SentinelOne - Q4 2022
March 15, 2022
Transcript
Speaker 0
Good evening. Thank you for attending today's SentinelOne Q4 2022 Earnings Call. My name is Hannah, and I will be your moderator for today's call. All lines will be muted during the presentation portion of the call with an opportunity for questions and answers at the end. I would now like to pass the conference over to our host, Doug Clark, Investor Relations of SentinelOne.
Please go ahead.
Speaker 1
Good afternoon, everyone, and welcome to SensiOne's earnings call for the Q4 fiscal year 2022 ended January 31. With us today are Toma Weingarten, CEO Nicholas Warner, COO and Dave Bernhardt, CFO. A press release and a shareholder letter were issued earlier today and are posted on our website. This call is being broadcast live via webcast. And following the call, an audio replay will be available on the Investor Relations section of our website.
Before we begin, I would like to remind you that during today's call, we will be making forward looking statements regarding future events and financial performance, including our guidance for the 1st fiscal quarter and full fiscal year 2023 as well as certain long term financial targets. In connection with our recently announced definitive agreement to acquire Atevo, management will provide additional information as to the benefits of the acquisition. However, we will not back The planned acquisition into our fiscal 'twenty three guidance at this time. We caution you that such statements reflect our best judgment based on factors Currently known to us and that actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our S-one, our Our quarterly report on Form 10 Q and our annual report on Form 10 ks that we file, these documents contain and identify important risk Factors and other information that can cause our actual results to differ materially from those contained in our forward looking statements.
Any forward looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during this call may not contain current or accurate information. Except as required by law, we We have no obligation to update these forward looking statements publicly or to update the reasons actual results differ materially from those anticipated in the forward looking statements, even if new information becomes available in the future. During this call, unless otherwise stated, we will discuss non GAAP financial measures. These non GAAP financial measures are not prepared in accordance with generally accepted accounting principles.
A reconciliation of GAAP and non GAAP results is provided in today's press release and in our shareholder letter. These non GAAP measures are not intended to be a substitute for our GAAP results. The financial outlook that we provided today excludes stock based compensation expense, employer payroll tax on employee stock transactions And amortization expense of acquired intangible assets, which cannot be determined at this time and are therefore not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.
Speaker 2
Good afternoon, everyone, and thank you for joining our fiscal Q4 earnings call. This was another excellent quarter and I'm extremely proud of the entire SentinelOne team. Our ARR grew 123% year over year in the 4th In today's digital world, cybersecurity is mission critical infrastructure in every geography, industry vertical And organization size, the demand environment remains incredibly strong. We continue to scale our business as a result of our cutting edge autonomous XDR platform in In our powerful partner supported go to market strategy, we built an AI driven security platform that spans endpoint, cloud, IoT, data And now also Identity. I'm thrilled that today we announced our plan to acquire Ativo Networks.
Ativo is a premier and highly differentiated solution That will enable us to provide cybersecurity in one of the most critical and dynamic parts of enterprise security today, the identity parameter. With Ativo's user centric identity capabilities, we will be able to support an even more comprehensive 0 Trust framework. I'd also encourage everyone to read our shareholder letter we published on our Investor Relations website, which provides a lot more detail. Let's take a look back at our fiscal 2022. It was a groundbreaking year for Centaur and One.
We started the year as a private company, Delivered a triple digit revenue and ARR growth rate through all four quarters and ended the year as one of the fastest growing technology companies in public markets, With outstanding growth in ARR rapidly approaching $300,000,000 throughout the year, we celebrated accomplishments that highlight our product market fit, Innovation and superb customer experience, such as a leader in the 2021 Gartner Magic Quadrant for endpoint protection, Highest scores in Gartner critical capabilities use cases and being the only vendor with 100% visibility and no missed detection in the latest MITRE evaluation. In the Forrester XDR wave, we were named the best fit for companies that want customizability and to grow into XDR. Our Q4 and fiscal 'twenty two results demonstrate the relentless execution of our teams and focus on innovation. We're protecting more enterprises today than ever before with faster speed, greater scale, higher accuracy and with more automation. Automation has never been more critical to tackle the complexity of today's threats.
I'd like to dig deeper into 3 key points about our performance. First, our success with large enterprises underscores the scalability of our platform. We added a record number of 100,000 plus ARR deals, A record number of $1,000,000 plus ARR customers and closed our largest ever net new customer contract, one of the most influential and leading global Internet Nick will discuss this in more detail later on. 2nd, we paired our phenomenal growth with Significant progress towards our long term profitability targets. I'm pleased to share that we ended the 4th quarter with double digit year over year improvement in both our growth And operating margins, our gross margins expanded 12 percentage points year over year and our operating margin improved 38%.
This progress reflects our growing scale and increasing efficiency. Looking at the full year, fiscal 'twenty two was an investment year for Central One. It featured our IPO, solidifying our brand as an industry leader as well as investments in our go to market and innovation engines. We doubled our total workforce. I'm proud of SentinelOne being named to comparably best company culture list and receiving the 2021 Great Closet to Work award.
Given the significant market opportunity ahead, we remain committed to investing in the growth of our business. And just like we did last year, We intend to balance this growth with further margin improvement in fiscal 2023. Finally, our business is performing We will be broad based strength across new customer adds, existing customer renewals and up sales. Throughout the year, we significantly expanded our platform offerings. Our endpoint solution remains a primary driver of our business, which is being complemented by emerging growth vectors, including cloud, IoT and data.
We're still in the early innings of a large and expanding total market driven by the proliferation of hybrid work environment, digital transformation and an evolving threat It's clear that we achieved a lot as a company in the past year, but we must remain as vigilant as ever around the threat landscape. The persistence and sophistication of new attacks continues. We entered 2021 on the heels of sunburst and exited the year battling Log4j. Most recently, The potential for cyber warfare has significantly increased in light of the Russia Ukraine conflict. This has further escalated the threat environment.
Our vision is to be a force for good, and we're committed to doing our part to help affected people and businesses in Ukraine and around the world to stay cyber secure. We've established a Ukraine crisis resource center and begin offering free access to Singularity XDR for cyber threat protection in Ukraine. We ran similar programs to help others in the wake of Sunburst and we're committed to defending against cyber warfare. Threat sharing and collaboration are essential to our collective mission against cyber attacks.
Speaker 3
Our teams at Sentinel Labs are leading the
Speaker 2
Our teams at Sentinel Labs are leading the way by uncovering some of the most sophisticated attacks across the world. Our global footprint puts us in a unique position to not only protect our customer base in real time, but also produce novel research to educate and arm the cybersecurity community. We're able to leverage the power of our partner ecosystem to stay on the frontline With leading incident response providers like Mandiant, KPMG, Kroll, Parate and many others. As an example, we recently named and published research on hermetic wiper related to the escalating cyber attacks surrounding the Russia Ukraine conflict. This was a real time discovery on the eve of Russia's ground invasion.
It helped bring awareness to cyber attacks accompanying modern warfare. Our publication was followed by an alert notice from Cybersecurity and Infrastructure Agency highlighting the significance and relevance of Sentinel Labs' research. If we look at the evolution of cybersecurity technologies for a moment, it's clear that legacy AV represents the past, EDR is the present and XDR is the future. While the majority of enterprises still utilize legacy AV solutions, we have undoubtedly entered the XDR era. At SentinelOne, we established the foundations of XDR by pioneering the world's first purpose built AI powered autonomous cybersecurity platform.
Singularity XDR brings the critical capabilities customers need from a comprehensive cybersecurity platform, speed, scale and automation. Enterprises are increasingly selecting SentinelOne for our best of breed XDR. Over the past year, we significantly broadened our platform capabilities by Introducing several mission critical and highly differentiated innovations. I want to briefly highlight a few of these. First, We enhanced our network visibility and control capabilities with Ranger Pro.
Ranger helps enterprises eliminate one of the most commonly exploited threat vectors, Unprotected and rogue assets. It reduces the attack surface by offering device mapping and management capabilities. 2nd, we introduced Storyline Active Response, our engine for automated threat hunting, detection and response. Next, we developed remote script orchestration, a powerful endpoint management tool for both IR partners and enterprises. Finally, we launched Singularity Mobile, a new AI powered mobile security solution for iOS, Android and Chrome OS devices.
Building upon the acquisition of Scalar, we launched DataSet in February of this year, a revolutionary live enterprise data platform for data queries, analytics, Insights and data retention. Datasets expands our capabilities beyond cybersecurity use cases. It's a cloud native flexible enterprise data platform Built for petabyte scale. Not only dataset is the backend for our Singularity XDR platform, the technology is already being used by hundreds of enterprises Analyzing trillions of real time events. Customers like DoorDash, Copart, Asana, TomTom and many others are selecting data sets to unlock the Power of their own data with speed, scalability and technology driven cost advantages.
Our platform approach is resonating and is contributing meaningfully to our Financial performance. Endpoint continues to fuel the company's growth. At the same time, we're seeing outstanding traction with our adjacent platform technologies and capabilities. Over 1 third of our Q4 new business was driven by our Singularity modules and dataset, up from about 20% a year ago. Because all of our capabilities, our cloud workflow protection and data retention modules have been the most outstanding, Each delivering year over year ACV growth of over 10x.
Let me spend a second on cloud security. This is one of the fastest growing markets in security today and we're already doing extremely well on this front. Demand for our cloud workload protection solution has been broad based both within our installed base as well as with new customers. Cloud security represents a sizable opportunity for SentinelOne for years to come. And today, we are further expanding our addressable market and extending We are adding another growth vector to our platform.
Identity now joins endpoint, cloud, IoT and data. I couldn't be more excited to introduce everyone to Atevo. Ativo aligns with the M and A strategy we previously outlined. First, it expands our addressable market into a $4,000,000,000 in growing identity TAM. And within that, Atevo is capturing share, growing its ARR north of 50%.
2nd, user centric identity is highly complementary and value add for our XDR platform and customers. It opens new customer and cross sell opportunities. Finally, it has a compelling financial profile and strong cultural fit, additive to our hyper growth and accretive to gross margins. Identity is a critical component of the enterprise parameter and 0 Trust framework. At People's Markets' leading identity offerings Help organizations keep passwords safe, admin privileges restricted and user identity intact.
Ativo Networks is the right technology and the team To extend our portfolio and is a natural extension of our Singularity XDR platform and go to market strategy. These used credentials are now one of the techniques used in breaches. If an attacker can't compromise the endpoint, they will often look for the next layer of vulnerability, the user's credential. If successful, attackers can install backdoors, exfiltrate data and change security policies. Ativo, as part of SentinelOne, will help organizations reduce their attack surface, not only at the device level, but now at the human identity level too.
Activo has a clear product market fit with an established customer and revenue base. Its differentiated and battle tested Solution is already trusted by over 300 customers from Fortune 500 Enterprises to government entities. Ativo is not just any identity company or technology. We strongly believe that it's the best and most comprehensive identity security platform in the market today. Let me briefly introduce you to the 3 parts of the Ateevo platform.
First, identity protection is an agent based solution It secures credentials and detects malicious identity behaviors. It delivers real time protection against credential theft, privilege escalation, lateral movement and more. 2nd is identity infrastructure assessment, identity based vulnerability scanning and management for enterprise infrastructure. Aptivo scanner provides instant visibility of Active Directory misconfigurations, suspicious password changes and unauthorized access. This complements our Ranger network asset visibility and control capabilities and now folds in a user centric identity view.
3rd, identity powered deception. Ativo's deception solution make attackers review themselves, their methods and targets through misdirection. This sums up to a multilayered approach and a broad set of capabilities to fend off, not just detect, identity based attacks. Ativo will put us front and center in the identity security market. As Dave will discuss later, financially, even in the early stages of a joint go to market, This acquisition will add to our hyper growth trajectory.
I'd like to share a few closing thoughts. There has never been a greater enterprise need for a modern Cybersecurity platform, which means a tremendous business opportunity for CenterOne's world class autonomous protection. We are still in the early innings of our innovation and growth. Our outstanding Q4 and fiscal 'twenty two financial performance speak for itself. Triple digit revenue and ARR growth paired with double digit non GAAP margin expansion.
We're perfectly positioned for continued success and expansion of our business, Even in times of global uncertainty, our growth journey continues, and I want to thank all customers, Sentinels and partners for making all this possible. With that, I will turn the call over to Nick Warner, our Chief Operating Officer.
Speaker 3
Thank you, Tomer, and welcome, everyone. We delivered an outstanding Q4 across every geography driven by our go to market flywheel of sales, marketing, channel and technology partners. More large enterprises are selecting SentinelOne than ever before because of our industry leading efficacy, automation, ease of use And differentiated XDR capabilities. I'm also excited to welcome the Ativo team. Listening to customers and following many of the largest Incidents in cybersecurity over the past few years, identity is a critical vector in delivering the most complete XDR platform.
Not only is it a natural fit within our platform, it will complement our network of strategic service providers extremely well. In Q4, we reported impressive ARR growth of 123 percent reaching $292,000,000 This growth was driven by a healthy mix of new customer additions, renewals and up sells. Our momentum with large enterprises was We added a record number of customers with ARR over $100,000 and a record number of $1,000,000 plus ARR customers. All of this is extraordinary and reflects the success of our sales and marketing organizations. Let me share more on this.
Our customers with ARR over $100,000 grew 137% year over year to 520. And let me give you an example. In Q4, we closed the largest new customer deal in our history with one of the most influential and leading global Internet companies. This win came after an intensive evaluation process, including other next gen security providers. I'd like to highlight one additional win, which is emblematic of what we're seeing in the market.
Like most Fortune 500 companies, this enterprise was using multiple operating systems. They lack true security parity across all surfaces. Their existing next gen EDR vendor failed to quickly deploy and left Critical Mac and Linux attack surfaces unprotected. They terminated their existing 3 year subscription mid flight and turned to SentinelOne. Singularity XDR deployed instantly across the whole enterprise, which was expedited by our patented Ranger Discovery and Auto Deploy capabilities.
The customer has become a fantastic partner and is benefiting from our true cross platform feature parity And automation. We also closed new deals with many other large enterprises across verticals from technology to global consumer brands To financial services companies, SentinelOne is winning more market share in every major geography, replacing incumbent vendors of All types and winning against the competition. In total, at the end of fiscal 'twenty two, we secured over 6,700 customers comprising both large And medium sized businesses. That's total growth of more than 70% or almost 3,000 more customers compared to last year. Our total addressable market is large and expanded.
A majority of the market still utilizes legacy antivirus solutions. The competitive environment has not changed. We've maintained incredibly strong win rates in all competitive situations against both legacy and next GenVendors. What's more exciting is that the opportunity per customer is much larger today than it was for legacy providers in the past. This is because of the breadth of our platform, covering endpoints and surfaces of all types, cloud workloads, Kubernetes, mobile devices And IoT devices and soon identity.
We once again achieved strong retention and expansion within our customer base. Our net retention rate of 129% remained extremely healthy and well above our target of over 120%. Our NRR was driven by footprint expansion, cross sell of adjacent modules and up sell from platform tiers. We continue to prioritize new customer growth, while at the same time, we are seeing massive success in customers consuming more and more of the Singularity platform. Our modules and data set now represent over a third of our new business.
And once again, this is broad based and includes everything from cloud and Ranger to manage Our cloud workload protection and data modules are delivering the highest growth. They each grew over 10x year over year reflecting demand for our best in class runtime protection for cloud workloads and unparalleled data retention offerings. I also want to call out our newest endpoint management module, remote script orchestration. RSO has achieved of any new module in SentinelOne history. Our incident response partners love the ability to remotely manage fleets of endpoints at machine speed In critical breach response moments.
Next, I'd like to talk more about our channel partners. Our partner ecosystem continues to magnify our market presence, Significantly extending our reach and efficiency. Our strategic technology and services partners have grown to over 20% of our business. This includes MSFPs, MDRs and IR firms. These partnerships are accretive to our overall growth rate With significant business expansion opportunities yet to be unlocked.
Let me double click on the success of our IR partnerships. Over the past year, we focused on partnering with many of the largest and most sophisticated IR providers in the world. In the Q4, Mandiant selected SentinelOne as a global go to market partner. We are becoming the partner of choice for leading IR providers, Including KPMG, Kroll, Arete and many others. Our strategy brings the best of both worlds to our joint customers.
Top incident response consultants leveraging the best in class XDR platform. I can't stress enough that we don't compete with our partners. We work with over 100 of the world's leading IR firms, enabling us to address a majority of the IR market worldwide. These partnerships create hundreds of high value and fast moving opportunities every quarter. This is significantly more coverage than any single vendor could hope GAIN on its own.
We are also very excited about our growing partnerships with MSSPs. They continue to expand our coverage across large enterprises And mid market customers. Leading MSSPs are choosing SentinelOne because of our technology leadership, Ease of management and multi tenancy capabilities. Today, we are partnering with top tier MSSPs, including Enable, ConnectWise, Pax8, AT and T and hundreds of others, many of which exclusively work with SentinelOne. These relationships have helped us Achieved significant scale and exposure, complementing our enterprise sales success.
Looking at just a few of our top MSSP partners like Enable and Pax8, they represent millions of endpoints now secured by SentinelOne. We're extremely confident about the market opportunity we can jointly address 0 Trust security model by partnering with leading vendors. Our two way technology integrations with Zscaler, Mimecast, ServiceNow and many others Demonstrate top tier vendors working together as part of the Singularity ecosystem. This year has been incredible for SentinelOne, Filled with innovation and growth and we begin the new fiscal year announcing our plan to add identity to our platform, which further expands SentinelOne's capabilities and offers exciting business opportunities. I'm proud to work with our global team of relentless sentinels every day.
I'm excited about our future. We will continue to deliver on our vision by focusing on execution and listening to our customers. Thank you again for joining us. And let me turn it over to Dave Bernhardt, our CFO.
Speaker 4
Nick, Tomer, thank you. And let me also thank everyone for joining us today. I'll discuss our Quarterly financial highlights and provide additional context around our guidance for Q1 and full fiscal year 2023. I'll also touch on the financial highlights for OTIVO And the full year implications. Afterwards, we will open the call to your questions.
We delivered another strong quarter of revenue and ARR growth, both well into the triple digits. We achieved year over year revenue growth of 120 percent reaching $66,000,000 and ARR growth of 123 percent exceeding 292,000,000 We added net new ARR of $56,000,000 in the quarter, a new record for the company. We saw strong momentum and a robust demand environment for our platform. The strength of our performance was broad based coming from a healthy mix of new customer additions, existing customer renewals and up sells. All of this was further magnified by the strong underlying seasonality of our Q4.
Our business expanded nicely across all geographies. Revenue from international markets grew 140% and represented 31% of revenue. Turning to our costs and margins. Our non GAAP gross margin in Q4 was 66%, reflecting a double digit increase of 12% year over year. We're seeing the benefits from our increasing economies of scale and business expansion, including strong module attach, platform upsell and data processing efficiencies.
This was partially offset by the temporary costs we discussed last quarter With the migration of existing customers to our data set back end. We've made excellent progress on this front. All of our new customers are Already using the data set back end, plus we've already migrated many of our largest existing customers. These customers are enjoying up to 10x performance improvements. We remain on track for our migration plan and these temporary duplicative costs should be behind us after the first half of this year.
When I put it all together and I look at the Q4 gross margin of 66% and the significant improvement compared to last year, I see increasing evidence of scale and efficiencies of our business. Looking at the rest of our P and L, our non GAAP operating margin was negative 66 Compared to negative 104 percent a year ago, a huge improvement of 38 percentage points. And we achieved these impressive results while for growth throughout the year, including the IPO, new product launches and doubling of our workforce. This progress Our long term financial target demonstrates the potential for leverage throughout our business model. We're investing in our business, Which is the right strategy given the huge market opportunity and strong demand for our leading platform.
Moving to our guidance for Q1 and the full fiscal year 'twenty three. In Q1, we expect revenue of $74,000,000 to $75,000,000 reflecting annual growth of 99% at the midpoint. For the full year, we expect revenue of $366,000,000 to $370,000,000 reflecting annual growth of 80% at the midpoint. While we don't specifically guide for ARR, I do want to remind you that we are a subscription business. Our ARR and revenue growth track very closely.
Our revenue guidance for Q1 implies that we should be at or better than typical Q1 net new ARR seasonality, which has been down between 25% to 35 sequentially the past 2 years. We believe the structural tailwinds of digital transformation, hybrid work environments is more complex and elevated than ever before and our product innovation, brand recognition and scaling go to market have positioned us well to capture the favorable opportunities. For Q1, we expect non GAAP gross margin to be between 63% to 64% and full year non GAAP gross margin to be between 65 to 67%. Our Q1 guidance implies over 10 percentage points year over year gross margin expansion at the midpoint. We expect to continue benefiting from increasing scale and better data processing efficiencies.
Our guidance also reflects the migration of our remaining existing Customers to dataset, which once again we expect will conclude in the first half of the year. As a reminder, these costs are temporary. Based on our full year guidance, we see the opportunity to achieve high 60% gross margins by year end. Finally, for non GAAP operating margin, we expect 84% to 86% in Q1 and negative 55% to 60% for the full year. Both of these represent meaningful year over year improvements.
At the midpoint, we expect Q1 operating margin to improve over 40 percentage points and full year operating margin to improve over 25 percentage points. We see tremendous opportunity for growth and the investments we're making today will put us in a position to succeed for the long term. And we're doing this as we make progress towards And our long term target EBIT margin of 20% plus. Before I close, let me share the key financial points related to Ativo. This should help you as you think through modeling the business for the future.
We're acquiring Atevo for $617,000,000 in a combination of cash and stock plus additional retention. We expect the deal to close in our fiscal Q2 subject to customary closing conditions, including regulatory approval. I want to be clear, Ativo is not currently into our fiscal 'twenty three guidance at this time. We expect to incorporate their financials into our outlook after the deal closes on our next earnings call. Ativo is an excellent business that can become even stronger as part of our Singularity platform.
They concluded their quarter ended December 21 with over 300 customers in ARR of approximately 30,000,000 growing north of 50%. For calendar year 'twenty two, the current For the business is to deliver revenue of approximately $40,000,000 for the full year. And from a margin standpoint, Ativo is accretive to our organic gross margins. But remember, as we expect this to close during our 2nd fiscal quarter, we would incorporate only a portion of that. Ativo and SentinelOne are highly complementary solutions It will open up new customer and cross sell opportunities further addressing the needs of larger enterprises.
I want to join Tomer, Nick and all of SentinelOne In summary, Q4 was another excellent quarter with strong execution company wide, and we're expecting that momentum to continue into the next fiscal year. Thank you all for attending our earnings call. We can now take questions. Operator, can you please open up the line? Thank you.
Speaker 0
As a reminder, if you are using a speakerphone, please remember to pick up your handset before asking your question. We will pause here briefly as questions are registered. The first question is from the line of Duane Pfitz with Goldman Sachs. Please proceed.
Speaker 5
Hi, good afternoon and thank you for taking the question and congrats on a solid quarter, really nice set of results. So if I'm keeping it to one question, I guess I'll Kiva 2, rather upfront obvious one. I guess, Dave, if you could help us understand, I know you're not giving Specific guidance around operating margin impact of Akevo, it's nice to see it accretive to gross margins, but How should we think about how you anticipate the impact that's going to have on your model, both this year and next year as maybe it gets a little bit of scale on top of your platform?
Speaker 4
Sure. So obviously, we have stated that it is accretive to our gross margin. From an operating margin standpoint, I think This current year while we take into account our expected integration costs, the margin profile will be very similar to ours. If you take out those costs on a go forward basis, it would be accretive to ours on an operating margin basis. And we'll have that guidance obviously when we specifically guide next quarter.
Speaker 5
Got it. Is there a way to think about the overall accretion and overlap on your platform and how that Maybe accelerated as you kind of integrate it with your platform?
Speaker 4
Yes. I mean, on a combined basis, we've got plenty of opportunities to scale both operationally and with our products As we have this in the go to market, it really doesn't change our long term margin targets right now, but we will have better guidance as we complete To complete the transaction.
Speaker 5
Okay, understood. Thank you.
Speaker 0
Thank you, Mr. Essex. The next question is from the line of Gray Powell with BTIG. Please proceed.
Speaker 4
Okay, great. Thanks. Yes, I know it's probably a little bit early, but What kind of upsell are you expecting Identity Security to be relative to your typical customer's core EDR bill?
Speaker 3
Go ahead. I think what we're going to see is broad based demand, especially Our enterprise customers and as you folks know, enterprise business is our largest part of our revenue contribution. In addition, it's Even faster than our overall growth rates. So the demand is going to be high and it's only going to get higher.
Speaker 2
Maybe one I think to add to that, we've been partnering with Ativo more than a year now. So we kind of See already the demand that's being generated jointly by the companies. So that just gives us a lot of confidence in our ability to go ahead and You really make it an incredibly successful module for us.
Speaker 3
I think the one last thing I would mention as well is we've seen an incredible level of interest from our incident Spons partnerships and I think we're going to experience a ton of demand coming out of that motion as well.
Speaker 4
Got it. That's really helpful. And then just one quick follow-up. If I look at your sales and marketing efficiencies, they improved every quarter this year. What's driving that and just how should we think about the potential for additional gains in fiscal 'twenty three?
Speaker 3
Well, I think 1st and foremost, it's getting the right operational pieces in place over the last several quarters, which we worked really hard on in terms of Onboarding, training, enablement, but that also extends out to our partner ecosystem as well, because a new sales rep is going to be a lot more productive when they dropped in a region that has mature veteran up to speed partnerships in place and that's the state of the union today with our go to market.
Speaker 4
Okay. Thank you very much.
Speaker 0
Thank you, Mr. Powell. The next question is from the line of Patrick Colville with Deutsche Bank. You may proceed.
Speaker 4
Thank you so much
Speaker 6
for taking my question and Echo the congrats of others on closing out a great 1st year. Just on Ateeva, I mean, I've met with the company quite a few times, And their messaging to me was much more around deception and kind of honeypots and false flags and kind of that domain. What you've been kind
Speaker 5
of mentioning to us today
Speaker 6
is much more about identity. So just trying to understand, has the business shifted quite a lot recently to kind of more focus more on identity? To kind of more focus more on identity, is that how you're kind of trying to pivot the business? Just help me understand Kind of that aspect and whether, I guess, deception and it's going to be part of the kind of Go forward with the TiVo.
Speaker 2
Yes, it's a good question. And the business definitely shifted significantly In the past few quarters, they expanded what they're doing and they really leveraged their expertise in understanding Active Directory structure, which is really The vote for identity to build complete new offerings, which are now, if you look at the revenue mix, are the fastest growing And are definitely showing the biggest traction that they have as a company. It's kind of a threefold type of a product portfolio today Between what we define as kind of legacy deception, which is still very much needed in today's world, especially as we focus on preventing lateral movement That is not always machine driven, but more user driven. But then on top of that, the ability to assess risk Within Active Directory, not just on a go forward basis, but also on a look back basis, allow you to eliminate configuration mismatches More or any type of vulnerabilities you already have pre existing in your environment, that becomes a big deal for customers out there today with the Your complexity of managing identities in kind of on prem situations, but then the entire identity protection layer, Credential protection, all of that, these are new modules that they have built over the last few quarters and are showing meaningful traction For that company, so to us, it's just a great multi layered approach that really addresses in the most comprehensive way today, Everything in and around identity and we feel it's just a great way for our customers to reduce risk, once again, in the most profound way that you can When you're looking at the user perspective, including the insider threat, which is to us maybe an overlooked part What's happening today with the enterprise landscape, but remains a big pain point for enterprises today.
Speaker 6
Great. That's very helpful. Thank you so much.
Speaker 0
Thank you, Mr. Colville. The next question is from the line of Fatima Boolani with Citi. You may proceed.
Speaker 5
Hey, good afternoon guys. This is Mark on for Fatima. Thanks for taking our questions. Maybe just a quick one on OTIVO as well. On the I guess, as of going forward, how do you expect OTivo to be sold?
Should we think about this as a feature or a new modular Capabilities similar to the ones we've seen with cloud security and IoT SKUs or should we expect, I guess, like a different approach here. Thanks.
Speaker 2
Yes. I mean, I think what you're seeing in our business is also a complete shift to really platform selling. So When you look at our cloud portion, it's a complete separate module or module package. Identity will be the same. It's basically an Identity suite of capabilities It will be sold on top of the platform, so not included in any bundle.
To us, I mean, that's the way that we today See success with our existing modules like RSO is an example, it's a complete endpoint management suite, cloud suite and our identity suite. To us, I mean it's just a it's a great way to really expand what we do, But at the same time, make sure that we're not just continuing and selling just one core endpoint or into just one core endpoint TAM, but With every sale, we expand across terms.
Speaker 5
Great. Thank you very much.
Speaker 0
Thank you. The next question is from the line of Saket Kalia with Barclays. You may proceed.
Speaker 5
Okay, great. Hey guys, thanks for taking my question here. Tomer, maybe for you, just maybe zeroing in On the core endpoint part of the business, can you just talk a little bit about how the base looked at the end of the year just around Across different Singularity bundles, Core, Control and Complete. And maybe talk to us how you think about that mix sort of going forward.
Speaker 4
Does that make sense?
Speaker 2
Yes, absolutely. And I think in kind of a quick follow-up to what I just said, We've really shifted in the past couple of quarters to more of kind of an overarching platform selling approach, which really means that We're really focused on just selling complete right now. It's kind of the one and only package you can buy at the enterprise level. And then on top of that, the expansion modules that we built to date, both towards surfaces, data retention and obviously Entity and the user perspective. So to us, Complete really becomes kind of the base of what we sell to the enterprise market.
I think it accounts for about 75% of our enterprise sales today. The vast majority of what we don't sell where we don't sell complete It is really true with the MSSP channel and other parts of the market that might not need the fully fledged functionality that comes with our complete package. But definitely going forward, the focus here is selling complete as the base package for our platform and then on top of that, The extension module, the extension suite that again today span cloud, IoT, data and with Ativo identity as well.
Speaker 3
And I think all of that really is against the backdrop of our growing success in the enterprise. And when we're selling into the enterprise, They're buying more products, more modules.
Speaker 5
Got it. Very helpful. Thanks.
Speaker 0
Thank you, Mr. Kalia. The next question is from the line of Trevor Walsh with JMP Securities. Please proceed.
Speaker 5
Great. Thanks team for taking my question. Maybe best for Dave. I was wondering if you could speak a little To net customer adds on a quarter over quarter basis, it looks like from what I'm seeing around 500 to 700, 700 kind of being kind of more Record of a net add within any given quarter. Is that kind of how you would expect it to kind of go in this throughout this year and into next?
Or do you have Kind of plans from either kind of how your go to market teams are getting segmented, etcetera, to maybe boost that number up considerably and if you could just provide some
Speaker 4
color on that, that'd be great.
Speaker 3
Well, you're right. Q4 was a record quarter, and it wasn't just a record quarter for number of customers added. It's A record quarter for ARR per customer. It was a record quarter for customers over 100,000 in ARR. It was a record quarter for customers over 1,000,000 in ARR.
And lastly, it was also a record quarter for module contribution. So we are seeing absolute positive momentum in the business, and we expect that to continue.
Speaker 5
Great. Thanks a lot.
Speaker 0
Thank you, Mr. Walsh. The next question is from the line of Hamzah Bhatawala with Morgan Stanley. You may proceed.
Speaker 7
Hey guys, good afternoon. Thank you for taking my question. I had a question on data set For Tomer and for Nick. Tomer, if you could just talk a little bit about how the pipeline is trending For that dataset product, I know you rebranded it recently off the acquisition of Scalar. And to what And this is a one to one replacement for some of the existing SIEM and logging solutions out there.
And then For Nick, how are you thinking about building the go to market engine for data set? Is this something that you see that can be sold Separate from the Singularity platform and how are you ramping the reps around that sales motion?
Speaker 2
Yes. So again, record quarter pipeline for data set. I mean, obviously, at the back of the launch, I mean, it just generated a lot of But at the same time, I think what's important to understand is when you're talking about the dataset brand, we're really more addressing the non security use cases Where you find these SEM replacement opportunities, to us, this is going to come on the back of Singularity XDR, dataset is the backbone technology behind the scenes for Singularity XDR, but our way to address security use cases It's with Singularity, with the Singularity brand, with the SentinelOne brand, and with XDR. So head to head Some replacements, these are ones that we're addressing with our XDR platform. When you talk about loading platforms, search capabilities, real time Data monitoring, that's what we do with data set, and that's where we're seeing a ton of traction right now.
So to us, data set is really focused When addressing all use cases above and beyond security, we're leaving the same replacements To our XDR approach, which we truly believe is just the next incarnation of the SIEM, it's a much more of an active solution To aggregate security events, we're going to be opening up ingestion at scale from every product that you have in your enterprise ecosystem And into the XDR platform, so the XDR is the answer for SEM. Dataset is our ability to now go and expand On the foundation that Scalar was built upon and we tailor not into just logging environment and production environment, But also even business data where we see some of our existing customers are ingesting unstructured data from every source, Not only production, not only logging and are deriving insights from the data that they put into the platform.
Speaker 3
And our go to market data set is really twofold. We have a specialized sales force for data analytics, But we've also incented our entire sales force to be able to cross sell data set, and this approach is working great. In Q4, We closed large seven figure deals like a new business deal with Copart and then we also grew customers like DoorDash Well into the 7 figures from an ARR perspective.
Speaker 7
Maybe if I could just follow-up, Nick. Are these being sold to different buyers almost because it seems like data and analytics on the dataset side is an almost entirely different use case versus secure. So are you selling them both to the CECL or is one being sold to maybe another part of the organization?
Speaker 3
We're selling into the CIO.
Speaker 6
Thank you.
Speaker 0
Thank you, Mr. Fodderwala. The next question is from the line of Rob Owens with Piper Sandler. You may proceed.
Speaker 3
Great. Good afternoon. Thanks for taking my question. I was wondering if you can unpack some of the trends you're seeing in your sales and marketing line, which has been somewhat flattish over the last couple of quarters Relative to forward thinking around capacity additions, where you're at and what a return to office might look like for that line? Thanks.
Speaker 4
I can start a bit of it from the financial standpoint. I think what we're seeing is we're just continuing to see more efficiencies and productivity gains. When I think about the time of marketing expense, obviously with it being our IPO year, they were more heavily weighted to the front of the year. We're continuing to invest in sales and marketing to support the growth of the business. And this past year has just been a huge Year of growth for us, whether it's the IPO, the meaningful jump in scale, the growth of the platform or just bringing us a little further up in the mindset of buyers, This has been a really important year for SentinelOne.
And Nick, I don't know if you want to expand a bit just in terms of how
Speaker 3
the sales force is how they're ramping. Well, we doubled our sales force last year. We're going to continue to aggressively hire as we get into the
Speaker 2
end of the year.
Speaker 3
As I had mentioned before, we're really pleased with the productivity and performance of our teams. And again, I want to stress again so much of that It is a benefit of our channel ecosystem. And so what we have out there is the ability to punch Well above our weight, instead of having a few 100 sellers out there, we have thousands of sellers out there that are interacting at all different lifecycle Stages and parts of the organization. So, when I the question I just answered around data set, that's a conversation with the CIO. That really up levels our brand and visibility outside of just having CISO conversations.
So when you think about Scaling and building out a team, what they're inheriting now is a great brand, incredible momentum and a huge channel And what that makes us really confident about is for hiring, increasing our scale and capacity and being able to do so very successfully. Yes. Just a
Speaker 2
quick add to that, like a great way to look at that is our magic number, and it's been over 1, and it's continuing to expand. So to us, I mean, we obviously track efficiently very, very closely and we're very pleased with the progression that gives us more confidence To kind of continue and scale the business of course, couple that with win rates that are consistently strong and you just get a good recipe for growth.
Speaker 6
Next question please.
Speaker 0
Thank you, Mr. Owen. The next question is from the line of Roger Boyd with UBS Securities. Please proceed.
Speaker 5
Great. Thanks for taking my questions. Just a comment on the partner channel. You noted 20% plus The business now coming through strategic partners, given the success you're seeing here and the work you've done in the last 18 months to go and partner with the largest ones, How big could this get as a percent of your business? And as you continue to add end users through these partners, how are you thinking about customer additions in fiscal 'twenty three versus the 3,000 you added in fiscal 'twenty two.
Speaker 3
I mean, I think the growth environment On the partner side is really unbounded. If you think about what we've done, it's not just partnering With security resellers, you think about partnering with MDRs, with MSSPs, with incident response partners, Each on their own, those macro ecosystems are growing massively, especially if you look at the MDR and MSSP space. So As we're growing and adding more of those partners, their own business is really growing super rapidly and that's why APC Contribution, it's accelerating and it will continue to accelerate. And I think what really is great about it is it just gives us exposure To a broad set of customers, especially with MSSPs that we wouldn't normally touch. And so we're doing all those things.
And then in addition, We are continuing to totally focus on enterprise selling and so selling that platform motion, selling modules, Totally focusing on selling Complete into enterprise customers with this amazing collection of modules that we have as well. And that's why frankly we're so excited about the Ativo acquisition is we feel like it gives us several more important arrows in our quiver that we can go out
Speaker 0
Thank you, Mr. Boyd. The next question is from the line of Brent Thill with Jefferies. You may proceed.
Speaker 5
Sooner, you guys mentioned your large customers are growing 2x your smaller customers. Many are asking what's easing the enterprise friction for you going forward?
Speaker 2
I think it's a combination of things, right? I mean, I think I wouldn't I'd be remiss if I didn't say our brand and our ability to Show incredibly well every time the platform is put to the test. I think that's a big driver for us. I think Our Ranger capability, which you might look at just the capability, but it also allows for rapid deployment. It allows for discovery More surfaces in the enterprise, and that just speaks to the simplicity of use that our platform really carries.
If you take that with the ability to join these enterprises in their journey to the cloud with a best of breed runtime protection, We're becoming really a one stop shop for a lot of these enterprises to look at every surface that they currently have, and I think that just unlocks more and more traction for us. If you kind of look even at our data capabilities, once again, the ability to provide up to a year of data retention out of the box, no Customization, just something that you tick off is something that is unique to us in this space. And I think that a lot of the large enterprises out there We are looking at that because otherwise if they're going with a different EBR vendor, they suddenly need to figure how How are they going to retain data and be good on the back of maybe a different platform and that sometimes going to be just incredibly With us, it comes on the back of a single platform. It's the benefit of data set that is now the back end of our entire XDR So obviously, I mean, that is becoming something that's very, very tempting to a lot of enterprises there to solve both for security, but also for data
Speaker 4
Thanks.
Speaker 0
Thank you, Mr. Thill. The next question is from the line of Andrew Nowinski with Wells Fargo. You may proceed.
Speaker 3
Great. Thanks. Can you give us any color on that large deal that you mentioned that was the largest in company history? And was there any significant pricing pressure on that deal and whether we should normalize
Speaker 7
for that deal when we think about billings growth for Q4 of this year? Thanks.
Speaker 2
Yes. I mean, I don't think it's something that we think is completely out of whack in many regards. I mean, we do have a pipeline that shows that our large deal progression is here to stay and it's going to expand and Hopefully, it will be more meaningful as we can progress towards the next quarters. All in all, we could have just a great win for us. No notable pricing pressure outside of the obvious competitive environment.
So to us, it's just another great indicator For our ability to just progress upwards and upward in our large deal velocity trajectory.
Speaker 6
Okay. Thank you.
Speaker 0
Thank you, Mr. Nowinski. The next question is from the line of Joshua Tilton with Wolfe Research. You may proceed.
Speaker 1
Hey guys, thanks for squeezing in my question. Just a quick one for me. On the gross margin guidance, would it be possible to kind of give us a sense of what it would have been if you were not digesting costs associated with migrating
Speaker 4
Yes, I mean in the past we've said it was around 4%. So I would say it's in that ballpark. When I think about what it would be if we weren't having a duplicative cost, we're expecting this to continue through the first half of the year and then obviously it's anticipate over that time, but we expect that the rest of customers will be migrated by the end of Q2.
Speaker 1
Thank you very much. Much appreciated.
Speaker 4
I think you'll see the continued scale on us As we're looking at how we're going to exit the year, if you look at what our guidance is with these suppressed margins in the first half, I think what you're What you can perceive from that is that we'd be in the high 60s by year end.
Speaker 2
Great.
Speaker 0
Thank you, Mr. Tilton. The next question is from the line of Rudy Kessinger with D. A. Davidson.
You may proceed.
Speaker 5
Thanks for taking my question. On TiVo, it would appear the customer base certainly much more tilted towards enterprise customers, Our per customer, a bit over double your guys. How much customer overlap is there? What kind of opportunities do you have within the Ativo customer base I have to cross sell your solutions into those enterprise customers.
Speaker 3
There's some overlap, But it's actually quite small and so that is an incredibly compelling cross sell opportunity, because what's also even more rare is that There isn't much overlap, but we're ultimately trying to solve the same problems together as a joint solution. And we're still selling it to the same parts of the organization, Especially as it's focused around security. So when you think about the Ativo customer base, it's dozens of Fortune 500, several Fortune 10s, Really great customers like Aflac and others and a real strength in federal And public sector and also a real strength in the Middle East as well. And so these are all areas that are going to be highly complementary to our existing business.
Speaker 0
Thank you, Mr. Kapsinger. That concludes the question and answer session. So I will pass the conference over to the management team for any closing remarks.
Speaker 2
Thanks, everybody. We appreciate the time and attention today and looking forward to the next one. Thank you.
Speaker 0
That concludes today's conference call. Thank you for your participation. You may now disconnect your lines.