SentinelOne CEO: SIEM, Purple AI Driving ‘Outsized’ Growth Surge

Roughly half of SentinelOne’s bookings during its latest quarter came from emerging products, led by its AI-powered security operations tools, CEO Tomer Weingarten said during the vendor’s quarterly call Thursday.

SentinelOne is seeing “outsized” contributions from products beyond its core endpoint security offering, underscoring major adoption of the company’s broader Singularity platform by partners and customers, SentinelOne Co-founder and CEO Tomer Weingarten said Thursday.

As one key indicator, roughly 50 percent of SentinelOne’s bookings during its latest quarter came from emerging products outside of endpoint security, Weingarten told analysts during the vendor’s quarterly call.

Those products include SentinelOne’s AI-powered security operations tools such as Singularity AI SIEM (security information and event management) and Purple AI, the company’s “AI security analyst,” he said.

All in all, during the third quarter of SentinelOne’s fiscal 2026, ended Oct. 31, “our emerging platform solutions continued to scale and achieve outsized growth,” Weingarten said.

The fact that approximately half of quarterly bookings came from outside endpoint detection and response (EDR) showcases the “growth, diversity and expanding value of our platform,” he said.

Annual recurring revenue (ARR) per customer also reached record levels during the recent quarter, a feat that was “primarily driven by strong contributions from our data, Purple AI and cloud security solutions,” Weingarten said. The company reports sales of AI SIEM within its data segment, he noted.

For the quarter as a whole, SentinelOne beat analyst expectations with total revenue of $258.9 million, up 23 percent from the same period a year earlier.

SentinelOne’s stock price fell Thursday, however, with one Wall Street analyst indicating during the call that the vendor’s guidance update fell short of expectations. Shares in SentinelOne were down 7.7 percent, to $15.66 a share, in after-hours trading Thursday evening.

The security vendor also disclosed Thursday that Barbara Larson will step down as CFO, a role she’d held since September 2024, for an unspecified opportunity outside the company. SentinelOne has begun the search for a replacement and has named Barry Padgett, the vendor’s chief growth officer, as interim CFO.

During the call with analysts, Larson described the move as a “personal decision” that is “entirely independent of SentinelOne’s outlook.”

“We’ve built a really strong foundation, achieved profitability [and] have solid momentum. That’s clear by our Q3 out-performance and outlook for FY26,” she said, adding that she will remain with SentinelOne through mid-January to assist with the transition.

Strong indicators from the company’s latest quarter included a 40-percent attach rate for Purple AI when it came to licenses sold in the SentinelOne’s fiscal third quarter, executives said during the call.

SentinelOne also saw triple-digit growth, year over year, during the quarter in its data segment including AI SIEM, Weingarten said.

Within that category, SentinelOne is finding major traction in replacing “legacy” SIEM products—and is poised to continue the momentum through moves such as its recent acquisition of data streaming platform Observo AI, he said.

Bringing together Observo’s “complete, AI-native data pipeline” with the company’s “ultra-fast” data lake is a powerful combination, Weingarten said.

The result, he said, is that SentinelOne now has “the complete data suite—from data pipelines and ingestion, to data lake and search, [to] data orchestration and hyperautomation.”

Ultimately, “that marriage of data ingestion, data processing and data orchestration really starts to produce this vision of the complete, autonomous cybersecurity platform, which is where we’re going,” Weingarten said.

Others ‘Missing’ The Mark On Agentic

In an interview with CRN in November, Weingarten suggested that other security industry vendors are coming up short in terms of truly improving cyber defense with AI- and agentic-powered technologies.

“Everybody wants to say they have agents,” Weingarten said during the interview at SentinelOne’s OneCon 2025 conference. “I think it’s just coming from these companies needing to rush something out and to say, ‘We’re here, we’ve got agentic capabilities.’ But tangible outcomes [with agentic]? That’s a whole different story right now.”

The company debuted an array of AI-powered products for security analysts in connection with the event, in a move toward fulfilling the vendor’s vision for an “agentic SOC” (Security Operations Center).

SentinelOne, in fact, is the first to deliver what could be considered a “fully agentic” SOC offering, Weingarten said. That’s in contrast to other major vendors that have focused more heavily on providing individual AI agents for various security tasks—such as alert triage or threat investigation—as well as on providing platforms for organizations to build their own agents, he said.

“That’s where I think a lot of [vendors] in cybersecurity are just missing it,” Weingarten told CRN. “They give you components. They don’t focus on the experience or on the outcome.”

‘Huge’ Partner Opportunities

For solution and service provider partners of SentinelOne, the opportunities are abundant in helping customers get ready for an agentic SOC transition, he said during the interview.

For instance, for solution and service provider partners looking to help customers move toward an autonomous SOC approach, “the first step is to start getting data in,” Weingarten told CRN. “Let’s start to route the data. Let’s start figuring out, how do we move data from which systems? And how do we optimize, filter and enrich all these data sources?”

Overall, partners have a “huge opportunity” with SentinelOne across numerous segments, with other major areas including AI security, enabled by the vendor’s recent acquisition of Prompt Security, he said.

Weingarten echoed the sentiments during the quarterly call Thursday. Responding to an analyst’s question, which referenced the intense competitive landscape over working with partners, he said that SentinelOne’s “partner ecosystem is incredibly robust” at this stage.

“All I see is growth from our partner set as a whole,” Weingarten said.