SentinelOne: 97% Subscription Revenue and $1.3B RPO — But a 42pp GAAP Gap, an ARR Restatement, and Disappearing Disclosures. What Five Lenses Found.

Three lenses — Gravy Gauge, Moat Mapper, and Consolidation Calibrator — independently validated SentinelOne's operational core. The evidence is consistent and well-documented: approximately 97% subscription revenue recognized ratably over 1-3 year contracts, $1.3 billion in remaining performance obligations growing 35% year-over-year (outpacing revenue growth at 23%), no single customer exceeding 10% of revenue, and 1,572 customers above $100K in ARR growing 20% annually.

The platform diversification story has substance behind it. Customers on four or more modules quadrupled in Q4 FY2025. Non-endpoint products now represent 50% of bookings. Data Lake bookings grew at triple-digit rates. Purple AI, the company's generative AI security assistant, has reached 40%+ attach rates. These are not aspirational metrics — they appear in multiple quarters of verified financial data.

The balance sheet reinforces the picture: zero long-term debt, estimated $900-950 million in cash post-acquisitions, and free cash flow that improved from negative to a 6% margin. No debt covenants to constrain operations. No financing risk.

Two lenses — Fugazi Filter and Consolidation Calibrator — converged on the same transparency concerns, arriving independently from different analytical frameworks. The convergence makes the findings harder to dismiss.

The most substantive debate in this analysis centered on whether SentinelOne's accounting integrity should be classified as QUESTIONABLE or CLEAN. The Sonnet minority argued that the ARR correction is 2.5+ years old, the securities class action was dismissed with the court finding no fraud intent, GAAP financials have never been restated, the Deloitte audit is clean, and the non-GAAP gap is a disclosure issue rather than an integrity issue.

The committee majority preserved QUESTIONABLE because conditions for reclassification have not yet been met: the correction is less than three years old, there is no permanent CFO with finance credentials, sector peer benchmarking is unavailable to contextualize the GAAP gap, and the ARR disclosure retirement introduces new opacity. However, the proximity to CLEAN was explicitly documented — if the next 2-3 quarters produce clean KPI reporting, a permanent CFO, and no additional measurement corrections, reclassification to CLEAN would be warranted.

CrowdStrike is roughly four times SentinelOne's size by revenue. That scale gap is real and constrains moat width. But the Moat Mapper lens found that the competitive narrative may overstate the threat. SentinelOne's moat is not built on being "as good as CrowdStrike" — it is built on switching costs that deepen as customers adopt more modules. When 4+ module customers quadruple and Data Lake bookings grow at triple-digit rates, the lock-in compounds independently of what CrowdStrike does.

The AI differentiation story (Purple AI at 40%+ attach rate) is genuine but time-limited. Both Opus and Sonnet agreed it provides a real near-term advantage but estimated its durability at 1-3 years before competitors close the gap. The moat trajectory was assessed as "gradually widening" at the customer level, with a Sonnet minority view that competitive response may keep the net trajectory approximately flat.

The real competitive risk is not CrowdStrike taking share today. It is Microsoft Defender being bundled free with E5 licenses and Palo Alto Networks' platformization strategy compressing the addressable market from above and below simultaneously.

Seven acquisitions since FY2022. The Consolidation Calibrator lens found a genuinely mixed track record.

Q4 FY2026 earnings may be the most consequential single report for this thesis. Every monitoring trigger in the analysis converges on this date. Here are the specific items that may shift the assessment.