SentinelOne (S) Q3 2025 Earnings Call Transcript

Image source: The Motley Fool.

SentinelOne (S 4.10%)
Q3 2025 Earnings Call
Dec 04, 2024, 5:00 p.m. ET

Contents:

• Prepared Remarks
• Questions and Answers
• Call Participants

Prepared Remarks:

Operator

Good afternoon. Thank you for attending today’s SentinelOne Q3 fiscal year 2025 earnings conference call. My name is Jaimie, and I’ll be your moderator for today. All lines will be muted during the presentation portion of the call with an opportunity for questions and answers at the end.

I’d now like to turn the conference over to our host, Doug Clark. Doug, you may proceed.

Doug Clark — Vice President, Investor Relations

Good afternoon, everyone. Welcome to SentinelOne’s earnings call for the third quarter of fiscal year ’25, which ended October 31st, 2024. With us today are Tomer Weingarten, CEO; and Barbara Larson, CFO. Our press release and the shareholder letter were issued earlier today and are posted on the investor relations section of our website.

This call is being broadcast live via webcast, and an audio replay will be available on our website after the call concludes. Before we begin, I would like to remind you that during today’s call, we’ll be making forward-looking statements about future events and financial performance, including our guidance for the fourth fiscal quarter and full fiscal year ’25, as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our annual report on Form 10-K and our quarterly reports on Form 10-Q.

These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons actual results could differ materially from those anticipated in the forward-looking statements, even if new information becomes available in the future.

During this call, we will discuss non-GAAP financial measures, unless otherwise stated. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results, other than with respect to our non-GAAP financial outlook, is provided in today’s press release and in our shareholder letter. These non-GAAP measures are not intended to be a substitute for our GAAP results.

Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges, and gains on strategic investments, which cannot be determined at this time and are, therefore, not reconciled in today’s press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Tomer Weingarten — Chief Executive Officer

Good afternoon, everyone, and thank you for joining our fiscal third quarter earnings call. Our Q3 results demonstrate strong execution and business momentum. We exceeded our top line growth expectations and continue to deliver year-over-year margin improvement. Importantly, our net new ARR growth reaccelerated back to positive territory, driven by solid execution and a record number of customers with ARR of $100,000 or more.

This momentum reflects a stronger competitive position and notable rise in customer interest for SentinelOne. We continue to bolster our position as a technology leader through constant innovation. Today, Singularity is a comprehensive cybersecurity platform that delivers best-in-class security and operational resilience. Singularity unifies data capabilities and AI-powered security across endpoint cloud identity, as well as third-party integrations, all in one single user interface.

Enterprises are increasingly selecting SentinelOne for our ability to provide real-time autonomous security that adapts to the modern threat landscape while simplifying operations. In a world where cyber threats evolve rapidly, our platform’s proactive approach is designed to safeguard enterprises today and into the future. The Singularity Platform empowers customers to bring advanced AI capabilities into their entire security stack, from data to operations. This ability not only sets a new standard in the market but also establishes what we believe is a foundational pillar for the future of cybersecurity, streaming enterprisewide security data to be processed and analyzed by advanced AI algorithms and agents that drive real-time autonomous outcomes.

It is clearly a more effective and efficient way to do cybersecurity. The rapid adoption of our Purple AI suite, now our fastest growing solution, further highlights the value and innovation we bring to our customers. Looking ahead, we’re raising our full year revenue guidance. For fiscal year ’25, we now expect to deliver revenue growth of 32% compared to last year, up from our prior guidance of 31% growth.

Our confidence stems from a strong pipeline, successively merging solutions, and an expanding opportunity set driven by increasing customer and partner engagements. I want to thank our customers and partners for the trust and collaboration, and all Sentinels who work tirelessly to protect our ways of life from cyber threats and disruption. As always, please read our shareholder letter published on the investor relations website which provides more detail. Let’s review the details of our quarterly performance.

In Q3, total ARR grew 29%, and revenue grew 28% year over year. Net new ARR of 54 million increased over 20% sequentially, well above our historical third quarter seasonality. Importantly, our net new ARR growth accelerated to 4% year over year. This return to positive growth is a strong indication of our business momentum and improving market position.

While we continue to operate in challenging macroeconomic landscape, the strength of our Q3 performance was broad-based across geographies and platform solutions. Once again, we delivered best-in-class growth margin of 80%. Operating margin improved by more than 6 percentage points compared to last year. And for a second consecutive quarter, we delivered positive net income.

With an improving margin profile and a solid balance sheet, we have the opportunity to be dynamic and flexible, positioning ourselves for long-term share gains across diverse growth opportunities. As I mentioned on our last earnings call, the increasing sophistication and intensity of modern cyber threats are exposing the growing shortcomings of incumbent security solutions. Even so-called modern technologies are aging faster than ever. As a result, customer awareness and interest in our platform and AI-based security have risen.

We’re beginning to see notable strength with new and large customer additions. In Q3, we added a record number of $100,000-plus ARR customers, which grew 24% year over year. Our customers with more than $1 million in ARR grew even faster. Overall, our success with large enterprises and platform adoption continues to drive higher ARR per customer which reached a new record in Q3 as well.

In parallel, we continue to maintain healthy expansion rates with our existing customer base. We continue to see substantial growth potential with our install base over the long term. In October, we hosted our first investor day at our OneCon customer conference. It was a terrific event with record attendance, plenty of excitement, and great customer conversations.

A central point of the discussions was the evolution and expansion of Singularity, from an endpoint-centric solution to now one of the broadest, most performant, and reliable enterprise security platforms in the market. Regardless of the size or industry, our customers benefit from our modern data analytics architecture, cutting-edge AI security models, and broad coverage across endpoint cloud identity and more. The Singularity Platform has earned prominent recognitions across the industry, including being named a leader in Garter’s Magic Quadrant for Endpoint Protection for a fourth consecutive year; leading MITRE evaluations also for four years in a row, a clear demonstration of Singularity’s undisputed security efficacy; Cyber SecOps Innovation Award for Purple AI; receiving SC Media’s top honors for best enterprise security solution and best endpoint security solution; and just yesterday, Singularity Cloud Security was recognized as the overall winner for CRN’s Cloud Security Product of the Year. These recognitions are a testament to our innovation leadership and platform differentiation.

We’re delivering larger platform wins and expansions among both new and existing customers. These are powerful security and data capabilities. Each of our platform solutions delivers functionality equivalent to deploying multiple modules from competing vendors. We sell solutions, not an endless list of modules and point features.

Our platform coverage positions SentinelOne as a strategic cybersecurity partner for enterprise. Among many platform wins in Q3, a major international retailer adopted endpoint, cloud, and identity security, Purple AI, and threat hunting services. This broad platform deal was a multimillion dollar expansion that doubled the ARR of the customer. In another example, a leading technology provider selected endpoint and cloud security, network visibility, and AI SIEM for a multiyear and multimillion dollar deal.

Purple AI was a “must have.” With the Singularity Platform, we help enterprises seamlessly aggregate data and leverage industry-leading AI. We continue to see outsized growth from our cloud, data, and AI solutions. At OneCon, we detailed the rising scale and opportunity with cloud and data, exceeding $100 million and $70 million in ARR, respectively. These solutions continue to drive premium growth for our business and represent unbounded opportunities in massive target markets.

As one of our newer capabilities, Purple AI remains a true source of platform differentiation and growth. The market response and interest in Purple has been extremely positive. In Q3, the attached rate of Purple AI across all eligible endpoints doubled compared to Q2. Purple is one of the fastest-growing solutions in SentinelOne’s history and will continue to drive meaningful growth into the future.

Gen AI for security use cases is a force multiplier for security analysts. Customers using Purple AI enjoy real gains in productivity to streamline workflows and more automation. And Purple is continuously getting better. We recently announced auto alert triage, threat hunting, and investigation capabilities.

We’re giving security analysts the tools they need to manage hundreds and thousands of alerts in just minutes, giving them the upper hand against threats. Importantly, we are committed to ensuring that our AI capabilities are used ethically, safely, and securely. Our AI models provide transparency and ensure that customers maintain complete control of their data within our platform, keeping sensitive information in the hands of its rightful owners. Also, at OneCon, we introduced AI SIEM, a foundation for real-time autonomous cybersecurity for the future.

AI SIEM is so much more than just next-gen SIEM. By ingesting and synthesizing data from across the security ecosystem, our AI SIEM provides full visibility, real-time detection and streaming data, accelerating investigation, and autonomous responses. We’re empowering enterprises to supercharge security operations and fight AI with AI. Our technology and vision are resonating with customers and partners.

As an example, a major federal agency selected both endpoint and AI SIEM for unified threat visibility in a single platform, proactive threat hunting, and automated rollback capabilities. We’re also seeing MSSPs expand their platform adoption with emerging solutions like Purple AI and Singularity Data Lake to reduce costs and improve visibility and security for their customer base. In addition to Purple AI, we’re pairing AI SIEM with our recently announced hyper-automation capabilities. SentinelOne is bringing more automation use cases with next-gen SOAR and making it faster and easier to use, all without code.

It’s unlike any other data or SIEM solution on the market and will further unlock the legacy SIEM opportunity. In cloud security, we continue to see strong adoption of our leading cloud workload protection solution. And the combination of agent-based and agent-less capabilities offers a comprehensive approach to securing the cloud. Building on our industry-leading CNAPP capabilities, we recently announced AI security posture management to protect and secure the use of gen AI services in the workplace.

Singularity AI-SPM gives enterprises visibility into AI services, detecting misconfigurations and vulnerabilities in AI applications and determining potential attack paths. AI-SPM was designed from the ground up to safeguard AI models and pipelines deployed on managed AI services such as Amazon SageMaker, Amazon Bedrock, Azure OpenAI, and Google Vertex AI. We’re enabling enterprises to securely adopt modern AI technologies. SentinelOne customers can confidently embrace AI transformative benefits and competitive advantages while protecting and securing AI data and applications.

Rounding out the discussion of our platform, endpoint remains a cornerstone of enterprise security and a key driver of our business. In light of the unprecedented IT outage on July 19, enterprises are distinctly more focused on the combination of security performance and reliability. We’re engaging with an increasing number of large enterprises. Many of them are getting a chance to evaluate and experience our technology and platform breadth for the first time, and they’re pleased with what they’re seeing.

As a result, we achieved a record number of customer wins against our closest competitor in Q3, more opportunities equating to more wins. In one example, a Fortune 50 company switched to SentinelOne due to the superior platform architecture and efficacy, integration capabilities, and productivity enhancements with Purple AI. We also had a number of federal and local government entities switch to SentinelOne after testing our platform against their existing solution. In all of those evaluations, they found the Singularity platform was easier to use and improved their security posture.

Many of these customers are already considering enhancing their performance and experience with Singularity Data Lake and Purple AI, which are unique capabilities absent from other alternatives. Taking a step back, the shortcomings of incumbent solutions are becoming more apparent than ever before. Siloed solutions, close platform architectures, and human-dependent security solutions simply cannot keep pace with modern threats. We had one customer that utilized SentinelOne to protect servers and Microsoft for endpoints.

After endpoints covered by Microsoft Defender were breached twice in just the past 12 months, this customer turned to SentinelOne for incidence response and recovery and ultimately decided to secure their endpoint footprint with SentinelOne as well. Overall, there is more awareness, consideration, and interest in SentinelOne than ever before. We’re now engaging in opportunities that weren’t available to us in the past. This includes some of the largest financial institutions in the world and other strategic opportunities, as well as more channel engagements.

This will play out in quarters and years to come, as enterprises evaluate, test and come to renew their incumbent solutions over time. The road is open. To maximize our long-term success and scale, we’re strategically expanding our market presence. Let me provide a few examples.

First, we partnered with Lenovo, the world’s largest PC manufacturer. Together, Lenovo will bundle the Singularity Platform and Purple AI on new enterprise PC shipments to enhance security and autonomous protection to millions of endpoints across the world in the coming years. The agreement showcases how SentinelOne can truly partner and not compete with other industry participants. We believe partnering with OEMs like Lenovo can drastically increase the reach and scale of Singularity.

Second, we’re expanding our presence in the federal arena, and we recently achieved FedRAMP High for both endpoint security and AI-SIEM. Going through rigorous testing over multiple years, this designation is a testament of our performance and ability to meet the most demanding security requirements. Third, we’ve expanded our partnership with AWS. AWS customers that choose SentinelOne can now run Purple AI on Amazon Bedrock.

We will continue to deepen our relationship with Amazon, enabling customers to choose and deploy Singularity to one of the largest cloud providers in the world. Finally, as I mentioned earlier, we’re enabling our MSSP partners to adopt more of the Singularity Platform, like Singularity Data Lake and Purple AI. This helps them improve efficiency, enhance security, and expand their business potential. We also recently launched our suite of agent-less CNAPP solutions for MSSPs, including CSPM, CIEM, and more.

All in all, our improving execution, expanding market presence and leading platform capabilities are driving more customer engagement and interest in SentinelOne than ever before. It’s on us to execute well and convert these tailwinds into customer wins over time. We’re working hand in hand with customers and partners to test, trial and deploy the Singularity Platform. We’re focused on building long-lasting relationships and enduring security infrastructure, helping organizations stay ahead of the evolving threat landscape.

Security solutions are strategic and mission critical for enterprises. We’re constantly innovating in building intelligent autonomous cybersecurity for the future. Just this week, we were named to Fortune’s Future 50 list, recognized as a company most likely to adapt, drive, and grow. We have the right strategy, people and technology.

I’m encouraged by the growth and momentum we delivered in Q3. While early, the investments we’re making in expanding our market presence and mine share are fueling one of the highest growth rates in all of software. In this quarter alone, we achieved record contributions across platform solutions, returned to positive new business growth and continued expanding margins. We are positioning the company for long-term share gains across diverse growth opportunities.

With that, I would like to welcome and turn the call over to Barbara Larson, our chief financial officer.

Barbara Larson — Chief Financial Officer

Thank you, Tomer, and thanks to everyone for joining us today. I’m thrilled to be here. Stepping into this role has been an exciting journey, and it’s a privilege to work alongside an incredible team dedicated to transforming cybersecurity. Over the past couple of months, I focused my time on listening, learning, and exploring SentinelOne’s unique strengths and opportunities.

Our mission is to secure the future through cutting-edge technology. From a financial perspective, we’re committed to delivering consistent value and building on the strong foundation already in place. I see clear potential for long-term growth, scale, and operating leverage. Now, let’s review the details of our third quarter financial performance and our guidance for Q4 and fiscal year ’25.

As a reminder, all comparisons are year over year and financial measures discussed here are non-GAAP unless otherwise noted. We exceeded our third quarter revenue and ARR growth expectations. Revenue increased 28% to 211 million in the quarter with strong momentum across all geographies. Revenue from international markets also grew 28% and represented 37% of our quarterly revenue.

In Q3, our total ARR grew 29% to 860 million. Net new ARR of 54 million exceeded our expectations and grew 22% sequentially, significantly outpacing our historical Q3 seasonality. Our Q3 net new ARR increased by 4% year over year, reflecting a 14 percentage point improvement from the growth rate in Q2. This reacceleration of new business growth marks a return to positive growth and demonstrates that we are well-positioned to deliver stronger net new ARR growth in the second half of the year compared to the first half.

This quarter, we added a record number of customers with ARR of $100,000 or more. This reflects our team’s strong execution and improved competitive position and broad adoption of our platform solutions. The growth of our emerging solutions and success with large enterprises continues to drive higher ARR per customer, which increased by a double-digit percentage year over year and to a new high in Q3. Consistent with prior quarters, we continue to maintain healthy expansion rates across our existing customer base.

Beyond top-line growth, our Q3 gross margin of 80% highlights the strong unit economics of our Singularity Platform and disciplined pricing. In Q3, our operating margin was negative 5%, reflecting a 6 percentage point improvement compared to the last year. In Q3, we incurred onetime legal settlement costs and legal fees that are included in our non-GAAP financials. Excluding these one-time expenses, our operating margin would have been approximately negative 3%, consistent with our Q3 guidance.

For the second consecutive quarter, we delivered positive net income. We also achieved positive free cash flow on a trailing 12-month basis for the first time in company history. Importantly, we’re on track to achieve positive free cash flow for fiscal year ’25. Our steady progress toward sustained profitability is driven by increasing scale, improved operational efficiencies, and disciplined cost management.

Overall, we’ve significantly improved our margin and cash flow profile. At the same time, we are strategically investing to expand our market presence and position ourselves for durable growth. These investments are already yielding early results, including increased adoption of our new platform solutions, record wins against our closest competitor, and reacceleration of new business growth. Our unit economics and financial position remains strong with more than 1 billion in cash, cash equivalents and investments and no debt.

Moving to our guidance for Q4 and fiscal year ’25. Given strong net new ARR in Q3 and solid business momentum, we’re raising our full year revenue guidance. We now expect full year revenue of approximately 818 million and growth of 32%, an increase from our prior guidance of 815 million and 31% growth. For Q4, we expect revenue of approximately 222 million, reflecting a year-over-year increase of 27%.

We continue to expect stronger net new ARR growth in the second half of fiscal ’25 compared to the first half. This outlook is supported by positive trends in new customer acquisition, a healthy pipeline, a solid competitive position, and increasing momentum with our data, cloud, and AI solutions. It’s also important to note that we’re still navigating a challenging macroeconomic environment. Organizations continue to focus on cost and efficiency, and we expect these dynamics to continue.

At the same time, the threat landscape remains intense with frequent headlines about new breaches and evolving cyber threats. Now, turning to the outlook for margins. For the full year, we continue to expect gross margin of approximately 79%, reflecting an improvement of over 150 basis points compared to last year. In Q4, gross margin is also expected to be approximately 79%, an increase of about 100 basis points year over year.

For fiscal year ’25, we expect operating margin of approximately negative 4%, consistent with the midpoint of our prior guidance and reflecting an improvement of about 15 percentage points compared to fiscal year ’24. In Q4, we expect operating margin to be about negative 3%, an improvement of approximately six percentage points year over year and an increase of 2 percentage points sequentially. Reflecting on my past few months, It’s clear we built a solid foundation to take SentinelOne to new heights. From an industry-leading AI security platform to a diverse customer base and robust partner ecosystem, I’m constantly impressed by our talented teams and their dedication to SentinelOne’s success.

We’re nearing the milestone of crossing $1 billion in ARR, a significant achievement for any company. As we expand our reach and strengthen our market presence, SentinelOne is well-positioned to protect millions more endpoints and secure tens of thousands of additional businesses across the globe. We remain committed to delivering ongoing leverage in the business as we execute our growth strategy. Our investment approach strikes a thoughtful balance between maximizing long-term growth opportunities and maintaining a strong, responsible and profitable financial profile, a strategy that’s key to scaling SentinelOne to a multibillion-dollar business.

At the same time, we’re instilling operational discipline by identifying ways to enhance efficiency and productivity. Ultimately, our goal is sustainable growth while progressing toward our long-term target of achieving a 20% operating margin over time. One thing remains certain. Our unwavering focus on customers, partners and security has always been and will continue to be the backbone of our success.

I’m incredibly proud of the dedication shown by our team and the progress we’ve made so far. While we’ve already accomplished a great deal, I’m confident that even greater opportunities lie ahead. Thank you for joining us today. I look forward to connecting with our analysts, shareholders, and the broader investment community in the days and months to come.

With that, we’ll now take questions. Operator, please open up the line.

Questions & Answers:

Operator

[Operator instructions] Our first question comes from Brad Zelnick with the company, Deutsche Bank. Brad, your line is now open.

Brad Zelnick — Analyst

Great. Thanks very much, and good to see the ARR momentum continue to build. Tomer, over the last few months, you’ve been very clear that the benefits you’re seeing from market disruption and many of the newer growth levers and execution improvements wouldn’t all show up immediately in your financials. And the trend is clearly positive from what we can see in Q3 results.

But what is it that you see in terms of pipeline and the visibility that you have ahead that gives you confidence in acceleration? And then, for Barbara, how does that inform how you might be thinking about next year at this point? Thank you.

Tomer Weingarten — Chief Executive Officer

Well, clearly, the July outage added to the strong momentum we’re already experiencing. So, you know, we’re starting to see the benefits. And that includes more customer opportunities, record pipeline. And we’re still maintaining the same strong win rate so that will translate over time.

In Q3 alone, we’ve had a record number of wins against our closest competitor. We’ve added a record number of 100K plus customers. Our endpoint growth actually accelerated in Q3. So, it really indicates the opportunity is improving not only across our growth lever with emerging products but really within our core market of endpoint.

I mean, the momentum on all these fronts drove, you know, some incremental upside to the ARR in the quarter, and we believe that’s going to continue. Broadly, enterprises paying more attention to security performance and operational resilience. So, I think, you know, SentinelOne is proving to be the superior platform offering. It is resulting in more consideration for SentinelOne.

It is resulting in bigger deals in the pipeline. It is resulting in just more engagements, and it’s on us to translate these engagements. It’s very encouraging the type of customers that we’re seeing, the industries that we’re serving, the ability to have these conversations, as we mentioned in the prepared remarks. These are conversations we have not had before.

So, this will be positive for us. It continues to be something we unlock, and it’s going to translate into quarters and years to come.

Barbara Larson — Chief Financial Officer

And then, Brad, just in terms of FY ’26, it’s too early to discuss next year’s forecast right now. Our focus is really on executing, innovating, and maximizing the opportunity that we have in front of us. But clearly, we are pleased to see the net new ARR reaccelerate in Q3 and deliver stronger year-over-year growth in the second half compared to the first half.

Brad Zelnick — Analyst

OK. Thanks for taking my questions.

Operator

Next question comes from Gray Powell with the company, BTIG. Gray, your line is now open.

Gray Powell — Analyst

Oh, great. Thanks for taking the questions. And, yes, I’ll echo Brad’s comments. It’s great to see the net new ARR get back into positive territory.

Just in terms of seasonality, maybe I missed this, but what was it that actually drove the, you know, stronger quarter-over-quarter growth in Q3 this year that, was different than prior years? And then, just like how should we think about the sustainability of whatever that driver was?

Tomer Weingarten — Chief Executive Officer

It’s a combination of two main factors, I’d say. One is just the leverage we’re seeing with our emerging products. So, I think you’re seeing more capabilities for us come online, whether it’s Purple AI with double detach rate from past quarter. So, that’s significant.

And cloud continues to grow, data is coming up online. These are all relatively new capabilities for us. So, as they come online we expect bigger lens, we expect bigger deals, and we see that evidence in our pipeline. It was the case going into Q3.

And obviously, the other factor, just the, you know, July 19 outage. Some of the upside that you’re seeing is definitely coming from these customer migrations. We’ve had more, you know, large enterprise displacements than we ever had in the past. So, those two, I think just, drove into a very different type of seasonality that we’ve seen from Q2 to Q3.

And we believe that trend will continue. We believe, according to the pipelines that we’re seeing, that this is something that is sustainable. We will need to translate that. I will repeat that.

But in terms of the pipeline, it’s there, and it’s for us to work.

Doug Clark — Vice President, Investor Relations

Operator, can we go to the next question, please?

Operator

Our next question comes from Rob Owens — absolutely. Our next question comes from Rob Owens with the company, Piper Sandler. Rob, your line is now open.

Rob Owens — Analyst

Yeah. Great. Thank you for taking my question. Curious about what you’re seeing upmarket and the success with larger customers and larger deals just from I guess a macro perspective, number one, and then the motion as you’re selling multiple elements of the platform and where you’re seeing the most success there.

Thanks.

Tomer Weingarten — Chief Executive Officer

Our playbook is definitely evolving. We’re lending more with the entire platform or more components of the platform than a single capability than ever before. And I think that is something that is relatively new for us. I think we’ve always had that motion of upselling and cross-selling and attaching more.

But now, it’s really clear, we’re just lending with more, we’re covering more, and that’s incredibly important. The dialogue with the largest enterprises out there is also very encouraging. You see that evidenced by the average deal sizes that are on the rise. You see that with the record number of $100K and $1 million customers.

So, our ability, you know, to now cater to that higher end of the enterprise, which I believe is gradually being unlocked away from some of these incumbents that were relatively dominant in that part of the market in the past is going to translate to more presence for SentinelOne in the Fortune 500, in the Fortune 100. The other capability that we have, which is AI SIEM or the data analytics capability we have, is one that is actually, you know, a capability that thrives when the macro is what the macro is. And I would not say that customers have stopped scrutinizing, I would not say that customers are not very budget-oriented. But that actually translates into a very good fit to what our data analytics and data solutions can provide, given the immense cost savings that we can create for some of these customers.

And obviously, you know, cyber threats are not going away, so the need for best-of-breed security is structurally there. So, those two things combined, even in this macro, which I still think, you know, is relatively on par with what we’ve seen in the past couple of years. It bodes well to our market motion.

Operator

Our next question comes from Saket Kalia with the company, Barclays. Saket, your line is now open.

Saket Kalia — Analyst

OK, great. Hi guys, thanks for taking my questions here. Barbara, maybe just to start with you, Tomer talked about broadening the market presence with the Lenovo partnership, and it sounds really interesting. Maybe the question is how do you think about Lenovo contributing to net new ARR? Specifically, when does that kick in? And is this going to be something that ebbs and flows with Lenovo shipments sort of on a quarterly basis? Or talk to us about how that layers into the model going forward?

Barbara Larson — Chief Financial Officer

Sure. Thanks so much for the question. In terms of Lenovo, it is a multiyear agreement. We’re in the early innings.

We’re really excited about its long-term potential. This is a strategic partnership. It’s designed to evolve over time. We’re working closely with Lenovo to activate multiple routes to market.

That includes pre-installations, as well as managed security offerings. It also builds on the fact that we have an existing reseller agreement today. So, we’re really extending, deepening our collaboration. And we expect the contributions to pick up in the latter part of next year in terms of revenue as Lenovo starts to ship pre-installed units and as we ramp up co-sell through all of our regions.

So, not going to talk to specifics on deal and ARR, but that’s how we’re thinking about it in terms of the contribution to revenue latter half of next year.

Operator

Our next question comes from Shaul Eyal with the company, TD Cowen. Shaul, your line is now open.

Shaul Eyal — Analyst

Thank you. Hi, good afternoon. Tomer, Barbara, so, I know you slightly raised your annual guidance. I know you guys do not guide or discuss RPO metrics.

It was up, I believe, 24% year over year, which I think would imply maybe a deceleration from last year and think just a 4% sequential growth. Can you talk to us about, you know, RPO trends maybe your thoughts on pricing and contract duration? Thank you.

Barbara Larson — Chief Financial Officer

Sure. Great. I’ll take that. So, for RPO in Q3, we delivered strong year-over-year growth of 25%.

So, that’s relatively in line with our total ARR growth. Just to keep in mind, in Q3 of last year, we signed several large long-term contracts, including with several of our MSSPs, making this a more difficult year-over-year comparison. So, our preferred metric is ARR as RPO can be impacted by contract duration, and ARR removes that variability.

Tomer Weingarten — Chief Executive Officer

And just in terms of pricing, I think, you know, the ability to sell a full platform right now really changes how you think about pricing. There’s no longer a specific price point in the market. Our prices have held steady. You see that reflected in our gross margin, which is definitely best of breed in the market.

We’re seeing, and I think for the past few years, I’ve always seen a player or a number of players, you know, just go heavy on discounts. So, I don’t think there’s anything out of the ordinary in the way that this market has evolved over the years. I don’t think there’s anything too different right now. There’s definitely more discounting by vendors who are maybe, you know, a bit more mindful of the need to preserve their customers, and they’re using deep discounts in order to do that.

We, on the other hand, have always been flexible, transparent with our pricing, and we continue to be that way. It doesn’t stop us from making deals. And in many cases, especially in the markets that we play in, price is not the dominant factor. And we always are incredibly focused on the value that we bring and the cost savings that we can extract.

So, all in all, you know, we’re focused on maintaining our pricing. It hasn’t changed. Gross margin is very high. Is just the realities of the cybersecurity market when it comes down to the different discounting by different vendors.

Operator

Our next question comes from Tal Liani with the company, Bank of America. Tal, your line is now open.

Tal Liani — Analyst

Yes, hi. How important is vendor financing in the market now? I’m asking it because we’ve seen Palo Alto doing it very aggressively. Now, we’re seeing CrowdStrike starting it. Is this something that is required? Or do you see higher requirement by customers? And the second question is just clarification.

You noted a few times that you expect a strong net new ARR for 4Q. Is there any number that you have in mind or any growth you have in mind for a net new ARR for 4Q? Thanks.

Tomer Weingarten — Chief Executive Officer

As for financing, we don’t think that it’s something that is showing any outside demand right now. Financing has been always very apparent in this space, typically done by channel partners. A lot of our channel partners are helping financing customers. We do it every now and then.

I do believe that the focus for every subsequent vendor needs to be on the current capabilities that customers need today. A lot of these financing commitment deals that you’re seeing out there are really dealing with futures. They really aiming toward the future possible consumption of capabilities that may or may not happen. For SentinelOne, you know, we’re very focused on giving customers what they need right now.

If customers require any sort of financing, which I’ve not seen any uptick of, we typically work with a set of partners that can facilitate that. So, all in all, as a as you’re flexible is obviously working with the customer desired ramp. I think there is no need to do anything out of the ordinary. As for net new ARR, you know, we still maintain that we have great momentum.

We still maintain that, for the second half of the year, we are going to be, you know, growth positive. So, all in all, you know, that’s what I can share on net new ARR for Q4.

Tal Liani — Analyst

Thank you.

Operator

The next question comes from Brian Essex with the company, JPMorgan. Brian, your line is now open.

Brian Essex — Analyst

Hi. Good afternoon, and thank you for taking the question. And great to see the reacceleration on ARR. I have two questions.

I guess first one for Tomer. You’ve talked previously about a focus on new logo adds over expansion within the installed base. But maybe if you could help us understand where are you keeping your foot off the gas, so to speak, with regard to investing in, you know, expansion within the installed base, where there’s cross-sell upsell, and how you think about prioritization, or what you’re holding back on as you invest in new logo growth. And maybe the follow-up for Barbara, with regard to just the onetime legal settlement costs in the non-GAAP financials, maybe expand on that a little bit, help us understand what they’re for.

And maybe why those point back to non-GAAP. Thank you.

Tomer Weingarten — Chief Executive Officer

Sure. We’re not really holding back on anything. I just think that we’re letting certain things, you know, kind of come online at their own natural time. Obviously, we still want the majority of our sellers focused on adding new accounts to our estate.

So, if there is one piece where we’re I would say, less focused on driving right now is that upsell and cross-sell within the customer base in, I would say, adjacent footprints. And that, to us, is something that will gradually start to unlock itself as we put more and more playbooks and frameworks into next year. So, expect that, at some point, becoming another growth lever for us. It’s very clear that our customers’ state is under-penetrated with our adjacent solutions, especially if you look at our core endpoint estate.

And that represents an opportunity, revenue opportunity not only for end customers, but also for MSSP partners, OEM partners, many partners that resell our software will have the ability to expand into new markets. But with that, as I mentioned, the focus of our sellers is going after new accounts. It’s going after competitive accounts with any capability. So, we don’t really discriminate, I’d say, between endpoint or cloud or, you know, data analytics.

Whatever the customer needs and lever the account would prescribe is where we go in and where we try to usher more value. So, that to us, and you see that evident in the quarter as well, has been the motion. The dominant part of ARR is coming from new accounts. It’s what we want to see.

But we are gradually starting to balance that with our desire to also become more efficient with our go-to-market motion. And obviously, selling into your own customer state is a more efficient go-to-market. So, those two things will start showing more impact in the next couple of years.

Barbara Larson — Chief Financial Officer

And with regards to Q3 operating margin, as I noted in my prepared remarks, this was impacted by one-time legal settlement costs and legal fees of a few million dollars. Excluding these, our margin would have been negative 3%, so in line with our Q3 guidance. These legal costs were associated with past M&A activity. And during the quarter, we proactively made the decision to settle in order to avoid lengthy litigation, and also minimize the overall legal costs going forward.

Operator

Our next question comes from Joe Gallo with the company, Jefferies. Joe, your line is now open.

Joseph Gallo — Analyst

Hi, guys, thanks for the question. Barbara, I know you’re not giving guidance for next year yet, but can you just walk us through any changes to process you brought to SentinelOne or just your guidance methodology as a whole as we start to fine-tune our models for next year? And then, as a part of that, Tomer, how are customers thinking about their calendar ’25 budgets? Thanks.

Barbara Larson — Chief Financial Officer

Yeah. Sure, in terms of our guidance philosophy, I would just say, overall, it’s to set clear and reasonable expectations that reflects the potential we see in the business. And we based that guidance on what we have line of sight to and what’s in our control, things like pipeline activity, contributions from new products, and anticipated conversion and win rates.

Tomer Weingarten — Chief Executive Officer

And when we look at budgets, I think what customers are currently focused on is still very much cost savings. And I think that if you look at most prominent cybersecurity platform providers, it’s very clear that it’s not only about expanding their presence. It’s also about creating cost synergies. You know, customers are looking for capabilities to fend off AI-based threats, which is a complete new threat vector, you know, from the past couple of years.

Those capabilities are becoming mandatory. So, customers are looking to invest into solutions that can not only fend off these threats but really modernize infrastructure as they think about the speed of response and the need to become more resilient, more robust, and fend off any type of disruption. So, all in all, I would say customers are looking at, you know, spending much like they looked at it in the past couple of years. I think there is more emphasis on the ability for certain vendors and certain technologies to actually create cost savings.

And that we’re also focused where we believe a cloud-native solution set can create significant synergies versus some of the incumbent solutions that you have today. Whether on-premise or converted into the cloud, they cannot perform as well as cloud-native capabilities.

Operator

The next question comes from Matt Dezort with the company, Needham and Co. Matt, your line is now open.

Matt Dezort — Analyst

All right, thanks for taking the question, and congrats on the results. Tomer, for you, I think you talked about more enterprise displacements than ever in the past this quarter. Can you talk about whether pipeline supports continued momentum there, maybe how pricing and discounting are behaving specifically in those conversations? And then, on the flip side of that, you know, how are you seeing your ability to win change, if at all, since July 19th in the 50% of the market that is still leveraging legacy AV? Thanks.

Tomer Weingarten — Chief Executive Officer

I mean, we fully believe that the pipeline supports the continued upward trends into enterprise — into the enterprise market. There is no question that some of the dialogues that we’re having are of a different magnitude of the dialogues we’ve been having in the past. I think that pricing for us has always been our strong suit. I think we were always able to play almost at any price point.

And specifically around endpoint protection, it’s not an issue for us to match anybody in the market. It never has been. And you still see us operate throughout the years at around the 79% to 80% gross margin, which is obviously best of breed. So, as we look into next year, we’re going to continue to be aggressive.

We’re going to continue to sustain our gross margin, and we’re going to continue, you know, having our average contract size be on the rise. I mean, for us, that has been — and we’ve talked about it, that has been a point of focus, and we believe next year could be quite transformative in that regard. We mentioned in the prepared remarks, some of the largest financial institutions, some of the largest companies in the world are looking for ways to address some of the shortcomings that they see with other platforms. I think they look at SentinelOne, they see a technology leader.

Leading MITRE for four years in a row is no easy fit, and I think you’re going to see that carry on into the future. So, it’s not only about pricing. It’s not only about the July 19 outage. It’s about crystallizing the technology leadership that SentinelOne has especially as it pertains to AI capabilities.

And you see that evidence both in the acceleration with endpoint protection market share and both with the attached, with Purple AI, these are obviously pointing you in a certain direction of where we’re seeing the most traction.

Operator

Our next question comes from Shrenik Kothari with the company, Baird. Shrenik, your line is now open.

Shrenik Kotharia — Analyst

Great. Thanks for taking my question. Again, great execution on the net new ARR. Tomer, as well as Barbara, mentioned ARR per customer, of course, hit a new high this quarter driven, of course, by success in large enterprise and highlighted cross-sell, upsell.

Could you help unpack how, perhaps, macro factors like the constrained IT budgets and also the outage dynamic kind of influences sales cycles? Is there a dynamic of potentially larger deals affecting sales cycles getting a bit longer? And I have a quick follow-up here.

Tomer Weingarten — Chief Executive Officer

I think, largely, the macro factors are relatively similar. I don’t think there’s any meaningful or material change in the macro factors or how customers are thinking about those. I also would encourage everybody to kind of think about the July 19 outage as just another factor. I mean, it’s not what’s driving business for SentinelOne.

SentinelOne’s momentum is what driving the business. The technology we have is what’s driving the business. I think this is just more just more consideration that results in. The conversations we’re having are ones that allow us to showcase our technology first and foremost.

And I think that’s the most important part. And as customers see what we can bring to the table, I think this is where you’re starting to feel more at ease to move away from their incumbent solutions. Now, to your point, larger deals do mean larger and longer sales cycles. And that, I think, is what we’re looking at.

This is not a new phenomenon for us. I mean we have been doing large deals in the past. We’re just seeing more and more of those. But we’re balancing all of those, I think, with the growth of the business, we’re balancing all of those with our wins at any part of this market.

So, all in all, to me, this is a complete net positive for us. And while sales cycles will take time, we will translate those and we will consider those one of the most strategic elements of our plan going into next year is obviously, it accelerates and catapults our position in the large enterprise market.

Operator

Our next question comes from John DiFucci with the company, Guggenheim. John, your line is now open.

John Difucci — Analyst

Thank you. Tomer, on that point, yes, it does take time, right? They’re sales cycles and especially for the enterprise. But for the SMB and the mid-market, you talked a lot about the enterprise, those sales cycles are a lot shorter. Now, the results this quarter indicate improving momentum for the business.

Obviously, there’s some investors, I guess, might have expected a little more, but it does indicate that. How — can you comment on how the SMB/midmarket performed this quarter?

Tomer Weingarten — Chief Executive Officer

Yeah. It’s performing well. I mean, I think that we’re definitely seeing even increased momentum there. I think we’re seeing our MSSP partners continue to grow in a very strong way.

So, I think it does contribute all across the board. I can’t, I would say, pinpoint exactly what is outage-driven versus our own innate momentum. But at the end of the day, you know, we are seeing benefits pretty much everywhere. I mean, both geographically and across the different verticals in the market, whether we want to see less or more, I think we always want to see more.

But as I mentioned, our focus is really on extracting more in the enterprise. The MSSP ecosystem for us is one that’s more self-driven. The same goes for kind of the SMB dynamics that we’re seeing. But even there, I think we’re just seeing better win rates and some acceleration.

Again, endpoint is one of these very, I would say, core established markets. So, when you see an acceleration in that market specifically, 10 years into this journey, I mean, that’s very, very encouraging.

Operator

Our next question comes from Trevor Walsh with the company, Citizens JMP. Trevor, your line is now open.

Trevor Walsh — Analyst

Great. Hi, team, thanks for taking my questions. Maybe, Tomer, just following up a little bit on the MSSP portion of your comments that you made just a second ago. In the shareholder letter, you talked about kind of expanding the potential of products within the MSSP, specifically around CNAPP.

Is there a reason or kind of can you help us understand maybe a little bit more detail as to kind of why it’s a more gradual release of products within that space? If it’s more just not wanting those partners to get to over their skis in terms of the technical requirements and enablement, or some other kind of limiting factor and why not just, I guess, let them go kind of more just broadly all at once on the platform. Just help us kind of understand those dynamics, that would be great. Thanks.

Tomer Weingarten — Chief Executive Officer

Of course. It’s, honestly, I mean, more in our hands. We just need to enable them more. We also need to make sure that these products adhere to that multi-tenanted approach that we’ve had over years in kind of the endpoint market.

So, we’re adapting certain elements of our playbook, certain elements of our training to make sure that our products are the right fit for that part of the market. I mean, arguably, not every capability that we have is as prevalent in that segment of the market as endpoint was and is. So, it’s really about making sure that we give customers, the end customers, and obviously, the partners themselves the capabilities that they need. But it’s on us to enable them.

It’s on us to help them articulate the value proposition for these types of customers, and it will happen over time. We have expanded our MSSP team just this past quarter in a pretty significant way. And we’re now working to extract more both from our data lake technology in the MSSP market, as well as Purple AI. Both of those, we believe, are the best fit for that part of the market, even above and beyond, let’s say, CNAPP capabilities.

So, it’s really about what you feel is going to generate the most traction in that segment of the market, which is obviously a bit different than selling to a large enterprise. Obviously, the amount of workloads they have is different. The amount of staff they have a different. The amount of automation they require is different.

So, all of those we are adjusting. We’re making sure that we have the best fit possible in these markets, and then we will continue to enable these partners to succeed.

Operator

At this time, I would like to pass the conference back over to our hosting team for closing remarks.

Tomer Weingarten — Chief Executive Officer

Thank you, everybody, for joining us today.

Operator

That will conclude today’s conference call. Thank you for your participation. [Operator signoff]

Duration: 0 minutes

Call participants:

Doug Clark — Vice President, Investor Relations

Tomer Weingarten — Chief Executive Officer

Barbara Larson — Chief Financial Officer

Brad Zelnick — Analyst

Gray Powell — Analyst

Rob Owens — Analyst

Saket Kalia — Analyst

Shaul Eyal — Analyst

Tal Liani — Analyst

Brian Essex — Analyst

Joseph Gallo — Analyst

Matt Dezort — Analyst

Shrenik Kotharia — Analyst

John Difucci — Analyst

Trevor Walsh — Analyst

More S analysis

All earnings call transcripts