S · SentinelOne, Inc. · Stock research

Current Thesis

The condition the previous note pre-registered as the earliest re-rate signal has now occurred. On 2026-07-06 Scotiabank's Patrick Colville upgraded SentinelOne to Sector Outperform from Sector Perform and raised his target to $23.50 from $16 a 47% target lift and the second bank pivot after BofA's lone Buy at $20 on 2026-05-29. Price responded: $15.91 on 2026-06-26 became $19.57 by 2026-07-17, roughly +23% in three weeks, which takes the stock back through the ~$18 gap left by the 2026-05-28 earnings crater and to within 9% of the $21.40 52-week high. Market cap is back to ~$6.71B.

What the buyer is buying here is not endpoint share recapture. It is the agentic-security attachment. On 2026-06-17 SentinelOne opened Purple AI Agentic Investigation to all customers and introduced Singularity Credits as a unified currency for AI work across the Singularity Platform, with a multi-model stack spanning Anthropic's Claude, OpenAI's GPT and its proprietary Ultraviolet models landing the same day as the Amazon Bedrock AgentCore integration that supplies prompt-injection, PII and tool-use guardrails through the acquired Prompt Security unit. Colville's upgrade note cited exactly this: agentic SOC, Purple AI and AI runtime security as the vectors that let a decelerating grower attach to an accelerating budget line. The theme is cooperating IBM stated on 2026-07-14 that enterprise AI spending is not crowding out cybersecurity budgets, and cyber names moved together that session.

The honest counterweight is that revenue growth of ~21% YoY has not stabilised, and the sell-side average target of ~$19.45 sits below the last price. The narrative leg is live and the tape confirms it; the fundamental leg reports on 2026-08-27.

Bullish and bearish views on SentinelOne, Inc.

The model's bull view on SentinelOne, Inc. (S), in brief: Second bank flip, and it was a large one (2026-07-06). The bear view: The growth problem is unfixed. Revenue of ~$277M in Q1 FY2027 grew ~21% YoY. Q2 is guided to $289–291M and the FY2027 range of $1.195–1.205B was affirmed, not raised. A company that carried a premium growth multiple and now affirms into a recovering tape is re-rating on story… Both cases follow in full.

Bull Case

• Second bank flip, and it was a large one (2026-07-06). Scotiabank moved target from $16 to $23.50 a 47% revision, not a maintenance nudge. Sequential upgrades from separate houses inside six weeks (BofA 2026-05-29, Scotiabank 2026-07-06) is the shape of a sell-side cluster forming, and the playbook treats clustered upgrades inside 14 days of price confirmation as narrative acceleration rather than as a top signal.
• The gap is reclaimed. $19.57 on 2026-07-17 is above the ~$18 pre-earnings shelf that the 2026-05-28 print destroyed. Recovering the level a crater created, with a higher low intact from the ~$14 low, is what distinguishes a base from dead tape. The prior note called for exactly this reclaim before the read could improve.
• A real product attachment, not a slide (2026-06-17). Purple AI Agentic Investigation is generally available to all customers now, not roadmapped. The Bedrock AgentCore guardrail integration gives a named AWS surface. Securing AI agents is the most-funded new cyber budget line for 2026, and SentinelOne has a shipped product on it while much of the field is still announcing intent.
• Cost base was reset ahead of the recovery (2026-05-28). The ~8% workforce reduction and $25M restructuring charge support the affirmed FY2027 adjusted EPS range of $0.32–0.38. Q1's $0.04 adjusted EPS beat showed the margin line responding before the revenue line.
• Theme is cooperating with confirmation from peers. The 2026-07-14 session moved SentinelOne +7.3% alongside Qualys on a CISA/NSA/FBI joint advisory covering Russian state actors targeting critical infrastructure. Peer participation on the same tape argues theme, not single-name story.

Bear Case

• The growth problem is unfixed. Revenue of ~$277M in Q1 FY2027 grew ~21% YoY. Q2 is guided to $289–291M and the FY2027 range of $1.195–1.205B was affirmed, not raised. A company that carried a premium growth multiple and now affirms into a recovering tape is re-rating on story ahead of numbers. Narrative can carry a multiple for a quarter or two; it cannot substitute for growth stabilising.
• Price is through the consensus target. The average 12-month target sits near $19.45 against a $19.57 close on 2026-07-17. That reads as confirmation of a re-rate the sell-side hasn't caught up to, but it also removes the analyst-upside cushion. From here the upgrade cycle must continue or the tape has to carry itself.
• Structural third place is still structural. CrowdStrike leads AI-native security and Microsoft Defender wins on bundling. The agentic-security angle is genuinely differentiated but early, and CRWD, PANW and ZS are pursuing the same budget with stronger balance sheets and better incumbency. CRWD remains the cleaner instrument for undiluted cyber-momentum exposure.
• The 2026-07-14 pop was sentiment beta. A government threat advisory moves the whole complex for a session or two and decays without follow-through orders. Roughly 7% of the recent move traces to news with no revenue attached.
• Overhead supply at $21.40. The 52-week high sits ~9% up. Everyone who bought between $18 and $21.40 before the crater is now approaching break-even, which is where supply typically appears.

Setup & Price Structure

The post-crater sequence is now three distinct phases. Phase one: the 2026-05-28 gap-down and flush to ~$14. Phase two: roughly ten sessions of dead tape through mid-June with no catalyst. Phase three, beginning around the 2026-06-17 Purple AI and AgentCore announcements and accelerating on the 2026-07-06 Scotiabank upgrade, is a trend leg $15.91 to $19.57, with the 2026-07-14 advisory session adding +7.3% and an intraday print of $19.83.

The structure has the marks a momentum book looks for: a higher low above the crater bottom, a reclaimed gap, an expanding-volume upgrade day, and peer participation. Against that, the move is now ~40% off the $14 low and has covered its distance quickly, so entries here are extended relative to any moving-average support. In this playbook extension on an accelerating, cluster-confirmed theme is not by itself a reason to stand aside waiting for a pullback that an accelerating name does not deliver is a documented way to forfeit the move. The genuine timing consideration is different: the 2026-08-27 print is the event that either validates or kills the re-rate, and it falls roughly five and a half weeks out. That leaves a workable window before any earnings blackout, but positions established now must survive a binary they cannot handicap.

Levels that matter: $18 as the reclaimed gap (the level that has to hold to keep the recovery structure valid), $17 as the point where the reclaim fails outright, and $21.40 as the overhead 52-week high that separates a completed re-base from a new leg.

Catalyst Calendar (next 30 days)

• 2026-07-19 to 2026-08-18 no scheduled company catalyst. The 30-day forward window is empty of dated company events. What moves the name in this stretch is sell-side revision flow and cyber-theme headlines.
• 2026-08-27 (confirmed, just outside the window) Q2 FY2027 results. Guide is $289–291M revenue. Earnings blackout applies from roughly 2026-08-22. This is the binary the entire re-rate resolves against.

Elapsed catalysts

• Ongoing additional target revisions. With two houses flipped (BofA 2026-05-29, Scotiabank 2026-07-06) and price above the ~$19.45 consensus average, the mechanical response is upward target revisions from houses still anchored near $16–$20. Each is an incremental confirmation. _(passed 13d ago)_
• Ongoing Purple AI / Singularity Credits adoption datapoints. GA landed 2026-06-17; any customer-count, credit-consumption or attach-rate disclosure between now and the print is the first hard evidence the agentic narrative converts to revenue. _(passed 32d ago)_
• "Later in 2026", no firm date Bedrock AgentCore guardrails GA. Announced 2026-06-17 with BYOL for existing Prompt Security licenses. A firm date would be a catalyst; the absence of one is a reason not to underwrite it. _(passed 32d ago)_

What Would Change Our Mind

• A weekly close below $17. That surrenders the reclaimed pre-earnings gap and returns the chart to post-crater chop, at which point the July advance reads as a sell-side-driven bounce inside a downtrend rather than a base breakout.
• Another affirm-not-raise on 2026-08-27. The FY2027 range of $1.195–1.205B has now been affirmed once into weakness. Affirming it a second time, into a recovered price and two upgrades, tells you the upgrades were about the story rather than the pipeline. Growth needs to stabilise near or above the ~21% line.
• The upgrade cluster stopping at two. If no further house revises upward within four to six weeks while price holds above consensus, the re-rate has stalled and the $19–$20 zone is fair value rather than a waypoint.
• A competitor landing the agentic-security narrative harder. CrowdStrike or Palo Alto shipping a comparable agent-runtime guardrail with named large-enterprise logos would compress the one axis on which SentinelOne currently leads, and the differentiated leg of the thesis goes with it.
• A failed test of $21.40. Rejection at the 52-week high followed by a lower high would define the recovery as complete and the range as $14–$21.
• Conversely, upside confirmation: a weekly close above $21.40 on expanding volume, or a raised FY2027 guide on 2026-08-27, converts this from re-base to a genuine re-rate and would justify materially more size than the current setup does.

Correlation Notes

• Highest correlation: CRWD, PANW, ZS, QLYS. The 2026-07-14 CISA/NSA/FBI advisory moved SentinelOne and Qualys together, which is useful confirmation that the theme is bid but a reminder that a large share of any given session is complex beta. CrowdStrike remains the leadership name; SentinelOne trades as the higher-beta, lower-quality expression of the same tape.
• Divergence to watch. The agentic-security angle is the one axis where SentinelOne can decouple from the group. If it outperforms CRWD on days with no sector news, the differentiated narrative is being priced. If it only moves on sector-wide headlines, it is a beta vehicle and should be sized as one.
• Secondary linkage: the AI-infrastructure complex. IBM's 2026-07-14 comment that AI spending is not crowding out security budgets matters because the bear case for cyber in 2026 has been budget cannibalisation by AI capex. Confirmation that the two budgets are additive supports the whole group's multiple, and the AWS/Bedrock attachment ties SentinelOne's newest product surface directly to hyperscaler agent adoption.
• Inverse consideration: MSFT. Microsoft Defender bundling is the structural headwind. Aggressive Defender packaging announcements are a specific negative for SentinelOne that will not show up in the cyber-ETF tape.