SentinelOne, Inc. (S) Earnings Call Transcript

Good afternoon, and welcome to OneCon. Please welcome Chief Business Officer, Eran Ashkenazi.

Hello, everyone. Good evening. First of all, this is a welcome to OneCon 2026. Give it a round of applause. So this is -- I know you're tired, you had a long day. Same here, by the way. This is just a warmup, okay? This is just the preshow. Tomorrow is kind of the big kickoff. However, we wanted to kind of do something interesting this year, so we have a couple of evening sessions for you. Just really just 1 session and 1 -- actually 2 sessions. One of them is from our Chief Customer Officer, Steve Stone. He will talk about how we are combining AI and experts together. Everything that we've done within the Wayfinder Threat Hunting Services and a lot of takeaway things that you can take with you to your own environment because we learned a lot of lessons by using AI and experts together. The second session is actually the Sentinels League Threat Hunting World Championship were from thousands and thousands of participants, we came all the way to the finalist and we're going to choose the one clear winner. So again, tomorrow, we'll do all the things about housekeeping and apps and parties and schedules, tonight is just to get into the groove, okay? So take a deep breath, relax, start enjoying the show. And first up, it's our Chief Customer Officer, Steve Stone.

All right, folks. As Eran said, we're trying some new things here this year. And I love that we are starting off with threat hunting tonight. I think when we run a business, it's really easy to forget about what we do every single day and threats how we find them, that's what we're here to do. So we're really excited to have all of you here with us in Vegas. I'm pretty happy here being my third OneCon. How many of you is this your first OneCon? Look at that, a lot of first OneCons. All right. I love that. So what I want to kind of start with is let's do some like typical Vegas stuff. Let's do some accountability. Vegas loves that. When you hear Vegas, you think accountability. I think if you go buy one of those magnets in the lobby, it says, what happens in Vegas, let's hold on to it for a year and then talk about it with 1,000 people. It's like really awkward on a magnet. But that's not what we're going to do here. We're going to talk about threat hunting and we're going to talk about AI. But what I really want to talk about is, are we delivering on what we promised you when we stand on stages like this. When we look back at the last year, what we promised you, are we delivering that? And we want to be transparent and accountable so then we can talk about what we're doing, how we see it changing the world and where we are going at SentinelOne. And for today, we're going to really focus on that AI and expert piece. So it's hard to overstate how much changed in the last year. I had the benefit of being on stage and talking about predictions what we thought was going to happen. I went back and checked our scorecard and give us like a B-. I think we did pretty good. But with AI, our assessment was it's going to change fast, and we don't really know what that's going to be. That's kind of a mulligan of a prediction. You kind of get that one right, and that one turned out to be true. If we look at the big headlines from cybersecurity, all of them come back to something to do with AI. We can start with the Hugging Face incident. I know we are all very familiar with. We can start with multiple governments having multiple clashes with AI companies. We can talk about international disputes around chips. We can talk about how we in the U.S., let's talk about Anthropic and OpenAI and Nvidia and then we look in China and DeepSeek, particularly their V4 and running on Huawei's Ascend chips. These are things we just didn't talk about. But if I had to give one example of what's really driving this change, I'd pick the example from the U.K. government. The U.K. government put out an assessment about 3 months ago and their official government assessment is that the frontier models are doubling their offensive cyber capability every 4 months. That means since the last time we were here for those this is your second, third or fourth OneCon, that offensive capability from those models has tripled. That's a change in pace we have not seen before in this industry. And it's really driving a lot of things. So I think it's really important. We just talk about this is moving so fast, and this is the pace we must meet. When we talk about the things we owe you as customers, this is the pace that we owe you. And I think it's also fair to say we stood on the stage, and we made a bunch of promises. We rolled out a bunch of products. I am really, really excited for you folks to see what Chris Corde and his team is going to roll out tomorrow. Tomer is going to provide his vision, but it's hard to dive into those things if we don't instill confidence in all of you that what we say we're going to do, we do. And we look back at last year, we talked a lot about AI. We talked about the expansion of Purple AI. We talked about agentic investigations. We relaunched our threat services with AI being the single thing that ran through every one of those elements. We launched our own Frontier AI services. And what I'll talk about here as an example of our commitment to you is our AI-driven hunting because I think, ultimately, the thing we focus on the most at SentinelOne is pairing the right technology with the right people. That's how we see AI really changing this market. And honestly, that's how we see it having the greatest impact in securing your organizations. So let's talk about where we see AI and where we fit in hunting. At SentinelOne, the base of every single thing we do is detections, period hard stop. This is the first and last thing we do every single cycle. As we dive into that, for those who have done detections, the concepts are not complicated. The work is incredibly difficult. We start with fragile detections, what we talk about with indicators of compromise, we will take any advantage we have to find and stop attackers. If they want to give us things that we can go track, we will do that. Although we try not to rely on that because what matters today could be irrelevant tomorrow. The command and control that we're seeing for key intrusions can be worthless in 30 seconds, but we'll use that advantage. Second, like everyone else in the cybersecurity industry, we use signatures. We write specific content to look for specific things and really try to focus on how to be impactful for there. And then what has always made SentinelOne different is our focus on autonomous models. SentinelOne's first patent ever in 2014, 12 years ago was for an autonomous model to detect malware. We sit and watch a lot of organizations struggle to move into the AI area, we were already here. This is where we started at SentinelOne. So this excitement that we feel, it just feels like we get to really focus on the things that started with us and that we really get to do well here. So our autonomous models will always be the core of how we approach detections. Last year, one of the things we stood on this exact stage and talked about was we relaunched our threat services. I don't want to spend any time with architecture. I don't want to talk about offerings, but I do want to talk about one of the core components that we built into every single level was a multi-tiered threat hunting capability. As we looked at this, we felt this is critical. Detections are the base, detections are key. But we combine that with hunting, we can move faster, we can pivot we can identify and flag things to our analysts that we would never pass on in a product. There's a huge difference between something being viable for hunting and being production-grade ready for a platform. And so we want to leverage these 2 different things, so they're complementary and not competitive. At SentinelOne, you can see we're pretty original with our names. We have threat intel-based hunting, where we use Intel. We have real-time hunting, which is where we hunt in real-time and retrospective hunting, where we do more computationally intensive and requires more analysis type of work and that we time bound that. But the thing that we launched that we had never done before at SentinelOne was our AI-based threat hunting. This was our first foray into this. And when we talk about our commitment to technology and experts, I think this is single best example we can give you of how we approach that. So I want to give you 3 examples of why we think this is important and where we see successes and what we're going to build around in the future. Ultimately, our overall goal is to tie all of these things together. Our goal is to create as many layers as many traps as many ways that we can detect, find, isolate, prevent and respond to threat activity, and we'll do this in any way we possibly can. And this is always part of our whole. So when we talk about the benefits from AI-assisted hunting, we have to think about it as part of this whole. This is how we approach the strategy here at SentinelOne. So let's just kind of give some metrics. Everybody in Vegas loves metrics. So we'll go through this one pretty quickly. But we talk about scope and scale for artificial intelligence. What does that mean? What does that actually apply? How does that actually manifest in your organizations and in our work. If we look at the last year, market analysis says the typical organization will grow their endpoints about 16%, that matches what we see at SentinelOne. We typically see an environment grow about that same amount. So by extension, we should have 16% more detections and hunt findings than we did last year because we have that much more surface area. But as we focus on those autonomous models and the ability to scale, we see that a 50% increase in our true positive detections in that last year. We've identified more than 14 million true positives to our customers in the last calendar year, and that's growing faster than we see overall endpoints and environments. But where we see AI-assisted hunting providing the greatest benefit as part of that larger capability is the ability to move at speed and scale. So let's show how that fits in here. We launched AI assisted threat hunting at OneCon. It went live on 1 December. In the first quarter, we had it, we saw a 380% increase in our ability to find malicious activity using that methodology. That's fine. Any of us that have built something, your first iteration, you're going from nothing to something. So all right, that's great. We love it, but that's not really a meaningful number. As we were 6 months into this effort, we saw AI-assisted hunting's ability to find evil increase 1,400%. And right now, today, we have seen that ability to go up 2,200% in the last year since we were on this stage in this room, this is what we believe the outcomes and the scope and scale of this technology and our people combined works. But that doesn't mean anything 22,00% cool, awesome. That doesn't mean anything for your environment. The real number when we talk about scope and scale that matters to us and our organizations that build, field and respond to these things is 28. We notify customers 28 times every single day of intrusion activity that we found solely for our AI-assisted hunting. We will do this at least once while I am here on this stage. That is what AI and the right people building the right models and understanding that is able to provide to us. So that's one example. Let's get into like intrusions stuff. I love intrusion stuff. I've been very lucky to spend 25 years in the intrusion business. I had to promise I wasn't going to spend too much time talking about intrusions on stage, but we want to give a second example of where we see AI-assisted hunting help. And we'll start with React2Shell. I'm sure most of you in this room are very familiar with React2Shell. This is the fastest mass exploitation event of the last year, and this was our very first stress test of our AI-enabled hunting. What we saw here for React2Shell for those who may not be familiar with it, this is a critical vulnerability around React servers that the company that builds these went public with on 3 December. Let's talk about a stress test. We launched AI-assisted hunting on 1 December. We dealt with the largest mass exploitation event of the last year within 48 hours of us building this new capability. For those who may not be real deep in how this works, you'll see the CVSS score of 10.0. that's as high as it gets. There's nothing worse. There's not a 12, there's not a 15, there's not a 10A and B. If you see a CVSS of 10.0, that's essentially the industry saying, this is as bad as it gets. This can be easily exploited and it can do really dangerous things, and everybody needs to pay attention immediately. The reason this particular React2Shell, when we look at this, what was so dangerous about it was, you could have exploitation based only on a crafted HTTP request, no authentication required, no user action, no code push to servers, a single HTTP request could lead to active compromises. That's why we saw this as a 10.0. And at SentinelOne, this became an all-hands on deck immediately. Every single 1 of our capabilities to be able to find this, we started working on overnight. Didn't stop. This is as serious as it gets for us. And as we see this play out, we saw industry reporting within the first 24 hours. AWS was the first organization to come out publicly and say they knew of at least 1 Chinese-based threat group that have already exploited this vulnerability and it was within about 12 hours, fairly rapid turn on this. As we sat and looked at our posture in detection and hunting, we knew we have strong coverage in Linux and Mac early, but we had real challenges on Windows, just the way this manifested. I would freely love to dive into the details there. But again, I'm on a shot clock and they may be so, I would not. But we had weaknesses we had to cover. We had strengths to build around. This is exactly why we have those 7 different layers and how we're able to use them together. We're able to have detection, the strengths for 2 of the 3 areas and then we're going to focus hunting and detections on the ones we have the weakest coverage. Within the first 48 hours, CISA has identified this as a KEV. That just means the U.S. government knows this thing is being actively exploited out in the wild. By the time they put this out, they were 36 hours behind. The first exploitation had happened 36 hours before this notification went to the public. This entire time, we're cranking on the back end, and then we start to see mass exploitation. We saw Google Threat Intelligence put out a piece on they saw no less than 5 different Chinese-based threat groups exploiting React2Shell. We saw an additional 2, so across our enterprise, our research told us there was at least 7 significant groups that had already exploited this within the first week and we're running active intrusions. If we go back to the first contact, the first time we actually observed React2Shell at one of our customers, it was on December 9. And the first fire we had was AI-assisted hunting. That was the very first way that we found this 10.0 based activity. We had built a specific hunting engine that was designed to recognize the general shape of web exploitation. We would never take a tool designed to do a general shape of web exploitation and load that into your devices. It would explode every device would just go off. We would bury our customers in alerts. And that alert would take significant global visibility and multiple analysts with different skill sets to suss through and make sense of it. That's why we use hunting versus detections. And that fire in and of itself, when that thing fires and now we have something to work with didn't mean it was conclusive. That first fire just meant there's something interesting to look at. And this is where we start seeing the technology and the experts working hand in hand. We had a specific threat hunter looking at this fire, and it looked like pentest. And we see pentest 24/7. So when we see malicious activity, that masquerades as a pentest, it's not in isolation. We see lots of pentests all the time. So our analyst looks at this and just says the thing that we never want to admit in this industry just doesn't feel right. We love to say we have technology answers, everything is universal. It's machine driven. It's not how we got going on this. We had an expert who looked at pentest for years, and that expert could say, I just know this isn't right. At this point, we started waking people up. We start moving across our MDR organization. We start moving across our detection organization because now we have real content, we have a real trail that we can start pulling apart and figuring out how we're going to detect this, where is the best place for coverage, what do we do on endpoints? What do we do in cloud, which rule sets get what? This is where we think we really shine. This is what SentinelOne loves to do more than anything else. And as we figured that out, we were now able to move across those 7 different categories and strengthen all of them and expand our detection surface area. We're able to take the things that we were finding in hunting, which we're able to refine down and now it is production grade. Now we can load it into the platform. And now, by the way, we can hunt for something totally different. We can take that work from the AI models and the experts, move into the platform and build an entirely new AI model and go after something new and original and innovative. And this process just kept happening day after day after day. And by the time we ended that first 30 days, we had identified a total of 8 attempted victims from numerous threat groups using React2Shell against our customers. What was interesting was that exploit by that point, had been used for a number of different things. We saw some really interesting attempted domain reconnaissance that we believe was designed to lead to some really in-depth intrusions. We saw coin mining, we saw crypto mining. These things aren't necessarily exciting, but you don't know that at the time. So we worked through all of these things. And this is the kind of things we write blogs about. We did. This is the kind of things that we talk about a threat conferences. How do you find something that has never been seen before and is as dangerous and critical as this is. So we think this is our second example. This brand-new capability we rolled out was able to hold up against what is one of the most difficult challenges we have seen in the last year. So we can see trends that show a scope and scale is demonstrably improved and we have experts and AI. We can see that it's able to find highly evasive and dangerous types of activity that is also representative amongst a bunch of other noise. And then the third example I want to give is kind of boring. We never want to say on stage that something is going to be kind of boring, but again, we're all in the same work here. We all spend our time trying to secure our organizations. One of the things that may be the only thing harder than finding something for the first time is making sure you can find it day after day, month after month, year after year because now not only are you evaluating, does your detection rules still work you're also evaluating is that rule capturing everything. SectopRAT is one of our best examples of that. I'll just refer to that as this RAT moving forward. That's kind of an awkward word. This thing has been out there for 7 years. We've been detecting and reporting this to customers for 7 years before our first OneCon ever occurred, we were working against this activity. And it's not super exciting, but it's important. Primarily, it steals browser sessions and crypto wallets. But what we saw over time was there was a new delivery wrapper every few months. So we had to be prepared to deal with this constantly evolving RAT and again, go back and make sure across all of our levels and say everything is still where it needs to be. We're still firing on this. And what we're able to do is really start working through, what do you use detection for? And our answer was we're going to use detection to really look at the behavior of this thing and not focus on some specifics and not focus on the whole entity. What we're going to focus on those areas is with hunting. So some examples over this summer, we have done dozens of updates on this threat over the years. I mean, literally dozens of different things. July 13, pretty typical. Pretty typical example of how we do this. We started on the 13th of July, we update our static rules. They've got some new Windows and Linux rules that really help us find this specific piece of malware. That's great, but that's not the strongest detection. We also focus on changing our behavioral detections, how do we find this overall model of a cookie stealer, whether it's SectopRAT or not, Also, we have those fragile detections. We had 50 known active indicators of compromise that were doing command and control. We'll take them. If the bad guys come to us, we will take it. We will make sure that's a layer as well. But then what we started changing was our ability to use AI-assisted hunting. We were already doing regular hunting. We had found more than 6 findings that we had discovered via retrospective hunts that we were running, looking back 2 weeks against customers. But what this new capability gave us was, we were able to also run AI-assisted hunting to say, are we finding the edges of this thing what's happening and evolving that may be something that just we've never seen before, it looks a little bit different, and then we can run the whole drill all over again. So in this case, -- we did not use AI-assisted hunting as the core detection or hunting technology. We used it to evaluate our other capabilities and make sure things were exactly how we thought it would be. And in this business, this is one of the most difficult tasks. So we're able to say, you know what, we absolutely are finding this. In this case, the new wrapper is masquerading as a fake Claude Desktop installer. Great. It's a new kind of installer. We've seen this over and over again. But we can verify that our static rules and our behavioral detections are working effectively cross it off the list. That's the first way. Second way, we're able to point the rest of our hunting at going after the chain. What are the things that do change over time. Let's create a rule set that targets specific EXEs that poses specific things. Perfect for hunting. We wouldn't want to load that in detections because that's going to change. We want to make sure we can be nimble and we can move quickly. And we're able to verify this again against our AI-assisted hunting. And then our third layer we're able to say, you know what, let's just actually go build for this thing with AI as well. But in this case, we actually built a specific DLL side-loading hunting pack that was designed not to go after this tool, but to go after this activity. So now let's go see what it fires on. And it fires on these things, we can now bring it back, analyze it. Now we have full attack paths, we have full intrusion chains, and we can run right back and work this against every one of our layers and make sure it's correct. So I present these not as us here at SentinelOne saying we're great, like we won a trophy. What we're actually saying is, this is why we pair experts and technology together. This is why we are committed to this path. It helps us move at a speed and scale we could not before. It helps us find high-end rare intrusion activity, and it helps us do our daily job better. It's rare to find a single capability that can do those types of things day in and day out. And what I would leave you with as we talk about AI and hunting is really 2 quick sets of takeaways. And then I'm really excited for folks to see our hunting challenge come on. I'm really, really excited to see our experts go after these things. But we look at the attacker side of the house, I got some bad news, I got some good news. Bad news. attackers are using AI. That's not next year, that's last year. We are seeing AI-driven attacks across the entire threat landscape. It's not just the remit governments. We're seeing individuals use it. We're seeing small groups use it. We're seeing governments use it. AI-driven attacks are here to stay. This genie does not go back in the bottle. That's the bad news. Good news, these are actually like super detectable. That's a technical term, by the way, super detectable industry term. We can see these things. In some ways, AI-driven attacks may actually be a little bit easier to find because the AI agents are not quite as focused on some of the evasive activity. So we have more things that we can detect on. Plus one of my favorite things about looking at prompts, it is the only time in my entire career where the attacker has to literally write out what they want to do. I would have killed for that 25 years ago. That allows us to detect. So we should not give up hope. We should not sit and say the attackers have all the advantages. We can find these things. The challenge we now have, what is changing in the landscape and the piece that we all need to pay attention to, speed is changing. If you go and look at the media reports, almost all of that is focused on vulnerabilities. You can read about every one of the Frontier models and its ability to find hundreds to thousands of vulnerabilities. You can easily read about the ability of these models to create exploits against those vulnerabilities. It doesn't really change much. And the example I would give is, finding vulnerabilities was never the attacker bottleneck. We were multiple vulnerabilities and exploits behind 20 years ago. We were 100 vulnerabilities and exploit behind 2 years ago. We're 1,000 vulnerability exploits behind now. It helps. It helps the attacker. It's an advantage, but that's not the biggest challenge we have. The biggest challenge we have is, for the first time, we are literally seeing attackers move at machine speed. I know all of you have heard that before. I know you've read it in marketing decks, I know you've heard it talked about on stages just like this one, but it's real. The speed with which attackers can move through an event is unparalleled. That is our biggest challenge and the thing that we have to work incredibly hard to solve. Here's the good news. On the right-hand side here, we have the same capabilities. Everything they are doing, we can do. And I'll kind of get on a limb here in a little bit, in my career, this is the first technology I actually think benefits defenders more than it does attackers. The things it solves for us compared to the things that solves for them, we gain more ground. We gain more capability. But as we talked about in this presentation, that tool by itself does nothing. It's not going to get us home free. If we can pair that right tool with the right expert, we can do really interesting and powerful things. We can do things we've never done before, and we can move at a speed and scale that was not in our wheelhouse before. We find that really exciting here at SentinelOne. And again, I just want to say, we talk about things being real. It's easy to see things on a slide and think about it as a concept. But the people that did this work are here in this room. We have Luca here in the room that runs our Hunt team. We have Brian Kerns that helps drive a lot of this AI-assisted hunting. We have Sagi Shoshani, who helps build these models and detections and make sure it works. We have Matan Weinstein that does the exact same things. These are real people. These are not some imaginary thing that we have sitting behind a curtain somewhere. You can talk to them here. You can hear their experiences. You can ask them what are we getting right? What are we getting wrong? And you have the same people, too. We know we are not the only ones doing this. And that's why we want to have discussions like this. We want to share our lessons. We want to share what we think will work against the speed we see with these attacks, and we want to do it together because that's how this thing is going to work. That's the first piece of good news. The second, another capability we have that we never had before is we can treat agents like we treat people when it comes to tasks. We can say, where do we want to put an agent and where do we want to put a person? Here's the good news with agents. They're not taking PTO to go to their niece's wedding, they didn't get in a car wreck on the way into work. They're not having a bad day and are distracted because the lunch wasn't right. It runs 24/7. We can make intentional choices about where we put that capability and then save and augment the cycles of our actual experts. We can take the people that we need to do the really difficult work and we can lift them out of the mundane and we can put tools in their hands, they've never had before. And that's not us at SentinelOne. That's everyone of us in this room. I don't know that I've seen anything more exciting in my short career than the ability to do this. We finally have capabilities other than just wearing our people out going into hero mode working nights and weekends. We can let the machines do that. We can build sustainable lives for our people, and I know that sounds dramatic. And I know that sounds emotional. But that's how real we think this capability is here. So you'll see a lot more of what we intend to do over the next year tomorrow. Again, Chris and his team is going to walk through what we think is going to be some really impactful upcoming technology. You'll hear Tomer talk about where he is taking SentinelOne and how he views the entire landscape, not just the threat landscape changing and where we intend to fit into that. And again, our whole point here is to spend time with you. Our whole point here is to learn from you, have you learn from us, let's compare notes, and let's get after this thing because it's not going away. And with that in mind, I'm going to hand it over to our threat hunting challenge. We're going to bring them on stage. You can actually see some folks threat hunt live right in front of you. So thank you, everyone.