SentinelOne, Inc. (S) Q1 2024 Earnings Report, Transcript and Summary

Good afternoon, and thank you for joining the SentinelOne First Quarter Fiscal Year 2024 Earnings Conference Call. My name is Elissa, and I will be your moderator for today's call. [Operator Instructions]. I would now like to pass the conference over to your host, Doug Clark, Head of Investor Relations. Mr. Clark, you may proceed.

Good afternoon, everyone, and welcome to SentinelOne's Earnings Call for the First Quarter and Fiscal Year '24 ended April 30. With us today are Tomer Weingarten, CEO; and Dave Bernhardt, CFO. Our press release and the shareholder letter were issued earlier today and are posted on our Investor Relations section of our website. This call is being broadcast live via webcast, and an audio replay will be made available on our website after the call concludes. Before we begin, I would like to remind you that during today's call, we will be making forward-looking statements about future events and financial performance, including our guidance for the second quarter and full fiscal year '24 as well as long-term financial targets. We caution you that such statements reflect our best judgment based on the factors currently known to us and that our actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our annual report on Form 10-K and our quarterly report on Form 10-Q. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons actual results could differ materially from those anticipated in the forward-looking statements, even if new information becomes available in the future. During this call, we will discuss non-GAAP financial measures, unless otherwise stated. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results is provided in today's press release and in our shareholder letter. These non-GAAP measures are not intended to be a substitute for GAAP results. Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets and acquisition-related compensation costs, which cannot be determined at this time and are, therefore, not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fiscal first quarter earnings call. We delivered another quarter of significant revenue growth and margin improvement. Customer retention and expansion remains strong and above our long-term targets. We continue to achieve high win rates with stable pricing. The most discerning enterprises are consolidating their security on our best-of-breed platform, which now includes half of the Fortune 10 companies. We continued our progress towards profitability in the first quarter, making a seventh consecutive quarter of more than 25 percentage points of operating margin improvement. Despite many underlying business trends, our first quarter top line growth was lower than we expected as global macroeconomic pressures continue to persist. Succeeding in this environment requires a sharpened focus on go-to-market execution. Furthermore, we're taking actions to fortify our business by improving our cost structure and ensuring our path to profitability. We believe these measures will drive growth efficiencies across our business. Cybersecurity is mission-critical and a must-have for all enterprises, especially with the world going through a digital transformation. We're leading the charge in security AI innovation and building the enterprise security platform for the future. On today's call, I'll focus on two key areas: one, details of our quarterly performance and external market dynamics; two, how we're continuously optimizing our business and ensuring progress towards profitability, which includes our recent cost saving measures. Before we move on, let me briefly address the onetime adjustment we made to our ARR throughout fiscal year '23. We believe making this change will reduce ARR volatility and better align growth with revenue. This adjustment did not impact our historical revenue or bookings. All of our Q1 reported ARR-related metrics and forward-looking statements include the impact of this onetime adjustment. Dave will provide more detail on this. Now let's dive into the details of our Q1 performance and demand environment. We delivered revenue growth of 70%, a strong growth rate in any economic environment. We added net new ARR of $42 million, driven by continued adoption of our Singularity platform across endpoint, cloud and adjacent solutions. We achieved a record high gross margin of 75% supported by data efficiency and strong unit economics. Our operating margin expanded by 35 percentage points in Q1. Let me double-click on that. We're making rapid progress towards our profitability targets. We also significantly improved our free cash flow margin, showing a year-over-year improvement of 46 percentage points. In absolute dollar terms, we reduced our operating losses and free cash flow outflows significantly. With that said, our Q1 revenue and ARR growth fell short of our internal expectations. Let me address the two key factors head on that impacted our Q1 results. First, macroeconomic conditions are further impacting both deal sizes and sales cycles. Incrementally, budgetary scrutiny is leading to deal size adjustments for new customers and renewal contracts. We're seeing customers evaluate usage and rightsize on renewals. Some enterprises are taking a wait-and-see approach by deferring purchase decisions. While not entirely new, the impact from these conditions was more pronounced this quarter. Second, operating in this environment raises the bar for execution. We were disappointed with some late-stage contract execution challenges on large deals that caused a few deals to slip to next quarter. For example, a multimillion dollar deal with a customer who had already fully deployed our solution could not close in Q1 due to contract delays. At our scale, we have the opportunity to adapt quickly. We're focused on further enhancing our execution, including streamlining our closing process and up-leveling our enterprise platform go-to-market approach. In particular, we've incorporated factors like deal rightsizing, lower pipeline conversion as well as a higher emphasis on efficient growth into our outlook. There is no fundamental change in the business or opportunity, and our win rates remain strong, but the selling environment is more difficult. We're assuming a worsening macro environment. We now expect full year revenue to grow 41% at the midpoint. To be clear, we are still adding significant new business and expanding with existing customers. With these assumptions we calibrate our growth outlook and give us a solid foundation for the future. We're operating at record gross margins and winning significant majority of competitive opportunities. As we scale our...

Please hold as we reconnect our speaker. Ladies and gentlemen, again, thank you for your patience. Please remain holding as we reconnect our speaker. Ladies and gentlemen, thank you for your patience. Our speakers have been reconnected.

Business toward $1 billion in ARR and beyond, we believe our business will continue to become even more durable and resilient. We continue our expansion into adjacent domains such as security analytics and cloud security. We're early in this journey, and we remain focused on the long-term opportunity. We're bringing innovative technology to a $100 billion addressable market composed of legacy solutions and ripe for disruption. The only way for companies to stay protected from cyber attacks is to have the best security. At SentinelOne, we leverage AI to deliver leading protection and value to enterprises of all sizes. Digging deeper into our Q1 results, we are encouraged by several important strengths across our business. Customers of all sizes and geographies continue to treat SentinelOne for industry-leading technology and superior platform value. We added more than 700 new customers in the quarter, and total customer count grew about 43% year-over-year, exceeding 10,680. As you know, our customer account does not include the customers served by our MSSP partners so the number is dramatically understated. Customers with over $100,000 in ARR grew 61% year-over-year, much faster than our total customer growth. Customers above the $1 million mark grew even faster. In Q1, we added a new Fortune 10 customer, and we're now the cyber security platform of choice for half of the Fortune 10. Our Singularity platform scales with the world's largest enterprises and outperforms in the most stringent security requirements from detection to manageability to privacy and controls, other prominent customer wins, spend endpoint and cloud footprints, ranging from global financial institutions to iconic retail brands. Our momentum across mid-market enterprises remained particularly strong in Q1, even with budgetary pressure and some downsizing, our ARR per customer increased by more than 20 percentage points year-over-year demonstrating our success with large enterprises as well as increasing adoption of broader platform offerings. Our land and expand strategy is working as customer retention and expansion remains resilient. Our NRR exceeded 125%. This expansion was driven by footprint expansion and module adoption. Our emerging capabilities represented more than one third of quarterly bookings in Q1, demonstrating strong momentum of our adjacent solutions. Singularity cloud remained our fastest-growing solution followed by meaningful contributions from other adjacent capabilities such as Vigilance, MDR and Ranger. Our customers state remains underpenetrated in terms of module adoption. There is clear opportunity to increase our platform expansion and improve our business durability. Our partner-supported go-to-market model continues to unlock scale and enhance our market position. We achieved another quarter of resilient growth from our MSSP partners in one as businesses increasingly turned to managed security protection. Beyond endpoint license expansions, our MSSP partners have started to adopt broader platform modules such as Vigilance, MDR, Ranger and many others. We expect continued MSSP share gains, installed base replacement and module attach to drive meaningful growth going forward. Our autonomous security, multi-tenancy and fully customizable access control makes SentinelOne a critical partner for large MSSPs. Together, we're providing enterprise-grade protection to customers of all sizes. Expanding upon our cloud security partnership with Wiz, we've enhanced the customer experience through deeper technology integration. Now our integrated cloud security form provides enterprises with complete visibility into their cloud-hosted infrastructure and allows them to protect against cloud-based threats at machine speed. Our recently launched cloud security marketing campaign is creating strong momentum, increasing customer and partner interest in Singularity cloud. Looking at the competitive landscape, we continue to maintain strong win rates without having to compromise on pricing. This hasn't changed, and our disciplined pricing and value is reflected in our record gross margins. Our ASPs remain stable, and we continue to win against legacy and next-gen vendors in significant majority of competitive evaluations, and we expect these trends to continue. Customers value SentinelOne's culture of trust and transparency, which is a philosophy we bring to every relationship. We're focused on expanding our pipeline, leveraging our channel ecosystem and refining our execution. SentinelOne's platform is purpose-built to help customers optimize security and cost with coverage across diverse operating systems and cloud environments. We're helping enterprises consolidate multiple point solutions, enabling them to realize better security and business outcomes using fewer resources. Let me share how we're balancing our investments and taking specific actions to ensure our path towards profitability. In the current economic landscape, it is vital that we adapt and optimize our resources accordingly. By acting swiftly, we can enhance our execution and drive operational improvements. We're reiterating our commitment to delivering margin expansion regardless of current economic scenarios as demonstrated by our Q1 margin improvement and overachievement. As a result, we're adjusting our cost as needed to drive more efficient growth, enhance resiliency and ensure our path to profitability. Let me provide a few specific examples. First, we're implementing a plan to optimize our workforce that is expected to impact about 5% of our current employees and pace our future headcount growth plans. We also see opportunities to leverage AI tools to make our teams more productive and help drive operational efficiencies for the company. Second, we're sharpening our focus on cost discipline. This includes reducing variable spend to business-critical needs as well as optimizing talent locations and facilities. We're prioritizing core products that hold the greatest potential for delivering substantial business and customer value. We believe this initiative is more closely align our cost structure with our current outlook without sacrificing long-term growth potential and market opportunities. These are the right steps to streamline our business. We are continuing to maintain a balance between growth and profitability. Reflecting upon last few years, SentinelOne has evolved from an endpoint security solution to a comprehensive enterprise security platform. Our endpoint solution has been a source of tremendous growth, and we expect this to continue in the coming years. Beyond our endpoint market success, growth of our emerging solutions have diversified our business mix across endpoint cloud identity and data. Our leading innovations and holistic approach to cybersecurity put us in a strong position for long-term growth across multiple large addressable markets. We're in the midst of a paradigm shift among enterprise security and operations technological advancements are changing what was once imagined possible for cybersecurity. Artificial intelligence is among the most disruptive technologies of our time and has the potential to scale cybersecurity in a completely new way, and we are leading the charge through innovation. From early on, we developed a fully automated AI-based security platform, integrating neural networks to serve a specific use case, combating cyber attacks and protecting our digital way of life is a force for good. Our Singularity platform is powered by a single proprietary security data lake to protect multiple attack surfaces. Our AI-based approach delivers best-in-class autonomous protection, where we've consistently led in third-party evaluations and Gartner critical capabilities. Our success is also proven in real-world experiences whether that be the global scale [indiscernible] attack a few years ago when we had 0 customers impacted or more recently, the smooth operator global supply chain attack. Here again, our Singularity platform successfully prevented the attack from executing well before the threat was discovered and identified by other security vendors. This is the true potential of SentinelOne's leading security, real-time AI-based autonomous protection. And once again, we're leading the industry by incorporating generative AI into cybersecurity. We recently launched Purple AI, a one-of-a-kind innovation in cybersecurity that supercharges users to control all aspects of enterprise security from visibility to response with unmatched speed and efficiency. This is much more than a sidecar assistant. It can upgrade any security analysts to superhuman levels. Customers and prospects were given hands-on access to a live demo of Purple AI at RSA, the world's largest cybersecurity event. And feedback was extremely positive. The Wall Street Journal called us out as an AI innovator. CRN put us on the top of the list of 10 cool new cybersecurity tools announced at RSA 2023. And CSO magazine named us one of the most interesting products to see at RSA Conference 2023. We are well positioned to bring more AI to customers. SentinelOne's AI-based detection engine has always been a differentiator. Now with purple, we're taking a big step in bringing generative AI to security professionals, making security operations easier, faster and efficient across petabytes of data from any source. Importantly, we are committed to ensuring our cutting-edge technologies are used ethically, safely and responsibly. Our Singularity platform allows customers to maintain complete control of their data, reinforcing our dedication to keeping sensitive information in the hands of its rightful owners. Before concluding my remarks, let me mention an exciting development. Sally Jenkins joined SentinelOne in April as our new Chief Marketing Officer. Sally's marketing leadership will help further define our value proposition, expand our brand presence and solidify our leading growth across multiple market segments. She brings over 30 years of experience, amplifying brands at high growth and scaled companies. We welcome Sally to the SentinelOne leadership team. In conclusion, we believe today's macro challenges are not permanent and that enterprise transformation is in its infancy. We're well positioned to address critical enterprise needs leading next-generation security across endpoint, cloud and security data analytics. We also believe the market will continue to convert towards enterprise-wide cybersecurity platform driven by AI and approach we pioneered and lead. We're committed to innovation, improving our operating performance and empowering customers with the best enterprise security resources. Ultimately, companies win when they continue to adapt, innovate and deliver value for all stakeholders, and this is our North Star. I thank you and all stakeholders, especially our SentinelOne's customers, partners and shareholders for your continued support and commitment. With that, let me turn the call over to Dave Bernhardt, our Chief Financial Officer.

Tomer, thank you. I'll discuss our quarterly financials and provide additional context about our guidance for Q2 and fiscal year '24. As a reminder, all comparisons made are year-over-year and all margins discussed are non-GAAP, unless otherwise stated. Before digging into the Q1 results, I will discuss the details of a onetime adjustment we made to our ARR for fiscal year '23. First, some context. In the past few years, we had seen steadily increasing usage and consumption patterns by our large customers, which we accounted for real-time and quarterly ARR. However, as the first quarter progressed, we experienced a notable decline in usage, which continued in May. In light of the current macro environment, we expect these lower usage and consumption trends to persist. Due to this new dynamic, we elected to tighten the methodology for calculating ARR for consumption and usage-based agreements to reflect committed contract values. This provides a cleaner view of growth for fiscal '24 and beyond. By making this change now, we expect ARR and revenue to be more closely aligned. It should also reduce volatility in ARR compared to the prior methodology, where usage and consumption changes could have a magnified impact on ARR. As we reviewed the methodology, we also discovered historical upsell and renewal recording inaccuracies relating to ARR on certain subscription and consumption contracts, which are now corrected. After considering these factors, this adjustment resulted in a onetime ARR reduction of $27 million or approximately 5% of ARR, resulting in Q4 fiscal '23 ending ARR of $522 million. We are applying a comparable estimated adjustment to the remaining quarters in fiscal year '23, which we believe is a reasonable approximation of the impact in those periods. Importantly, this adjustment did not impact historical revenue or bookings. We wanted to be transparent to address this upfront and move forward on a clearer path. Now moving on to our Q1 results. Revenue grew 70% to $133 million, with international revenue growing 84% year-over-year and representing 35% of total revenue. We added net new ARR of $42 million and ended the quarter with total ARR of $564 million. This did not meet our expectations. Customers continue to tighten budgets and deal sizes. While these factors are not entirely new, they were more pronounced in Q1, and we have the opportunity to execute better. Looking beyond the top line growth, our Q1 performance showcased many areas of strength across the business. We continue to see a healthy mix of new customers and expanding business from existing customers. Our dollar-based net retention rate remains north of 125%. Also, our ARR per customer increased more than 20% compared to last year, reflecting strong business momentum among large enterprises and growing adoption of our Singularity platform. We achieved another quarter of resilient growth from our MSSP partners in Q1 as businesses increasingly turn to manage security protection. Our broader platform adoption by our existing customers and partners remains durable and resilient, fueling a solid base for growth regardless of broader conditions. Turning to our costs and margins. In the quarter, we achieved better gross and operating margin and narrowed our operating loss and free cash flows, all despite lower top line growth. We delivered a record gross margin of 75%, an increase of seven percentage points year-over-year. Just two years after setting our long-term gross margin target, we're already operating within the range of 75% to 80%. This demonstrates great progress. We're seeing continued benefits from economies of scale, data processing efficiencies and cross-sell from adjacent solutions. This also underscores the importance and benefits of our fully integrated security data analytics back end where we collect data once to enable more and more capabilities. We also delivered substantial operating margin improvement, expanding 35 percentage points year-over-year to negative 38%. As market conditions have evolved, we have become more selective about investments. We've taken important steps to align our cost structure with our updated growth outlook. We've also improved our cash conversion in the first quarter. On a dollar basis, we reduced our operating losses year-over-year in Q1. We also reduced our free cash outflow from $55 million in Q1 of last year to $31 million this quarter, reflecting a free cash flow margin improvement of 46 percentage points. Moving to our guidance for Q2 and the full fiscal year '24. We are maintaining strong competitive win rates, stable pricing, and we're generating strong pipeline momentum. At the same time, we expect macro conditions to worsen impacting enterprise budgets and sales cycles. It's a more difficult selling environment. We are assuming lower pipeline conversion for the remainder of the year as well as further deal downsizing. We strongly believe this does not change our competitive position or our long-term opportunity. The only way for companies to stay protected from cyber attacks is with the best security protection, and SentinelOne offers that leading security and platform value. For the second quarter, we expect revenue of about $141 million, up 38% year-over-year, and we expect net new ARR in the low $40 million range, consistent with Q1. We expect second half net new ARR to be higher than the first half, consistent with typical seasonality. For the full year, we expect revenue of $590 million to $600 million, growing 41% at the midpoint. We now expect full year ARR to grow in the mid-30% range from the adjusted fiscal year '23 ending ARR of $522 million. While lower than our previous expectations, we expect continued growth and rapid progress towards our profitability targets. Turning to the outlook for margins. In Q2, we expect gross margin to be about 74.5%, an improvement of 10 percentage points year-over-year. We expect gross margin to remain relatively consistent in the remainder of the year. As a result, we are increasing our full year gross margin guidance to 74% to 75%, up over two percentage points year-over-year at the midpoint. We expect our increasing scale and improving data processing efficiencies to continue benefiting our results. Finally, we expect our Q2 operating margin to be negative 36%, implying an improvement of more than 20 percentage points year-over-year. Despite a lower growth expectation for the year, we are reiterating our operating margin guidance of between negative 29% and negative 25%, an improvement of about 22 points at the midpoint compared to fiscal year '23. We're focused on improving our execution and operating the business efficiently through evolving economic conditions. We must adapt, execute better and will emerge as a stronger company in the years ahead. Every dollar we invest must generate a positive return. To that end, we are taking measured steps to align our cost structure with the pace of growth this year, including decreases in variable spend and cloud hosting costs, optimizing talent and facility locations, lower forward hiring and approximately a 5% total headcount reduction. These efforts will increase performance accountability and operating efficiency, driving expected cost savings of about $40 million once fully executed. We believe these are the right steps to optimize our long-term market and growth potential while remaining on track to achieve breakeven profitability in fiscal year '25. We have a very strong balance sheet with $1.1 billion in cash, cash equivalents and investments and no debt. This is a substantial war chest. It provides longevity, flexibility and ample runway to achieve our profitability targets. Before we open for Q&A, I want to take a minute to summarize everything we covered here today, which has been a lot. We achieved many positive results. 70% revenue growth and delivered upside to margins with significant free cash flow improvements. Demand in our pipeline remain healthy. On the other hand, customers are heavily scrutinizing deals, and we have the opportunity to elevate our execution. We also experienced a slowdown in consumption and usage among certain customers, which led us to adjust our ARR to better align with revenue and mitigate further fluctuations. Finally, we're executing workforce reduction and cost optimization actions to ensure we meet our fiscal year '24 margin targets and continue to deliver disciplined growth. Thank you all for joining us today. We will now take questions. Operator, please open up the line.

[Operator Instructions]. The first question comes from the line of Brian Essex with JPMorgan.

I guess, Dave, just want to address this adjustment and get a little bit of clarity there. You just alluded to the slowdown in consumption and usage. Is this for kind of storage and query? Maybe you can explain the underlying products that's related to this consumption-based revenue. And then as we look at our models and try to forecast the revenue generated from ARR, is this going to be -- does this basically remain out of the ARR equation now? So it's kind of an extra layer of revenue we need to consider that's more variable in nature? Maybe a little bit of color there will help.

Yes. Happy to discuss this. So what's happened is we had a $27 million onetime adjustment. It's about 5% of the ending ARR that we decided to be more conservative on and restate as of Q4 of last year. It's two parts: one, we've changed the methodology of calculating the ARR and consumption and usage-based agreements to reflect the committed contract value. When you asked specifically what's that about? It's about the data ingestion and the security data lake and the data set consumption products. So those are approximately single digit of our total ARR. But what we had been seeing historically was we were seeing customers that were signing up for contracts, using the data in excess of what they were committed to, renewing early, and we were reflecting that in the ARR balance. As something that we've seen going into late Q4 and early Q1 and then throughout Q1, even into May and likely into June, we're seeing a decrease in that and customers rightsizing their spend to get back to committed total. So we were seeing an outsized swing to the opposite end that we had seen prior. So what had happened was we're -- by doing this, we're trying to tighten the definition of ARR to eliminate these swings to our favor or to our detriment and basically lock it to the committed contract. So we believe that this is -- this going forward, it's going to reduce the quarterly ARR fluctuations. It's going to more correlate ARR and revenue. And that's the reason that we did this. The reason hasn't changed any historical bookings. In terms of the other side of this, which was historical upsell and renewal inaccuracies, what we were seeing was we had upsell motions that included a renewal. And we were adding that to the historical ARR versus adding just the upsell component of it. This was an error in our CRM. We have fixed this and should not have that error going forward. That's why it didn't affect revenue didn't affect overall total bookings, didn't affect cash flows, didn't affect the income statement. But what it did do is it set external expectations for what revenue should be going forward, both externally and internally, that's why we made this adjustment now.

Okay. And maybe to follow up, how should we -- is there a way we can understand the practical use case around how an enterprise might be managing their security posture and choose to maybe ingest and store less data? What is the thought process that goes along with that? And what is the risk award kind of trade off of their decision to ingest less data to save costs when your kind of security posture's at risk?

We're seeing this in two different areas. I think that, one, that's something that you see, I think, with a lot of consumption-based companies. I mean, when people look at log analytics and generally trying to ingest data, they now take a more prudent approach to what they want to store. So you see them filtering out a lot of the data that they don't feel is useful. To us, that's one thing that we saw through the dataset user base happening where they downsize, rightsize some of the logs that they wanted to keep. I think a lot of companies are kind of going through that same exercise now, whether with us or other vendors, which was really why we elected to just remove that consumption part from our ARR to prevent from kind of being something we consider into the future. And obviously, if something kind of aligns to the better, obviously, that becomes upside. The other side of it is when you look at security data, it's much of the same story. Some log sources are not as useful for customers, and they're now scrutinizing what they put into the platform, generally very healthy. Just when it comes after two years of putting everything they could into the platform, I think now we're seeing, obviously, the inverse behavior, which we felt, again, something prudent to do here is just remove that volatility from ARR, and that's the result.

Patrick Colville with Scotiabank. Your line is now open.

Hi, thanks for taking my question. This is Lory Luo on for Patrick. I just have a quick question on the cloud security. Can you hear me?

We can hear you, yes.

The next question comes from the line of Tal Liani with Bank of America. Your line is now open.

Great. Don't hang up on me, please. I hope you can hear me.

We're here.

I know. I know.

It's not you. I know hopefully, she can hear us.

So I want to ask a question about certain things you said. On one hand, you're saying that this is a slippage of contracts from Q1 on to the next few quarters? On the other hand, if this is just slippage, why are you reducing second quarter guidance and full year guidance? And then why are you reducing workforce and other expenses? It seems to me from -- just from your actions into the guidance and into the expenses that it's more than just slippage. That's something in the environment and is worse. And the question I have is first about quarter linearity. I think in April, you said that things are fine. So does it mean that it deteriorated right after? And I want to ask you something about competition. The question is, is it more related to competition? Did you have greater loss rate of contracts or things that impacted the guidance, the lower guidance? Or is it really strictly about spending? It's hard for me just to see the same spending comments from other companies. And I'm trying to triangulate kind of what the data points from other companies on the space.

Of course. It's not just deal slippage. We tried making that clear. I think deal slippage is something that obviously we witnessed as early as Q3 and Q4 of last year. So some of it was known. And I think that generally, we factored some of that into how we convert pipeline. I think we have -- we've had a couple of execution hiccups where some deals that just were not supposed to slip -- this is not specifically macro related, we just weren't able to execute these contracts in time. And that was unfortunate, and that's something that we need to do better. So to me, this is not bill slippage. It's our own execution. The other factor and why we're taking a more cautious approach is just generally, we feel this environment, customers are not really at the end of the contract, reflecting what they intend to buy was in the beginning of entry to the pipeline. So if we take a more cautious look into our pipeline, which are very healthy, it just we don't always are able to predict what that deal size is going to be at the end overall. So to us, I mean, we're just taking a more prudent approach. The third factor that we see in play is that consumption dynamic. I mean consumption is something that we've had in our ARR, it's something that is part of our ongoing operations, obviously. So taking out consumption from ARR obviously forces us to also take the guide down and really don't consider consumption as part of our go-forward only as upside, as I mentioned. So these are the three factors that go into it. The competitive environment remains pretty much the same. Our win rates have been stabilized over the past few quarters and even before. I don't think we're seeing anything out of the ordinary there. We definitely see some of these providers that we compete against, I mean, become more aggressively defensive, especially when we come for their estates. I mean we're the up and comer here. We gun for their estates, and sometimes they become highly aggressive to the point of $0-deal types of transactions that we just don't do and will not do. But outside of that, which I would kind of call on the outline or kind of the outskirts of things, things are pretty normalized on the competition front.

And Tal, to build on that further and talk about some of the cost initiatives we've put in place, with these lowered expectations for revenue and ARR leading into the latter part of this year, we've said from the beginning, our goal was to get to breakeven or better for fiscal '25. These are things we have to do to make that -- to enable that to happen. So we said we were going to sharpen our pencils. We've said that everything we were going to do was focused on achieving those bottom line results no matter what the growth was. Everything we're doing in this action and what we've been doing earlier in the year when we've made similar actions that were smaller and kind of cuts around the edges, everything has been to [indiscernible] to be ready for that longer term, and that's why we made those decisions that we've made over the past week and really support today.

Our next question comes from the line of Saket Kalia with Barclays.

It's Saket. Sorry, can you hear me?

Yes.

I'm so sorry. I was just hoping between calls a little bit. Tomer, very helpful response on the last question. Maybe just to dig into the competitive part of that response a little bit. I was wondering if you could just double-click on Microsoft specifically? I mean a lot of times, there have been questions around just how competitive or how effective the product is, but it's obviously very easy to buy. I mean any views on just how you're referring specifically versus them competitively?

Sure. Look, Microsoft is a formidable competitor. I mean this is not a legacy signature-based solution. Obviously, they have a fairly expanded security portfolio. With that said, I think that four customers that are looking for the security capabilities and the coverage that pure-play vendor can provide. Microsoft just doesn't cut it. So I think in certain parts of the market, you can see them a bit more palatable for security teams. But as a whole, I think that doesn't really translate into more discerning customers. Moreover, I think that when you look at what capabilities, customers are opting right now for cloud security would be one that I mentioned, triple-digit growth for us year-over-year on cloud security. That is something where obviously Microsoft is not as I would say, prominent in their capability set. So all in all, they're still there. We see time and time again that when people eventually do go with Microsoft, that's a CFO-type led decision. I think that more and more people are kind of shying away from that approach. The last thing I'll say there is we're targeting now between all the different offerings we have in our portfolio about $100 billion addressable market. Even if you look at Microsoft as one of the leading cybersecurity providers with $20 billion of revenue overall, I mean, I think you're looking at about 1/5 of that market. So a lot of it is still up and up for grabs. And we feel still pretty good about our ability to compete with Microsoft, especially with security savvy professional, especially with MSSPs that are looking for more automated, more OpEx-driven solutions. So we feel well positioned, but obviously, Microsoft, they're a formidable vendor out there.

Our next question comes from the line of Adam Tindle with Raymond James.

Tomer, I just wanted to start to understand a lot of the concentration of the negative surprise here is in the data ingestion piece. And I know it's a smaller part of the business. But if we think about that the narrative would be that there's perhaps concerns that, that could be a leading indicator for broader challenges coming in the business with the logic saying, hey, it's easier to shut off consumption quickly, and we'll get to the contractual stuff later and ultimately start shutting that off. Just wondering, with that kind of narrative or potential bear case, how you're thinking about preventing that or what you would say to investors that would be concerned about that?

I think these are two completely separate things. I mean, at the end of the day, if you look at our GRR, it remained stable across many quarters. We don't churn customers, customers don't leave SentinelOne. At the end of the day, even when we look at the rightsizing of licenses, which I think is what you kind of referring to, I mean that looks very same to us. I mean these are just getting aligned to the workforce that they have. So I don't think there's anything material with what's happening with licensing for us. Consumption in its nature just more volatile. And I think that for companies out there, when they're under the gun to save obviously, something as intangible as data is something that they can start thinking twice about. That's not the same for their core security posture, and that is something that we've seen very, very stable over time. Even if we imply some factor of rightsizing into it, that doesn't create that same volatility that an ad hoc consumption model would have. Obviously, these are multiyear contracts. Obviously, these are tied specifically to the amount of people you have in the organization. Even if you have some volatility in that, it is not even close to the volatility that you can have with data volumes. And that's why, once again, to kind of remove that volatility, we removed that from our ARR projections.

Okay. And Dave, maybe just a quick follow-up. I'm sorry if I missed it, but did you size that -- the consumption business? I know Scalyr, years ago, you talked about $10 million for that piece of it. What's the size that we're looking at? And any changes looking at from contractual basis or anything like that moving forward?

It's single-digit percentage of total ARR. So -- or single-digit percentage of total ARR. We shouldn't expect the fluctuations going forward as we've moved to contractual. What we're -- everything we're doing is anchoring around having this be as conservative a number and removing the fluctuations either side going forward.

The next question comes from the line of Patrick Colville with Scotiabank. Your line is now open.

This is Lory again on for Patrick. Can you guys all hear me?

Yes.

So I just want to ask the cloud security product. Last quarter, you had a very good traction, you mentioned. And how is this quarter? And can you share with us any update on partnership with Wiz?

Of course. It's been great growth for us on the cloud side. And this quarter, once again, remain that same proportion of contribution for ACV, which represents, again, triple-digit growth year-over-year for cloud security. The Wiz partnership, I mean, we see a ton of pipeline movement from existing customers and also new shared opportunities. All in all, it's early days with that partnership. We've tightened up the technical integration part of it. We're kind of after Phase 1. And all in all, I mean it shows great signs of progression. Generally speaking, we're not dependent on that partnership whatsoever to continue to grow our cloud business, and we're generating more and more cloud pipeline. With every quarter that passes, we have a dedicated campaign for cloud security. We have dedicated sales force for cloud security. So we're also maturing our sales force to kind of expand and evolve from an endpoint company to a platform company in cloud is obviously the tip of the spear for us.

The next question comes from Hamza Fodderwala with Morgan Stanley.

Dave, just a quick one for you. You talked about the $40 million in cost savings from the workforce reduction. Is that reflected in the full year guidance? And would you be willing to sort of reaffirm the expectation for free cash flow breakeven exiting this year?

So we're expecting to deliver $40 million cost savings relative to our prior plan. This ensures that we remain on track to achieve our full year EBIT guidance that we provided earlier and then reiterated again today. Specifically, from the [indiscernible], it's about $15 million in annualized savings. I think about $5 million -- saves $3 million to $5 million in severance costs. There's inventory write-offs. We're also looking at facilities and other things that we will have that will continue the savings going forward. That's all contemplated in this guidance. And then in terms of free cash flow, I think in light of the reduced top line expectations for the year, I think the target for this year, where we said we could potentially hit it in the latter part of this year, say, Q4, I think that's probably better off thinking of that as a fiscal '25 activity just based on the lower top line.

The next question comes from the line of Joshua Tilton, Wolfe Research.

Can you hear me?

Yes.

So a lot of the feedback that I'm getting from investors is just that it seems like you guys came across pretty bullish during the quarter. And clearly, the tone is changing here on this call. So I apologize if I missed this, but I'm just trying to understand when exactly did you notice the slowdown of the business really pick up? And maybe even like when did you guys notice the issues with the historical ARR disclosure?

I think generally, when we look at it, we see kind of the end of the quarter is the point where we started noticing more and more pronounced consumption changes. To us, that was a point where coupled that with a couple of deals slips and suddenly, you're looking at a very different outcome for the quarter. So I think, generally, if you just look at our new and upsell target for the quarter, it was pretty much in line with what we expected. But when you couple that with that downsizing of consumption then you just arrived at a very, very different result. And to us, I mean, once again, win rates sustained revenue still growing about 70%. I think if you take out that consumption element, I mean things would have looked very, very different. So that, I think, is kind of the reason where parts of the business here are really humming. And suddenly, we saw this, which, frankly, we were surprised by and we were surprised by the magnitude and that's where we are today.

And in terms of evaluating the ARR, I guess, rebasing restatement, when we really were diving into that, it was because I was investigating why revenue was coming up as a shortfall. So it started out, and we did a deep dive into revenue. And obviously, you would assume that about one fourth of ARR goes into revenue absent some churn, absent some slower deployments, things like that, that are typical. But I still -- obviously, based on our Q1 results had a shortfall. So to understand that, we did a deeper dive by scrubbing everything in ARR, all 10,700 customers to evaluate why that was. And that's where we noticed that we essentially had an uplift that we expected because of renewals that had not been essentially moved out of the system because they were treated as upsell. So I was essentially stacking and upsell on top of an existing renewal without removing the previous renewal. And this was an error in our CRM. We fixed it, but that's where that came up, and that was obviously later on in the quarter and actually post quarter end when we really had fully identified it and been able to scrub all the customers.

The next question comes from the line of Gray Powell with BTIG.

Great. And I just want to make sure, can you hear me okay?

Yes.

All right, great. This might be a tough one, but I feel like I do have to ask it. And to some extent, you may have already answered it, but I'm just going to give it a shot anyway. So I guess like how should we think about -- like what was the main driver [indiscernible] you missing the Q1 revenue guidance at $137 million. I mean you guided on March 14 and revenue is mostly ratable. And I know we've talked about the consumption components, but I just want to make sure that I fully understand that dynamic. And then can you just reiterate like why this won't happen again?

I'll try and iterate for Dave because it's going to be the third time. But basically, the ARR adjustment that we've done was realizing that both we've had consumption is kind of an ad hoc element to our ARR, which basically drives up ARR as consumption goes up, but it drives down significantly when consumption is not continuing to grow. In the past couple of years, consumption for us was always on the up and up, and it created that overstatement of ARR, so to speak, which created an expectation for revenue for us internally as well. So when the quarter ended, the dust settled when he started kind of figuring out, hey, why aren't we seeing that revenue? A big part of it was the ARR was reflecting consumption that was now going down. And that impacted what we should have seen in revenue. And couple that with, again, some CRM inaccuracies that Dave mentioned as well, and that was mainly the reason for the revenue mix. Outside of that, the ARR for the quarter was roughly in line with what we expected, minus again that consumption downsizing. So all in all, a lot of it was cleaned and will never happen again, given that rebasing of ARR and the removal of consumption from the base.

The next question comes from the line of Brad Zelnick with Deutsche Bank.

Great. Can you guys hear me?

Yes we can.

Awesome. The ARR statement is very unfortunate. The environment is very tough. I think you guys have said it yourselves, and you're being asked a lot of tough questions. So I mean as long as we're in this forum, I'm going to add to those, which I guess for you, Tomer, most appropriately, what is your strategic end game? You're facing an increasingly hostile macro and competitive end market. You're still burning a good amount of cash. I mean it just seems like in a recession, you're in a bit of a tough spot. And you yourself, I think, said in many different ways, that conditions are worsening. So when you think about what you envision for the business years ago coming to the public market versus where you are today and what you can see a few years out on the horizon, how do you think about the different alternatives out there?

Sure. Look, it's a long game. None of us expected to IPO the company and go home. I mean we're here to stay, it's a $100 billion TAM. We've got the most cutting-edge technology in the market, and we're improving our margins to the point that next year we hope to be profitable. So all in all, I don't see anybody else in the market making such incredible improvements on the margin front and our progression, I think, have been fairly impressive. Obviously, this is not the best market to operate in for a growth company. And I think what you're seeing is real-time adjustment for a full on growth -- from a full on growth company and into a more balanced approach, a disciplined growth company. We want to become more efficient, what you're seeing us do the public eye is making the company more efficient. And we're really setting the stage, I think, for efficient growth. This is not the economy to put the pedal to the metal and run fast. This is where we just want to be more efficient, we want to make sure we're doing right by our customers. That's our North Star. That's why we're here. We're going to continue to build our platform. we're adding customers at a pretty rapid clip even in this environment. So all in all, I mean, I can't say it's a lot of fun right now. But at the end of the day, we keep on growing. We've got very promising technology. We're a leader in AI. AI in itself is going to disrupt the cybersecurity infrastructure landscape significantly in the next couple of years. All of that translates to an opportunity. And hopefully, our shareholders will see that, too.

I think if you look at us on a 3- to 5-year horizon -- let's play this out. If we're a profitable company, still growing at a reasonable growth rates, this is a far more valuable company than it is today. And we're not relaxing on technology. We're continuing to advance that. We've been a technological leader, and we're going to continue to do that. So we look at this as it's still early innings in cybersecurity for us. We have a long runway to execute to execute better and to grow this company to be a more sizable company than we are today.

Our final question comes from the line of Ray McDonough with Guggenheim.

Can you hear me okay?

Yes, we can.

Great. Maybe for you, Dave, and just to finish off. You guys mentioned a couple of times that customers are rightsizing on renewals, but also mentioned that gross retention rates remained stable. And last quarter, I actually think that you mentioned they ticked up. So just to be clear, dollar gross retention remained stable despite those comments? And I guess I'm -- on the flip side of that, I'm trying to decipher the commentary that new and upsell was also in line with expectations and that renewals were stable. Is consumption -- that consumption business that's kind of the headwind here or a lot of the headwind, is that not accounted for in the gross renewal rate? How should we think about where are the headwinds, I guess, showed up the most between renewals, expansion and new logos?

If you think about it on a pure NRR rate, we've gone from the 130s into approximately north of 125. So we're still seeing our customers continue to increase their spend with us year-over-year. We expect that to persist. We're expecting 120-plus percent kind of as a floor for us, and we see that for the foreseeable future. In terms of how this affects GRR, our GRR has essentially been flat for past eight quarters or so. I don't think it's deviated more than 1 point. So one of the things that Tomer had talked about is when customers use us, they don't tend to leave us. What we -- in terms of the rightsizing of deals, historically, we've seen customers that may have signed multiyear deals, and they would have stepped up employee counts for endpoint and say, hey, I'm going to buy this much minimum and I'll step up for a better price for the following year and a better price for the following year based on volume. We're seeing customers now just flatten that out based on the employee counts now. And then they come back to us if at renewal, if they're purchasing a more sizable amount. So we're just not seeing that forward projections from our customers that we were historically seeing.

Maybe just something to add to that and maybe that can help you kind of piece it all together. I mean, GRR is stable and it's what we call planned GRR. And I think the one dynamic that we did see is that traditionally, we didn't even get to the planned GRR. GRR was even lower than that. And that is something that we started almost taking for granted. And I think in this environment, that is something that you can't take for granted anymore. But once again, I mean, we still are one of the industry best in GRR, definitely in NRR, and we expect that to continue.

That concludes today's Q&A session. I would now like to pass the conference back over to Tomer for closing comments.

Thank you, everybody, for joining. Appreciate your time.

That concludes today's call. Thank you for your participation. You may now disconnect your lines.