SentinelOne, Inc. (S) Q2 2023 Earnings Report, Transcript and Summary

Good afternoon. Thank you for attending today's SentinelOne Q2 Fiscal Year 2023 Earnings Conference Call. My name is Hannah, and I will be your moderator for today's call. All lines will be muted during the presentation portion of the call, with an opportunity for questions-and-answers at the end. [Operator Instructions] I would now like to pass the conference over to our host, Doug Clark, Vice President of Investor Relations. Please go ahead.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the second quarter of fiscal year 2023 ended July 31. With us today are Tomer Weingarten, CEO; Nick Warner, President of Security; and Dave Bernhardt, CFO. Our press release and shareholder letter were issued earlier today and are posted on our website. This call is being broadcast live via webcast. And following the call, an audio replay will be available on the Investor Relations section of our website. I would like to remind you that during today's call, we'll be making forward-looking statements regarding future events and financial performance, including our guidance for the third fiscal quarter and full fiscal year 2023, as well as certain long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us, and that actual events or results could differ materially. Please refer to the documents we file from time-to-time with the SEC, in particular, our annual report for Form 10-K and our quarterly reports on Form 10-Q, including our filings for Q2. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is being replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons actual results could differ materially from those anticipated in the forward-looking statements even if new information becomes available in the future. During this call, unless otherwise stated, we will discuss non-GAAP financial measures. These non-GAAP financial measures are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of the GAAP and non-GAAP results is provided in today's press release and in our shareholder letter. And with that, let me turn it over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fiscal second quarter earnings call. I am pleased to share that, we delivered another excellent quarterly performance, exceeding our expectations across the board. We delivered our sixth consecutive quarter of triple-digit growth, set new customer growth records and continue to push the boundaries of autonomous security through innovation. Our results demonstrate strong execution against our strategy and success in delivering hyper growth with substantial margin improvement. As always, please read our shareholder letter published on the Investor Relations website, which provides a lot more detail. On today's call, I'll focus on two key areas: one, details of our quarterly performance, including customer growth and expansion as well as execution against our strategy; and two, an update on the demand environment and how we're optimally positioned to help enterprises with our autonomous XDR platform. Let's turn the discussion to our performance. We once again delivered substantial revenue and ARR growth, both grew over 120% year-over-year, driven by strong demand for our XDR platform across endpoint, cloud and identity. We outperformed all of our expectations in the quarter through strong focus on execution, platform innovation and our partner-friendly go-to-market strategy. Looking forward, we're raising our full year revenue growth guidance to 103% from prior 98%. We're combining this rapid growth with meaningful margin improvement, showcasing strong unit economics and operational efficiencies. We exceeded Rule of 60 in the quarter. Our gross margin expanded by 10 percentage points year-over-year and reached a new high of 72%. Our operating margin improved 42 percentage points compared to just a year ago. Our extraordinary performance reflects increasing scale and leverage in our business model. We expect to achieve the Rule of 40 for the full year and are making meaningful progress towards profitability. For customer growth and retention, our land and expand strategy is reaching new heights. In the second quarter, we once again added a record number of new customers on an organic basis, and we're excited to engage with hundreds of additional Attivo customers. On top of this, our net retention rate reached a new record of 137%. We're seeing outsized growth from our strategic channel partners as well as many of our expansion modules. We're protecting a growing number of the world's largest organizations. Among new customers, we secured an eight-figure multiyear deal, the largest new customer contract in SentinelOne's history. This multinational industrial company wanted to consolidate legacy products and selected a broad range of our Singularity platform capabilities from endpoint and cloud protection to modules such as Ranger data retention, NDR services and others. Singularity XDR clearly stood out among all evaluated vendors for leading efficacy, automation and ease of use. This is a great example of our large enterprises are selecting more of the SentinelOne platform, translating into larger deals and higher ARR per customer. As an example of expansion with existing customers, a major American retail chain significantly expanded its endpoint and cloud footprint by fully replacing Microsoft cybersecurity products. This customer preferred the full deployment of SentinelOne's Unified XDR platform instead of needing to manage multiple consoles and disjointed products. These examples demonstrate how our differentiated AI-based autonomous cybersecurity platform is becoming the solution of choice for enterprises around the world. We remain in a position of competitive strength and maintained extremely high win rates across all the competition. Turning to our platform capabilities beyond the endpoint. We're seeing strong growth and customer adoption of our expanding platform. We're still in the early innings, and our platform approach should continue to fuel growth for years to come. Singularity Cloud remained our fastest-growing solution in Q2, followed by data retention and Ranger. Let me dig deeper into cloud security, where we're seeing tremendous demand for our best-of-breed cloud run time protection. Enterprises are rapidly shifting workloads to the cloud, creating an emerging yet critical attack surface and therefore, a significant greenfield opportunity for protection. Cloud-native companies, in particular, are choosing Singularity cloud. We're even being selected in situations where the incumbent endpoint coverage may be from our closest competitors. Let me provide two examples. A new customer, a leader in global ride-hailing, selected Singularity cloud despite having deployed a competitive next-gen EDR solution under endpoint footprint reinforcing the superiority of our cloud architecture workload protection. We closed the deal to the AWS Marketplace, which is opening new opportunities for growth. We see meaningful expansion potential with the customer, making cloud multiple times larger than the endpoint opportunity. This is frequently the case with cloud-native companies. Next, an example of an existing customer expansion. A global e-commerce giant, more than doubled the size of its cloud security coverage just one quarter after its initial deployment. There remains significant expansion potential beyond this. Our momentum in cloud security is strong, and we're encouraged by the early adoption from cloud-native enterprises and our strong competitive position. Shifting gears to innovation and platform breadth. I'm pleased to say that we've completed the integration and customer migration to the DataSet back end. We're now delivering a one-of-a-kind unified XDR platform, offering a seamless experience from the back end to the user interface. This is a significant milestone and an important competitive differentiator for a few reasons. First, we have a single unified platform. We stand out from the crowd for being the only cybersecurity vendor that covers the essential attack surfaces of endpoint cloud and identity, powered by our proprietary data ingestion and analytics technology. That means an even more powerful user experience with complete security visibility across the enterprise all in one place. Second, our platform is purpose-built to process all types of data at significant scale. We're living in the petabyte era and data processing at scale is a must-have. Our Singularity platform is already running multiple petabytes of data every day in a live environment, while other vendors can merely handle a fraction of such scale in test or benchmark scenarios. Finally, we offer unmatched data retention capabilities. Enterprises need to cost effectively retain an increasing amount of data for long periods. We're helping them reduce operational and storage costs, while maintaining access to critical information. In the past quarter, we've announced transformative innovations like XDR Inject, Skylight and the new process craft visualization. With these new capabilities, we continue to lead the XDR experience, consolidating data and security actions into a single platform with a single period language and hunting interface. Moving on, we completed the acquisition of Attivo in May. By adding Attivo's comprehensive identity security capabilities to our platform, we're now protecting customers both at the device and end user level. Identity is one of the critical attack surfaces commonly leveraged by bad actors to breach enterprises. Attivo puts us in the front row of the identity security market and helps enterprises adopt a holistic Zero Trust strategy. We're delivering on our mission to autonomously protect customers by harnessing the power of data analytics, machine learning and artificial intelligence. The market opportunity in front of us remains massive across endpoint, cloud and identity, as well as security data analytics. We're investing in our technology, people and strategic partnerships. We remain agile and our balanced approach is continuing to drive high growth in progress towards profitability. Let's turn the discussion to the demand environment for our XDR platform and the trends we're seeing in our market. Cybersecurity remains a top priority for enterprise IT spending, a must-buy for all enterprises. We're encouraged by the broad-based strength across customers, geographies and capabilities in Q2. Our pipeline does sequentially, reinforcing our conviction around the vast future opportunity. Demand is strong, and we remain extremely well positioned. At the same time, enterprises across all sectors of the economy are being impacted in different ways by evolving macro conditions. Like other software companies, we've seen some signs of cost consciousness and prudence around IT budgets. This has resulted in marginally longer sales cycle and more budgetary approvals. The impact has been quite modest so far. The risks of not being protected by a leading security solution are too costly. Through XDR, we deliver what customers need the most, best-in-class protection and superior platform value. Our platform delivers leading efficacy, speed and scale superior to legacy incumbents and competitors alike. We've led the MITRE ATT&CK evaluation for years, and we further enhance our EDR platform with a unified proprietary data back end. We envision cybersecurity to be a catalyst for product consolidation, attack surface reduction and operational efficiency. We're enabling advertisers to do more than ever before through automation and data analytics, while driving down operational costs. In closing, there has never been a greater enterprise need for a modern cybersecurity platform like Singularity XDR, which means a tremendous business opportunity ahead. Our growth journey continues. I want to thank both Sentinel's customers and partners. SentinelOne remains well positioned for continued success and market share expansion even in today's economic environment. Our outstanding performance speaks for itself, triple-digit revenue and ARR growth paired with double-digit margin expansion. With that, I will turn the call over to Nick Warner, President of Security.

Thank you, Tomer, and welcome, everyone. Our go-to-market flywheel of sales, marketing and channel partners resulted in record quarterly performance across the board. In the second quarter, we set a new organic customer growth record by adding over 750 customers in addition to over 350 customers from the acquisition of Attivo, bringing total customer adds to over 1,100. Today, we are protecting over 8,600 customers around the globe. Our momentum with large enterprises continues to be a bright spot. Our customers with ARR over $100,000 grew 117% year-over-year to 755, much faster than our total customer count. Our strength was balanced across geographies. We're seeing strong momentum as we expand our presence and brand in international markets. As an example, among many international deals, we closed one of the largest telecommunications companies in Asia Pacific, another platform win spanning endpoint, cloud, data, Ranger and other capabilities. Beyond rapidly adding new customers, we're seeing strong retention and expansion within our customer base. Our net retention rate reached 137% this quarter, a new record for SentinelOne. Our NRR was driven by significant subscription expansion, especially from our channel ecosystem and cross-sell of adjacent solutions. We continue to balance customer growth with cross-selling new capabilities, a strategy for long-term success. Let's talk more about our partner ecosystem achievements. We've cultivated an extensive and diverse network of channel partners that's unlocking meaningful scale, reach and strengthening our market position. We're both adding new partners and enabling more of our existing partners to deploy the full breadth of our expanding Singularity XDR platform. Digging deeper into our strategic partnerships, with incident response providers and MSSPs. Our growing network of IR partners engaged with a record number of new breaches in the second quarter. These partnerships continue to create high-value and fast-moving opportunities every quarter. Shifting to MSSPs. Enterprises are increasingly turning to strategic partners to address talent shortages and improve their security posture. Our partners and customers want automated solutions that reduce reliance on human intensive processes. We've designed a differentiated architecture that makes us a partner of choice for MSSPs across the globe, such as multi-tenancy, fully customizable role-based access control and a full set of open and documented APIs. In Q2, our partner supported go-to-market model helped us achieve record customer additions and NRR. As an example, our MSSP partners are rapidly adding subscriptions and are just beginning to deploy many of our modules. We don't compete with our partners. We enable them to win with our Singularity XDR. Finally, let me share updates on Attivo networks. We're making good progress on integrating Attivo's technology and go-to-market. It remains early, but customers and partners are engaged across the entire identity portfolio, including active directory assessment, identity security and threat deception. At the Black Hat security conference in August, nearly every customer and partner conversations indicated interest in Attivo solutions. Also, in one deal example, a large transportation company that selected Singularity XDR also added identity security and Ranger AD to further reduce the risk of credential-based attacks. Securing against identity theft addresses critical enterprise vulnerabilities that are frequently exploited by bad actors. Take the recent Cisco hack, which was yet again traced to credential theft. Since the breach occurred, we have demonstrated how Attivo's identity security could have prevented this breach. This is a clear example of how important identity security is for all enterprises. We remain focused on execution and listening to our customers and partners. I'm proud to work with this global team of relentless Sentinels. Thank you again for joining us, and let me turn it over to Dave Bernhardt, our CFO.

Nick, Tomer, thank you. I'll discuss our quarterly financial highlights and provide additional context around our guidance for Q3 and fiscal year 2023. As a reminder, all margins discussed are non-GAAP unless otherwise stated. We once again delivered high growth combined with meaningful margin expansion, showcasing the efficiency of our business model and strong unit economics. We're raising our full year revenue guidance above and beyond our Q2 outperformance, and also increasing our full year gross margin and operating margin expectations. ARR and revenue both grew well into the triple digits. Revenue grew 124% year-over-year, and ARR grew 122% to $439 million. We added net new ARR of $100 million in the quarter. The upside in the quarter was driven by seasonally strong growth from the organic business, which delivered triple-digit year-over-year ARR growth. Our largest ever customer win and strength from our channel ecosystem also elevated our performance. Our financials now incorporate the acquisition of Attivo, which performed in line with our expectations and is on track for our full year ARR target of $45 million or more. We do not intend to break out Attivo financials going forward as it becomes part of our broader platform offering as our identity suite. The strength of our performance is broad-based coming from a healthy mix of new customer additions, existing customer renewals and upsells. I'm extremely pleased that we delivered record customer growth and record expansion rates in the quarter. We're seeing ARR per customer rise, reflecting our success with large enterprises and the adoption of the broader Singularity XDR platform. Turning to our cost and margins. We achieved a meaningful improvement in gross margin, exceeding 70% two quarters earlier than our previous expectation. Our Q2 gross margin increased to 72%. This is tremendous progress. In just the past year, we've improved from a gross margin in the low 60s to over 70%. Our land and expand strategy is working, underscored by our platform unit economics, where we collect data once and enable more and more capabilities. Our Q2 gross margin included a little over one percentage point of onetime benefit from our cloud hosting provider. Most importantly, we're seeing continued benefits from economies of scale, data processing efficiencies and module cross-sell. We completed the migration of our back-end DataSet, which was a meaningful undertaking that we completed in just over a year. I'm extremely proud of our team's focus and delivery on this transformative project. It positions us extremely well in the future of XDR, a unified, scalable and efficient data back end, gives us a significant competitive advantage. And evident by our Q2 gross margin, it's already supporting our path towards our long-term gross margin targets. Looking at the rest of our P&L. We delivered substantial operating margin improvement, expanding 42 percentage point's year-over-year to negative 57%. Our strategy to invest efficiently for growth continues, and it's working well. We're achieving scale, leveraging our channel and globalizing our talent pool. Our Magic number was well over one again, and we exceeded the Rule of 60 for the quarter. Moving to our guidance. We're raising our full year revenue and growth expectations above and beyond our Q2 outperformance. We exited Q2 with our largest ever pipeline and so far, we continue to see strong and durable demand. At the same time, we want to be prudent about the evolving macro environment. These trends can potentially impact sales cycles and IT budgets, though the impact has been modest to date. Cybersecurity remains a top IT priority, and our AI-based autonomous Singularity platform is optimally positioned to deliver enterprise value and superior protection. Taking all that into account, in Q3, we expect revenue of about $111 million, reflecting 98% growth. As a high-growth company, this point guidance reflects our best estimate for the business and should be interpreted as the high end of the range. For the full year, we are raising our revenue outlook to $415 million to $417 million, up $11 million at the midpoint versus our prior guidance. This reflects 103% growth at the midpoint versus 98% previously. While we don't specifically guide for ARR, I do want to provide some context given the uplift we got from incorporating Attivo in Q2. We expect net new ARR in Q3 to be in the high $50 million range. This incorporates the macro factors I just mentioned, which we believe is prudent in this environment. This would bring ARR to nearly $0.5 billion, once again growing in the triple digits. Our guidance reflects our confidence and optimism around cybersecurity demand, as well as our business momentum. Turning to the outlook for margins. We've taken a major step forward as a company, operating above 70% gross margin. We're benefiting from platform data efficiencies inherent in the business model. We expect Q3 gross margin to be about 71%, and we're increasing our full year gross margin guide to 70.5% to 71%. This is up from prior guidance of 69.5% at the midpoint and up about 7% year-over-year. By extension, we currently expect Q4 gross margin to be relatively consistent with Q3 levels. Finally, for operating margin. We expect Q3 operating margin of negative 57%, up 11 points year-over-year. At the same time, we're improving our full year range to negative 58% to 55%, a one point improvement at the midpoint from our prior range. While the timing of expenses can vary from quarter-to-quarter, we're on track to deliver about 30 points of margin improvement for the full year, showcasing pronounced progress towards profitability. Given the vast opportunity in front of us and the structural tailwinds in cybersecurity, our strategy remains to invest in the technology and business. We plan to continue delivering high growth and margin improvement. We have an incredibly strong balance sheet with $1.2 billion in cash and investments, which provides us the flexibility to make quarter-to-quarter investments in the business depending on near- and long-term priorities. In summary, Q2 was another excellent quarter with strong execution company-wide, and we're expecting that momentum to continue. Thank you all for attending our earnings call. We can now take questions. Operator, can you please open up the line? Thank you.

Certainly. [Operator Instructions] The first question is from the line of Roger Boyd with UBS. Please proceed.

Great. Thanks for taking my questions, and congrats on a nice quarter. Maybe just starting with the macro conversation, can you just talk a little bit more in depth about some of the budget scrutiny you're seeing? And then how are you actually factoring that into the guidance? Are you assuming sales cycles stay the same or maybe potentially get worse? And any color on the pipeline and sales efficiency heading into the back half of the year would be great, too? Thanks.

Yeah. I mean, let's start with sales efficiency. I mean we're actually very encouraged. Our magic number is in excess of 1.3, and we think that's just a great result for us. When we look specifically at what we've seen this quarter, more scrutiny, definitely, more build tightening. But at the end of the day, we haven't seen something significantly change in the way that people buy and procure. Even sales cycles that were prolonged were not superbly prolonged. So all in all, we still feel pretty good about demand. I think what you see reflected in our guidance is the level that we feel we need to be conservative and prudent. And all in all, again, things remain incredibly strong.

Great color. Thanks.

Thank you. The next question is from the line of Hamza Fodderwala with Morgan Stanley. Please proceed.

Hey, guys. Thanks for taking my question. Just one from me maybe for Nick. The net retention rate this quarter was really strong. You spoke to a lot about how you're seeing that growing partner pipeline. Can you talk a little bit about how the sales cycles have trended since you've expanded your partner network and really deepened your relationship with those MSSPs? And can you talk a little bit about what the deal sizes for these MSSPs look like relative to perhaps overall SentinelOne?

Sure. Great question. And I think one of the very most exciting things about our business is the incredible demand that we're seeing from MSPs, MSSPs and – investments partners, many of which have become MDRs or managed detect and response providers themselves. And I think there's a couple of fascinating elements to this part of the business. One, it really lets us, in a very efficient way, cover a tremendous part of the market. Two, it absolutely fits amazingly well in today's macro environment where folks are looking to efficiently protect their networks, efficiently protect their data and their users and expand their security prowess without having to make a lot of capital investments. And managed services do exactly that. Third is incredible velocity in terms of deal cycles. And to one part of your question, I think as we've unfolded and allowed deployment of modules within our managed service providers, we're starting to see incredible traction in terms of cross-sell and upsell. And again, we're able to do this in a very efficient way. We have a very capable and global managed service team, but the outsized impact they're having in our business, I think, really speaks to, one, the architectural advantage that we have that has lent itself to real domination in that space from a vendor perspective. And two, the absolute growing macro demand for managed service as it relates to security. So we feel like we're incredibly well positioned in that way.

Thank you very much.

Thank you. The next question is from the line of Joshua Tilton with Wolfe Research. Please proceed.

Hey. This is Patrick on for Josh. I just wanted to dig in a little bit more on the operating margins in the quarter and in the guide as well. You obviously outperformed in the quarter significantly, but this didn't necessarily pass a lot of that on to the guidance. Is that just due to the timing of expenses in the quarter, or was there any impact on the acquisition specifically in 2Q? Just a little more color on that would be great.

Yeah. I think one of the things you'll see in our results this quarter is just due to the market conditions, I think we were really looking at spending that wasn't essential and having some controls over that as we sort of waited to see how the market was going to work its way through Q2. If you look, we increased our guidance for the year or improved our guidance for the year rather. So I think there is some shift between Q2, Q3 expenses or expenses from Q2 into the second half as we felt a bit better about the market conditions. So all in all, I'd encourage you to look at it on a full year basis. We took it from 55% to 60% range, to a range where we've improved 1% at the midpoint. So I would look at it that way. I think we're excited about what we're seeing in terms of the top line. We know that expenses are something we can control, and we're just trying to be prudent around the expenses that we have to make sure we make the right investments at the right time.

Great. Thank you.

Thank you. The next question is from the line of Fatima Boolani with Citi. Please proceed.

Good afternoon. Thank you for taking my questions. Hey, Nick, just for you on the MSSP channel as your route to market, clearly, a very differentiated and robust go-to-market avenue for you. But what I'm curious about is if there's any delineation from a unit economics perspective, between a direct deal that you would sell to an enterprise customer versus a deal that you would sell through an MSSP? And what I'm getting at is, is there sort of a, call it, a wholesale element when you sell large volumes and protectable endpoints in modules along those lines? I hope that's clear, if that makes sense.

Yes. And good question, Fatima. So, I think, it's the -- it's actually the inverse. If you look at the unit economics of our managed service deals, they actually are higher and trending higher than direct deals through channel partners. So there's a couple of reasons for that. One, there is a monthly and quarterly billing, which lends itself to higher PPN; two, there's wrapped-in services; three, it's a relatively captive audience. Typically, they're already on board with either an RMM, remote management platform, or they are getting some other bundled set of services from that provider. And I think a really important and interesting element to this is largely those deals, once we set up these partnerships, they are noncompetitive. So, we become the platform of choice within these managed service partners. And I think the last thing I'd leave you with is from a customer satisfaction perspective, we tend to see a very high customer sat scores for our solution, delivered through third-party managed service providers. And I think, what that really is the way that we've enabled these partners, we've given them the best technology in the market that allows them to shine to their customers.

Appreciate the color. Thank you, Nick.

Thank you. The next question is from the line of Joseph Gallo with Jefferies. Please proceed.

Hey guys, really appreciate the question. Just a quick clarification first. Did you guys give the Attivo ARR number for F 2Q? I realize, it’s going to be the final time you talk about it. And then, also appreciate that it hasn't hit the business yet, but are there any similarities in those extra levels of scrutiny? Is it SMB, enterprise, any geo regions stuff outside of core cyber? Any color there would be appreciated. Thanks.

In terms of ARR, I think we'd said it was going to be around -- was it 35 for the quarter, in general around that. I think the ARR beat, if you're trying to focus on where the significant beat we had was, it was driven from the organic business. I think Attivo, being new to the company, has just performed in line with expectations.

What I would add in terms of levels of scrutiny in the macro environment, what we have seen, back to my commentary around managed services, we've absolutely seen a number of deals that have gone managed service instead of direct, which, again, to the earlier question around unit economics, that's actually a good thing for us. It's also a great thing for our managed service partners. What we're really starting to see is a push upstream from just SMB being the consumers of managed services. As we've gone through an evolution of MDR and other more sophisticated security service providers, we're starting to see small, medium and large enterprises go with a managed service. And so, we've seen from an overall global trend perspective, I think the scrutiny around spend has lent itself to an upsell in that type of business. The only area that we've seen deals get scrutinized heavily as larger deals, but we have not seen any material impact on sales cycles, et cetera. And I think that really speaks to the durability of cybersecurity and the criticality of the type of security that we provide to our customers and partners.

Awesome to hear. Thanks.

Thank you. Next question is from the line of Tal Liani with Bank of America. Please proceed.

Hey. Thanks for taking my question. This is John on for Tal. Can you just please help us understand the momentum and opportunity you're seeing with the Attivo and overall in identity? Was there anything – any meaningful cross-sell in the quarter as well? Thanks.

Yeah. I mean, as Nick mentioned, I mean we're just getting the Attivo integrated into our business, and it's showing great signs of success. I mean, we're building incredible pipe with the Attivo offering. That will be a holistic part of our identity suite. We're seeing the ability to sell into Attivo's account. I mean they've been fairly strong on the Fortune 500 front. That's incredibly promising for us. We're seeing our sellers now talk about identity in pretty much every classic EDR deal that we have. Nick talked about enabling our MSSP ecosystem to now also carry our identity protection offerings. That's a differentiator in itself. So all-in-all, just a lot of promise, especially, as you see the attack landscape really shifting toward more identity bourne attacks. So obviously look at what identity has been throughout the year, it's been through that evolution that started with just protecting users, to protecting credentials, now protecting the overall identity forest in Active Directory or Okta, and Attivo, and people really comes with propositions across all these different fronts. So once again, we're seeing really great pipe building up. We're very encouraged by the ability to now carry Attivo and their offering. As far as the overall EDR suite, it's a great complement. So again, all in all, as we go through the year and into next year, we feel really good about identity security as one of our leading modules.

Got it. Thank you.

Thank you. The next question is from the line of Saket Kalia with Barclays. Please proceed.

Okay. Great. Hey, guys. Thanks for taking my question here as well. Tomer, maybe for you. Great to see the ARR per customer growth and of course, the net retention, I was wondering, if you could just talk a little bit about the Singularity complete bundle. How much of your base has adopted that high-end bundle? And how much opportunity is there still to go out there – out to that base and cross-sell further?

Yeah. I mean, as we kind of said before, the vast majority of people that go on the platform today, they start with Complete. That really becomes our baseline. Even if you look into the estate, Complete is really what we see the most in our installed base. But the ability for us to now go in with additional 15 different modules, that's where the expansion opportunity is. That's where you see our net retention rate really going up. We're incredibly underpenetrated still, even though with 137% net retention rate. So the opportunity is large within our estate. The opportunity is also large with attaching and landing bigger with accounts. If you kind of look at our revenue mix, about 30% of our revenue comes from these adjacent modules. So even through to today, really seeing meaningful traction with cloud, with Ranger, obviously, with identity through the Attivo acquisition, but once again, highly underpenetrated. This is just the first innings for us. We're becoming better and better in really providing the entire portfolio for our entire customer estate. So I'd encourage you again to kind of look at what we have kind of in our portfolio outside of the complete offering. It's a bit misleading. Complete is not fully complete. We got a lot more offering outside of that. And again, if you look at our cloud prospects, I mean it's incredibly promising, and I think we have a lot of room to grow.

Very helpful. Thanks, Tomer.

Thank you. The next question is from the line of Rob Owens with Piper Sandler.

Hey, guys. This is Justin on for Rob. Just wanted to follow-up on commentary around when you guys are running alongside an incumbent endpoint vendor in the cloud. Are you guys typically seeing opportunities to eventually displace that vendor later on in the whole environment, or is the focus on these accounts primarily on the cloud opportunity? Thanks.

Yeah. I mean we're definitely looking at this as almost as kind of a backdoor to the account, right? I mean it allows us to unlock many accounts that might have already went at some point in the past with another endpoint provider. It allows us to really go in on the merits of our cloud protection platform. And then obviously, people are always looking for ways to consolidate further. That opens the door for that endpoint conversation. But to be honest, I mean, when we look at how these cloud opportunities, especially with the cloud-native companies, they're probably 4x, 5x, sometimes 10x the size of the endpoint footprint and the endpoint opportunity. So we don't really feel bad about going in deeper into cloud and we treat the ability to then expand over to the endpoint footprint as more opportunistic. But with that, obviously, it's a strategic vector for us to continue and unlock more and more accounts, both on the cloud side, but also on the endpoint side.

Got it. Thanks, Tomer.

Thank you. The next question is from the line of Andrew Nowinski with Wells Fargo. Please proceed.

Hi. Thanks for taking our questions. This is Justin on for Andrew. Just one quick one for me. If I have my numbers right, it looks like headcount doubled since last year. So I was just wondering if you could talk a little bit about maybe your plans for hiring? Is this the pace that you're expecting to continue at? And especially, how that plays into your expanded partnerships? Thanks.

Yeah. We almost doubled our workforce, and we continue to invest in a balanced way, like Dave mentioned. I mean, obviously, there's still a degree of uncertainty in the market, and we're taking that into consideration. But again, when we see traction, when we see clear ROI on the investments that we're doing, that gives us the conviction that we need to continue and invest, and we'll keep on growing the headcount. Obviously, when you see a company growing triple digit, I mean it can't happen without also investing in the headcount and in the people. So that will continue.

I think I'd remind you too that, that was also a quarter that included the Attivo acquisition. So that was 300-plus employees that we picked up in one shot. So that was a huge accelerator within the quarter.

Thank you. The next question comes from the line of Shaul Eyal with Cowen. Please proceed.

Thank you. Good afternoon. Congrats on results and the improved outlook. Nick or Tomer, when you look at your channel partner, the VAR contribution, are there a handful of partners that maybe stood out during this quarter? Maybe any one partner, any handful of partners that are generating 10%, 15% of total revenue?

We really have a kind of balanced ecosystem of partners. I mean, as Nick mentioned, and I'll let him also give more color. But we really have the VARs on one end, integrators, IR partners, MDRs, MSSPs. So it's a very balanced portfolio of different avenues to market that we leverage. We're absolutely also in the journey of enabling a lot of these partners to not sell their components in our portfolio, but like cloud as an example. So we anticipate even more growth from our partner ecosystem going forward. But to your question, there is no real concentration into one partner. We have a very balanced portfolio of partners across the globe.

What I would add is what we've seen in Q1 and through Q2 is a real acceleration from a couple of very nationally known security resellers in North America, who had previously partnered largely with a couple of other next-gen companies. And I think what's really starting to resonate, even at the national level with large resellers, is how we don't compete with our partners, we enable them. So we don't have competing lines of business. We don't try to compete with them on IR. We don't try to compete with them as it relates to MSP and MSSP. And that matters, and that really matters in a world where resellers are really looking to then subsequently manage many of the products that they're reselling to their customers. And what they see in SentinelOne is the best technology, but also the best partner to enable their business. And that's been really, really encouraging because that's how we're going to continue to unlock our way into very large enterprises, particularly in the Americas.

Thank you. Very helpful.

The last question is from the line of Yun Kim with Loop Capital Markets. Please proceed.

All right. Great. Thank you. First, congrats on a strong quarter. Heard a lot about positive feedback regarding your XDR analytics technology at the RSA and Black Hat. By the way, congrats on a couple of strategic hires there in that team. Obviously, you are executing very well on the XDR platform strategy. But given that in the marketplace, XDR is somewhat of a common buzzword, I understand or better understand, what are some specific marketing initiatives and go-to-market that you guys are doing to get the word out regarding the product differentiation?

Yes, it's a great question. And I think maybe just to kind of level set, we really look at the XDR opportunity as it pertains to data and data ingestion, which is what we announced at Black Hat is really something that's more of a decade-long opportunity. So what you're seeing now is just the first innings of what the XDR market will be. The first foray we had, and that started about a year ago, was really around data retention, and that became, I think, our second growing module, especially this quarter. So our ability to process more data for customers, our ability to retain it for longer and really be a cost saver for customers. Obviously, in this macro environment, that's fixed volumes. When you can go into some of these accounts and actually create cost savings, that's a sales facilitator. So to us, when we look at XDR, not only we look at protecting more surfaces in the enterprise, and you see that through our ability to cover cloud services, our ability to cover the user element through identity protection, but also to now start ingesting data from other third-party products in the ecosystem, we do all of that into one singular platform. That's very different in the market. There is no other provider that can really do all of that within one console, within one platform. But that is a long-term opportunity for the company. Our focus right now is absolutely in monetizing our cloud portfolio, our identity portfolio, our Ranger asset management portfolio, our MDR portfolio through Vigilance. We got a lot of different capabilities that we focus on today. And XDR is just unlocking that opportunity for the next years to come. And that's what you see us re-pushing the envelope on innovation on and that, to us, is really what will fortify the success for the company in the years to come.

Okay. Great. Thank you for that. Thanks.

Thank you. That concludes the question-and-answer session. I will now turn the call over to Tomer Weingarten, CEO, for closing remarks. End of Q&A:

Thank you, everybody, for joining. I appreciate your time and attention, and talk to you next quarter.

This concludes the SentinelOne Q2 Fiscal Year 2023 Earnings Call. Thank you for your participation. You may now disconnect your lines.