Good evening. Thank you for joining today's SentinelOne Q4 2022 Earnings Call. My name is Hannah, and I will be your moderator. I would now like to turn the conference over to our host, Doug Clark, Investor Relations of SentinelOne. Please proceed.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the fourth quarter and fiscal year 2022 ended January 31. With us today are Tomer Weingarten, CEO; Nicholas Warner, COO; and Dave Bernhardt, CFO. Our press release and a shareholder letter were issued earlier today and are posted on our website. This call is being broadcast live via webcast, and following the call, an audio replay will be available on the Investor Relations section of our website. Before we begin, I would like to remind you that during today's call, we will be making forward-looking statements regarding future events and financial performance, including our guidance for the first fiscal quarter and full fiscal year 2023, as well as certain long-term financial targets. In connection with our recently announced definitive agreement to acquire Attivo, management will provide additional information as to the benefits of the acquisition. However, we will not factor the planned acquisition into our fiscal '23 guidance at this time. We caution you that such statements reflect our best judgment based on factors currently known to us and that actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our S-1, our quarterly report on Form 10-Q and our annual report on Form 10-K that we filed. These documents contain and identify important risk factors and other information that can cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during this call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons actual results differ materially from those anticipated in the forward-looking statements, even if new information becomes available in the future. During this call, unless otherwise stated, we will discuss non-GAAP financial measures. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in today's press release and in our shareholder letter. These non-GAAP measures are not intended to be a substitute for our GAAP results. The financial outlook that we provided today excludes stock-based compensation expense, employer payroll tax on employee stock transactions and amortization expense of acquired intangible assets, which cannot be determined at this time and are, therefore, not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fiscal fourth quarter earnings call. This was another excellent quarter, and I'm extremely proud of the entire SentinelOne team. Our ARR grew 123% year-over-year in the fourth quarter, marking the fourth consecutive quarter of triple-digit growth. In today's digital world, cybersecurity is mission-critical infrastructure in every geography, industry vertical, and organization size. The demand environment remains incredibly strong. We continue to scale our business due to our cutting-edge autonomous XDR platform and our powerful partner-supported go-to-market strategy. We've built an AI-driven security platform that spans endpoint, cloud, IoT, data, and now also identity. I'm thrilled that today, we announced our plan to acquire Attivo Networks. Attivo is a premier and highly differentiated solution that will enable us to provide cybersecurity in one of the most critical and dynamic parts of enterprise security today, the identity parameter. With Attivo's user-centric identity capabilities, we will be able to support an even more comprehensive zero trust framework. I'd also encourage everyone to read our shareholder letter we published on our Investor Relations website, which provides a lot more detail. Let's take a look back at our fiscal '22. It was a groundbreaking year for SentinelOne. We started the year as a private company, delivered triple-digit revenue and ARR growth rates through all 4 quarters, and ended the year as one of the fastest-growing technology companies in the public markets with outstanding growth in ARR rapidly approaching $300 million. Throughout the year, we celebrated accomplishments that highlight our product market fit, innovation, and superb customer experience, such as being a Leader in the 2021 Gartner Magic Quadrant for Endpoint Protection, achieving the highest scores in Gartner Critical Capabilities use cases, and being the only vendor with 100% visibility and no misdetection in the latest MITRE evaluation. In the Forrester XDR Wave, we were named the best fit for companies that want customizability and to grow into XDR. Our fourth quarter and fiscal '22 results demonstrate the relentless execution of our teams and focus on innovation. We're protecting more enterprises today than ever before at faster speeds, greater scale, higher accuracy, and with more automation. Automation has never been more critical to tackle the complexity of today's threats. I'd like to dig deeper into 3 key points about our performance. First, our success with large enterprises underscores the scalability of our platform. We added a record number of $100,000-plus ARR deals, a record number of million dollar-plus ARR customers, and closed our largest ever net new customer contract with one of the most influential and leading global Internet companies. Nick will discuss this in more detail later on. Second, we paired our phenomenal growth with significant progress towards our long-term profitability targets. I'm pleased to share that we ended the fourth quarter with double-digit year-over-year improvement in both our gross and operating margins. Our gross margins expanded 12 percentage points year-over-year, and our operating margin improved 38%. This progress reflects our growing scale and increasing efficiency. Looking at the full year, fiscal '22 was an investment year for SentinelOne. It featured our IPO, solidifying our brand as an industry leader, as well as investments in our go-to-market and innovation engines. We doubled our total workforce. I'm proud that SentinelOne was named to Comparably's Best Company Culture List and received the 2021 Great Places to Work award. Given the significant market opportunity ahead, we remain committed to investing in the growth of our business. And just like we did last year, we intend to balance this growth with further margin improvement in fiscal '23. Finally, our business is performing extremely well with broad-based strength across new customer adds, existing customer renewals, and upsells. Throughout the year, we significantly expanded our platform offerings. Our endpoint solution remains the primary driver of our business, which is being complemented by emerging growth vectors, including cloud, IoT, and data. We're still in the early stages of a large and expanding total market driven by the proliferation of remote work environments, digital transformation, and an evolving threat landscape. It's clear that we achieved a lot as a company in the past year, but we must remain as vigilant as ever around the threat landscape. The persistence and sophistication of new attacks continue. We entered 2021 on the heels of Sunburst and exited the year battling Log4j. Most recently, the potential for cyber warfare has significantly increased in light of the Russia-Ukraine conflict, further escalating the threat environment. Our vision is to be a force for good, and we're committed to doing our part to help affected people and businesses in Ukraine and around the world to stay cyber secure. We've established a Ukraine Crisis Resource Center and began offering free access to Singularity XDR for cyber threat protection in Ukraine. We ran similar programs to help others in the wake of Sunburst, and we're committed to defending against cyber warfare. Threat sharing and collaboration are essential to our collective mission against cyberattacks. Our teams at SentinelLabs are leading the way by uncovering some of the most sophisticated attacks across the world. Our global footprint puts us in a unique position to not only protect our customer base in real time but also produce novel research to educate and arm the cybersecurity community. We're able to leverage the power of our partner ecosystem to stay on the front line with leading incident response providers like Mandiant, KPMG, Kroll, RSA, and many others. As an example, we recently named and published research on HermeticWiper related to the escalating cyber attacks surrounding the Russia-Ukraine conflict. This was a real-time discovery on the eve of Russia's ground invasion. It helped bring awareness to cyberattacks accompanying modern warfare. Our publication was followed by an alert notice from the Cybersecurity and Infrastructure Agency, highlighting the significance and relevance of SentinelLabs' research. If we look at the evolution of cybersecurity technologies for a moment, it's clear that legacy AV represents the past, EDR is the present, and XDR is the future. While the majority of enterprises still utilize legacy AV solutions, we have undoubtedly entered the XDR era. At SentinelOne, we established the foundations of XDR by pioneering the world's first purpose-built AI-powered autonomous cybersecurity platform. Singularity XDR brings the critical capabilities customers need from a comprehensive cybersecurity platform: speed, scale, and automation. Enterprises are increasingly selecting SentinelOne for our best-of-breed XDR. Over the past year, we significantly broadened our platform capabilities by introducing several mission-critical and highly differentiated innovations. I will briefly highlight a few of these. First, we enhanced our network visibility and control capabilities with Ranger Pro. Ranger helps enterprises eliminate one of the most commonly exploited threat vectors: unprotected and rogue assets. It reduces the attack surface by offering device mapping and management capabilities. Second, we introduced Storyline Active Response, our engine for automated threat hunting, detection, and response. Next, we developed Remote Script Orchestration, a powerful endpoint management tool for both IR partners and enterprises. Finally, we launched Singularity Mobile, a new AI-powered mobile security solution for iOS, Android, and Chrome OS devices. Building upon the acquisition of Scalyr, we launched DataSet in February of this year, a revolutionary live enterprise data platform for data queries, analytics, insights, and data retention. DataSet expands our capabilities beyond cybersecurity use cases. It's a cloud-native, flexible enterprise data platform built for petabyte scale. DataSet is the backend for our Singularity XDR platform, and the technology is already being used by hundreds of enterprises, analyzing trillions of real-time events. Customers like DoorDash, Copart, Asana, TomTom, and many others are selecting DataSet to unlock the power of their own data with speed, scalability, and technology-driven cost advantages. Our platform approach is resonating and is contributing meaningfully to our financial performance. Endpoint continues to fuel the company's growth. At the same time, we're seeing outstanding traction with our adjacent platform technologies and capabilities. Over a third of our fourth quarter new business was driven by our Singularity modules and DataSet, up from about 20% a year ago. Across all of our capabilities, our cloud workload protection and data retention modules have been the most outstanding, each delivering year-over-year ACV growth of over 10x. Let me spend a second on cloud security. This is one of the fastest-growing markets in security today, and we're already doing extremely well on this front. Demand for our cloud workload protection solution has been broad-based, both within our installed base as well as with new customers. Cloud security represents a sizable opportunity for SentinelOne for years to come. And today, we are further expanding our addressable market and extending our XDR platform capabilities with our planned strategic acquisition of Attivo Networks. We're adding another growth vector to our platform. Identity now joins endpoint, cloud, IoT, and data. I couldn't be more excited to introduce everyone to Attivo. Attivo aligns with the M&A strategy we previously outlined. First, it expands our addressable market into a $4 billion and growing identity TAM. And within that, Attivo is capturing share, growing its ARR north of 50%. Second, user-centric identity protection is highly complementary and value-add for our XDR platform and customers. It opens new customer and cross-sell opportunities. Finally, it has a compelling financial profile and strong cultural fit, additive to our hypergrowth and accretive to gross margins. Identity is a critical component of the enterprise parameter and zero trust framework. Attivo's market-leading identity offerings help organizations keep passwords safe, admin privileges restricted, and user identity intact. Attivo Networks has the right technology and the team to advance our portfolio and is a natural extension of our Singularity XDR platform and go-to-market strategy. Misused credentials are now one of the top techniques used in breaches. If an attacker can compromise the endpoint, they will often look for the next layer of vulnerability, the user's credential. If successful, attackers can install backdoors, exfiltrate data, and change security policies. Attivo, as part of SentinelOne, will help organizations reduce their attack surface not only at the device level but now at the human identity level, too. Attivo has a clear product market fit with an established customer and revenue base. Its differentiated and battle-tested solution is already trusted by over 300 customers from Fortune 500 enterprises to government entities. Attivo is not just any identity company or technology; we strongly believe that it's the best and most comprehensive identity security platform in the market today. Let me briefly introduce you to the 3 parts of the Attivo platform. First, identity protection is an agent-based solution that secures credentials and detects malicious identity behaviors. It delivers real-time protection against credential theft, privilege escalation, lateral movement, and more. Second is identity infrastructure assessment, identity-based vulnerability scanning, and management for enterprise infrastructure. Attivo's scanner provides instant visibility of active directory misconfigurations, suspicious password changes, and unauthorized access. This complements our Ranger network asset visibility and control capabilities and now folds in a user-centric identity view. Third, identity power deception. Attivo's deception solution makes attackers reveal themselves, their methods, and targets through misdirection. This sums up to a multi-layered approach and a broad set of capabilities to fend off, not just detect, identity-based attacks. Attivo will put us front and center in the identity security market. As Dave will discuss later financially, even in the early stages of a joint go-to-market, this acquisition will add to our hypergrowth trajectory. I'd like to share a few closing thoughts. There has never been a greater enterprise need for a modern cybersecurity platform, which means a tremendous business opportunity for SentinelOne's world-class autonomous protection. We are still in the early innings of our innovation and growth. Our outstanding fourth quarter and fiscal '22 financial performance speak for themselves, with triple-digit revenue and ARR growth paired with double-digit non-GAAP margin expansion. We're perfectly positioned for continued success and expansion of our business even in times of global uncertainty. Our growth journey continues, and I want to thank all customers, Sentinels, and partners for making all this possible. With that, I will turn the call over to Nick Warner, our Chief Operating Officer.

Thank you, Tomer, and welcome, everyone. We delivered an outstanding fourth quarter across every geography, driven by our go-to-market flywheel of sales, marketing, channel, and technology partners. More large enterprises are selecting SentinelOne than ever before because of our industry-leading efficacy, automation, ease of use, and differentiated XDR capabilities. I'm also excited to welcome the Attivo team. Listening to customers and following many of the largest incidents in cybersecurity over the past few years, identity is a critical vector in delivering the most complete XDR platform. Not only is it a natural fit within our platform, but it will complement our network of strategic service providers extremely well. In Q4, we reported impressive ARR growth of 123%, reaching $292 million. This growth was driven by a healthy mix of new customer additions, renewals, and upsells. Our momentum with large enterprises was particularly strong this quarter. We added a record number of customers with ARR over $100,000 and a record number of million dollar-plus ARR customers. All of this is extraordinary and reflects the success of our sales and marketing organizations. Let me share more on this. Our customers with ARR over $100,000 grew 137% year-over-year to 520. In Q4, we closed the largest new customer deal in our history with one of the most influential and leading global Internet companies. This win came after an intensive evaluation process, including other next-gen security providers. I'd like to highlight one additional win, which is emblematic of what we're seeing in the market. Like most Fortune 500 companies, this enterprise was using multiple operating systems. They lacked true security parity across all surfaces. Their existing next-gen EDR vendor failed to quickly deploy and left critical Mac and Linux attack surfaces unprotected. They terminated their existing 3-year subscription mid-flight and turned to SentinelOne. Singularity XDR deployed instantly across the whole enterprise, expedited by our patented Ranger discovery and auto-deploy capabilities. The customer has become a fantastic partner and is benefiting from our true cross-platform feature parity and automation. We also closed new deals with many other large enterprises across verticals from technology to global consumer brands to financial services companies. SentinelOne is winning more market share in every major geography, replacing incumbent vendors of all types and winning against the competition. In total, at the end of fiscal '22, we secured over 6,700 customers comprising both large enterprises and medium-sized businesses. That's total growth of more than 70% or almost 3,000 more customers compared to last year. Our total addressable market is large and expanding. A majority of the market still utilizes legacy antivirus solutions. The competitive environment has not changed. We've maintained incredibly strong win rates in all competitive situations against both legacy and next-gen vendors. What's more exciting is that the opportunity per customer is much larger today than it was for legacy providers in the past. This is because of the breadth of our platform, covering endpoints and surfaces of all types, cloud workloads, Kubernetes, mobile devices, IoT devices, and soon, identity. We, once again, achieved strong retention and expansion within our customer base. Our net retention rate of 129% remained extremely healthy and well above our target of over 120%. Our NRR was driven by footprint expansion, cross-sell of adjacent modules, and upsell from platform tiers. We continue to prioritize new customer growth while at the same time, we are seeing massive success in customers consuming more of the Singularity platform. Our modules and DataSet now represent over a third of our new business. This is broad-based and includes everything from cloud and Ranger to managed capabilities and DataSet. Our cloud workload protection and data modules are delivering the highest growth, each growing over 10x year-over-year, reflecting demand for our best-in-class runtime protection for cloud workloads and unparalleled data retention offerings. I also want to call out our newest endpoint management module, Remote Script Orchestration. RSO has achieved the fastest ramp of any new module in SentinelOne history. Our incident response partners love the ability to remotely manage fleets of endpoints at machine speed in critical breach response moments. Next, I'd like to talk more about our channel partners. Our partner ecosystem continues to magnify our market presence, significantly extending our reach and efficiency. Our strategic technology and services partners have grown to over 20% of our business. This includes MSSPs, MDRs, and IR firms. These partnerships are accretive to our overall growth rate with significant business expansion opportunities yet to be unlocked. Let me double-click on the success of our IR partnerships. Over the past year, we focused on partnering with many of the largest and most sophisticated IR providers in the world. In the fourth quarter, Mandiant selected SentinelOne as a global go-to-market partner. We are becoming the partner of choice for leading IR providers like KPMG, Kroll, Arete, and many others. Our strategy brings the best of both worlds to our joint customers: top incident response consultants leveraging the best-in-class XDR platform. I can't stress enough that we don't compete with our partners. We work with over 100 of the world's leading IR firms, enabling us to address a majority of the IR market worldwide. These partnerships create hundreds of high-value and fast-moving opportunities every quarter. This is significantly more coverage than any single vendor could hope to gain on its own. We are also very excited about our growing partnerships with MSSPs. They continue to expand our coverage across large enterprises and mid-market customers. Leading MSSPs are choosing SentinelOne because of our technology leadership, ease of management, and multi-tenancy capabilities. Today, we are partnering with top-tier MSSPs, including Enable, ConnectWise, Pax8, AT&T, and hundreds of others, many of which exclusively work with SentinelOne. These relationships have helped us achieve significant scale and exposure, complementing our enterprise sales success. Looking at just a few of our top MSSP partners like Enable and Pax8, they represent millions of endpoints now secured by SentinelOne. We're extremely confident about the market opportunity we can jointly address with our MSSP partners as more organizations seek managed solutions. Finally, I'd like to share how we are helping enterprises adopt a zero trust security model by partnering with leading vendors. Our two-way technology integrations with Zscaler, Mimecast, ServiceNow, and many others demonstrate top-tier vendors working together as part of the Singularity ecosystem. This year has been incredible for SentinelOne, filled with innovation and growth. And we began the new fiscal year announcing our plan to add identity to our platform, which further expands SentinelOne's capabilities and offers exciting business opportunities. I'm proud to work with our global team of relentless Sentinels every day. I'm excited about our future. We will continue to deliver on our vision by focusing on execution and listening to our customers. Thank you again for joining us, and let me turn it over to Dave Bernhardt, our CFO.

Nick, Tomer, thank you, and let me also thank everyone for joining us today. I'll discuss our quarterly financial highlights and provide additional context around our guidance for Q1 and full fiscal year 2023. I'll also touch on the financial highlights for Attivo and the full year implications. Afterwards, we will open the call to your questions. We delivered another strong quarter of revenue and ARR growth, both well into the triple digits. We achieved year-over-year revenue growth of 120%, reaching $66 million, and ARR growth of 123%, exceeding $292 million. We added net new ARR of $56 million in the quarter, a new record for the company. We saw strong momentum and a robust demand environment for our platform. The strength of our performance was broad-based, coming from a healthy mix of new customer additions, existing customer renewals, and upsells. All of this was further magnified by the strong underlying seasonality of our fourth quarter. Our business expanded nicely across all geographies. Revenue from international markets grew 140% and represented 31% of revenue. Turning to our cost and margins. Our non-GAAP gross margin in Q4 was 66%, reflecting a double-digit increase of 12% year-over-year. We're seeing the benefits from our increasing economies of scale and business expansion, including strong module attach, platform upsell, and data processing efficiencies. This was partially offset by the temporary costs we discussed last quarter associated with the migration of existing customers to our DataSet backend. We've made excellent progress on this front. All of our new customers are already using the DataSet backend, plus we've already migrated many of our largest existing customers. These customers are enjoying up to 10x performance improvements. We remain on track for our migration plan, and these temporary duplicative costs should be behind us after the first half of this year. When I put it all together and I look at the Q4 gross margin of 66% and a significant improvement compared to last year, I see increasing evidence of scale and efficiencies of our business. Looking at the rest of our P&L, our non-GAAP operating margin was negative 66% compared to negative 104% a year ago, a huge improvement of 38 percentage points. We achieved these impressive results while investing for growth throughout the year, including the IPO, new product launches, and doubling of our workforce. This progress towards our long-term financial targets demonstrates the potential for leverage throughout our business model. We're investing in our business, which is the right strategy given the huge market opportunity and strong demand for our leading platform. Moving to our guidance for Q1 and the full fiscal year '23. In Q1, we expect revenue of $74 million to $75 million, reflecting annual growth of 99% at the midpoint. For the full year, we expect revenue of $366 million to $370 million, reflecting annual growth of 80% at the midpoint. While we don't specifically guide for ARR, I do want to remind you that we are a subscription business. Our ARR and revenue growth track very closely. Our revenue guidance for Q1 implies that we should be at or better than typical Q1 net new ARR seasonality, which has been down between 25% to 35% sequentially in the past two years. We believe the structural tailwinds of digital transformation, hybrid work environments, and an evolving threat landscape will continue to drive customer adoption of our real-time AI-powered security platform. The threat landscape is more complex and elevated than ever before, and our product innovation, brand recognition, and scaling go-to-market have positioned us well to capture the favorable opportunities. For Q1, we expect non-GAAP gross margin to be between 63% to 64% and full-year non-GAAP gross margin to be between 65% to 67%. Our Q1 guidance implies over 10 percentage points year-over-year gross margin expansion at the midpoint. We expect to continue benefiting from increasing scale and better data processing efficiencies. Our guidance also reflects the migration of our remaining existing customers to DataSet, which, once again, we expect will conclude in the first half of the year. As a reminder, these costs are temporary. Based on our full-year guidance, we see the opportunity to achieve high 60% gross margins by year-end. Finally, for non-GAAP operating margin, we expect negative 84% to 86% in Q1 and negative 55% to 60% for the full year. Both of these represent meaningful year-over-year improvements. At the midpoint, we expect Q1 operating margin to improve over 40 percentage points and full-year operating margin to improve over 25 percentage points. We see tremendous opportunity for growth, and the investments we're making today will put us in a position to succeed for the long term. And we're doing this as we make progress towards profitability and our long-term target EBIT margin of 20% or more. Before I close, let me share the key financial points related to Attivo. This should help you as you think through modeling the business for the future. We're acquiring Attivo for $617 million in a combination of cash and stock plus additional retention. We expect the deal to close in our fiscal second quarter, subject to customary closing conditions, including regulatory approval. I want to be clear that Attivo is not currently factored into our fiscal '23 guidance at this time. We expect to incorporate their financials into our outlook after the deal closes on our next earnings call. Attivo is an excellent business that can become even stronger as part of our Singularity platform. They concluded their quarter ended December '21 with over 300 customers and ARR of approximately $30 million, growing north of 50%. For calendar year '22, the current forecast for the business is to deliver revenue of approximately $40 million for the full year. From a margin standpoint, Attivo is accretive to our organic gross margins. But remember, as we expect this to close during our second fiscal quarter, we would incorporate only a portion of that. Attivo and SentinelOne are highly complementary solutions that will open up new customer and cross-sell opportunities, further addressing the needs of larger enterprises. I want to join Tomer, Nick, and all of SentinelOne in welcoming the Attivo team. In summary, Q4 was another excellent quarter with strong execution company-wide, and we're expecting that momentum to continue into the next fiscal year.

The first question is from Brian Essex with Goldman Sachs.

Congrats on a solid quarter. Really nice set of results. So if I'm keeping it to one question, I guess I'll keep it to a rather upfront and obvious one. I guess, Dave, if you could help us understand, I know you're not giving explicit guidance around operating margin impact of Attivo. It's nice to see it will be accretive to gross margins. But how should we think about how you anticipate the impact that's going to have on your model, both this year and next year as maybe it gets a little bit of scale on top of your platform?

Sure. So obviously, we have stated that it is accretive to our gross margin. From an operating margin standpoint, I think this current year, while we take into account our expected integration costs, the margin profile will be very similar to ours. If you take out those costs on a go-forward basis, it would be accretive to ours on an operating margin basis. And we'll have that guidance, obviously, when we specifically guide next quarter.

Got it. Is there a way to think about the overall accretion and overlap on your platform and how that maybe accelerated as you integrate it with your platform?

Yes. I mean on a combined basis, we've got plenty of opportunities to scale, both operationally and with our products as we have this in the go-to-market. It really doesn't change our long-term margin targets right now, but we will have better guidance as we complete the transaction.

I know it's probably a little bit early, but what kind of upsell are you expecting identity security to be relative to your typical customers' core EDR build?

Nick, go ahead.

I think what we're going to see is broad-based demand, especially across our enterprise customers. And as you folks know, enterprise business is our largest part of our revenue contribution. In addition, it's growing even faster than our overall growth rates. So the demand is going to be high, and it's only going to get higher.

Yes. Maybe one small thing to add to that. We've been partnering with Attivo for more than a year now, so we kind of see already the demand that's being generated jointly by the companies. So that just gives us a lot of confidence in our ability to go ahead and really make it an incredibly successful module for us.

I think the one last thing I would mention as well is we've seen an incredible level of interest from our incident response partnerships. And I think we're going to experience a ton of demand coming out of that motion as well.

Got it. That's really helpful. And then just one quick follow-up. If I look at your sales and marketing efficiencies, they improved every quarter this year. What's driving that? And how should we think about the potential for additional gains in fiscal '23?

Well, I think first and foremost, it's getting the right operational pieces in place over the last several quarters, which we worked really hard on in terms of onboarding, training, enablement. But that also extends out to our partner ecosystem as well because a new sales rep is going to be a lot more productive when they're dropped in a region that has mature, veteran, up-to-speed partnerships in place. And that's the state of the union today with our go-to-market.

Let me echo the congrats of others on closing out a great first year. Just on Attivo, I mean, I met with the company quite a few times. And their messaging to me is much more on deception and kind of honeypots and full slags and kind of that domain. What you've been kind of mentioning to us today is much more about identity. So just trying to understand, has the business shifted quite a lot recently to kind of more focus more on identity? Is that how you're kind of trying to pivot the business? Just help me understand kind of that aspect and whether, I guess, deception is going to be part of the kind of go forward with Attivo.

Yes, yes. It's a good question. The business definitely shifted significantly in the past few quarters. They expanded what they're doing, and they leveraged their expertise in understanding Active Directory structure, which is really the vote for our identity to build complete new offerings. If you look at the revenue mix, these are the fastest growing and are definitely showing the biggest traction that they have as a company. It's a threefold type of product portfolio today between what we define as legacy deception, which is still very much needed in today's world, especially as we focus on preventing lateral movement that is not always machine-driven but more user-driven, and then on top of that, the ability to assess risk within Active Directory not just on a go-forward basis but also on a look-back basis allows you to eliminate configuration mismatches or any type of vulnerabilities you already have preexisting in your environment. That becomes a big deal for customers out there today with the sheer complexity of managing identities in on-prem situations. But then the entire identity protection layer, credential protection, all of that, these are new modules that they have built over the last few quarters and are showing meaningful traction for that company. To us, it's just a great multi-layered approach that really addresses in the most comprehensive way today everything in and around identity. We feel it's just a great way for our customers to reduce risk once again in the most profound way that you can when you're looking at the user perspective, including insider threat, which is, to us, maybe an overlooked part of what's happening today in the enterprise landscape, but remains a big pain point for enterprises today.

The next question is from the line of Fatima Boolani with Citi.

This is Mark on for Fatima. Maybe just a quick one on Attivo as well. On the — I guess like going forward, how do you expect Attivo to be sold? Should we think about this as a feature or a new modular capability similar to the ones we've seen with cloud security and IoT SKUs? Or should we expect, I guess, like a different approach here?

Yes. I mean I think what you're seeing in our business is also a complete shift to really platform selling. So when you look at our cloud portion, it's a complete separate module or module package. Identity will be the same. It's basically an identity suite of capabilities. It will be sold on top of the platform. To us, I mean, that's the way that we today see success with our existing modules. Like RSO as an example, it's a complete endpoint management suite, cloud suite, and our identity suite. To us, it's a great way to re-expand what we do, but at the same time, make sure that we're not just continuing and selling just one core endpoint or into just one core endpoint TAM, but with every sale, we expand across TAMs.

The next question is from the line of Saket Kalia with Barclays.

Okay. Great. Tomer, maybe for you, just maybe zeroing in on the core endpoint part of the business. Can you just talk a little bit about how the base looked at the end of the year just around across different Singularity bundles, Core, Control, and Complete? And maybe talk to us how you think about that mix sort of going forward. Does that make sense?

Yes, yes. Absolutely. And I think in kind of a quick follow-up to what I just said, we've really shifted in the past couple of quarters to more of kind of an overarching platform selling approach, which means that we're really focused on selling Complete right now. It's kind of the one and only package you can buy at the enterprise level. And then on top of that, the expansion modules that we've built to date, both towards surfaces, data retention, and now obviously identify in the user perspective. So to us, Complete really becomes kind of the base of what we sell to the enterprise market. I think it accounts for about 75% of our enterprise sales to date. The vast majority of what we don't sell — where we don't sell Complete is through the MSSP channel and in other parts of the market that might not need the fully fledged functionality that comes with our Complete package. But definitely, going forward, the focus here is selling Complete as the base package for our platform and then on top of that, the expansion modules, the expansion suite that, again, today span cloud, IoT, data, and with Attivo identity as well.

And I think all of that really is against the backdrop of our growing success in the enterprise. When we're selling into the enterprise, they're buying more products, more modules.

The next question is from the line of Trevor Walsh with JMP Securities.

Maybe best for Dave. I was wondering if you could speak a little bit to net customer adds on a quarter-over-quarter basis. It looks like from what I'm seeing, around 500 to 700, 700 kind of being kind of more recent record of a net add within any given quarter. Is that kind of how you would expect it to kind of go in this — throughout this year and into next? Or do you have kind of plans from either kind of how your go-to-market teams are getting segmented, etc., to maybe boost that number up considerably? And if you could just provide some color on that, that would be great.

Well, you're right. Q4 was a record quarter, and it wasn't just a record quarter for a number of customers added. It's a record quarter for ARR per customer. It was a record quarter for customers over $100,000 in ARR. It was a record quarter for customers over $1 million in ARR. And lastly, it was also a record quarter for module contribution. So we are seeing absolute positive momentum in the business, and we expect that to continue.

The next question is from the line of Hamza Fodderwala with Morgan Stanley.

I had a question on DataSet for Tomer and for Nick. Tomer, if you could just talk a little bit about how the pipeline is trending for that DataSet product? I know you rebranded it recently off the acquisition of Scalyr. And to what extent this is a one-to-one replacement for some of the existing SIEM and logging solutions out there? And then for Nick, how are you thinking about building the go-to-market engine for DataSet? Is this something that you see that can be sold separate from the Singularity platform? And how are you ramping the reps around that sales motion?

Yes. So again, a record quarter pipeline for DataSet. I mean obviously, in the back of the launch, I mean, it just generated a lot of customer interest. But at the same time, I think what's important to understand is that when you're talking about the DataSet brand, we're addressing the known security use cases. Where you find the SIEM replacement opportunities, to us, this is going to come on the back of Singularity XDR. DataSet is the backend technology behind the scenes for Singularity XDR. But our way to address security use cases is with Singularity, with the Singularity brand, with the SentinelOne brand, and with XDR. So head-to-head SIEM replacements are ones that we're addressing with our XDR platform. When you talk about logging platforms, search capabilities, real-time event data monitoring, that's what we do with DataSet, and that's where we're seeing a ton of traction right now. So to us, DataSet is really focused on addressing all use cases above and beyond security. We're leaving the SIEM replacements to our XDR approach, which we truly believe is the next incarnation of SIEM. It's much more of an active solution to aggregate security events. We're going to be opening up ingestion at scale from every product that you have in your enterprise ecosystem and into the XDR platform.

Our go-to-market for DataSet is twofold. We have a specialized sales force for data analytics, but we've also incented our entire sales force to be able to cross-sell DataSet. And this approach is working great. In Q4, we closed large 7-figure deals like a new business deal with Copart. We also grew customers like DoorDash well into the 7 figures from an ARR perspective.

The next question is from the line of Rob Owens with Piper Sandler.

I was wondering if you could unpack some of the trends you're seeing in your sales and marketing line, which has been somewhat flattish over the last couple of quarters relative to forward thinking around capacity additions, where you're at, and what a return to office might look like for that line.

I can start a bit from the financial standpoint. I think what we're seeing is we're just continuing to see more efficiencies and productivity gains. When I think about the time of marketing expense, obviously, with it being our IPO year, they were more heavily weighted to the front of the year. We're continuing to invest in sales and marketing to support the growth of the business. The past year has been a huge year of growth for us, whether it's the IPO, the meaningful jump in scale, the growth of the platform, or just bringing us a little further up in the mindset of buyers. This has just been a really important year for SentinelOne.

Well, we doubled our sales force last year. We're going to continue to aggressively hire as we get into the end of the year. As I mentioned before, we're really pleased with the productivity and performance of our teams. And again, I want to stress again, so much of that is a benefit of our channel ecosystem. What we have out there is the ability to punch well above our weight. Instead of having a few hundred sellers out there, we have thousands of sellers out there that are interacting at all different life cycle stages and parts of the organization. The question I just answered around DataSet – that's a conversation with the CIO. That really uplifts our brand and visibility outside of just having CISO conversations. So when you think about scaling and building out a team, what they're inheriting now is a great brand, incredible momentum, and a huge channel ecosystem. What that makes us really confident about is forward hiring, increasing our scale and capacity, and being able to do so very successfully.

Yes. Just a quick add to that. Our magic number has been over 1, and it's continuing to expand. We obviously track efficiency very closely, and we're very pleased with the progression. That gives us more confidence to continue and scale the business, of course. Couple that with win rates that are consistently strong, and you just get a good recipe for growth.

The next question is from the line of Roger Boyd with UBS Securities.

Just a comment on the partner channel. You noted 20% cost of business now coming through. Given the success you're seeing here and the work you've done in the last 18 months to go and partner with the largest ones, how big could this get as a percent of your business? And as you continue to add end users through these partners, how are you thinking about customer additions in fiscal '23 versus the 3,000 you added in fiscal '22?

I mean I think the growth environment on the partner side is really unbounded. If you think about what we've done, it's not just partnering with security resellers. If you think about partnering with MDRs, MSSPs, and incident response partners, each on their own, those macro ecosystems are growing massively, especially if you look at the MDR and MSSP space. We are growing and adding more of those partners; their own business is growing super rapidly. If you see contribution, it's accelerating, and it will continue to accelerate. What is great about it is it gives us exposure to a broad set of customers, especially with MSSPs that we wouldn't normally touch. We are focusing on enterprise selling, selling that platform motion, and modules, totally focusing on selling Complete into enterprise customers with this amazing collection of modules we have as well. That's why, frankly, we're so excited about the Attivo acquisition. We feel like it gives us several more important arrows in our quiver that we can go out and execute against.

The next question is from the line of Brent Thill with Jefferies.

Tomer, you guys mentioned your large customers are growing 2x your smaller customers. Many are asking what's easing the enterprise friction for you going forward.

I think it's a combination of things, right? I mean I wouldn't — I'd be remiss if I didn't say our brand and our ability to show incredibly well every time the platform is put to the test. I think that's a big driver for us. I think our Ranger capability, which you might look at as just a capability, but it also allows for rapid deployment and discovery of more surfaces in the enterprise. That just speaks to the simplicity of use that our platform really carries. If you take that with the ability to join these enterprises in their journey to the cloud with best-in-breed runtime protection, we're becoming really a one-stop shop for a lot of these enterprises to look at every surface that they currently have. I think that just unlocks more and more traction for us. If you consider our data capabilities, the ability to provide up to a year of data retention out of the box, no customization, just something that you tick off is unique to us in this space. A lot of large enterprises looking for that because otherwise, if they're going with a different EDR vendor, they need to figure out how to retain data on the back of maybe a different platform. That could be incredibly costly. With us, it comes on the back of a single platform. It's the benefit of DataSet that is now the backend of our entire XDR platform. So obviously, that is becoming very tempting to a lot of enterprises there to solve both for security and for data and log retention in one fell swoop.

The next question is from the line of Andrew Nowinski with Wells Fargo.

Can you give us any color on that large deal that you mentioned that was the largest in company history? And was there any significant pricing pressure on that deal and whether we should normalize for that deal when we think about billings growth for Q4 of this year?

Yes. I don't think it's something that we think is completely out of whack in many regards. I mean we do have the pipeline that shows that our large new progression is here to stay, and it's going to expand and hopefully be more meaningful as we progress towards the next quarters. All in all, we think it's just a great win for us. There's no notable pricing pressure outside of the obvious competitive environment. To us, it's just another great indicator for our ability to progress upwards in our large deal velocity trajectory.

The next question is from the line of Joshua Tilton with Wolfe Research.

Just a quick one for me. On the gross margin guidance, would it be possible to give us a sense of what it would have been if you were not digesting costs associated with migrating customers to DataSet in the first half of the year?

Yes. I mean in the past, we've said it was around 4%, so I would say it's in that ballpark. When I think about what it would be if we weren't having duplicative costs, we're expecting this to continue through the first half of the year. Obviously, it's going to dissipate over that time, but we expect the rest of customers to be migrated by the end of Q2. I think you'll see the continued scale on us. As we're looking at how we're going to exit the year, if you look at what our guidance is with these suppressed margins in the first half, I think what you'd perceive from that is that we'd be in the high 60s by year-end.

The next question is from the line of Rudy Kessinger with D.A. Davidson.

On Attivo, it would appear the customer base is certainly much more tilted towards enterprise customers, ARR per customer a bit over double your guys'. How much customer overlap is there? And what kind of opportunities do you have within the Attivo customer base to cross-sell your solutions into those enterprise customers?

There's some overlap, but it's actually quite small. That is an incredibly compelling cross-sell opportunity because what's also even more rare is that there isn't much overlap, but we're ultimately trying to solve the same problems together as a joint solution. We're still selling into the same parts of the organization, especially as it's focused around security. When you think about the Attivo customer base, it's dozens of Fortune 500, several Fortune 10s, really great customers like Aflac and others, and a real strength in federal and public sectors. These are all areas that are going to be highly complementary to our existing business.

That concludes the question-and-answer session, so I will pass the conference over to the management team for any closing remarks.

Thanks, everybody. We appreciate your time and attention today and looking forward to the next one. Thank you.

That concludes today's conference call. Thank you for your participation. You may now disconnect your lines.