Summary

  • SentinelOne reported US$1.218106 billion of ARR at 31 July 2026, up 22% year on year, and said SentinelOne Flex exceeded 10% of ARR. That implies more than roughly US$121.8 million associated with Flex, but no exact Flex balance was disclosed.
  • ARR annualises subscription, consumption and usage-based agreements at period end and assumes renewal on existing terms. It is an operating run rate, not recognised revenue, billings, cash or a forecast.
  • Rounded RPO rose from US$1.4 billion in January to US$1.5 billion in April and US$1.7 billion in July, while the portion expected within 24 months fell from 86% to 81% and then 79%.
  • For non-cancellable consumption commitments, SentinelOne determines RPO using a ratable pattern over the remaining term, but says the amount and timing of revenue generally depend on inherently variable customer consumption.
  • A useful disclosure would reconcile opening commitments, additions, realised usage, overages, unused capacity, rollover or expiry and renewals. Until then, ARR and RPO prove commercial scale without proving utilisation or renewal durability.

The milestone is material before it is precise

One line in SentinelOne’s second-quarter presentation deserves more attention than its size on the slide: SentinelOne Flex exceeded 10% of ARR. Total ARR stood at US$1.218106 billion at 31 July 2026. Ten per cent of that balance is US$121.8 million, so “exceeded” establishes a lower bound of roughly that amount for Flex.

It does not establish an exact figure. The presentation does not say whether Flex represented 10.1%, 11% or a higher share. Nor does it publish the opening balance, net additions, consumption, product allocation or renewal rate for the Flex cohort. The threshold is useful because it moves the model beyond immaterial experimentation. It is insufficient because materiality makes the missing operating bridge more consequential.

SentinelOne presents Flex as an alternative to rigid point-product procurement. Its public commercial description stresses the ability to align licences with usage, review usage quarterly and activate additional platform capabilities without separate procurement cycles. This can reduce purchasing friction and let a security team move budget across endpoint, cloud, data, identity and AI functions as needs change.

The proposition is operationally sensible. Security workloads are not static: data ingestion can spike during an incident, a cloud estate can expand, or an organisation can add a new module before its next annual budget cycle. A flexible commitment can make those changes easier. But flexibility also turns the analytical object from a fixed product subscription into a pool whose value depends on what customers actually activate and consume.

That is the central distinction. A signed commitment is evidence that a buyer allocated budget and accepted contractual terms. It is not yet evidence that every unit of capacity is being used, that the mix carries the expected margin, or that the buyer will renew the pool at the same level.

ARR freezes one moment and assumes the next contract

SentinelOne defines ARR as the annualised revenue run rate of subscription, consumption and usage-based agreements at the reporting date. The calculation assumes that customers under contract renew on their existing terms. The company explicitly warns that ARR is not a forecast of future revenue and can be affected by contract start and end dates, usage, renewal rates and other terms.

That definition does useful work. It places conventional subscriptions and newer consumption arrangements inside a common commercial scale measure. It also exposes the assumption that matters as Flex grows: renewal is carried forward before it has occurred.

ARR reached US$1.218106 billion in July, compared with US$1.001360 billion a year earlier, producing the reported 22% growth. It was US$1.119095 billion at January year-end and US$1.162604 billion at April quarter-end. The sequential increase from April to July was US$55.502 million, or about 4.8%. From January to July, the increase was US$99.011 million, or about 8.8%.

Those calculations show momentum in the reported perimeter. They do not identify how much came from new customers, higher endpoint counts, additional modules, usage growth, acquisitions, price, currency or Flex commitments. The presentation calls the July quarter a record second quarter for net new ARR and shows US$56 million, consistent after rounding with the change from April’s published balance. It still does not turn net new ARR into a consumption schedule.

The renewal assumption is especially important for a commercial pool. A customer can sign a large commitment, consume slowly during deployment, accelerate later, reallocate capacity among products, use more than the commitment, or finish the term with unused capacity. The period-end ARR balance can be valid under the stated definition in every case. The economic reading changes materially across them.

RPO measures an enforceable perimeter, not workload activity

Remaining performance obligations answer a different question. SentinelOne describes RPO as non-cancellable contract revenue that has not yet been recognised, comprising deferred revenue and amounts to be invoiced in future periods. Contracts typically run for one to three years.

For consumption and usage-based contracts with non-cancellable commitments, the company says RPO is determined using ratable recognition of the remaining commitment over the remaining contract term. In the next sentence, it states that the amount and timing of revenue recognition generally depend on customers’ future consumption, which is inherently variable at their discretion.

The two statements are not contradictory. The first describes how the remaining commitment is represented in the obligation disclosure. The second describes the operating contingency that governs actual revenue timing. Together they show why RPO cannot be read as a consumption forecast.

At July, RPO was reported as US$1.7 billion, of which 79% was expected to be recognised during the following 24 months. In April, it was US$1.5 billion with 81% expected within 24 months. At January year-end, it was US$1.4 billion with 86% expected within that window.

The direction is clear: the contracted obligation pool expanded and its disclosed recognition horizon lengthened. False precision is not available. Each RPO balance is rounded to one decimal place in billions, so a comparison could be distorted by nearly US$100 million across two endpoints. It is reasonable to say the balance grew substantially. It is not reasonable to publish an exact sequential growth percentage from the rounded figures.

Nor does the declining 24-month share automatically signal slower customer usage. Contract duration, renewal timing, the mix of newly signed multi-year agreements and acquisitions can change the expected schedule. The useful question is not whether 79% is “good” or “bad.” It is which portion belongs to committed consumption arrangements and what operational behaviour supports the expected conversion.

Revenue has at least three paths through variable consideration

SentinelOne’s revenue policy adds another layer. Its arrangements can contain fixed consideration, variable consideration or both. Variable amounts are typically based on transaction volume or another usage measure. Depending on the contract, the company may allocate the variable amount directly to each service period, estimate total variable consideration at inception and update the estimate, or use the right-to-invoice practical expedient and recognise the amount invoiced.

These are materially different routes. Direct allocation ties revenue to performance in a specific service period. An estimated transaction price requires judgement and revision. Right-to-invoice follows enforceable billing rights. The filing does not report what proportion of Flex ARR or usage-contract RPO follows each path.

This means a single aggregate ARR line can sit above multiple recognition mechanics. The business can add a commitment today, invoice it today or later, recognise a fixed portion ratably, and recognise variable usage as activity occurs. Cash can arrive on another schedule. None of these differences makes ARR misleading; they make reconciliation necessary.

The July quarter produced US$291.981 million of revenue, rounded to US$292 million in the release, up 21% year on year. The company recognised US$212.8 million during the quarter from deferred revenue that existed at the beginning of the period. During the first six months, that opening-contract-liability contribution was US$372.6 million.

Those figures demonstrate that prior billings and commitments are converting into current revenue. They do not reveal Flex utilisation. A customer’s Flex pool might support revenue from several modules, and the filing does not publish that product-level conversion.

Deferred revenue moves in the opposite direction for legitimate reasons

Deferred revenue was US$633.1 million at 31 January, US$586.2 million at 30 April and US$577.6 million at 31 July. The balance fell by US$55.5 million over six months even as ARR increased by US$99.0 million and rounded RPO rose.

That divergence is analytically useful because it stops the metrics being collapsed into one another. Deferred revenue is an invoicing-and-recognition stock: amounts billed in advance but not yet recognised. RPO also includes future non-cancellable amounts not yet invoiced. ARR is a period-end annualised operating run rate. They can move in different directions without any inconsistency.

Billing seasonality is one explanation. Recognition of beginning deferred revenue is another. A new multi-year contract whose later instalments have not yet been invoiced can increase RPO without increasing deferred revenue by the same amount. A usage arrangement billed in arrears can contribute differently again. The public data do not isolate these effects.

It would therefore be wrong to use the falling deferred-revenue balance as proof that Flex customers are under-consuming. It would be equally wrong to use growing RPO as proof that consumption is accelerating. The divergence identifies the need for a bridge; it does not supply the missing columns.

Large-customer growth is not an end-user census

SentinelOne reported 1,715 customers with ARR of at least US$100,000 in July, up 13% from 1,513 a year earlier. The April balance was 1,702, so the sequential net increase was 13. ARR grew by about 4.8% during the same three months.

The contrast could reflect expansion within large existing accounts, larger new customers, aggregation changes or other flows. It cannot be solved from ending balances. A customer can add modules or usage without adding a new customer to the count. Another can fall below the threshold while remaining active.

The customer definition also has a deliberate channel perimeter. Managed service providers, managed security service providers, managed detection and response firms, and original equipment manufacturers may buy for multiple companies but are each counted as one customer. Resellers and distributors are not counted as customers. Substantially all sales are fulfilled through channel partners.

For operational analysis, the result is important: 1,715 is not the number of protected organisations or deployed workloads behind the US$100,000 threshold. A single service provider can represent many downstream environments. Consumption can expand inside that aggregate without a visible customer addition.

That channel design can be a strength. It lets SentinelOne scale through partners and gives service providers flexibility across end clients. It also makes the missing utilisation bridge more valuable. Partner-level commitments, downstream activation and end-customer retention are different control points.

The missing bridge has a simple shape

A useful Flex schedule would not require customer names or commercially sensitive unit prices. It could begin with opening committed capacity or contract value and reconcile six movements: new commitments, expansion, realised consumption, overages, unused capacity that rolls forward, and capacity that expires. A renewal column would then show which closing commitments survive into the next term.

The company could provide the schedule in dollars, indexed units or percentages. It could separate endpoint, data, cloud, identity and AI only at a level that does not reveal competitive pricing. Cohort bands—new, first renewal, second renewal and mature—would make durability visible without exposing individual buyers.

The most important denominator is not total ARR. It is the ratio of realised usage to available committed capacity, measured consistently through the term. A high ratio with healthy overage and renewal would show that flexibility is pulling demand forward without leaving a large pool idle. A low ratio might be deliberate early in deployment, but it would need a credible activation path.

RPO could then be reconciled to the same operating object. Readers would know how much relates to fixed subscriptions, how much to non-cancellable consumption floors and how much is excluded variable upside. Deferred revenue and unbilled receivables would describe billing. Revenue would describe delivered service. ARR would remain the commercial run rate rather than being asked to prove all four things.

The evidence supports scale, not a negative verdict

The absence of a consumption bridge should not obscure strong reported performance. Revenue grew 21%, ARR grew 22%, non-GAAP operating margin reached 10%, and the company raised full-year revenue and operating-income guidance. More than half of ARR came from non-endpoint solutions, according to the presentation, and Flex crossed a material threshold.

These are counterweights to a bearish reading. Customers are signing, the platform is expanding beyond endpoint protection, and contracted visibility is growing. The filing also gives explicit caution that ARR is not a forecast and that consumption is variable. The company is not pretending the metrics are identical.

The analytical gap is narrower: once a flexible consumption model exceeds 10% of ARR, aggregate commercial metrics no longer tell enough about utilisation and renewal quality. The next increment of disclosure should follow the operating model’s maturity.

Until then, the defensible conclusion has two parts. SentinelOne has built a material Flex business inside a growing security platform. But ARR and RPO are measures of run rate and contractual obligation; neither alone proves that customers are consuming the committed pool at the rate, mix or margin that will sustain the next renewal.

Sources