Full Transcript: SentinelOne Q1 2027 Earnings Call

SentinelOne (NYSE:S) reported first-quarter financial results on Thursday. The transcript from the company's first-quarter earnings call has been provided below. This transcript is brought to you by Benzinga APIs. For real-time access to our entire catalog, please visit https://www.benzinga.com/apis/ for a consultation. The full earnings call is available at https://sentinelone-q1-fy2027-earnings-conference-call.open-exchange.net/ Summary SentinelOne Inc reported strong Q1 FY 2027 results with a 21% year-over-year revenue growth to $277 million and a record net new ARR growth of 55%, driven by new logo acquisition and platform adoption. The company is focusing on AI-driven cybersecurity solutions, reporting that its AI Security ARR nearly doubled. SentinelOne's strategic initiatives include expanding AI security, cloud, and data solutions, and enhancing the Singularity platform. Looking forward, SentinelOne provided guidance for FY 2027 with expected revenue growth of 20% and raised operating income outlook, demonstrating a strong balance between growth and profitability. The company announced a workforce reduction to streamline operations and boost efficiency, resulting in anticipated annualized cost savings of $45 million. Full Transcript OPERATOR Hello and welcome to the SentinelOne Inc Q1 FY 2027 earnings conference call. We ask that you please hold all questions until the completion of the formal remarks, at which time you will be given instructions for the question and answer session. Also, as a reminder, this conference is being recorded today. If you have any objections, please disconnect your call. I will now turn the call over to Saat Nazir, Vice President of Investor Saat Nazir (Vice President of Investor Relations) Relations Good afternoon everyone and welcome to SentinelOne Inc's earnings call for the first quarter of fiscal year 27 which ended April 30, 2026. With us today are Tomer Weingarten, CEO and Sonali Parekh, CFO. Our press release and an earnings presentation were issued earlier today and are posted on the Investor Relations section of our website. This call and accompanying slides are being broadcast live via webcast and a replay will be available on our website shortly after the call. Before we begin, I would like to remind you that during today's call we'll be making forward looking statements about financial performance and future events, including our guidance for the fiscal second quarter and full fiscal year 2027 as well as long term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual results or events could differ materially. Please refer to the documents we file from time to time with the SEC, in particular our quarterly reports on Form 10Q and annual report on Form 10K. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward looking statements. Any forward looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information except as required by law. We assume no obligation to update these forward looking statements publicly or to update the reasons why actual results may differ materially from those anticipated even if new information becomes available in the future. During this call we will discuss non GAAP financial measures and all comparisons made are year over year. Unless otherwise noted. These non GAAP financial measures are not prepared in accordance with Generally Accepted Accounting principles. A reconciliation of the GAAP and non GAAP results other than with respect to our non GAAP Financial Outlook is provided in today's press release and in our earnings presentation. These non GAAP measures are not intended to be a substitute for our GAAP results. Our Financial Outlook excludes stock based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets acquisition, related compensation costs, restructuring charges, gains on strategic investments, impact of the previously announced ITA tax settlement and income tax provision which cannot be determined at this time and are therefore not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of Sentinel One. Tomer Weingarten (Chief Executive Officer) Good afternoon everyone and thank you for joining our first quarter earnings call. Q1 was a solid start to the year for Sentinel One. We delivered strong revenue growth, record net new ARR growth and significant operating margin improvement year over year. Total ARR growth accelerated to 23% in Q1 driven by strong new logo acquisition and expansion with existing customers. We delivered 44 million in net new ARR in Q1, a 55% increase year over year, setting a new company record. This marks our fourth consecutive quarter of positive net new ARR growth. While exceeding expectations, these results showcase execution, consistency and strong business momentum. Our platform strategy is showing solid traction. We have established clear technology leadership across the most critical domains of cybersecurity including AI, data, cloud and endpoint. Enterprises realize they cannot defend against AI driven threats by by consolidating onto legacy platforms that simply bolt on the separate tools together. What's needed is a natively unified AI driven data and security architecture and that is what Sentinel One delivers. According to Gartner, AI security is the fastest growing segment in cybersecurity, growing more than 70% year over year. AI represents a massive market opportunity for us and a durable tailwind for our business. We are already seeing this momentum with our AI offerings as our AI Security ARR nearly doubled again in Q1. AI has been foundational to the singularity platform from day one. This inherent AI advantage has never been more critical and we are well positioned to expand our market share across $100 billion plus market opportunity. Now let's dive deeper into the details of our quarterly performance. We are winning new logos and expanding our footprint across diverse platform categories beyond the Singularity platform's best in class efficacy and autonomy. Its intuitive design and operational simplicity are driving strong customer adoption. In Q1, our total ARR mix reached an important inflection point. For the first time, the total ARR from our non endpoint Solutions approached 50%. This performance was driven by accelerated ARR growth of our AI security data and cloud solutions, a clear testament to the diversity and customer outcomes of the Singularity platforms. Our cross platform adoption drove a record ARR per customer in the quarter, signifying the momentum and contributions across our platform solutions. Overall, we're maintaining a healthy balance between new logo acquisition and existing customer expansion. Given our scale and relative market share, this strategy allows us to increase our market share while still retaining significant future expansion potential. We maintain solid win rates across all competitive situations. We're gaining mind share and market share among customers and partners. Customers of all sizes, especially large enterprises, are increasingly recognizing Sentinel One's AI advantage. Among our platform solutions, AI security continues to be a bright spot with ARR nearly doubling again sequentially in Q1. Today, comp security stands out as the only enterprise grade scalable solution capable of securing AI at this level, and organizations are recognizing that this is a prerequisite for safely accelerating their AI initiatives. Let's look at our Q1 wins that exemplify this A US state government selected SentinelOne to secure its AI infrastructure in one of the first government deals led by AI Security. With thousands of employees accessing AI tools across sensitive government systems, the need for real time visibility and governance was urgent. This customer chose Prompt alongside Endpoint Cloud and AI SIM to get runtime visibility into their employees AI usage while satisfying strict government compliance requirements. Moreover, we are increasingly winning standalone AI security deals from the customers of our direct competitors. This serves as a strategic entry point to expand our broader market exposure. In Q1, an iconic enterprise selected prompt security over the incomplete AI offering of their incumbent Next gen endpoint vendor. Winning this head to head evaluation is has built tremendous trust. By demonstrating the superiority of SentinelOne's technology, we have opened the door to displace that next gen competitor and drive broader consolidation for this enterprise with the Singularity platform. As organizations race to build and deploy homegrown AI applications, the attack surface is expanding faster than legacy tools can address it. To close that gap, we launched Singularity AI Red Teaming in May. Purpose built to secure AI applications from the inside out, this solution autonomously stress tests AI applications against real world attack scenarios before they ever reach production. This creates a highly complimentary lend and expand motion for us. Red Teaming discovers the vulnerabilities in development and our core platform seamlessly blocks them at runtime. We are now delivering AI security from the first line of code through execution. Next purple AI our AgentX SoC solution is rapidly becoming the bedrock of modern security operations. With the increasingly sophisticated capabilities of Purple, we are empowering customers to respond faster, accelerate detection and Automate investigations. In Q1 we announced the general availability of purple AI auto investigations, a major milestone in our journey towards delivering a fully autonomous SoC. Purple AI represents a significant expansion opportunity over time. In several early rollouts we are seeing instances where ARR from purple AIs end to end deployment can outgrow a customer's core endpoint footprint. Delivering Agentix SoC's autonomous capabilities can drive outsized value. Purple is built for enterprise scale and and natively integrated with Singularity Hyper Automation, but its value extends well beyond large enterprises. We've architected Purple to deliver meaningful impact across customers of all sizes and we see a particularly compelling opportunity with MSSP providers who stand to benefit from significant cost efficiencies and step change acceleration across their entire operations. At the capability level, Purple's latest auto investigation feature delivers human level reasoning at scale, providing one click and soon zero click automation with clear verdicts in seconds. This closes the critical gap between insight and action, fundamentally changing what security teams can accomplish. The accuracy we're seeing compared to human analysts make this a true game changer, allowing security practitioners to shift from manual investigation to immediate remediation. This is consistent with IDC's finding noting a 338% ROI for purple AI customers for data solutions Q1 marked the fourth consecutive quarter of ARR growth acceleration. We are seeing increasing demand for our AI SIM as enterprises seek unified visibility, real time detection and autonomous response. Over all this with far more efficient unit economics than legacy alternatives. With an integrated Observo AI, our customers now benefit from owning the critical data pipeline that powers modern security operations. We are delivering a truly comprehensive security data lake that natively unifies petabyte scale, ingestion, orchestration and hyper automation into a single seamless experience. Among several wins in the quarter, an iconic luxury brand displaced Splunk with a multi year commitment to SentinelOne Inc's AI SIM as their dedicated security data platform. Their global operations needed a solution that offered unified visibility into a single AI native platform. The combination of real time, autonomous security and operational simplicity of the Singularity platform made it a winning choice. In another win, a multinational services Enterprise signed a seven figure expansion with Sentinel 1 replacing their existing SIM provider. This enterprise selected the Singularity platform for superior cost of ownership, machine speed investigations and AI native Unified platform Independent validation continues to reinforce our competitive position. A recent IDC Business Value study found that SentinelOne Inc's AI SIM delivers a 331% three year ROI with only a seven month payback period. Our AI SIM customers see 70% faster queries, 75% faster investigations and four times the threat coverage for cloud security. ARR growth accelerated in Q1 driven by the strong adoption of our best of breed runtime security covering both on PREM and cloud environments. As AI workloads multiply and Cloud environments expand and the need for robust runtime security is increasing. Among cloud security wins, One of the most valuable private companies in the world, soon to become public, significantly expanded its footprint with Sentinel 1 in the quarter. To secure an enterprise of this magnitude, static cloud visibility or posture management was simply insufficient. This enterprise doubled down on Singularity Cloud for autonomous AI powered runtime protection capable of actively neutralizing AI based threats and across their dynamic infrastructure in real time. To secure dynamic cloud environments, organizations need more than static posture management. Our runtime cloud security stops real world cloud attacks in real time and seamlessly scales alongside our customers operation. It is clear that in an AI driven threat landscape, static defenses are no longer sufficient. Verifying identity at the door is useful, but it doesn't stop modern threats. We've seen this play out repeatedly. Traditional identity access management solutions and PAM solutions were built for the past. They were fine at mapping and governing access, but they were never designed to autonomously detect and respond to what happens next. Attackers often bypass access controls post authentication, operating undetected inside environments where trust was already granted. Machine speed, behavioral analysis and continuous validation at runtime is the key competitive edge and the only formidable defense strategy to stop real time attacks. In the age of AI. As the market pivots towards securing AI agents and frontier models, the endpoint remains the ultimate control plane. You simply cannot deliver comprehensive AI security without deep foundational visibility at the point of execution on the host machine that runs AI. AI powered EDR remains a critical vector for capturing the evolving AI security opportunity. With deep expertise and a significant portfolio of patented machine learning and behavioral detection algorithms, Sentinel one is uniquely positioned to protect endpoints and AI workloads directly where they are created and operated. Beyond monitoring access, we align intent to action through real time behavioral analysis, detecting threats that no identity or parameter control can see. Most recent supply chain attacks, including those targeting Light, LLM and Axios, underscore this point clearly. These were exploit free attacks purpose built to bypass traditional security controls and move at machine speed. No signature, no known vulnerability, no parameter trigger. The only effective defense was autonomous behavioral protection at the host level, exactly where CenterOne operates. These real world examples reinforce why the execution layer is where the battle is won. We continue to be a growth leader in the broader endpoint sector by delivering the most autonomous endpoint security solution available. Combining industry leading efficacy, performance and user experience. Nearly half of the existing endpoint sector is still using legacy antivirus solutions. This is a clear opportunity for continued market share gains. We're also beginning to see increased traction in securing highly restricted on prem environments where true sovereignty is required, which is a distinct structural advantage for us. While our competitors can't really secure these environments, this provides an emerging growth avenue for us. We have the distinct advantage of delivering fully autonomous high velocity AI protection in any environment, both cloud and on prem. Our expanding customer base now includes some of the most sophisticated and iconic companies on the planet. From frontier AI labs and major financial institutions to critical global supply chains, the world's most demanding organizations rely on and trust sentinelonone Turning to sentinelonone Flex, it is proving to be a highly effective model for broader platform adoption. We're seeing an increasing number of large deals and contributions from flex. In just three quarters of its launch, Flex had crossed $200 million in TCV. Looking ahead, our pipeline and demand for Flex shows continuation of this momentum. Sentinel One Flex is simplifying the purchasing process and driving an increasing number of large seven and eight figure deals and longer term commitments. Overall, our success upmarket is directly fueling bigger deals, driving steady retention and creating a highly visible durable Runway for long term growth. With the growth of token based AI adoption, we're also expanding our monetization model to capture the full value of how customers use our emerging solutions. Usage based metering creates a natural growth engine as customers expand their use of our products like Security Data Lake and Purple AI, customers can choose upfront annualized SentinelOne Flex commitments that provide cost visibility and preferred economics while giving us committed revenue visibility. Together, Sentinel One Flex and prepaid structures and create a durable hybrid model, a reliable baseline with meaningful expansion opportunity Layered on top in the partner ecosystem, we continue to expand our reach and scale. Our partner ecosystem is a force multiplier, expanding our global reach and driving broader platform adoption for MSSPs. The Singularity Platform delivers the AI native multi tenancy and remote management capabilities that drive valuable operational leverage. This structural advantage gives us a unique competitive edge within the MSSP ecosystem. A strong proof point of this leadership came at RSA where we announced an expansion of our partnership with LevelBlue, the world's largest MSSP. This partnership drives the strategic consolidation of their endpoint estate onto the Singularity Platform in the coming years and extends our reach across their global customer base. At rsa. The we also announced an expanded strategic alliance with Google Cloud to deliver autonomous security at global scale and we were honored by winning the 2026 Google Cloud Partner of the Year award. Last week we also announced Singularity Platform's integration into AWS Security Hub Extended. This removes the traditional barriers of enterprise procurement. AWS customers can now turn on Centineone's AI powered runtime security in minutes and directly from their AWS console without new contracts or procurements. This pay as you go model allows organizations to seamlessly secure their modern digital footprints. With SentinelOne, let's shift gears to the broader industry dynamics. Frontier AI models are rapidly changing cyber defense, allowing adversaries to execute AI based attacks and weaponize weaknesses faster than human teams can react. To stay secure, enterprises must rebuild infrastructure from the ground up with a unified AI native foundation to build modern and secure enterprise infrastructure. We believe a collaborative approach is key to solving this generational challenge. Our relationships with the Frontier AI labs are deep and strategic. We partnered with Anthropic on the launch of cloud security and with OpenAI through its early Access for Cyber program embedding Frontier models throughout our platform. We complement these with our own proprietary and fine tuned models and our core engines remain multimodal and model agnostic by design. AI security is becoming a focal point across the industry with programs like Glasswing or Daybreak. It validates the approach we have been building towards for years and we are actively engaged with both Anthropic and OpenAI to ensure Central one's role in this ecosystem continues to grow alongside our platform leadership. I am also pleased to share that we are a participating vendor in Project glasswing. Proactive visibility is only half of the equation. We must neutralize active threats at the point of execution. The new class of AI based attacks are designed to move faster than any human analyst could react. To give the advantage back to defenders, we launched Wayfinder Frontier AI services in Q1 with our elite partner coalition including Mendiant, WWT, KPMG and Booz Allen. We're fusing multimodal AI with tip of the spear human intelligence. Protecting the AI power business world requires securing the systems where AI is actually being built and used. Often Linux and MEC operating systems While many cybersecurity vendors remain dependent on securing only Windows environments, our established strength to secure Mac and Linux systems give us structural advantages in AI security. We're expanding our native EDR telemetry to protect autonomous AI agents across these operating systems where AI compute is rapidly growing. Our Singularity platform's own device behavioral AI recognizes malicious execution patterns and mitigates the processes preemptively. We autonomously stopped recent supply chain attacks instantly across multiple customers with zero prior knowledge and no human analysts in the loop before they could do any damage. At Sentinel 1 we are delivering end to end AI security from data to runtime, shifting gears to our operating model. As always, we remain committed to balancing durable growth with improving profitability and accelerating our path towards the rule of 40. That commitment requires us to continuously sharpen how we operate. As I outlined in March, we have been actively refining our team structures and go to market focus while accelerating our internal use of AI. In alignment with this strategy, we made a difficult but the necessary decision. We are streamlining our organizational structure resulting in about 8% reduction in our workforce. This is not a reactive measure. It is a deliberate evolution to reduce complexity and raise the performance bar and build a leaner, more agile Slone 1. On the go to market side, we see an opportunity to uplevel our teams and streamline distribution. This includes tightening our coverage and driving greater productivity across our sales organization. Our goal is straightforward driving better operating leverage, sales efficiency and execution velocity. On the AI side, through the company wide rollout of frontier models, we are seeing meaningful productivity gains across our organization. Work that previously took months is now being completed in weeks and in some cases days. Together, these actions provide us the resources and flexibility to concentrate investments in our highest conviction growth areas, AI, data Cloud and Endpoint Before I turn the call over, I'm very pleased to officially welcome Sonali Parekh to her first earnings call. Over the past months we have been working closely together. Sonele brings an impressive level of operational rigor that aligns with our focus on execution velocity and profitability. She's a phenomenal addition to our executive team and already making an impact. In closing, I want to take a moment to acknowledge the contributions of all Sentinels. Their relentless focus, dedication and execution drives our success and thanks to all our customers, partners and shareholders who are for their continued support. Thank you again for joining us today. With that, I'll hand it over to our CFO Sonali Parek. Sonali Parekh (Chief Financial Officer) Thank you Tomer and thanks everyone for joining us today. 60 days in as CFO of Sentinel 1 and the conviction that brought me here has only deepened. Q1 was a strong quarter and it reflects what I've seen firsthand. A platform that is genuinely best in class, a business model with meaningful operating leverage ahead of us and a market at an inflection point. AI is fundamentally expanding the attack surface, creating new security categories, accelerating customer urgency and opening growth vectors that are still in their earliest stages. Sentinel 1 is built for exactly this moment. Now let's review the details of our Q1 fiscal 27 financial performance and our guidance for Q2 and the full fiscal year 27. As a reminder, all comparisons are year over year and financial measures discussed Here are non GAAP Unless otherwise noted, Q1 was a solid quarter for Sentinel 1. Our revenue growth accelerated sequentially, growing 21% year over year to 277 million. Our international markets revenue grew 25% and represented 39% of total revenue, demonstrating strong international demand and a growing global footprint. In Q1, our total ARR growth accelerated to 23% and we added 44 million in net new ARR which comfortably exceeded our expectations. This record net new ARR growth of 55% was driven by new logo acquisition and broader platform adoption within our existing customer base. Our move upmarket continues to yield excellent results. Our ARR per customer reached a new company record led by strong momentum at the top end of the market where our cohort of customers with ARR of $100,000 or more grew 17% year over year. Our gross retention rate or GRR across our customer base remains stable underscoring the mission critical nature of the Singularity platform. For customers spending $100,000 or more in ARR, our dollar based net retention rate or NRR improved both sequentially and year over year. Driven by continued success in multi product platform adoption, we're increasingly landing premier logos providing us with a highly durable Runway for long term growth. Overall, we are maintaining a balanced split between new logo acquisition and existing customer expansion. Given our scale and relative market share, this focus allows us to increase our market share by with significant future expansion potential. This performance clearly reflects the value customers realize from our Singularity platform and our continued success in driving multi product expansion and stickier customers. Now turning to profitability, we continue to maintain a strong gross margin profile highlighting healthy platform unit economics and scale efficiencies. In Q1, our operating margin of 4% exceeded our expectations and represented an improvement of approximately 550 basis points year over year. Our earnings per share of $0.04 also exceeded our expectations and represented an improvement Of 83%. Year over year, we are sustaining a top tier growth profile while rapidly expanding our profitability. Most importantly, we are driving this structural operating leverage without compromising our relentless pace of innovation. On a trailing twelve month basis, our adjusted free cash flow margin was 6.5% representing an improvement of about 440 basis points. Year over year, we've put the company on a path to sustainable positive free cash flow growth which underscores our commitment to durable profitable growth at scale. Complementing this strong performance, our remaining performance obligations growth accelerated to 30% in Q1. Our total RPO reached a record $1.5 billion in Q1, a clear validation of the trust we've established with our customers and our commitment to innovation. We ended the year with a robust balance sheet including $812 million in cash, cash equivalents and investments and no debt. Looking ahead, Sentinel One is well positioned at the intersection of AI data and cybersecurity to lead the industry into the next era of autonomous defense. Capitalizing on this opportunity requires us to evolve our operating model and the way we work. As Tomer discussed, we are implementing a workforce optimization initiative impacting approximately 8% of our workforce. We are harnessing productivity gains to increase our agility and to invest in solutions and like AI Security, Purple, AI Data and Cloud which are key to delivering durable growth. In connection with this initiative, we expect to incur a one time restructuring charge of approximately $25 million in the second quarter which will be excluded from our non GAAP results. Once fully implemented, we expect this action to result in approximately 45 million in annualized cost savings. This provides us with the financial flexibility to purposefully reinvest in our key growth areas while continuing to drive significant operating margin expansion. With our strong growth profile, clear technology leadership and growing structural tailwinds, we have all the ingredients to scale into a multi billion dollar, highly profitable, durable business. Now turning to guidance for Q2 and fiscal year 27 for the full fiscal year 27 we continue to expect revenue to be between 1.195 and 1.205 billion representing 20% year over year growth at the midpoint. For Q2 we expect revenue to be between 289 and and 291 million representing 20% year over year growth at the midpoint. Overall, this outlook is supported by a solid pipeline, strategic partnership opportunities and rising contribution of our emerging solutions including AI data, Cloud and others. As always, we continue to be mindful of the evolving macroeconomic environment and and geopolitical uncertainties which can influence deal timing and sales cycles across the industry. Turning to the outlook for our Profitability metrics For fiscal 27 we are raising our operating income outlook to be between 115 and $125 million, representing an operating margin of 10% at the midpoint, representing a 650 basis point increase over fiscal year 26. For Q2 we expect operating income to be between 23 and 25 million, representing an operating margin of 8% at the midpoint. For full year fiscal 27 we expect fully diluted earnings per share to be between 32 and 38 cents, representing 35 cents at the midpoint. For Q2 we expect earnings per share to be between 6 and 8 cents. We continue to expect a non GAAP tax rate of approximately 17% for the fiscal year 27 and we expect our weighted average diluted share count to be approximately $347 million for Q2 and $350 million for the full year. Taking a Step Back Our technology leadership and competitive position remain strong. We are scaling the business while consistently driving operating leverage. Our investment approach strikes a disciplined balance between capturing long term growth opportunities and maintaining a durable, profitable financial profile. This strategy is foundational to scaling Sentinel 1 into a multi billion dollar business. At the same time, we are instilling operational discipline with a sharp focus on greater efficiency. In summary, we are well positioned at the intersection of AI, data and cybersecurity, leading the industry into the next era of autonomous security. Security is no longer just a safeguard, it is a key strategic enabler of AI innovation. With a strong financial foundation, a differentiated platform and growing market opportunity, we remain committed to delivering shareholder value. Thank you all for joining us today and thank you to all Sentinels for giving me such a warm welcome. And with that operator, we are ready for questions. OPERATOR Thank you. At this time, if you would like to ask a question, please click on the Raise hand button which can be found at the black bar at the bottom of your screen. When it is your turn, you will receive a message on your screen based on your place in the queue. Please accept Unmute your audio and ask your question. As a reminder, we are allowing analysts one question today. We will wait one moment to allow the queue to form. Our first question will come from Metta Marshall with Morgan Stanley. You may now unmute your audio and ask your question. Metta Marshall (Equity Analyst) Congrats on the quarter and the acceleration in Q1 from an opportunity standpoint, you know, are you seeing a pickup in Core Endpoint as customers try to address technical debt and how are you balancing selling them the full Singularity portfolio at initial sale vs upselling them later? Thank you. Tomer Weingarten (Chief Executive Officer) Absolutely. Thank you for the question. It's clear that the endpoint remains the most important control plane. Especially in the age of AI, we're seeing a lot of focus on how to secure AI agents, how to secure surfaces that could be impacted by the deployment of more and more AI technologies. So not only this bodes well for our overall Core Endpoint business. If you think about prompt security, generative AI protection that's specific and deployed on the endpoint, this is typically what we're seeing right now and how we're lending. So when we look at our pipelines, we're actually seeing A lot of contribution not only from core endpoint, which again has been phenomenal for us both in Q4 and in Q1 and will continue to grow, but also the immediate attach of core security generative AI protection that is adjacent to the endpoint as well as lastly, I'll say the definition of the endpoint is also expanding. And when you think about where AI workloads are being deployed today, it also spans towards cloud workload. And that's another strong suit of ours where we're seeing a lot of demand for the protection of these workloads that are now housing either agentic workloads or other model workloads. So all in all, really strong, really strong demand across endpoint surfaces and workload surfaces. OPERATOR Thank you. Our next question comes from Brett Zelnick with Deutsche Bank. Please go ahead. Brett Zelnick (Equity Analyst) Thank you so much. Tomer. I think we'd all like to hear your thoughts on the extent Mythos Daybreak and just the broader pace of AI innovation might be impacting customer spending behavior. You know, the extent to which it's in some cases maybe accelerating or perhaps even slowing down or even expanding budgets. Any color is helpful and as well why you're well positioned to capture what's ahead. Tomer Weingarten (Chief Executive Officer) Absolutely. And again, we're a proud member of the glasswing project. I would say by far, this drives, you know, a lot of concern, and that's not going to be new to anybody. I would say at the same time, vulnerabilities are not the only concern. So code security is definitely a big component of how you secure an entire enterprise. We've launched Frontier AI services alongside Anthropic and OpenAI. We're using these Frontier models to go to customer environments and reduce risk immediately. We're talking about deployments that take sometimes, you know, hours and days, not weeks and months. So with the customer urgency, there's also an ability to deploy fast and show, you know, immediate returns on these technologies. So, all in all, a lot of attention. I think a lot of customers are still grappling with what to protect first. And that again goes back to my assertion around vulnerabilities. You know, what Migos brings to bear, what, you know, models are bringing to bear right now, you know, GPT 5.5 as well, is the ability to not only find vulnerabilities in software, but really detect and exploit weaknesses in overarching network infrastructure, not just software and not just vulnerabilities. And that presents a very wide attack surface. Once again, CenterOne is well positioned to stop, to mitigate and to help customers Reduce risk actively. All of those things are obviously in motion. A lot of them showed up, you know, with the Mythos moment and will provide for structural tailwinds throughout the year. OPERATOR Thank you. Our next question comes from Brian Essex with JP Morgan. Please unmute your line and go ahead. Brian Essex (Equity Analyst) Great. Good afternoon. Thank you for taking the question and nice to see the acceleration and better profitability outlook. Maybe, maybe Tomer for you. I would love to get some color on the reduction in force that you announced. You know, where were the cuts made, you know, any changes to the sales organization and I get the productivity, you know, the AI driven productivity enhancements that you noted. But would love to maybe just connect the dots in terms of where the adjustments were weighed, how many to the sales Org and maybe the outlook for sales productivity and growth the rest of the year. Thank you. Tomer Weingarten (Chief Executive Officer) Sure. And as you've seen in the past, you know, we're focused on driving operational excellence all the time, honestly and simplifying our processes and removing unnecessary layers. That's happening, you know, all the time. We've been carrying more organizational capacity than I think we require at this stage of our scale and growth. And our profile of hiring is also changing. The talent we're recruiting is different and we're just aligning a lot of what we do with both our upmarket success and our emerging product categories. You've seen the infliction in the overall business mix. I mean, that's tremendous. And as always, you know, we're focused on driving higher efficiencies and allocating resources towards those key growth areas which, you know, naturally would be AI, data, cloud, endpoint. These are the growing areas for us. This is our major focus and this is the absolutely right thing for the business. You know, it's never an easy decision, but at the same time, we want to go after these areas in the most aggressive way that we can. We recognize an opportunity right now and we want to put all of our resources in the right places. We're barely, you know, impacting our technology groups with this. We are focused on streamlining parts of the organization, but we're continuously and always investing in innovation. And that's the key point here. We are delivering to the market what the market needs. We're delivering protection, best of breed, cutting edge to our customers using frontier AI models. That's where we're going. That's where we're going to be continuously investing and that's what you see us doing. OPERATOR Thank you. Our next question comes from Joseph Gallo with Jefferies. Please go ahead. Joseph Gallo (Equity Analyst) Hey, thank you. For the question, as a follow up to that, should we expect any sales disruption, particularly in two Q and as a part of that, certainly great to see the improvement in margins. Can you just talk a little bit more about your comfortability that you can capture this massive opportunity and not sacrifice the durability of growth? Thank you. Tomer Weingarten (Chief Executive Officer) Of course, we don't expect any go to market disruption, as you can probably imagine. You know, this comes on natural performance management. You know, folks that may have not been, you know, the biggest contributors. We're kind of focusing on the places where we see the greatest contribution. So if anything, again, this will provide more focus and kind of a distilled, crystallized go to market motion. I don't expect any major changes. We've not been changing things in a dramatic way here. This is kind of a continuous mode for us on the go to market side. We've said it for quite a few quarters. There's really almost nothing new here. And again, I mean, when we look at our pipelines, when we look where the opportunity is, we're just aligning towards that. We believe that a lot of the reinvestment capacity is actually, actually going to allow us to go after that exact same endpoint opportunity that we've been talking about. You can see some evidence of that with our partnership with LevelBlue. This gives us immediate access to tens of millions of endpoints over the years without needing to go and sell to those customers one by one. That's just one way that we're thinking about aggressive expansion and we're going to do more of those. So to us, it's all pointing in the right direction. We feel very comfortable with our technology's ability to go and replace the legacy incumbent. And the opportunity that comes with it is massive. It's still a massive market. It's still, you know, in many parts dominated by incumbents. And that represents a major opportunity for us to land with endpoint to attach generative AI capabilities and protection from all these new vectors of attack, leverage for interior AI models to deliver the best protection for our customers. These are all positive trends from the business that we're frankly very excited about. Sonali Parekh (Chief Financial Officer) Yeah, so thanks for the question. And we are really delighted with the margin progression that we showed this quarter and obviously to the upgrade to the operating margin guide for the full year. But I think the short answer is we don't see growth and margin expansion as a trade off. In this case, the investments that actually drive durable growth that Tomer was talking about in AI security, data. Cloud. Cloud. The labs are exactly where we're reinvesting. So we're removing organizational complexity that was actually slowing us down and redeploying it into the highest return and highest conviction opportunities that we see in the business. And I think the evidence that we can do both is actually already in the Q1 numbers. So this quarter we delivered record net new ARR, so up 55% year over year, while simultaneously expanding operating margin by 550 basis points. So I think that's really our platform model working at scale. And when I look forward, the demand signals give me real confidence. So RPO again at a record 1.5 billion, growing 30% net retention, expanding in our $100,000 plus cohort. That's both sequentially and year over year to above 110. Some of our products, like Prompt ARR, nearly doubling. Again, I think these are all leading indicators of durable growth. So I think you're going to see both durable growth and sequential and annual operating margin expansion. We really feel like we can deliver on both. OPERATOR Thank you. Our next question comes from Shaul Eyal at TD Cohen. Please go ahead. Shaul Eyal (Equity Analyst) Thank you. Question to Sonali. So now, being there a couple of months, have your initiatives you would like to undertake changed or how do you see opportunities to build upon the operating leverage you guys are seeing? Sonali Parekh (Chief Financial Officer) Yeah. Thanks. So, yes, 60 days in, I would say what struck me most coming in was really the strongest of the Singularity platform, our product leadership and technology differentiation, and then the significant opportunity in front of us for this category, much of which is just really in the early innings. So I think the operating leverage potential of the business as we scale, given our industry leading gross margins, creates this enormous opportunity to create outside value. And I would say my conviction on that has only increased. So in terms of priorities, first, it's my job to ensure we're allocating our resources and investing in the parts of the business where we feel we see the highest opportunity for growth and roi. So that's data cloud, AI security, I think will be massive. And you see already our emerging solutions now 50% of our ARR. So it's these areas where we feel like we have real competitive differentiation and a significant market opportunity ahead. I think prompt is a perfect example of that. Second, continuing to improve on the cost structure. You saw the announcement we made today on restructuring. It's really important that we focus the business. I'm going to be extremely focused on unit economics, driving operational excellence and discipline across the business, particularly in sales and marketing, where I see the largest opportunity for productivity improvement in today's results, you'll already know we've made a lot of progress in sales and marketing. So if you look at sales and marketing as a percentage of revenue Q1, it came in at 39%. That compares to 47% a year ago. And if you think about our upgraded full year operating profit guide of 10%, that's 700 basis points of year over year improvement. But I think what's most interesting and compelling really is what that implies in terms of where we're going to be exiting Q4, that exit operating margin that's significantly above the 10% guide. So we're on a path to deliver multi quarter, multi year margin expansion which you're already beginning to see. And then lastly, I think it's really important that Tomer and I are completely aligned on this. We need to put ourselves firmly on the path to rule of 40 which means not just efficiency but durability. And I'll be really focused on taking that NRR where we've already seen great progress and improving upon it. And you know, it's not just on the NRR side. On the DRR side we've seen improved logo retention this quarter and stability and I think that just underscores the mission critical nature of our platform. And then finally I would just say, you know, as one of the few platform providers in cybersecurity, the traction we're seeing with the platform is resulting in larger lands. So our ARR per customer reached a new company record. And also really importantly and again this is just the platform working is stickier customers. OPERATOR Thank you. Our next question comes from John Defucci with Guggenheim Securities. Please go ahead. John Defucci (Equity Analyst) Thank you. Thanks for taking my question and congrats to the whole team for the new edition and it's great to have you. Sunili Listen, you guys put up really strong ARR this quarter with growth that accelerated, you pointed that out, but it's accelerated for the first time in more than three years after three years of somewhat moderation which with the law of large numbers you'd expect. But frankly the growth in new ARR, even if you take into account attrition, was even better than it's been in almost four years from our calculations. I know you don't guide to ARR, but you maintained your revenue guidance for the year. I realize it's early, but how should we be thinking about that given that ARR is really the best determinant of the future revenue? Thanks. Sonali Parekh (Chief Financial Officer) Yeah, dawn, thanks. Thanks so much for the question and it is great to be here. I'm thrilled to be here on my first earnings call. So you're absolutely right. You know, we had a great showing on net new ARR this quarter. As you say, record the growth was driven both by strong new logo additions but also strong expansion and great contributions from our emerging products. So data ARR accelerated in Q1. I already talked about prompt, but that nearly doubled again in Q1 and our cloud ARR accelerated strongly as well. In terms of the overall guide, we did reiterate the guide and what I would say there is we're still pretty early in the year and we still continue to expect positive net new ARR growth for fiscal 27. In terms of the actual revenue contribution on the guide, we did see a fairly back end loaded quarter with some of those larger deals and as a larger proportion of our bookings are from larger deals, I think we'll expect to see a bit more of that back end loading. And that's why you're seeing that from a timing perspective. But we still are feeling really confident around net new ARR for the year. John Defucci (Equity Analyst) That makes total sense. Tonali and I was only going to ask one question that's I'm going to leave it. The second one would have been a linearity, but you read my mind. Thank you. OPERATOR Our next question comes from Fatima Bulani with Citi. Please unmute your line and go ahead. Please unmute your line. We will come back to you at a later point. Our next question comes from Sranik Guattari with Baird. Please unmute your line and ask your question. Zach Schneider (Equity Analyst) hey guys, this is Zach Schneider on Fortranic. Thanks for taking the question. So maybe one on capital allocation, you know, now with 800 million plus in cash path towards 100 million plus in free cash flow generation, no debt. You guys have, it seems much more flexibility than you've had historically. So maybe how should we think about capital allocation going forward and are there any changes there in strategy or priorities? Thank you. Sonali Parekh (Chief Financial Officer) Yeah, sure. Thanks for the question. So yeah, we feel really good about where the balance sheet is, a very robust balance sheet. I think our capital allocation priorities really haven't changed. So we will continue to focus on organic investments that drive our growth. We will consider inorganic investment, but I would say there's a fairly high bar there. So it would be very selective and would need to be extremely strategic. And then finally we absolutely will use our strong balance sheet and free cash flow to give us the flexibility and capacity to be able to opportunistically repurchase our shares. Given the long term potential of our business. And so long as we believe it's a positive ROI initiative, which certainly at current levels, we would. So I would say our capital allocation policy is dynamic and opportunistic. And again, we will do our best to take advantage of any dislocations in the market and also maintain a strong cash position to support our innovation and strategic initiatives from here. OPERATOR Great, thank you. Our next question comes from Richard Poland with Wells Fargo. Please go ahead. Richard Poland (Equity Analyst) Thanks for taking the question. I guess if you just think about the balance of the reinvestment that you're making, I think you quantified it somewhere in the range of 45 million in annualized savings from the reduction. I guess as we think about how that flows through to investments and just kind of how you're calibrating how much drops to the bottom line versus how much gets put back into things like AI. Can you help us, I guess, just contextualize that the rest of the year? Sonali Parekh (Chief Financial Officer) Yeah, so why don't I start with that? So for the full year, we're now guiding to about 700 basis points of year over year operating margin improvement. And as I said earlier, that would imply exiting at an operating margin significantly above that 10%. And we also talked about, you know, the desire to balance growth and profitability. And we felt strongly that there were areas where we had high conviction around, you know, parts of the market and products where we wanted to reinvest some of those savings. So we talked about AI security, we talked about cloud data. We really feel like those are the right opportunities to go after right now from an ROI perspective. And we feel like we'll be able to deliver both durable growth and operating margin expansion and still be able to, again, upgrade that operating margin from where we were a couple of months ago. Tomer Weingarten (Chief Executive Officer) Yeah, I would just add to that. I mean, we have a tremendous R and D and product and technology group. So. And for us, when we look at the opportunity ahead, clearly we want to build more. We want to produce more capability that we believe can add massive value to the security posture of our customers and at large. So all in all, I mean, in the world of today, the ability to build, the ability to push forward versus maybe a few years ago, a lot of the innovation was coming for other companies through acquisition. I sincerely think that with the strength of R and D, with the strength of our talent, we just want to do more and we want to enable them to do more. We want to bring more great people on board. And that's kind of how we're thinking. That's the philosophy behind our reinvestment. OPERATOR Great. Thank you both. Our next question comes from Roger Boyd with ubs. Roger Boyd (Equity Analyst) Please. Awesome. Thanks for the question, Tomer. We continue to hear really strong feedback from the channel on prompt security and it seems like it's already becoming a pretty material contributor to ARR. Can you talk about what you're seeing with with Prompt as maybe the tip of the spear for new engagements? And have you seen Prompt lead to bigger platform deals, including competitive displacements in Endpoint or Data Lake Sim? Thanks. Tomer Weingarten (Chief Executive Officer) Yes, and there's no question Prompt is delivering the capability that every single enterprise needs right now and that none of our competitors have. So we're seeing both the natural expansion for our customer base plus lending bigger with new logos and even in competitive environments, the ease of use, the seamlessness of deployment, the time to value. I think all of those are just radically different than anything else. But you finding in the space today deliverable coverage, compliance, governance. Everything that everybody's missing right now is being delivered by what Prompt can bring to bear. So all in all it's a great catalyst for us across pretty much every vector of our go to market motion. And at the same time, you can imagine most of our customer state is still underpenetrated, they're still not deploying Prompt. So we're also moving pretty fast to enable Prompt to be absorbed and consumed by our customer estate directly through the platform and that's going to unlock more growth opportunities for us in the out years. OPERATOR Thanks very much. Fatima Bulani (Equity Analyst) Our final question of today comes from Fatima Boulani with Citi. Please go ahead. Oh, good afternoon. Thank you so much for taking my questions and being patient with me today. Sonali, this one is for you and nice to see you on board here. Just looking at the deferred revenue and billings performance. I know you don't manage the business to billings, but just as we sort of, you know, look at the the deferred revenue cadence, was there anything atypical or different here that happened? Just as we noted some weaker seasonality in some of the growth metrics on the deferred revenue side and maybe tying it back to some of your commentary with respect to net retention rate, maybe outside of the 100k ARR cohort and on some of the gross retention rate comments you alluded to earlier. Would love any incremental color on why we maybe saw that come out as seasonally weaker than prior periods. Thank you. Sonali Parekh (Chief Financial Officer) Yeah, sure. So on billings, I would say there's nothing specific to call out other than the fact that this metric can move around A bit just due to the timing of invoicing. So we tend to focus and we actually run the business much more around Net new ARR as our key operating metric. Where obviously we saw a record number this quarter in terms of grr, we saw continued stability. It's actually, you know, when I first arrived here, of course I was looking through all the metrics. It's actually been stable for many, many, many quarters. And I remember seeing that and thinking that's an extremely strong sign just in terms of the stickiness and mission criticality of our platform. Like when we win a customer, they stay with us. I think up to now where we've seen some where just an impact on Net retention has been on the expansion side of things. And I think we saw positive traction there with some of our larger customers this quarter which helped to drive Net retention up. And that's something I said, I think in Mita's question around priorities. It's something that I'll be really focused on. And when I look at some of the signals as we look forward to coming quarters, that's a metric that I expect to continue to improve. And again, that's what gives me confidence on the full year guide as well is that will be a key support that improving that retention rate. Because of course every point we improve on net retention, you know, helps it creates a tailwind on revenue. Fatima Bulani (Equity Analyst) Thank you. I appreciate that. OPERATOR Thank you. We have now reached the end of our allotted time for questions. I will turn the call back over to Mr. Weingarten for closing remarks. Tomer Weingarten (Chief Executive Officer) Thank you everyone and have a good day. Disclaimer: This transcript is provided for informational purposes only. While we strive for accuracy, there may be errors or omissions in this automated transcription. For official company statements and financial information, please refer to the company's SEC filings and official press releases. Corporate participants' and analysts' statements reflect their views as of the date of this call and are subject to change without notice.