SentinelOne, Inc. Q1 FY2027 Earnings Call

Hello and welcome to the SentinelOne Q1 FY2027 Earnings Conference Call. We ask that you please hold all questions on the formal remarks, at which time you will be given instructions for the question and answer session. Also, as a reminder, this conference is being recorded today. If you have any objections, please disconnect your call. I will now turn the call over to Saat Nazir, Vice President of Investor Relations.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the first quarter of fiscal year 27, which ended April 30, 2026. With us today are Tomer Weingarten, CEO, and Sonali Parekh, CFO. Our press release and an earnings presentation were issued earlier today and are posted on the Investor Relations section of our website. This call and accompanying slides are being broadcast live via webcast and a replay will be available on our website shortly after the call. Before we begin, I would like to remind you that during today's call, we'll be making forward-looking statements about financial performance and future events, including our guidance for the fiscal second quarter and full fiscal year 2027, as well as long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual results or events could differ materially please refer to the documents we file from time to time with the sec in particular our quarterly reports on form 10q and annual report on form 10k these documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons why actual results may differ materially from those anticipated even if new information becomes available in the future. During this call, we will discuss non-GAAP financial measures and all comparisons made are year-over-year unless otherwise noted. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our earnings presentation these non-gap measures are not intended to be a substitute for our gap results our financial outlook excludes stock-based compensation expense employer payroll tax on employee stock transactions amortization expense of acquired intangible assets acquisition related compensation costs restructuring charges, gains on strategic investments, impact of the previously announced ITA tax settlement, and income tax provision, which cannot be determined at this time and are therefore not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our first quarter earnings call. Q1 was a solid start to the year for SentinelOne. We delivered strong revenue growth, record net new ARR growth, and significant operating margin improvement year over year. Total ARR growth accelerated to 23% in Q1, driven by strong new logo acquisition and expansion with existing customers. We delivered $44 million in net new ARR in Q1, a 55% increase year-over-year, setting a new company record. This marks our fourth consecutive quarter of positive NetNew RR growth while exceeding expectations. These results showcase execution consistency and strong business momentum. Our platform strategy is showing solid traction. We have established clear technology leadership across the most critical domains of cybersecurity including AI, data, cloud, and endpoint. Enterprises realize they cannot defend against AI-driven threats by consolidating onto legacy platforms that simply bolt on the separate tools together. What's needed is a natively unified, AI-driven data and security architecture. And that is what SentinelOne delivers. According to Gartner, AI security is the fastest growing segment in cybersecurity, growing more than 70% year over year. AI represents a massive market opportunity for us and a durable tailwind for our business. We are already seeing this momentum with our AI offerings as our AI security ARR nearly doubled again in Q1. AI has been foundational to the Singularity platform from day one. This inherent AI advantage has never been more critical, and we are well positioned to expand our market share across $100 billion plus market opportunity. Now, let's dive deeper into the details of our quarterly performance. We are winning new logos and expanding our footprint across diverse platform categories. Beyond the Singularity Platform's best-in-class efficacy and autonomy, its intuitive design and operational simplicity are driving strong customer adoption. In Q1, our total ARR mix reached an important inflection point. For the first time, the total ARR from our non-endpoint solutions approached 50%. This performance was driven by accelerated ARR growth of our AI security, data, and cloud solutions, a clear testament to the diversity and customer outcomes of the singularity platforms. Our cross-platform adoption drove a record ARR per customer in the quarter, signifying the momentum and contributions across our platform solutions. Overall, we're maintaining a healthy balance between new logo acquisition and existing customer expansion. Given our scale and relative market share, this strategy allows us to increase our market share while still retaining significant future expansion potential. We maintain solid win rates across all competitive situations. We're gaining mind share and market share among customers and partners. Customers of all sizes, especially large enterprises, are increasingly recognizing SentinelOne's AI advantage. Among our platform solutions, AI security continues to be a bright spot, with ARR nearly doubling again sequentially in Q1. Today, Compt Security stands out as the only enterprise-grade scalable solution capable of securing AI at this level, and organizations are recognizing that this is a prerequisite for safely accelerating their AI initiatives. Let's look at our Q1 wins that exemplify this. A US state government selected SentinelOne to secure its AI infrastructure in one of the first government deals led by AI security. With thousands of employees accessing AI tools across sensitive government systems, the need for real-time visibility and governance was urgent. This customer chose Prompt alongside Endpoint Cloud and AI Sim to get runtime visibility into their employees' AI usage while satisfying strict government compliance requirements. Moreover, we are increasingly winning standalone AI security deals from the customers of our direct competitors. This serves as a strategic entry point to expand our broader market exposure. In Q1, an iconic enterprise selected prompt security over the incomplete AI offering of their incumbent next-gen endpoint vendor. Winning this head-to-head evaluation has built tremendous trust. By demonstrating the superiority of SentinelOne's technology, we have opened the door to displace that next-gen competitor and drive broader consolidation for this enterprise with the Singularity platform. As organizations race to build and deploy homegrown AI applications, the attack surface is expanding faster than legacy tools can address it. To close that gap, we launched Singularity AI Red Teaming in May, purpose-built to secure AI applications from the inside out. This solution autonomously stress tests AI applications against real-world attack scenarios before they ever reach production. This creates a highly complementary lend-and-expand motion for us. Red teaming discovers the vulnerabilities in development, and our core platform seamlessly blocks them at runtime. We are now delivering AI security from the first line of code through execution. Next, Purple AI. our Agentex SOC solution is rapidly becoming the bedrock of modern security operations. With the increasingly sophisticated capabilities of Purple, we are empowering customers to respond faster, accelerate detection, and automate investigations. In Q1, we announced the general availability of Purple AI auto-investigations, a major milestone in our journey towards delivering a fully autonomous SOC. Purple AI represents a significant expansion opportunity over time. In several early rollouts, we are seeing instances where ARR from Purple AI's end-to-end deployment can outgrow a customer's core endpoint footprint. Delivering Agentex SOC's autonomous capabilities can drive outsized value. Purple is built for enterprise scale and natively integrated with Singularity Hyperautomation, but its value extends well beyond large enterprises. We've architected Purple to deliver meaningful impact across customers of all sizes. and we see a particularly compelling opportunity with MSSP providers who stand to benefit from significant cost efficiencies and a step change acceleration across their entire operations. At the capability level, Purple's latest auto investigation feature delivers human-level reasoning at scale, providing one-click and soon zero-click automation with clear verdicts in in seconds. This closes the critical gap between insight and action, fundamentally changing what security teams can accomplish. The accuracy we're seeing compared to human analysts makes this a true game-changer, allowing security practitioners to shift from manual investigation to immediate remediation. This is consistent with IDC's finding noting a 338% ROI for Purple AI customers. For data solutions, Q1 marked the fourth consecutive quarter of ARR growth acceleration. We are seeing increasing demand for our AI sim as enterprises seek unified visibility, real-time detection, and autonomous response. All this with far more efficient unit economics than legacy alternatives. With an integrated Observo AI, our customers now benefit from owning the critical data pipeline that powers modern security operations. We are delivering a truly comprehensive security data lake that natively unifies petabyte-scale ingestion, orchestration, and hyper-automation into a single, seamless experience. Among several wins in the quarter, an iconic luxury brand displays Splunk with a multi-year commitment to SentinelOne's AI Sim as their dedicated security data platform. Their global operations needed a solution that offered unified visibility into a single, AI-native platform. The combination of real-time autonomous security and operational simplicity of the Singularity Platform made it a winning choice. In another win, a multinational services enterprise signed a seven-figure expansion with Sentinel One, replacing their existing SIM provider. This enterprise selected the Singularity Platform for superior cost of ownership, machine speed investigations, and AI-native unified platform. Independent validation continues to reinforce our competitive position. A recent IDC business value study found that Central One's AI Sim delivers a 331% three-year ROI with only a seven-month payback period. Our AI Sim customers see 70% faster queries, 75% faster investigations, and four times the threat coverage. For cloud security, ARR growth accelerated in Q1, driven by the strong adoption of our best-of-breed runtime security covering both on-prem and cloud environments. As AI workloads multiply and cloud environments expand, the need for robust runtime security is increasing. Among cloud security wins, one of the most valuable private companies in the world, soon to become public, significantly expanded its footprint with Centrum One in the quarter. To secure an enterprise of this magnitude, static cloud visibility or posture management was simply insufficient. This enterprise doubled down on Singularity Cloud for autonomous AI-powered runtime protection capable of actively neutralizing AI-based threats across their dynamic infrastructure in real time. To secure dynamic cloud environments, organizations need more than static posture management. Our runtime cloud security stops real-world cloud attacks in real-time and seamlessly scales alongside our customers' operation. It is clear that in an AI-driven threat landscape, static defenses are no longer sufficient. Verifying identity at the door is useful, but it doesn't stop modern threats. We've seen this play out repeatedly. Traditional identity access management solutions and PAM solutions were built for the past. They were fine at mapping and governing access, but they were never designed to autonomously detect and respond to what happens next. Attackers often bypass access controls post-authentication, operating undetected inside environments where trust was already granted. Machine speed behavioral analysis and continuous validation at runtime is the key competitive edge and the only formidable defense strategy to stop real-time attacks in the age of AI. As the market pivots towards securing AI agents and frontier models, the endpoint remains the ultimate control plane. You simply cannot deliver comprehensive AI security without deep, foundational visibility at the point of execution, on the host machine that runs AI. AI-powered EDR remains a critical vector for capturing the evolving AI security opportunity. With deep expertise and a significant portfolio of patented machine learning and behavioral detection algorithms, Centrum One is uniquely positioned to protect endpoints and AI workloads directly where they are created and operated. Beyond monitoring access, we align intent to action through real-time behavioral analysis, detecting threats that no identity or parameter control can see. Most recent supply chain attacks, including those targeting LightLM and Axios, underscore this point clearly. These were exploit-free attacks, purpose-built to bypass traditional security controls and move at machine speed. No signature, no known vulnerability, no parameter trigger. The only effective defense was autonomous behavioral protection at the host level, exactly where Center1 operates. These real-world examples reinforce why the execution layer is where the battle is won. We continue to be a growth leader in the broader endpoint sector by delivering the most autonomous endpoint security solution available, combining industry-leading efficacy, performance, and user experience. Nearly half of the existing endpoint sector is still using legacy antivirus solutions. This is a clear opportunity for continued market share gains. We're also beginning to see increased traction in securing highly restricted on-prem environments, where true sovereignty is required, which is a distinct structural advantage for us. While our competitors can't really secure these environments, this provides an emerging growth avenue for us. We have the distinct advantage of delivering fully autonomous, high-velocity AI protection in any environment, both cloud and on-prem. Our expanding customer base now includes some of the most sophisticated and iconic companies on the planet, from frontier AI labs and major financial institutions to critical global supply chains. The world's most demanding organizations rely on and trust SentinelOne. Turning to SentinelOne Flex, it is proving to be a highly effective model for broader platform adoption. We're seeing an increasing number of large deals and contributions from Flex. In just three quarters of its launch, Flex had crossed $200 million in TCV. Looking ahead, our pipeline and demand for Flex shows continuation of this momentum. Central One Flex is simplifying the purchasing process and driving an increasing number of large, seven and eight-figure deals and longer-term commitments. Overall, our success upmarket is directly fueling bigger deals, driving steady retention, and creating a highly visible durable runway for long-term growth. With the growth of token-based AI adoption, we're also expanding our monetization model to capture the full value of how customers use our emerging solutions. Usage-based metering creates a natural growth engine, as customers expand their use of our products like like Security Data Lake and PurpleAI. Customers can choose upfront annualized SentinelOne Flex commitments that provide cost visibility and preferred economics while giving us committed revenue visibility. Together, SentinelOne Flex and prepaid structures create a durable hybrid model, a reliable baseline with meaningful expansion opportunity layered on top. In the partner ecosystem, we continue to expand our reach and scale. Our partner ecosystem is a force multiplier, expanding our global reach and driving broader platform adoption. For MSSPs, the Singularity platform delivers the AI-native multi-tenancy and remote management capabilities that drive valuable operational leverage. This structural advantage gives us a unique competitive edge within the MSSP ecosystem. A strong proof point of this leadership came at RSA, where we announced an expansion of our partnership with LevelBlue, the world's largest MSSP. This partnership drives the strategic consolidation of their endpoint estate onto the Singularity Platform in the coming years and extends our reach across their global customer base. At RSA, we also announced an expanded strategic alliance with Google Cloud to deliver autonomous security at a global scale, and we were honoured by winning the 2026 Google Cloud Partner of the Year Award. Last week, we also announced Singularity Platform's integration into AWS Security Hub Extended. This removes the traditional barriers of enterprise procurement. AWS customers can now turn on SentinelOne's AI-powered runtime security in minutes, directly from their AWS console, without new contracts or procurements. This pay-as-you-go model allows organizations to seamlessly secure their modern digital footprints with SentinelOne. Let's shift gears to the broader industry dynamics. Frontier AI models are rapidly changing cyber defense, allowing adversaries to execute AI-based attacks and weaponize weaknesses faster than human teams can react. To stay secure, enterprises must rebuild infrastructure from the ground up with a unified AI-native foundation. To build modern and secure enterprise infrastructure, we believe a collaborative approach is key to solving this generational challenge. Our relationships with the Frontier AI labs are deep and strategic. We partnered with Anthropic on the launch of Cloud Security and with OpenAI through its early access for cyber program, embedding frontier models throughout our platform. We complement these with our own proprietary and fine-tuned models, and our core engines remain multimodal and model-agnostic by design. AI security is becoming a focal point across the industry with programs like Glasswing or Daybreak. It validates the approach we have been building towards for years, and we are actively engaged with both Entropic and OpenAI to ensure SentinelOne's role in this ecosystem continues to grow alongside our platform leadership. I am also pleased to share that we are a participating vendor in Project Glasswing. Proactive visibility is only half of the equation. We must neutralize active threats at the point of execution. The new class of AI-based attacks are designed to move faster than any human analyst could react. To give the advantage back to Defenders, we launched Wayfinder Frontier AI Services in Q1. With our elite partner coalition, including Mandiant, WWT, KPMG, and Booz Allen, we're fusing multimodal AI with tip-of-the-spear human intelligence. Protecting the AI power business world requires securing the systems where AI is actually being built and used, often Linux and Mac operating systems. While many cybersecurity vendors remain dependent on securing only Windows environments, our established strength to secure Mac and Linux systems give us structural advantages in AI security. We're expanding our native EDR telemetry to protect autonomous AI agents across these operating systems where AI compute is rapidly growing. Our singularity platform's on-device behavioral AI recognizes malicious execution patterns and mitigates the processes preemptively. We autonomously stopped recent supply chain attacks instantly across multiple customers with zero prior knowledge and no human analysts in the loop, before they could do any damage. At Centrum One, we are delivering end-to-end AI security from data to runtime. Shifting gears to our operating model, as always, we remain committed to balancing durable growth with improving profitability and accelerating our path towards the Rule of 40. That commitment requires us to continuously sharpen how we operate. As I outlined in March, we have been actively refining our team structures and go-to-market focus while accelerating our internal use of AI. In alignment with this strategy, we made a difficult but a a necessary decision. We are streamlining our organizational structure, resulting in about 8% reduction in our workforce. This is not a reactive measure. It is a deliberate evolution to reduce complexity, raise the performance bar, and build a leaner, more agile Sentinel-1. On the go-to-market side, we see an opportunity to up-level our teams and streamline distribution. This includes tightening our coverage and driving greater productivity across our sales organization our goal is straightforward driving better operating leverage sales efficiency and execution velocity on the ai side through the company-wide rollout of frontier models we are seeing meaningful productivity gains across our organization work that previously took months is now being completed in weeks and in some cases days together these actions provide us the resources and flexibility to concentrate investments in our highest conviction growth areas AI, data, cloud, and endpoint. Before I turn the call over, I'm very pleased to officially welcome Sonali Parekh to her first earnings call. Over the past months, we have been working closely together. Sonali brings an impressive level of operational rigor that aligns with our focus on execution velocity and profitability. She's a phenomenal addition to our executive team and already making an impact. In closing, I want to take a moment to acknowledge the contributions of all Sentinels, their relentless focus, dedication, and execution drives our success. And thanks to all our customers, partners, and shareholders for their continued support. Thank you again for joining us today. With that, I'll hand it over to our CFO, Sonali Parekh.

Thank you, Tomer, and thanks everyone for joining us today. 60 days in as CFO of Sentinel One, and the conviction that brought me here has only deepened. Q1 was a strong quarter, and it reflects what I've seen firsthand, a platform that is genuinely best in class, a business model with meaningful operating leverage ahead of us, and a market at an inflection point. AI is fundamentally expanding the attack surface, creating new security categories, accelerating customer urgency, and opening growth vectors that are still in their earliest stages. Sentinel One is built for exactly this moment. Now, let's review the details of our Q1 fiscal 27 financial performance and our guidance for Q2 and the full fiscal year 27. As a reminder, all comparisons are year-over-year and financial measures discussed here are non-GAAP unless otherwise noted. Q1 was a solid quarter for Sentinel-1. Our revenue growth accelerated sequentially, growing 21% year-over-year to $277 million. Our international markets revenue grew 25% and represented 39% of total revenue, demonstrating strong international demand and a growing global footprint. In Q1, our total ARR growth accelerated to 23%, and we added $44 million in net new ARR, which comfortably exceeded our expectations. This record net new ARR growth of 55% was driven by new logo acquisition and broader platform adoption within our existing customer base. Our move-up market continues to yield excellent results. Our ARR per customer reached a new company record, led by strong momentum at the top end of the market, where our cohort of customers with ARR of $100,000 or more grew 17% year over year. Our gross retention rate, or GRR, across our customer base remained stable, underscoring the mission-critical nature of the Singularity platform. For customers spending $100,000 or more in ARR, our Dollar-Based Net Retention Rate, or NRR, improved both sequentially and year-over-year, driven by continued success in multi-product platform adoption. We're increasingly landing premier logos, providing us with a highly durable runway for long-term growth. Overall, we are maintaining a balanced split between new logo acquisition and existing customer expansion. Given our scale and relative market share, this focus allows us to increase our market share with significant future expansion potential. This performance clearly reflects the value customers realize from our Singularity platform and our continued success in driving multi-product expansion, and stickier customers. Now, turning to profitability. We continue to maintain a strong gross margin profile, highlighting healthy platform unit economics and scale efficiencies. In Q1, our operating margin of 4% exceeded our expectations and represented an improvement of approximately 550 basis points year over year. Our earnings per share of four cents also exceeded our expectations and represented an improvement of 83% year over year. We are sustaining a top tier growth profile while rapidly expanding our profitability. Most importantly, we are driving this structural operating leverage without compromising our relentless pace of innovation. On a trailing 12-month basis, our adjusted free cash flow margin was 6.5%, representing an improvement of about 440 basis points year over year. We've put the company on a path to sustainable, positive free cash flow growth, which underscores our commitment to durable, profitable growth at scale. Complementing this strong performance, our remaining performance obligations, growth accelerated to 30% in Q1. Our total RPO reached a record $1.5 billion in Q1, a clear validation of the trust we've established with our customers and our commitment to innovation. We ended the year with a robust balance sheet, including $812 million in cash, cash equivalents and investments, and no debt. Looking ahead, SentinelOne is well positioned at the intersection of AI, data, and cybersecurity to lead the industry into the next era of autonomous defense. Capitalizing on this opportunity requires us to evolve our operating model and the way we work. As Tomer discussed, we are implementing a workforce optimization initiative impacting approximately 8% of our workforce. We are harnessing productivity gains to increase our agility and to invest in solutions like AI security, Purple AI, data, and cloud, which are key to delivering durable growth. In connection with this initiative, we expect to incur a one-time restructuring charge of approximately $25 million in the second quarter, which will be excluded from our non-GAAP results. Once fully implemented, we expect this action to result in approximately $45 million in annualized cost savings. This provides us with the financial flexibility to purposefully reinvest in our key growth areas while continuing to drive significant operating margin expansion. With our strong growth profile, clear technology leadership, and growing structural tailwinds, we have all the ingredients to scale into a multi-billion dollar, highly profitable, durable business. Now, turning to guidance for Q2 and fiscal year 27. For the full fiscal year 27, we continue to expect revenue to be between $1.195 and $1.205 billion, representing 20% year-over-year growth at the midpoint. For Q2, we expect revenue to be between $289 and $291 million, representing 20% year-over-year growth at the midpoint. Overall, this outlook is supported by a solid pipeline, strategic partnership opportunities, and rising contribution of our emerging solutions, including AI, data, cloud, and others. As always, we continue to be mindful of the evolving macroeconomic environment and geopolitical uncertainties, which can influence deal timing and sales cycles across the industry. Turning to the outlook for our profitability metrics. For fiscal 27, we are raising our operating income outlook to be between 115 and 125 million, representing an operating margin of 10% at the midpoint, representing a 650 basis point increase over fiscal year 26. For Q2, we expect operating income to be between $23 and $25 million, representing an operating margin of 8% at the midpoint. For full year fiscal 27, we expect fully diluted earnings per share to be between $0.32 and $0.38, representing $0.35 at the midpoint. For Q2, we expect earnings per share to be between $0.06 and $0.08. We continue to expect a non-GAAP tax rate of approximately 17% for the fiscal year 27. And we expect our weighted average diluted share count to be approximately $347 million for Q2 and $350 million for the full year. Taking a step back, our technology leadership and competitive position remain strong. We are scaling the business while consistently driving operating leverage. Our investment approach strikes a disciplined balance between capturing long-term growth opportunities and maintaining a durable, profitable financial profile. This strategy is foundational to scaling SentinelOne into a multi-billion dollar business. At the same time, we are instilling operational discipline with a sharp focus on greater efficiency. In summary, we are well positioned at the intersection of AI, data, and cybersecurity, leading the industry into the next era of autonomous security. Security is no longer just a safeguard. It is a key strategic enabler of AI innovation. With a strong financial foundation, a differentiated platform, and growing market opportunity, we remain committed to delivering shareholder value. Thank you all for joining us today, and thank you to all Sentinels for giving me such a warm welcome. And with that, Operator, we are ready for questions.

Thank you. At this time, if you would like to ask a question, please click on the raise hand button which can be found at the black bar at the bottom of your screen. When it is your turn, you will receive a message on your screen, based on your place in the queue. Please accept, unmute your audio and ask your question. As a reminder, we are allowing analysts one question today. We will wait one moment to allow the key to form. Our first question will come from Metta Marshall with Morgan Stanley. You may now unmute your audio and ask your question.

Congrats on the quarter and the acceleration in Q1. From an opportunity standpoint, are you seeing a pickup in core endpoint as customers try to address technical debt? And how are you balancing selling them the full singularity portfolio at initial sale versus upselling them later. Thank you.

The most important control plane. We're actually seeing a lot of, again, has been phenomenal for us, both in Q4 and in Q1, and will continue to grow, but also the immediate touch or security generative AI protection that is adjacent to the endpoint as well. The endpoint is also expanding. And when you think about where AI workloads are being deployed today, it also spans toward either agentic workloads or other model workloads really strong you know really strong demand thank you our next question comes from brett zelnick with deutsche bank please go ahead thank you so much uh tomur i think we'd all like to hear your thoughts on the extent mythos

daybreak and just the broader pace of ai innovation might be impacting customer spending behavior you know the extent to which it's in some cases maybe accelerating or perhaps even slowing down uh or even expanding budgets any color is helpful and as well why you're well positioned to capture what's ahead of the glass wing new to anybody a big frontier ai services

and open ai we're using these frontier models to go to customer environments and reduce risk immediately that takes sometimes you know hours and days not weeks and months so with the customer and ability to deploy fast and show, you know, immediate returns on these technologies. So I think a lot of customers with what to protect first. And that, again, goes back to my assertion around vulnerabilities. You know, what Minkos brings to bear, what, you know, models are bringing to bear right now, you know, GPT 5.5 as well, is the ability to not only find vulnerabilities in software, but really detect and exploit weaknesses in overarching network infrastructure not just software and not just vulnerabilities and that presents a very wide attack surface once again to stop to mitigate and to help customers reduce risk actively all of those things are obviously in motion a lot of them showed up you know with this mythos moment and will provide for structural tailwinds throughout the year thank you our next question comes from brian sx with jp morgan please

unmute your line and go ahead great good afternoon thank you for taking the question and nice to see the acceleration and better profitability outlook um maybe maybe tomer for you i would love to get some color on the reduction in force that you announced um you know where were the cuts made you know any changes to the sales organization and and i get the productivity you know the ai driven productivity enhancements that you noted but would love to to maybe just connect the dots in terms of where the adjustments were weighed how many to the sales org and maybe the outlook for sales productivity and growth for the rest of the year thank you that's happening you know all the

time capacity then i think we require it is different in the overall business mix i mean that's tremendous and it's our data cloud endpoint these are the growing areas for us this is our major focus and this is the absolutely right thing for the business you know it's never an easy decision but at the same time we want to go we want to you know impacting we are focused organization but we're continuously and always and that's the key point here we are delivering to the market what the market needs we're delivering protection best to breed cutting edge where we're going to be continuously investing thank you our next question comes

from Joseph Gallo with Jefferies. Please go ahead.

Hey, thank you for the question. As a follow-up to that, should we expect any sales disruption, particularly in 2Q? And as a part of that, certainly great to see the improvement in margins. Can you just talk a little bit more about your comfortability that you can capture this massive opportunity and not sacrifice the durability of growth? Thank you.

And as you can probably imagine, you know, this comes on, you know, folks that Again, this will provide more focus.

Thanks for the question, and we are really delighted with the margin progression that we showed this quarter, and obviously it's the upgrade to the operating margins guide for the full year. But I think the short answer is we don't see growth and margin expansion as a trade-off in this case. The investments that actually drive durable growth that Tomer was talking about in AI security, data, cloud, the labs, are exactly where we're reinvesting. So we're removing organizational complexity that was actually slowing us down and redeploying it into the highest return and highest conviction opportunities that we see in the business. And I think the evidence that we can do both is actually already in the Q1 numbers. So this quarter, we delivered record net new ARR, so up 55% year over year, while simultaneously expanding operating margins by 550 basis points. So I think that's really our platform model working at scale. and when I look forward the demand signals give me real confidence so RPO again at a record 1.5 billion growing 30% net retention expanding and our $100,000 plus cohort that's both sequentially and year-over-year to above 110 you know some of our products like prompt ARR nearly nearly doubling again I think these are all leading indicators of durable growth so I think you're to see both durable growth and sequential and annual operating margin expansion. We really feel like we can deliver on both.

Thank you. Our next question comes from Shol Eyal at TD Cohen. Please go ahead.

Thank you. Question to Sona Lee. So now being there a couple of months, have your initiatives you would like to undertake changed or how do you see opportunities to build upon the operating leverage you guys are seeing?

Yes, 60 days I was coming in was really the strength of the Singularity platform. Our product leadership and technology differentiation and then the significant opportunity in front of us for this category, much of which is just really in the early innings. So I think the operating leverage potential of the business as we scale, given our industry-leading growth margins, creates this enormous opportunity to create outside value. And I would say my conviction on that has only increased. So in terms of priorities, my job to ensure we're allocating our resources and investing in the parts of the business where we feel we see the highest opportunity for growth and ROI. So that's data, cloud, AI security, I think will be massive. And you see already our emerging solutions now 50% of our ARR. So it's these areas where we feel like we have real competitive differentiation and you know a significant market opportunity ahead i think prompt is a perfect example of that second you know continuing to improve on the cost structure um you you know you saw the uh announcement we made today on restructuring it's really important that we focus the business i'm going to be extremely focused on unit economics driving operational excellence and discipline across the business particularly in sales and marketing where I see the largest opportunity for productivity improvement in today's results you'll already know we've made a lot of progress in sales and marketing so if you look at sales and marketing is the percentage of revenue q1 it came in at 39% that compares to 47% a year ago and if you think about our upgraded full-year operating profit guide of 10% that's 700 basis points of year-over-year improvement. But I think what's most interesting and compelling really is what that implies in terms of where we're going to be exiting Q4. That's significantly above the 10% guide. So we're on a path to deliver multi-quarter, multi-year margin expansion, which you're already beginning to see. And then lastly, I think it's really important that, and Tomer and I are completely aligned on this we need to put ourselves firmly on the path to rule of 40 which means not just efficiency but durability focused on taking that nrr where we've already seen great progress and and improving upon it um and you know it's not just on the nr side on the dr side we've seen improved logo retention this quarter and stability and i think that just underscores the mission critical nature of our platform and then finally i would just say you It was one of the few platform providers in cybersecurity. The traction we're seeing with the platform is resulting in our ARR per customer reached a new company record. And again, this is just the platform working.

Thank you. Our next question comes from John DeFucci with Guggenheim Securities. Please go ahead.

Thank you. Thanks for taking my question. And congrats to the whole team for the new addition. And it's great to have you, Sonali. um listen you guys put up really strong arr this quarter with growth that accelerated you pointed that out but it's accelerated for the first time in more than three years after three years of somewhat you know moderation which with the law of large numbers you'd expect but frankly the growth in new arr even if you take into account attrition was even better than it's been in almost four years from our calculations so see i know you don't guide to arr but you you maintained your revenue guidance for the year. And I realize it's early, but how should we be thinking about that, given that ARR is really the best determinant of the future revenue? Thanks.

And it is great to be on my first earnings call. So you're absolutely right. We have a great showing on that new ARR this quarter, as you say, record. The growth was driven both by strong new logo addition but also a strong expansion and great contributions from our emerging products. So data ARR accelerated in Q1. I already talked about prompt but that nearly doubled again in Q1 and our class. In terms of the overall guide we did reiterate the guide. What I would say there is we're still pretty early in the year and we still continue to expect positive net new ARR growth for fiscal 27. In terms of the actual revenue contribution on the guide, we did see a fairly back-end loaded quarter with some of those larger deals. And as a larger proportion of our bookings, I think we'll expect to see a bit more of that back-end loading. And that's why you're seeing that from a timing perspective.

But we still are feeling really confident around net new ARR for the year. that makes total sense totally and i was only going to ask one question that's i don't believe it the second one would have been a linearity but you read my mind thank you our next question comes from fatima bulani with city please unmute your line and go ahead please unmute your line we will come back to you at a later point our next question comes from shranik qatari with bared. Please unmute your line and ask your question.

Hey guys, this is Zach Schneider on for Shrenik. Thanks for taking the question. So maybe one on capital allocation, you know, now with 800 million plus in cash path towards 100 million plus in free cash flow generation, no debt, you guys have, it seems much more flexibility than you've had historically. So maybe how should we think about capital allocation going forward?

And are there any changes there in strategy? um or priorities thank you sure thanks for the question um so yeah we we feel really good about where the balance sheet is a very robust balance sheet i think our capital allocation priorities really haven't changed um so we will continue to focus on organic investments that drive our growth um we will consider inorganic investments but i would say there's a fairly high bar there so it would be very selective and would need to be extremely strategic and then finally we absolutely you know we'll use our strong balance sheet and free cash flow to give us the flexibility and capacity to be able to offer to opportunistically repurchase our shares given the long-term potential of our business and you know so long as we believe it's a positive ROI initiative which certainly at current levels we would so I would say we are capital allocation policy is dynamic and opportunistic. And again, we will do our best to take advantage of any dislocations in the market and also maintain a strong cash position to support our innovation and strategic initiatives from here.

Great. Thank you.

Our next question comes from Richard Poland with Wells Fargo. Please go ahead.

Thanks for taking the question. I guess if you just think about the balance of the reinvestment that you're making, I think you want to find it somewhere in the range of 45 million in annualized savings from the reduction, I guess, as we think about how that flows through to investments and just kind of how you're calibrating, you know, how much drops to the bottom line versus how much gets put back into things like AI. Can you help us, I guess, just contextualize that the rest of the year?

For the full year, we're now guiding to about 700 basis points of year-over-year operating margin improvement. And as I said earlier, that would imply exiting at an operating margin significantly above that 10%. And we also talked about the desire to balance growth and profitability and we felt strongly that there were areas where we had high conviction around parts of the market and products where we wanted to reinvest some of those savings. So we talked about AI security, we talked about cloud data, we really feel like those are the right opportunities to go after right now from an ROI perspective and we feel like we'll be able to We deliver both operating margin expansion and still be able to, you know, again, upgrade that operating margin from where we were a couple of months ago.

R&D and product and technology groups, opportunity ahead, build more. We want to produce more capabilities that we believe, you know, can add massive value to the security. All in all, I mean, you know.

Thank you both.

Our next question comes from Roger Boyd with UBS. Please.

Awesome. Thanks for the question. Tomer, we continue to hear really strong feedback from the channel on Prompt security and it seems like it's already becoming a pretty material contributor to ARR. Can you talk about what you're seeing with Prompt as maybe the tip of the spear for new engagements and have you seen Prompt lead to bigger platform deals, including competitive displacements and endpoint or data lakes? Thanks.

Yes, a single enterprise needs right now and that none of our competitors have so we're seeing both the natural expansion for a customer base plus lending bigger with new logos and even in competitive environments um the ease of use the seamlessness of deployment the time all of those are just radically different than anything else that you're finding in the space today the level of coverage compliance governing right now is being delivered by what prompt um you know can bring to bear so all in all it's a great character of our go-to-market motion. At the same time, you can imagine most of our deploying prompts are also moving pretty fast to enable prompts to be absorbed and consumed by our customer estate.

Thanks very much. Our final question of today comes from Fatima Boulani with Citi. Please go ahead.

Oh, good afternoon. Thank you so much for taking my questions and being patient with me today um so nali uh this one is for you and nice to see you on board here um just looking at the deferred revenue and billings performance i know you don't manage the business to billings but just as we sort of uh you know look at the the deferred revenue cadence was there anything atypical or different here that happened uh just as we noted um some weaker seasonality and some of the growth metrics on the deferred revenue side uh and maybe tying it back to some of your commentary with respect to net retention rate, maybe outside of the 100K ARR cohort and on some of the gross retention rate comments you alluded to earlier. I would love any incremental color on why we maybe saw that come out as seasonally weaker than prior periods. Thank you.

Yeah, sure. So on billings, I would say there's nothing specific to call out other than the fact that this metric can move around a bit just due to the timing of invoicing. So we tend to focus and we actually run the business much more around net new ARR as our key operating metric where obviously we saw a record number this quarter. In terms of GRR, we saw continued stability. It's actually, you know, when I first arrived here, of course, I was looking through all the metrics. It's actually been stable for many, many, many quarters. And I remember seeing that and thinking that's an extremely strong sign just in terms of the stickiness and mission criticality of our platform like when when when we win a customer they stay with us um i think up to now where we've seen some um uh uh where just an impact on on net retention has been on the expansion side of things and i think we saw positive traction there with some of our um larger customers this quarter which helped to uh drive net retention up and that's something i said uh I think in Mita's question, you know, around priorities, it's something that I'll be really focused on. And when I look at, you know, some of the signals, you know, as we look forward to coming quarters, that's a metric that I expect to continue to improve. And again, that's what gives me confidence on the full year guide as well, is that will be a key support that improving net retention, right?

Because of course, every point we improve on that retention you know helps it create a tailwind on revenue thank you appreciate that thank you we have now reached the end of our lots of time for questions I will turn the call back over to mr. Weingarten for closing remarks