A Possible Path For S1

Authored By Louis Stevens

I recently wrote about S1 in a Brief entitled Upside Surprises, and, today, I'll add thinking adjacent to those ideas.

I believe there are now four lenses through which we should consider S1 today:

1. S1 in light of Crowdstrike's recent misstep
2. S1 in light of Elastic
3. S1 in light of Monday.com
4. S1 in light of Splunk

Let's explore each of these today briefly so as to better appreciate S1's current risk/return setup, as well as its path to a successful outcome as an investment.

In Light Of Crowdstrike

Undoubtedly, Crowdstrike has been the better executed cybersecurity company through the lens of go to market motion and business execution. I have no illusions about this. This has been patently the case, until its recent misstep. That said, as I believed prior to the misstep, I do not believe this exceptional performance precludes S1 from doing well as a business.

Crowdstrike represents $4B of ARR (annual recurring revenue) out of a TAM (total addressable market) of $220B, and that TAM grows and evolves with each passing day, creating huge opportunity for high character, quality vendors of software to emerge and win business.

This is not a static pie in a static industry. There's a huge opportunity set from legacy vendors that need to be replaced by products like S1, from new threat surface areas, and from new companies that need cybersecurity services. In short, there should be no scarcity mindset when thinking about the cybersecurity TAM.

To contextualize where S1 stands within this dynamic and growing TAM, let's review data and corporate history for both S1 and Crowdstrike.

Today, S1 generates about $800M in ARR compared to Crowdstrike's aforementioned $4B, and S1 just grew its ARR at ~35%, which is huge growth for ARR of that scale. It should very much be noted that S1's ARR represents a giant, juggernaut software company.

As historical perspective, S1 was founded January 1st, 2013; whereas, Crowdstrike was founded in August of 2011, so Crowdstrike has had a bit of a head start on S1. Moreover, S1 has been led by the rather young Founder-CEO Tomer Weingarten who is just 41 years old today; whereas, Crowdstrike has been led by the 58 year old George Kurtz who was previously that CTO at McAfee after McAfee acquired his first company.

So it's worth noting that S1 was founded after Crowdstrike, and S1 was founded by a young man who was just 30 years old.

I share this to illustrate that S1's smaller scale is, in my eyes, a function of 1) a later start than Crowdstrike and 2) a later start stewarded by a very, very young man in the 30 year old Tomer Weingarten.

This is important to note because, as I mentioned, Crowdstrike's success has largely been the result of go to market and business execution, as opposed to purely better technology. Many have argued that S1's technology is actually superior, and I have had users of the software rave to me about their experience with it.

We can see some demonstration of this idea that S1 offers exceptional technology in both its Glassdoor reviews, where even the company's most critical employees acknowledge the quality of its software, and in its product reviews on Gartner.

Even The Most Disgruntled Employees Acknowledge The Product Is Great (Note Overall Rating Is A Solid 4.4 Stars Vs Crowdstrike's 4.1 Stars)

Even The Most Disgruntled Employees Acknowledge The Product Is Solid (Note Overall Rating Is A Solid 4.4 Stars Vs Crowdstrike's 4.1 Stars)

S1's Cloud Security Offering Has The Highest Rating On Gartner Adjusting For Number Of Reviews

So thus far, S1's technology has not been the issue for those wondering why it's operating at a smaller scale relative to Crowdstrike.

It's principally been the relative youth of the company and its CEO as well as its later start relative to Crowdstrike, as well as Crowdstrike's objectively otherworldly execution of its business and go to market strategy.

This is important to note as CISOs and enterprises broadly begin to consider other cybersecurity options following the very public Crowdstrike misstep.

Today:

1. S1 is now more mature than ever and battle tested after a brutal 2023. It's a lengthy discussion to walk you through all of the setbacks of 2023. If you'd like to hear about them, I would invite you to listen to, "To Be Sure, It's Been A Ride," or subscribe to LAS' Equity Research series where I detailed the history of S1 and its various setbacks in 2023 in a devoted research note.
2. S1 now operates from its greatest position of strength in its company history, having just reported its Best Quarter Ever, in which it generated free cash flow while growing 40%, held $1.1B cash and no debt, and reported that 40% of its net new revenue derived from emerging solutions adjacent to its core product. As we've discussed, this represents a business becoming multi-product, and there are a host of advantages associated with becoming multi-product.
3. Crowdstrike's execution has faltered, and this has opened the door to many conversations about cybersecurity vendor diversification and alternatives to Crowdstrike, with S1 being, from a technology perspective, one of the foremost alternatives, i.e., S1, as we just covered, offers arguably the best tech in the industry. I say arguably because some have, indeed, argued that S1's tech is the most cutting edge and visionary, and the Gartner peer comparisons above substantiate this to some degree.

To close, it's important to note that S1 has brilliant technology, which the marketplace, users, analysts, and disgruntled employees alike have doted on, so it should be seen as an easy choice for enterprises or MSP (managed security providers) looking for an alternative to Crowdstrike during this period, and S1's smaller scale is very clearly, at least in part, a byproduct of its youth and Mr. Weingarten's youth when the company was founded. With Crowdstrike experiencing execution issues, S1 should experience a boost in Q2'24 (ended July 31st, 2024) and in the quarters ahead.

In Light Of Elastic

Elastic is a log analytics, SIEM, and application performance monitoring software vendor that competes with companies like Datadog and Splunk, and, most recently, coincidentally, S1 and its latest Next Gen SIEM product.

Elastic is interesting to me, as it pertains to S1, insofar it was once seen as this revolutionary software vendor and received endless hype, as evidenced by its 24x sales valuation in 2019. Then, once growth slowed a bit, the narrative changed and all of a sudden Datadog was the vastly superior platform, and Elastic was doomed, which caused its valuation to collapse along with its share price.

(I've been noting on X that virtually all software vendors go through the same hype cycle and the valuation compression is never accompanied by a rosy narrative, as we're now witnessing with Crowdstrike.)

Through the entire process of narrative shift, share price collapse, and valuation compression, however, Elastic steadily grew sales at about 20%, and it continues to do so to this day, despite Datadog still very much existing in the industries in which Elastic operates and competes.

Note that this sustained elevated growth has been in direct opppostion to the prevailing narratives surrounding the company. Think about how the world speaks of S1. This is precisely how the world has spoken about Elastic through the entire process of its valuation compression and stock price decline.

Elastic's Growth, Free Cash Flow Per Share, And Price (Stock Is Up Over 100% From Its Lows And Doing Well Now)

In the same way market participants spent 2023 reading S1's eulogy, they also read Elastics's eulogy throughout 2023.

But through the entire process, just like S1, Elastic continued to grow and its free cash flow per share continued to grow.

And note that Datadog has not had any missteps! It has executed to absolute perfection (one of the best SaaS names ever) throughout the last two years; nevertheless, Elastic has continued to thrive, growing revenues at a healthy 20%, generating free cash flow, and growing its free cash flow per share, the last of which has sent the stock soaring recently.

S1's Growth, Free Cash Flow Per Share, And Price (Stock Is Up 100% From Its Lows And S1 Just Reported Best Quarter Ever)

This illustrates that S1 did not even need Crowdstrike's major misstep to be a successful investment; however, Crowdstrike has indeed now suffered a major misstep.

And this could result in accelerated growth and better margins in the coming quarters for S1, and, to this end, let's examine Monday.com's margin profile, which it has created in the frightening shadows of Microsoft, Atlassian, and Salesforce.

In Light Of Monday.com

I believe Monday provides a solid template for what S1 could become in the quarters and year ahead, as S1's free cash flow margin expands, its platform becomes more multi-product, and its growth sustains between 20-30% (maybe more in light of the Crowdstrike situation, but we don't know yet).

Below, we can see Monday's key metrics that are truly exceptional.

Monday's Revenue Growth, Free Cash Flow Per Share, Free Cash Flow Margin, And EV/Revenues

As we can see, Monday is an exemplary business, with phenomenal growth, huge free ash flow margins, and soaring free cash flow per share, which has buttressed its incredible 200%+ rise from its 2022 lows.

And, notably, Monday is doing this well, with 225k total customers, while competing against much larger peers like Microsoft, Salesforce, and Atlassian; most notably Atlassian, who could be seen as something akin to SentinelOne's Crowdstrike.

Like productivity software, cybersecurity is a massive, growing, and evolving TAM, within which S1 should be able to achieve the above margin profile, free cash flow per share, growth rate, and valuation over time, especially now that its big brother is experiencing a setback.

S1's Revenue Growth, Free Cash Flow Per Share, Free Cash Flow Margin, And EV/Revenues

Like Monday, S1 has built a fantastic multi-product platform, and evidence of this was given to us in its Q1'24 report in which it shared that 40% of its net new revenue derived from emerging solutions, such as its best of breed Next Gen SIEM and Cloud Security products.

Should S1 follow in Monday's footsteps in terms of sustained growth alongside margin expansion, from valuation expansion alone, it has about 40% upside currently.

If we factor in the normal share price appreciation it should experience by way of the growth of its business, I believe we could see ~75% upside in the year ahead.

In addition to all of the above mentioned similarities, like Monday, who has $1.4B in cash and no debt as of today, S1 has $1.1B in cash and no debt. Both have massive cash hoards, compelling multi-product platforms, huge runways for growth, Founder-CEOs (coincidentally from Israel) still at the helm, fantastic growth rates, and big brother competitors against whom they compete well generally speaking.

"The contribution from emerging solutions was a record in Q1, growing to about 40% of our bookings. Over time, our platform solutions will be an even more significant part of our business, driving diversity and long-term growth."

Tomer Weingarten, CEO, Q1 2024 SentinelOne Earnings Call

In Light Of Splunk

I've often referenced the Splunk case study on X.

To very briefly summarize the Splunk case study, everything that could go wrong for the company went wrong. Its entire C-Suite was gutted, and it still went on to 2-3x its ARR over 2-3 years during which it basically had no leadership and struggled to win new logos (customers).

This illustrated that multi-product software platforms can grow at incredible rates purely by virtue of upselling existing customers on new products, like the new products that S1 offers. It also illustrates that these platforms benefit from the concept of A Royalty On The Growth Of Others, and S1, as well as Monday, is certainly a beneficiary of this idea.

$26B Canva Has Grown Its Users To 170M In The Last 10 Years (S1 Customer)

S1 grows as its customers grow and use more of the products they've already adopted from S1.

S1 grows as it upsells these growing customers on new products.

And S1 grows as it adds new customers.

It's a growth trifecta that has created the incredible feats of growth S1 has experienced and is certainly set to continue to experience in the quarters ahead.

Disclosures:

L.A. Stevens has rated SentinelOne and Monday.com a "buy."

L.A. Stevens has not rated Crowdstrike nor Elastic.

Splunk was recently purchased by Cisco.

‍