely proud of the entire SentinelOne team. Our ARR grew 123% year-over-year in the fourth quarter, making the fourth consecutive quarter of triple-digit growth. In today's digital world, cybersecurity is mission-critical infrastructure in every geography, industry vertical and organization size. The demand environment remains incredibly strong. We continue to scale our business as a result of our cutting-edge autonomous XDR platform and our powerful partner-supported go-to-market strategy. We've built an AI-driven security platform that spans endpoint, cloud, IoT, data and now also identity. I'm thrilled that today, we announced our plan to acquire Attivo Networks. Attivo is a premier and highly differentiated solution that will enable us to provide cybersecurity in one of the most critical and dynamic parts of enterprise security today, the identity parameter. With Attivo's user-centric identity capabilities, we will be able to support an even more comprehensive zero trust framework. I'd also encourage everyone to read our shareholder letter we published on our Investor Relations website, which provides a lot more detail. Let's take a look back at our fiscal '22. It was a groundbreaking year for SentinelOne. We started the year as a private company, delivered a triple-digit revenue and ARR growth rate through all 4 quarters and ended the year as one of the fastest-growing technology companies in public markets with outstanding growth in ARR rapidly approaching $300 million. Throughout the year, we celebrated accomplishments that highlight our product market fit, innovation and superb customer experience, such as a Leader in the 2021 Gartner Magic Quadrant for Endpoint Protection, highest scores in Gartner Critical Capabilities use cases and being the only vendor with 100% visibility and no misdetection in the latest MITRE evaluation. In the Forrester XDR Wave, we were named the best fit for companies that want customizability and to grow into XDR. Our fourth quarter and fiscal '22 results demonstrate the relentless execution of our teams and focus on innovation. We're protecting more enterprises today than ever before at faster speed, greater scale, higher accuracy and with more automation. Automation has never been more critical to tackle the complexity of today's threats. I'd like to dig deeper into 3 key points about our performance. First, our success with large enterprises underscores the scalability of our platform. We added a record number of $100,000-plus ARR deals, a record number of million dollar-plus ARR customers and closed our largest ever net new customer contract, one of the most influential and leading global Internet companies. Nick will discuss this in more detail later on. Second, we paired our phenomenal growth with significant progress towards our long-term profitability targets. I'm pleased to share that we ended the fourth quarter with double-digit year-over-year improvement in both our gross and operating margins. Our gross margins expanded 12 percentage points year-over-year, and our operating margin improved 38%. This progress reflects our growing scale and increasing efficiency. Looking at the full year, fiscal '22 was an investment year for SentinelOne. It featured our IPO, solidifying our brand as an industry leader as well as investments in our go-to-market and innovation engines. We doubled our total workforce. I'm proud of SentinelOne being named to Comparably's Best Company Culture List and receiving the 2021 Great Places to Work award. Given the significant market opportunity ahead, we remain committed to investing in the growth of our business. And just like we did last year, we intend to balance this growth with further margin improvement in fiscal '23. Finally, our business is performing extremely well with broad-based strength across new customer adds, existing customer renewals and upsells. Throughout the year, we significantly expanded our platform offerings. Our endpoint solution remains the primary driver of our business, which is being complemented by emerging growth vectors, including cloud, IoT and data. We're still in the early innings of a large and expanding total market driven by the proliferation of hybrid work environment, digital transformation and an evolving threat landscape. It's clear that we achieved a lot as a company in the past year, but we must remain as vigilant as ever around the threat landscape. The persistence and sophistication of new attacks continues. We entered 2021 on the heels of Sunburst and exited the year battling Log4j. And most recently, the potential for cyber warfare has significantly increased in light of the Russia-Ukraine conflict. This has further escalated the threat environment. Our vision is to be a force for good, and we're committed to doing our part to help affected people and businesses in Ukraine and around the world to stay cyber secure. We've established a Ukraine Crisis Resource Center and began offering free access to Singularity XDR for cyber threat protection in Ukraine. We ran similar programs to help others in the wake of Sunburst, and we're committed to defending against cyber warfare. Threat sharing and collaboration are essential to our collective mission against cyber attacks. Our teams at SentinelLabs are leading the way by uncovering some of the most sophisticated attacks across the world. Our global footprint puts us in a unique position to not only protect our customer base in real time but also produce novel research to educate and arm the cybersecurity community. We're able to leverage the power of our partner ecosystem to stay on the front line with leading incident response providers like Mandiant, KPMG, Kroll, RSA and many others. As an example, we recently named and published research on HermeticWiper related to the escalating cyber attacks surrounding the Russia-Ukraine conflict. This was a real-time discovery on the eve of Russia's ground invasion. It helped bring awareness to cyber attacks accompanying modern warfare. Our publication was followed by an alert notice from Cybersecurity and Infrastructure Agency, highlighting the significance and relevance of SentinelLabs' research. If we look at the evolution of cybersecurity technologies for a moment, it's clear that legacy AV represents the past, EDR is the present and XDR is the future. While the majority of enterprises still utilize legacy AV solutions, we have undoubtedly entered the XDR era. At SentinelOne, we established the foundations of XDR by pioneering the world's first purpose-built AI-powered autonomous cybersecurity platform. Singularity XDR brings the critical capabilities customers need from a comprehensive cybersecurity platform: speed, scale and automation. Enterprises are increasingly selecting SentinelOne for our best-of-breed XDR. Over the past year, we significantly broadened our platform capabilities by introducing several mission-critical and highly differentiated innovations. I will briefly highlight a few of these. First, we enhanced our network visibility and control capabilities with Ranger Pro. Ranger helps enterprises eliminate one of the most commonly exploited threat vectors: unprotected and rogue assets. It reduces the attack surface by offering device mapping and management capabilities. Second, we introduced Storyline Active Response, our engine for automated threat hunting, detection and response. Next, we developed Remote Script Orchestration, a powerful endpoint management tool for both IR partners and enterprises. Finally, we launched Singularity Mobile, a new AI-powered mobile security solution for iOS, Android and Chrome OS devices. Building upon the acquisition of Scalyr, we launched DataSet in February of this year, a revolutionary live enterprise data platform for data queries, analytics, insights and data retention. DataSet expands our capabilities beyond cybersecurity use cases. It's a cloud-native, flexible enterprise data platform built for petabyte scale. Not only DataSet is the back end for our Singularity XDR platform. The technology is already being used by hundreds of enterprises, analyzing trillions of real-time events. Customers like DoorDash, Copart, Asana, TomTom and many others are selecting DataSet to unlock the power of their own data with speed, scalability and technology-driven cost advantages. Our platform approach is resonating and is contributing meaningfully to our financial performance. Endpoint continues to fuel the company's growth. At the same time, we're seeing outstanding traction with our adjacent platform technologies and capabilities. Over 1/3 of our fourth quarter new business was driven by our Singularity modules and DataSet, up from about 20% a year ago. Across all of our capabilities, our cloud workload protection and data retention modules have been the most outstanding, each delivering year-over-year ACV growth of over 10x. Let me spend a second on cloud security. This is one of the fastest-growing markets in security today, and we're already doing extremely well on this front. Demand for our cloud workload protection solution has been broad-based, both within our installed base as well as with new customers. Cloud security represents a sizable opportunity for SentinelOne for years to come. And today, we are further expanding our addressable market and extending our XDR platform capabilities with our planned strategic acquisition of Attivo Networks. We're adding another growth vector to our platform. Identity now joins endpoint, cloud, IoT and data. I couldn't be more excited to introduce everyone to Attivo. Attivo aligns with the M&A strategy we previously outlined. First, it expands our addressable market into a $4 billion and growing identity TAM. And within that, Attivo is capturing share, growing its ARR north of 50%. Second, user-centric identity protection is highly complementary and value-add for our XDR platform and customers. It opens new customer and cross-sell opportunities. Finally, it has a compelling financial profile and strong cultural fit, additive to our hypergrowth and accretive to gross margins. Identity is a critical component of the enterprise parameter and zero trust framework. Attivo's market-leading identity offerings help organizations keep passwords safe, admin privileges restricted and user identity intact. Attivo Networks has the right technology and the team to advance our portfolio and is a natural extension of our Singularity XDR platform and go-to-market strategy. Misused credentials are now one of the top techniques used in breaches. If an attacker can compromise the endpoint, they will often look for the next layer of vulnerability, the user's credential. If successful, attackers can install backdoors, exfiltrate data and change security policies. Attivo, as part of SentinelOne, will help organizations reduce their attack surface not only at the device level but now at the human identity level, too. Attivo has a clear product market fit with an established customer and revenue base. Its differentiated and battle-tested solution is already trusted by over 300 customers from Fortune 500 enterprises to government entities. Attivo is not just any identity company or technology. We strongly believe that it's the best and most comprehensive identity security platform in the market today. Let me briefly introduce you to the 3 parts of the Attivo platform. First, identity protection is an agent-based solution that secures credentials and detects malicious identity behaviors. It delivers real-time protection against credential theft, privilege escalation, lateral movement and more. Second is identity infrastructure assessment, identity-based vulnerability scanning and management for enterprise infrastructure. Attivo's scanner provides instant visibility of active directory misconfigurations, suspicious password changes and unauthorized access. This complements our Ranger network asset visibility and control capabilities and now folds in a user-centric identity view. Third, identity power deception. Attivo's deception solution make attackers reveal themselves, their methods and targets through misdirection. This sums up to a multi-layered approach and a broad set of capabilities to fend off, not just detect, identity-based attacks. Attivo will put us front and center in the identity security market. As Dave will discuss later financially, even in the early stages of a joint go-to-market, this acquisition will add to our hypergrowth trajectory. I'd like to share a few closing thoughts. There has never been a greater enterprise need for a modern cybersecurity platform, which means a tremendous business opportunity for SentinelOne's world-class autonomous protection. We are still in the early innings of our innovation and growth. Our outstanding fourth quarter and fiscal '22 financial performance speak for itself, triple-digit revenue and ARR growth paired with double-digit non-GAAP margin expansion. We're perfectly positioned for continued success and expansion of our business even in times of global uncertainty. Our growth journey continues, and I want to thank all customers, Sentinels and partners for making all this possible. With that, I will turn the call over to Nick Warner, our Chief Operating Officer.

Thank you, Tomer, and welcome, everyone. We delivered an outstanding fourth quarter across every geography, driven by our go-to-market flywheel of sales, marketing, channel and technology partners. More large enterprises are selecting SentinelOne than ever before because of our industry-leading efficacy, automation, ease of use and differentiated XDR capabilities. I'm also excited to welcome the Attivo team. Listening to customers and following many of the largest incidents in cybersecurity over the past few years, identity is a critical vector in delivering the most complete XDR platform. Not only is it a natural fit within our platform. It will complement our network of strategic service providers extremely well. In Q4, we reported impressive ARR growth of 123%, reaching $292 million. This growth was driven by a healthy mix of new customer additions, renewals and upsells. Our momentum with large enterprises was particularly strong this quarter. We added a record number of customers with ARR over $100,000 and a record number of million dollar-plus ARR customers. All of this is extraordinary and reflects the success of our sales and marketing organizations. Let me share more on this. Our customers with ARR over $100,000 grew 137% year-over-year to 520. And let me give you an example. In Q4, we closed the largest new customer deal in our history with one of the most influential and leading global Internet companies. This win came after an intensive evaluation process, including other next-gen security providers. I'd like to highlight one additional win, which is emblematic of what we're seeing in the market. Like most Fortune 500 companies, this enterprise was using multiple operating systems. They lacked true security parity across all surfaces. Their existing next-gen EDR vendor failed to quickly deploy and left critical Mac and Linux attack surfaces unprotected. They terminated their existing 3-year subscription mid-flight and turned to SentinelOne. Singularity XDR deployed instantly across the whole enterprise, which was expedited by our patented Ranger discovery and auto-deploy capabilities. The customer has become a fantastic partner and is benefiting from our true cross-platform feature parity and automation. We also closed new deals with many other large enterprises across verticals from technology to global consumer brands to financial services companies. SentinelOne is winning more market share in every major geography, replacing incumbent vendors of all types and winning against the competition. In total, at the end of fiscal '22, we secured over 6,700 customers comprising both large enterprises and medium-sized businesses. That's total growth of more than 70% or almost 3,000 more customers compared to last year. Our total addressable market is large and expanding. A majority of the market still utilizes legacy antivirus solutions. The competitive environment has not changed. We've maintained incredibly strong win rates in all competitive situations against both legacy and next-gen vendors. What's more exciting is that the opportunity per customer is much larger today than it was for legacy providers in the past. This is because of the breadth of our platform, covering endpoints and surfaces of all types, cloud workloads, Kubernetes, mobile devices and IoT devices and soon, identity. We, once again, achieved strong retention and expansion within our customer base. Our net retention rate of 129% remained extremely healthy and well above our target of over 120%. Our NRR was driven by footprint expansion, cross-sell of adjacent modules and upsell from platform tiers. We continue to prioritize new customer growth, while at the same time, we are seeing massive success in customers consuming more and more of the Singularity platform. Our modules and DataSet now represent over 1/3 of our new business. And once again, this is broad-based and includes everything from cloud and Ranger to managed capabilities and DataSet. Our cloud workload protection and data modules are delivering the highest growth. They each grew over 10x year-over-year, reflecting demand for our best-in-class runtime protection for cloud workloads and unparalleled data retention offerings. I also want to call out our newest endpoint management module, Remote Script Orchestration. RSO has achieved the fastest ramp of any new module in SentinelOne history. Our incident response partners love the ability to remotely manage fleets of endpoints at machine speed in critical breach response moments. Next, I'd like to talk more about our channel partners. Our partner ecosystem continues to magnify our market presence, significantly extending our reach and efficiency. Our strategic technology and services partners have grown to over 20% of our business. This includes MSSPs, MDRs and IR firms. These partnerships are accretive to our overall growth rate with significant business expansion opportunities yet to be unlocked. Let me double-click on the success of our IR partnerships. Over the past year, we focused on partnering with many of the largest and most sophisticated IR providers in the world. In the fourth quarter, Mandiant selected SentinelOne as a global go-to-market partner. We are becoming the partner of choice for leading IR providers, including KPMG, Kroll, Arete and many others. Our strategy brings the best of both worlds to our joint customers, top incident response consultants leveraging the best-in-class XDR platform. I can't stress enough that we don't compete with our partners. We work with over 100 of the world's leading IR firms, enabling us to address a majority of the IR market worldwide. These partnerships create hundreds of high-value and fast-moving opportunities every quarter. This is significantly more coverage than any single vendor could hope to gain on its own. We are also very excited about our growing partnerships with MSSPs. They continue to expand our coverage across large enterprises and mid-market customers. Leading MSSPs are choosing SentinelOne because of our technology leadership, ease of management and multi-tenancy capabilities. Today, we are partnering with top-tier MSSPs, including Enable, ConnectWise, Pax8, AT&T and hundreds of others, many of which exclusively work with SentinelOne. These relationships have helped us achieve significant scale and exposure, complementing our enterprise sales success. Looking at just a few of our top MSSP partners like Enable and Pax8, they represent millions of endpoints now secured by SentinelOne. We're extremely confident about the market opportunity we can jointly address with our MSSP partners as more organizations seek managed solutions. Finally, I'd like to share how we are helping enterprises adopt a zero trust security model by partnering with leading vendors. Our 2-way technology integrations with Zscaler, Mimecast, ServiceNow and many others demonstrate top-tier vendors working together as part of the Singularity ecosystem. This year has been incredible for SentinelOne, filled with innovation and growth. And we began the new fiscal year announcing our plan to add identity to our platform, which further expands SentinelOne's capabilities and offers exciting business opportunities. I'm proud to work with our global team of relentless Sentinels every day. I'm excited about our future. We will continue to deliver on our vision by focusing on execution and listening to our customers. Thank you again for joining us, and let me turn it over to Dave Bernhardt, our CFO.

Nick, Tomer, thank you, and let me also thank everyone for joining us today. I'll discuss our quarterly financial highlights and provide additional context around our guidance for Q1 and full fiscal year 2023. I'll also touch on the financial highlights for Attivo and the full year implications. Afterwards, we will open the call to your questions. We delivered another strong quarter of revenue and ARR growth, both well into the triple digits. We achieved year-over-year revenue growth of 120%, reaching $66 million, and ARR growth of 123%, exceeding $292 million. We added net new ARR of $56 million in the quarter, a new record for the company. We saw strong momentum and a robust demand environment for our platform. The strength of our performance was broad-based, coming from a healthy mix of new customer additions, existing customer renewals and upsells. All of this was further magnified by the strong underlying seasonality of our fourth quarter. Our business expanded nicely across all geographies. Revenue from international markets grew 140% and represented 31% of revenue. Turning to our cost and margins. Our non-GAAP gross margin in Q4 was 66%, reflecting a double-digit increase of 12% year-over-year. We're seeing the benefits from our increasing economies of scale and business expansion, including strong module attach, platform upsell and data processing efficiencies. This was partially offset by the temporary costs we discussed last quarter associated with the migration of existing customers to our DataSet back end. We've made excellent progress on this front. All of our new customers are already using the DataSet back end, plus we've already migrated many of our largest existing customers. These customers are enjoying up to 10x performance improvements. We remain on track for our migration plan, and these temporary duplicative costs should be behind us after the first half of this year. When I put it all together and I look at the Q4 gross margin of 66% and a significant improvement compared to last year, I see increasing evidence of scale and efficiencies of our business. Looking at the rest of our P&L. Our non-GAAP operating margin was negative 66% compared to negative 104% a year ago, a huge improvement of 38 percentage points. And we achieved these impressive results while investing for growth throughout the year, including the IPO, new product launches and doubling of our workforce. This progress towards our long-term financial target demonstrates the potential for leverage throughout our business model. We're investing in our business, which is the right strategy given the huge market opportunity and strong demand for our leading platform. Moving to our guidance for Q1 and the full fiscal year '23. In Q1, we expect revenue of $74 million to $75 million, reflecting annual growth of 99% at the midpoint. For the full year, we expect revenue of $366 million to $370 million, reflecting annual growth of 80% at the midpoint. While we don't specifically guide for ARR, I do want to remind you that we are a subscription business. Our ARR and revenue growth track very closely. Our revenue guidance for Q1 implies that we should be at or better than typical Q1 net new ARR seasonality, which has been down between 25% to 35% sequentially in the past 2 years. We believe the structural tailwinds of digital transformation, hybrid work environment and an evolving threat landscape will continue to drive customer adoption of our real-time AI-powered security platform. The threat landscape is more complex and elevated than ever before, and our product innovation, brand recognition and scaling go-to-market have positioned us well to capture the favorable opportunities. For Q1, we expect non-GAAP gross margin to be between 63% to 64% and full year non-GAAP gross margin to be between 65% to 67%. Our Q1 guidance implies over 10 percentage points year-over-year gross margin expansion at the midpoint. We expect to continue benefiting from increasing scale and better data processing efficiencies. Our guidance also reflects the migration of our remaining existing customers to DataSet, which, once again, we expect will conclude in the first half of the year. As a reminder, these costs are temporary. Based on our full year guidance, we see the opportunity to achieve high 60% gross margins by year-end. Finally, for non-GAAP operating margin, we expect negative 84% to 86% in Q1 and negative 55% to 60% for the full year. Both of these represent meaningful year-over-year improvements. At the midpoint, we expect Q1 operating margin to improve over 40 percentage points and full year operating margin to improve over 25 percentage points. We see tremendous opportunity for growth, and the investments we're making today will put us in a position to succeed for the long term. And we're doing this as we make progress towards profitability and our long-term target EBIT margin of 20%-plus. Before I close, let me share the key financial points related to Attivo. This should help you as you think through modeling the business for the future. We're acquiring Attivo for $617 million in a combination of cash and stock plus additional retention. We expect the deal to close in our fiscal second quarter, subject to customary closing conditions, including regulatory approval. I want to be clear, Attivo is not currently factored into our fiscal '23 guidance at this time. We expect to incorporate their financials into our outlook after the deal closes on our next earnings call. Attivo is an excellent business that can become even stronger as part of our Singularity platform. They concluded their quarter ended December '21 with over 300 customers and ARR of approximately $30 million, growing north of 50%. For calendar year '22, the current forecast for the business is to deliver revenue of approximately $40 million for the full year. And from a margin standpoint, Attivo is accretive to our organic gross margins. But remember, as we expect this to close during our second fiscal quarter, we would incorporate only a portion of that. Attivo and SentinelOne are highly complementary solutions that will open up new customer and cross-sell opportunities, further addressing the needs of larger enterprises. I want to join Tomer, Nick and all of SentinelOne in welcoming the Attivo team. In summary, Q4 was another excellent quarter with strong execution company-wide, and we're expecting that momentum to continue into the next fiscal year. Thank you all for attending our earnings call. We can now take questions. Operator, can you please open up the line? Thank you.

[Operator Instructions]. The first question is from the line of Brian Essex with Goldman Sachs.

Congrats on a solid quarter. Really nice set of results. So if I'm keeping it to one question, I guess I'll keep it to a rather upfront and obvious one. I guess, Dave, if you could help us understand, I know you're not giving explicit guidance around operating margin impact of Attivo. It's nice to see it will be accretive to gross margins. But how should we think about how you anticipate the impact that's going to have on your model, both this year and next year as maybe it gets a little bit of scale on top of your platform?

Sure. So obviously, we have stated that it is accretive to our gross margin. From an operating margin standpoint, I think this current year, while we take into account our expected integration costs, the margin profile will be very similar to ours. If you take out those costs on a go-forward basis, it would be accretive to ours on an operating margin basis. And we'll have that guidance, obviously, when we specifically guide next quarter.

Got it. Is there a way to think about the overall accretion and overlap on your platform and how that maybe accelerated as you kind of integrate it with your platform?

Yes. I mean on a combined basis, we've got plenty of opportunities to scale, both operationally and with our products as we have this in the go-to-market. It really doesn't change our long-term margin targets right now, but we will have better guidance as we complete the transaction.

The next question is from the line of Gray Powell with BTIG.

I know it's probably a little bit early, but what kind of upsell are you expecting identity security to be relative to your typical customers' core EDR build?

Nick, go ahead.

I think what we're going to see is broad-based demand, especially across our enterprise customers. And as you folks know, enterprise business is our largest part of our revenue contribution. In addition, it's growing even faster than our overall growth rates. So the demand is going to be high, and it's only going to get higher.

Yes. Maybe one small thing to add to that. We've been partnering with Attivo more than a year now, so we kind of see already the demand that's being generated jointly by the companies. So that just gives us a lot of confidence in our ability to go ahead and really make it an incredibly successful module for us.

I think the one last thing I would mention as well is we've seen an incredible level of interest from our incident response partnerships. And I think we're going to experience a ton of demand coming out of that motion as well.

Got it. That's really helpful. And then just one quick follow-up. If I look at your sales and marketing efficiencies, they improved every quarter this year. What's driving that? And how should we think about the potential for additional gains in fiscal '23?

Well, I think first and foremost, it's getting the right operational pieces in place over the last several quarters, which we worked really hard on in terms of onboarding, training, enablement. But that also extends out to our partner ecosystem as well because a new sales rep is going to be a lot more productive when they're dropped in a region that has mature, veteran, up-to-speed partnerships in place. And that's the state of the union today with our go-to-market.

The next question is from the line of Patrick Colville with Deutsche Bank.

Let me echo the congrats of others on closing out a great first year. Just on Attivo, I mean, I met with the company quite a few times. And their messaging to me is much more on deception and kind of honeypots and full slags and kind of that domain. What you've been kind of mentioning to us today is much more about identity. So just trying to understand, has the business shifted quite a lot recently to kind of more focus more on identity? Is that how you're kind of trying to pivot the business? Just help me understand kind of that aspect and whether, I guess, deception is going to be part of the kind of go forward with Attivo.

Yes, yes. It's a good question. And the business definitely shifted significantly in the past few quarters. They expanded what they're doing. And they really leveraged their expertise in understanding Active Directory structure, which is really the vote for our identity to build complete new offerings, which are now -- if you look at the revenue mix, are the fastest growing and are definitely showing the biggest traction that they have as a company. It's kind of a threefold type of product portfolio today between what we define as kind of legacy deception, which is still very much needed in today's world, especially as we focus on preventing lateral movement that is not always machine-driven but more user-driven, but then on top of that, the ability to assess risk within Active Directory not just on a go-forward basis but also on a look-back basis, allow you to eliminate configuration mismatches or any type of vulnerabilities you already have preexisting in your environment. That becomes a big deal for customers out there today with the sheer complexity of managing identities in kind of on-prem situations. But then the entire identity protection layer, credential protection, all of that, these are new modules that they have built over the last few quarters and are showing meaningful traction for that company. So to us, it's just a great multi-layered approach that really addresses in the most comprehensive way today everything in and around identity. And we feel it's just a great way for our customers to reduce risk once again in the most profound way that you can when you're looking at the user perspective, including insider threat, which is, to us, maybe an overlooked part of what's happening today in the enterprise landscape, but remains a big pain point for enterprises today.

The next question is from the line of Fatima Boolani with Citi.

This is Mark on for Fatima. Maybe just a quick one on Attivo as well. On the -- I guess like going forward, how do you expect Attivo to be sold? Should we think about this as a feature or a new modular capability similar to the ones we've seen with cloud security and IoT SKUs? Or should we expect, I guess, like a different approach here?

Yes. I mean I think what you're seeing in our business is also a complete shift to really platform selling. So when you look at our cloud portion, it's a complete separate module or module package. Identity will be the same. It's basically an identity suite of capabilities. It will be sold on top of the platform. So it will be included in any bundle. To us, I mean, that's the way that we today see success with our existing modules. Like RSO as an example, it's a complete endpoint management suite, cloud suite and our identity suite. To us, I mean, it's just -- it's a great way to re-expand what we do, but at the same time, make sure that we're not just continuing and selling just one core endpoint -- or into just one core endpoint TAM, but with every sale, we expand across TAMs.

The next question is from the line of Saket Kalia with Barclays.

Okay. Great. Tomer, maybe for you, just maybe zeroing in on the core endpoint part of the business. Can you just talk a little bit about how the base looked at the end of the year just around across different Singularity bundles, Core, Control and Complete? And maybe talk to us how you think about that mix sort of going forward. Does that make sense?

Yes, yes. Absolutely. And I think in kind of a quick follow-up to what I just said, we've really shifted in the past couple of quarters to more of kind of an overarching platform selling approach, which really means that we're really focused on just selling Complete right now. It's kind of the one and only package you can buy at the enterprise level. And then on top of that, the expansion modules that we've built to date, both towards surfaces, data retention and now obviously identify in the user perspective. So to us, Complete really becomes kind of the base of what we sell to the enterprise market. I think it accounts for about 75% of our enterprise sales to date. The vast majority of what we don't sell -- where we don't sell Complete is really through the MSSP channel and in other parts of the market that might not need the fully fledged functionality that comes with our Complete package. But definitely, going forward, the focus here is selling Complete as the base package for our platform and then on top of that, the expansion modules, the expansion suite that, again, today span cloud, IoT, data and with Attivo identity as well.

And I think all of that really is against the backdrop of our growing success in the enterprise. And when we're selling into the enterprise, they're buying more products, more modules.

The next question is from the line of Trevor Walsh with JMP Securities.

Maybe best for Dave. I was wondering if you could speak a little bit to net customer adds on a quarter-over-quarter basis. It looks like from what I'm seeing, around 500 to 700, 700 kind of being kind of more recent record of a net add within any given quarter. Is that kind of how you would expect it to kind of go in this -- throughout this year and into next? Or do you have kind of plans from either kind of how your go-to-market teams are getting segmented, et cetera, to maybe boost that number up considerably? And if you could just provide some color on that, that would be great.

Well, you're right. Q4 was a record quarter, and it wasn't just a record quarter for a number of customers added. It's a record quarter for ARR per customer. It was a record quarter for customers over $100,000 in ARR. It was a record quarter for customers over $1 million in ARR. And lastly, it was also a record quarter for module contribution. So we are seeing absolute positive momentum in the business, and we expect that to continue.

The next question is from the line of Hamza Fodderwala with Morgan Stanley.

I had a question on DataSet for Tomer and for Nick. Tomer, if you could just talk a little bit about how the pipeline is trending for that DataSet product? I know you rebranded it recently off the acquisition of Scalyr. And to what extent this is a one-to-one replacement for some of the existing SIEM and logging solutions out there? And then for Nick, how are you thinking about building the go-to-market engine for DataSet? Is this something that you see that can be sold separate from the Singularity platform? And how are you ramping the reps around that sales motion?

Yes. So again, a record quarter pipeline for DataSet. I mean obviously, in the back of the launch, I mean, it just generated a lot of customer interest. But at the same time, I think what's important to understand is that when you're talking about the DataSet brand, we're really more addressing the known security use cases. Where you find the SIEM replacement opportunities, to us, this is going to come on the back of Singularity XDR. DataSet is the backbone technology behind the scenes for Singularity XDR. But our way to address security use cases is with Singularity, with the Singularity brand, with the SentinelOne brand and with XDR. So head-to-head SIEM replacements, these are ones that we're addressing with our XDR platform. When you talk about logging platforms, search capabilities, real-time event data monitoring, that's what we do with DataSet, and that's where we're seeing a ton of traction right now. So to us, DataSet is really focused on addressing all use cases above and beyond security. And we're leaving the SIEM replacements to our XDR approach, which we truly believe is just the next incarnation of the SIEM. It's much more of an active solution to aggregate security events. We're going to be opening up ingestion at scale from every product that you have in your enterprise ecosystem and into the XDR platform. So XDR is the answer for SIEM. DataSet is our ability to now go and expand on the foundation that Scalyr was built upon and really tailor not into just logging environment and production environment but also even business data, where we see some of our existing customers are ingesting unstructured data from every source, not only production, not only logging, and are deriving insights from the data that they put into the platform.

And our go-to-market data set is really twofold. We have a specialized sales force for data analytics, but we've also incented our entire sales force to be able to cross-sell DataSet. And this approach is working great. In Q4, we closed large 7-figure deals like a new business deal with Copart. And then we also grew customers like DoorDash well into the 7 figures from an ARR perspective.

Maybe if I could just follow up, Nick. Are these being sold to different buyers almost? Because it seems like data and analytics on the DataSet side is an almost entirely different use case versus secure. So are you selling them both to the CISO? Or is one being sold to maybe another part of the organization?

We're selling into the CIO.

The next question is from the line of Rob Owens with Piper Sandler.

I was wondering if you could unpack some of the trends you're seeing in your sales and marketing line, which has been somewhat flattish over the last couple of quarters relative to forward thinking around capacity additions, where you're at and what a return to office might look like for that line.

I can start a bit from the financial standpoint. I think what we're seeing is we're just continuing to see more efficiencies and productivity gains. When I think about the time of marketing expense, obviously, with it being our IPO year, they were more heavily weighted to the front of the year. We're continuing to invest in sales and marketing to support the growth of the business. And this was -- the past year has been a huge year of growth for us, whether it's the IPO, the meaningful jump in scale, the growth of the platform or just bringing us a little further up in the mindset of buyers. This has just been a really important year for SentinelOne. And Nick, I don't know if you want to expand a bit just in terms of how the sales force is -- how they're ramping.

Well, we doubled our sales force last year. We're going to continue to aggressively hire as we get into the end of the year. As I mentioned before, we're really pleased with the productivity and performance of our teams. And again, I want to stress again, so much of that is a benefit of our channel ecosystem. And so what we have out there is the ability to punch well above our weight. Instead of having a few hundred sellers out there, we have thousands of sellers out there that are interacting at all different life cycle stages and parts of the organization. So when I -- the question I just answered around DataSet, that's a conversation with the CIO. That really up-levels our brand and visibility outside of just having CISO conversations. So when you think about scaling and building out a team, what they're inheriting now is a great brand, incredible momentum and a huge channel ecosystem. And what that makes us really confident about is forward hiring, increasing our scale and capacity and being able to do so very successfully.

Yes. Just a quick add to that. Like a great way to look at that is our magic number, and it's been over 1, and it's continuing to expand. So to us, I mean, we obviously track efficiently very, very closely, and we're very pleased with the progression. That gives us more confidence to kind of continue and scale the business, of course. Couple that with win rates that are consistently strong, and you just get a good recipe for growth.

The next question is from the line of Roger Boyd with UBS Securities.

Just a comment on the partner channel. You noted 20% cost of business now coming through. Given the success you're seeing here and the work you've done in the last 18 months to go and partner with the largest ones, how big could this get as a percent of your business? And as you continue to add end users through these partners, how are you thinking about customer additions in fiscal '23 versus the 3,000 you added in fiscal '22?

I mean I think the growth environment on the partner side is really unbounded. If you think about what we've done, it's not just partnering with security resellers. If you think about partnering with MDRs, with MSSPs, with incident response partners, each on their own, those macro ecosystems are growing massively, especially if you look at the MDR and MSSP space. So as we're growing and adding more of those partners, their own business is really growing super rapidly. And that's why if you see contribution, it's accelerating, and it will continue to accelerate. And I think what really is great about it is it just gives us exposure to a broad set of customers, especially with MSSPs that we wouldn't normally touch. And so we're doing all those things. And then in addition, we are continuing to totally focus on enterprise selling. And so selling that platform motion, selling modules, totally focusing on selling Complete into enterprise customers with this amazing collection of modules that we have as well. And that's why, frankly, we're so excited about the Attivo acquisition. We feel like it gives us several more important arrows in our quiver that we can go out and execute against.

The next question is from the line of Brent Thill with Jefferies.

Tomer, you guys mentioned your large customers are growing 2x your smaller customers. Many are asking what's easing the enterprise friction for you going forward.

I think it's a combination of things, right? I mean I think I wouldn't -- I'd be remiss if I didn't say our brand and our ability to show incredibly well every time the platform is put to the test. I think that's a big driver for us. I think our Ranger capability, which you might look at just a capability, but it also allows for rapid deployment, and it allows for discovery of more surfaces in the enterprise. And that just speaks to the simplicity of use that our platform really carries. If you take that with the ability to join these enterprises in their journey to the cloud with a best-of-breed runtime protection, we're becoming really a one-stop shop for a lot of these enterprises to look at every surface that they currently have. And I think that just unlocks more and more traction for us. If you kind of look even at our data capabilities, once again, the ability to provide up to a year of data retention out of the box, no customization, just something that you tick off is something that is unique to us in this space. And I think that a lot of the large enterprises out there are looking at that because otherwise, if they're going with a different EDR vendor, they suddenly need to figure how are they going to retain data on the back of maybe a different platform. And that's sometimes going to be just incredibly costly. With us, it comes on the back of a single platform. It's the benefit of DataSet that is now the back end of our entire XDR platform. So obviously, I mean, that is becoming something that's very, very tempting to a lot of enterprises there to solve both for security but also for data and log retention in one fell swoop.

The next question is from the line of Andrew Nowinski with Wells Fargo.

Can you give us any color on that large deal that you mentioned that was the largest in company history? And was there any significant pricing pressure on that deal and whether we should normalize for that deal when we think about billings growth for Q4 of this year?

Yes. I mean I don't think it's something that we think is completely out of whack in many regards. I mean we do have the pipeline that shows that our large new progression is here to stay, and it's going to expand and hopefully be more meaningful if you kind of progress towards the next quarters. All in all, we think it's just a great win for us. No notable pricing pressure outside of the obvious competitive environment. So to us, it's just another great indicator for our ability to just progress upwards and upwards in our large deal velocity trajectory.

The next question is from the line of Joshua Tilton with Wolfe Research.

Just a quick one for me. On the gross margin guidance, would it be possible to kind of give us a sense of what it would have been if you were not digesting costs associated with migrating customers to DataSet in the first half of the year?

Yes. I mean in the past, we've said it was around 4% so I would say it's in that ballpark. When I think about what it would be if we weren't having a duplicative cost, we're expecting this to continue through the first half of the year. And then obviously, it's going to dissipate over that time. But we expect that the rest of customers will be migrated by the end of Q2. I think you'll see the continued scale on us. As we're looking at how we're going to exit the year, if you look at what our guidance is with these suppressed margins in the first half, I think what your -- what you could perceive from that is that we'd be in the high 60s by year-end.

The next question is from the line of Rudy Kessinger with D.A. Davidson.

On Attivo, it would appear the customer base certainly much more tilted towards enterprise customers, ARR per customer a bit over double your guys'. How much customer overlap is there? And what kind of opportunities do you have within the Attivo customer base to cross-sell your solutions into those enterprise customers?

There's some overlap, but it's actually quite small. And so that is an incredibly compelling cross-sell opportunity because what's also even more rare is that there isn't much overlap, but we're ultimately trying to solve the same problems together as a joint solution. And we're still selling into the same parts of the organization, especially as it's focused around security. So when you think about the Attivo customer base, it's dozens of Fortune 500, several Fortune 10s, really great customers like Aflac and others and a real strength in federal and public sector and also a real strength in the Middle East as well. And so these are all areas that are going to be highly complementary to our existing business.

That concludes the question-and-answer session, so I will pass the conference over to the management team for any closing remarks.

Thanks, everybody. We appreciate your time and attention today and looking forward to the next one. Thank you.

That concludes today's conference call. Thank you for your participation. You may now disconnect your lines.