SentinelOne Customers Above $100K Rise 13%
SentinelOne is turning existing accounts into a bigger growth engine, with customers spending at least $100,000 a year rising 13% to 1,715 as the cybersecurity group pushes deeper across more of its product set.
That matters because the security software market is no longer rewarding pure new-logo growth alone. Buyers are consolidating vendors, bundling platforms and demanding more value from each contract, which means the companies that can expand within a customer base have a better shot at durable revenue growth and eventual operating leverage. For SentinelOne, the latest quarterly filing suggests its land-and-expand strategy is doing more than supporting the core endpoint business: it is helping lift adoption across adjacent products as customers add capability rather than switch suppliers.
The shares have already responded to that improving mix. SentinelOne is up almost 60% from levels seen earlier in the year, although the stock still trades well below the highs reached by larger peers CrowdStrike and Palo Alto Networks. SentinelOne closed at $23.80 on Monday, above its 50-day moving average of $20.66 and its 200-day moving average of $16.31, while RSI readings near 58 point to momentum that is constructive but not yet stretched. The stock’s rebound reflects a market that is increasingly willing to pay for visible execution in cybersecurity, especially when growth is being driven by expansion rather than expensive acquisition.
The company’s own disclosures support that thesis. SentinelOne said customers with annual recurring revenue above $100,000 increased by 13% year on year, largely because existing customers bought more and the average customer size expanded. That is important in a market where chief information officers are still scrutinizing budgets and often prefer to deepen relationships with vendors they already trust. It also suggests SentinelOne is gaining traction in cross-sell and upsell motions, a prerequisite for improving gross retention and pushing margin structure higher over time.
Investors will be comparing that progress with the broader sector. CrowdStrike and Palo Alto have both been beneficiaries of the same platform-consolidation trend, and their shares have outperformed SentinelOne over longer periods because of stronger scale and profitability. But SentinelOne’s recent move indicates that smaller security vendors can still win if they show that expansion revenue is broad-based and that customers are willing to add products after the initial sale. The bull case is that more products per customer can support a longer growth runway and bring the company closer to operating leverage. The bear case is that the expansion rate may be enough to stabilize growth without proving SentinelOne can match the durability, pricing power or margins of larger rivals.
For now, the key test is whether the company can keep turning installed accounts into larger, stickier relationships without sacrificing efficiency. If it can, SentinelOne’s growth story will increasingly look like a platform story rather than a point-solution recovery, and that is the kind of shift investors have been rewarding across cybersecurity.
| Entity | Gains | Losses |
|---|---|---|
| SentinelOne | ▲Higher expansion revenue | ▼Reliance on execution |
| Existing customers | ▲Broader security coverage | ▼Larger vendor lock-in |
| CrowdStrike | ▲Sector validation | ▼Incremental competition |
| Palo Alto Networks | ▲Platform-trade support | ▼Price pressure from peers |