The base business is solid and improving, but the upside requires proving that data/SIEM and agentic workflows can scale profitably. If execution stays clean through leadership transition, a re-rate is plausible.

SentinelOne can graduate from “EDR challenger” to an automated SecOps control plane (single agent + hot data + AI-driven workflows), capturing the AI-era SOC labor compression while expanding into data/SIEM and sovereign deployments; if it sustains ~20% growth with improving cash generation, today’s discounted multiple can re-rate.

AI makes both attacks and SOC work more automated; value shifts to always-on telemetry, trusted remediation, and distribution via partners—areas S is built for, though bundling by incumbents caps winner-take-most outcomes.

The setup is a mid-cap cyber platform with credible “automation + data” product direction and improving operating discipline. If S proves repeatable module attach beyond endpoint (data/SIEM, cloud, identity adjacency) and keeps unit costs controlled, it can earn a higher-quality SaaS multiple than today’s depressed level. The non-linear upside comes from agentic workflows shifting spend from human SOC labor to software outcomes, plus partner/MSSP distribution scaling faster than direct headcount.

The central risk is economic: winning consolidation deals while defending price against suite vendors, at the same time as data/SIEM increases cost-to-serve. If S cannot show durable net retention and improving free cash flow through this transition period, it may remain valued as a challenged endpoint vendor rather than a platform.

$21.64