S (SentinelOne, Inc.): Themes, ETFs, and Basket Ideas
Last updated June 2026
Short answer
What does SentinelOne, Inc. do?
SentinelOne (S) is a cybersecurity company specializing in AI-driven endpoint and cloud security. Its Singularity platform protects endpoints (laptops, servers, cloud workloads) by using machine learning to detect, block, and automatically respond to threats like malware and ransomware in real time, without relying solely on signature databases or human analysts. A distinctive feature is autonomous response: the platform can isolate and remediate attacks on its own, and it offers one-click rollback to undo ransomware damage.
SentinelOne sells through a subscription SaaS model, so revenue is recurring and measured by annual recurring revenue (ARR), and it has expanded from endpoint protection into cloud security, data and log analytics (including a Singularity Data Lake), identity protection, and AI-assisted security operations. It competes most directly with CrowdStrike for next-generation endpoint security. Founded in 2013 and headquartered in Mountain View, California, SentinelOne is a high-growth challenger still investing heavily toward profitability.
Where is SentinelOne, Inc. heading?
1. AI-native endpoint protection.
SentinelOne's core differentiator is autonomous, machine-learning-driven detection and response that can act without human analysts, including one-click ransomware rollback. As attacks grow faster and more automated, AI-native endpoint security is a structural growth category where SentinelOne is a recognized leader and the main challenger to CrowdStrike.
2. Platform expansion.
SentinelOne is broadening beyond endpoints into cloud security, identity protection, and a data lake for security analytics, letting customers consolidate tools onto one platform. Cross-selling these modules lifts ARR per customer and positions the company against broad security suites, the classic land-and-expand SaaS motion.
3. Data and AI analytics.
The Singularity Data Lake ingests and analyzes security data at scale, and SentinelOne is layering AI assistants for security operations on top. This expands its addressable market into SIEM-like analytics and threat hunting, areas with large budgets historically owned by Splunk and others.
4. Strong ARR growth.
SentinelOne continues to grow ARR and customer count at high rates with healthy net retention as customers add modules. Rapid recurring-revenue growth, improving gross margins, and progress toward free-cash-flow positivity drive the investment narrative.
Risks worth tracking: SentinelOne competes head-to-head with CrowdStrike, which is larger, profitable, and has a strong brand, plus Microsoft, which bundles endpoint security into broad licensing at attractive prices. It is still working toward consistent GAAP profitability and carries significant stock-based compensation, so it depends on sustaining high growth to justify its multiple. Decelerating growth, pricing pressure from bundling, or churn would weigh heavily on the stock. As a high-multiple growth name, it is sensitive to sentiment, rate cycles, and security-spending shifts. A high-profile security incident or product gap could also damage trust in a market where reputation is paramount.
Earnings and valuation (approximate, early 2026)
A simple financial snapshot. These are approximations and refresh quarterly; for current figures see SentinelOne, Inc.'s investor relations page or your broker.
- Revenue (TTM): ~$850 million
- Annual recurring revenue: Growing rapidly (around or above $900 million)
- Revenue growth: Strong (high double-digit, decelerating from very high)
- Gross margin: High (improving, ~75%+ non-GAAP)
- Operating margin: Negative GAAP; approaching breakeven non-GAAP
- Free cash flow: Turning positive
- Price to sales: High (premium SaaS multiple)
- Dividend yield: None
SentinelOne trades as a high-growth cybersecurity name valued on ARR growth and platform expansion rather than current GAAP earnings. The premium price-to-sales multiple reflects strong recurring-revenue growth and improving margins, balanced against GAAP losses, dilution, and direct competition with CrowdStrike and Microsoft. Valuation is highly sensitive to growth-rate changes and the path to profitability.
S's competitors
Endpoint detection and response
CrowdStrike is the closest and largest direct competitor in next-generation endpoint protection. Microsoft Defender for Endpoint, bundled into broad licensing, is a major price-competitive alternative, alongside legacy vendors like Palo Alto Networks (Cortex).
Cloud and workload security
Palo Alto Networks (Prisma Cloud), CrowdStrike, Wiz, and Microsoft compete in cloud workload and posture protection as SentinelOne expands beyond endpoints.
Security analytics and SIEM
Splunk (now part of Cisco), Microsoft Sentinel, and others compete in security data analytics and SIEM, the market SentinelOne targets with its Singularity Data Lake.
Using S in a Walnut basket
The most useful question to ask about a single stock is rarely “will it go up?”. It's “does this fit a thesis I actually believe in, and how do I size it alongside other stocks that fit the same thesis?” That's what Walnut is built for.
Open the AI assistant on Walnut and describe a thesis (for example: “the AI infrastructure buildout”, “dividend growth large-caps”, “global semiconductors”) where S would naturally fit. The AI proposes 5 to 6 constituents with target weights, you review, and you can fund the basket through your broker once you're ready.
Build a basket around S with Walnut
Use SentinelOne, Inc. as one constituent in a thematic basket Walnut's AI helps you assemble. Describe a thesis you believe in, the AI proposes the holdings and weights, and you approve before any broker order.
FAQ
What is SentinelOne's ticker symbol?
+
S, listed on the NYSE. Officially SentinelOne, Inc. Founded 2013, headquartered in Mountain View, California. Publicly traded since 2021. It trades during US market hours and is available at every major US brokerage. The single-letter ticker S is distinctive.
What does SentinelOne do?
+
SentinelOne provides AI-driven cybersecurity through its Singularity platform. It protects endpoints, servers, and cloud workloads using machine learning to detect, block, and autonomously respond to threats like ransomware in real time, with one-click rollback. It has expanded into cloud security, identity protection, and security data analytics.
Who are SentinelOne's main competitors?
+
By segment. Endpoint detection and response: CrowdStrike is the closest competitor, with Microsoft Defender and Palo Alto Networks also competing. Cloud security: Palo Alto Networks, CrowdStrike, Wiz, and Microsoft. Security analytics: Splunk (Cisco) and Microsoft Sentinel as SentinelOne expands its data lake.
Is SentinelOne profitable?
+
Not yet on a GAAP basis. SentinelOne is still investing heavily for growth and carries significant stock-based compensation, so it reports GAAP losses. However, gross margins are high, non-GAAP results have moved toward breakeven, and free cash flow has been turning positive, with profitability targeted as ARR scales.
How is SentinelOne different from CrowdStrike?
+
Both are next-generation endpoint-security leaders. SentinelOne emphasizes fully autonomous, AI-driven detection and response with one-click ransomware rollback, positioning as the AI-native challenger. CrowdStrike is larger, profitable, and has a broader installed base and brand. They compete directly, and customers often evaluate them head-to-head.
Is SentinelOne a cybersecurity stock?
+
Yes. SentinelOne is a pure-play cybersecurity company focused on AI-driven endpoint and cloud security and security analytics. Investors typically hold it within a cybersecurity theme as a high-growth, AI-native endpoint-security play and the primary challenger to CrowdStrike.
How does SentinelOne make money?
+
SentinelOne makes money through recurring software subscriptions to its Singularity platform, measured by annual recurring revenue. Customers pay annual fees for endpoint, cloud, identity, and security-analytics modules, and expand spend by adding capabilities over time, the standard land-and-expand SaaS model.
Why is SentinelOne's ticker just S?
+
SentinelOne secured the single-letter NYSE ticker S, a rare and memorable symbol, when it went public in 2021. Single-character tickers are scarce and often reassigned carefully; SentinelOne's choice reinforces its brand. It is officially SentinelOne, Inc., and the ticker simply reflects the company name's first letter.
Is SentinelOne in the S&P 500?
+
No. SentinelOne is a mid-cap, not-yet-GAAP-profitable company and is not an S&P 500 constituent. It appears mainly in cybersecurity, software, and growth-oriented thematic funds rather than the large-cap index.
Which thematic baskets typically include SentinelOne?
+
Cybersecurity and AI themes on Walnut. SentinelOne is often used as an AI-native endpoint-security sleeve within a cybersecurity basket, frequently paired with or as an alternative to CrowdStrike, reflecting a higher-growth, higher-risk challenger profile.
Which ETFs hold SentinelOne?
+
Cybersecurity-themed ETFs hold SentinelOne, often at meaningful weights as a recognized next-generation security name, alongside broad software, innovation, and small-to-mid-cap funds. It is generally not a significant weight in large-cap S&P 500 index funds.
Is SentinelOne a good stock to buy?
+
Descriptive, not a recommendation. SentinelOne offers exposure to AI-driven cybersecurity with strong ARR growth and platform expansion, balanced against GAAP losses, dilution, a premium valuation, and direct competition from larger rivals CrowdStrike and Microsoft. Whether it fits a portfolio depends on growth conviction and risk tolerance. Walnut is informational, not investment advice.
Walnut is informational, not investment advice. Financial figures on this page are approximations; always verify current numbers with SentinelOne, Inc.'s investor relations page or your broker before making investment decisions.