S - NYSE

Hello, and welcome to the SentinelOne Q2 FY 2026 Earnings Conference Call. [Operator Instructions] Also, as a reminder, this conference is being recorded today. If you have any objections, please disconnect at this time. I would now like to turn the call over to Saad Nazir, Head of Investor Relations.

Good afternoon, everyone, and welcome to SentinelOne's earnings call for the second quarter of fiscal year 2026, which ended July 31, 2025. With us today are Tomer Weingarten, CEO; and Barbara Larson, CFO. Our press release and earnings presentation were issued earlier today and are posted on the Investor Relations section of our website. This call and accompanying slides are being broadcast live via a webcast, and a replay will be available on our website after the call. Before we begin, I would like to remind you that during today's call, we'll be making forward-looking statements about financial performance and future events, including our guidance for fiscal third quarter and full fiscal year 2026 as well as our long-term financial targets. We caution you that such statements reflect our best judgment based on factors currently known to us and that our actual results or events could differ materially. Please refer to the documents we file from time to time with the SEC, in particular, our quarterly reports on Form 10-Q and our annual report on Form 10-K. These documents contain and identify important risk factors and other information that may cause our actual results to differ materially from those contained in our forward-looking statements. Any forward-looking statements made during this call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons why actual results may differ materially from those anticipated even if new information becomes available in the future. During this call, we will discuss non-GAAP financial measures unless otherwise stated. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results other than with respect to our non-GAAP financial outlook is provided in today's press release and in our earnings presentation. These non- GAAP measures are not intended to be a substitute for our GAAP results. Our financial outlook excludes stock-based compensation expense, employer payroll tax on employee stock transactions, amortization expense of acquired intangible assets, acquisition-related compensation costs, restructuring charges, gain on strategic investments and income tax provision, which cannot be determined at this time and are, therefore, not reconciled in today's press release. And with that, let me turn the call over to Tomer Weingarten, CEO of SentinelOne.

Good afternoon, everyone, and thank you for joining our fiscal second quarter earnings call. Q2 was a landmark quarter for SentinelOne. Our total ARR grew 24% and crossed $1 billion, a significant milestone in our growth journey. We also achieved a record second quarter net new ARR, reflecting positive year-over-year growth of over 20% and a strong uptick in new business generation. That's a clear reflection of our team's execution, business momentum and rising demand for SentinelOne's AI-powered cybersecurity. Our Q2 performance was broad-based with strong contributions from new customer additions, expansion with existing accounts and increased adoption of our AI and data solutions. These results underscore our stronger competitive position and growing product differentiation. We continue to maintain a top-tier growth profile while driving operating leverage. Following a strong Q2 outperformance, we're raising our full year revenue outlook while remaining prudent in our assumptions for the second half given the dynamic macro backdrop. These milestones also mark a defining moment for all Sentinels and signify that Singularity is a leading cybersecurity platform of this era. We've established SentinelOne as a clear technology leader in cybersecurity. Our relentless focus on delivering AI-powered innovations that unify security, data and automation has positioned us at the forefront of the industry. Let's take a closer look at our customer growth and platform momentum. We're winning new logos and expanding our footprint across enterprises of all sizes and industries globally. In the age of AI, customers are turning to SentinelOne for unified AI, data and security platform experience that is seamless to deploy, effortless to scale and designed to autonomously protect critical assets, including endpoints, cloud, data, identities and now GenAI. I'll share more on this later. We've also launched SentinelOne Flex, a major step forward in how customers adopt the Singularity platform. It's a unified flexible licensing model that gives organizations the agility to manage entitlements, seamlessly deploy new platform capabilities and drive greater return from their security investments. Flex provides customers with full access to the entire Singularity platform, enhancing our opportunity to expand our footprint across customer environments. The reception for Flex is outstanding with an 8-figure total deal value validating the model and many customers and prospects choosing the new structure. It enables our team to land bigger deals with higher efficiency and expand with greater velocity. This program is designed to deliver a frictionless procurement experience, meet customers where they are and grow with them as their needs evolve. Customers are gravitating towards Sentinel Flex and adopting more of the Singularity platform dynamically. We believe Flex represents a transformative shift in how customers adopt the Singularity platform, one that aligns more closely with how enterprises adopt and scale a multiproduct cybersecurity platform. We're excited about its long-term potential to drive deeper engagement and stronger retention with customers. In today's complex threat landscape, organizations need a platform and engagement experience that brings simplicity, intelligence and best-in-class security. That's exactly what Singularity delivers, streamlined operations, faster time to value and superior protection through a unified AI native platform. Let me highlight a few customer wins from the quarter that exemplify this. For platform consolidation, a global media conglomerate adopted multiple Singularity solutions, endpoint, data and cloud security as part of a strategic initiative to simplify and consolidate their security stack. This win came down to one core value proposition, reducing tools crawl while improving operational outcomes and SentinelOne was the clear choice. This enterprise needed a strategic partner to elevate their security, simplify operations and realize a superior platform value. For Singularity Data, an iconic luxury brand expanded its SentinelOne deployment with AI SIEM, making Singularity their central platform for data and security operations. This enterprise transitioned from a fragmented data and security posture to unified and autonomous security operation by consolidating on SentinelOne's platform. For Singularity Cloud, a Fortune 50 company deplatformized their existing network vendor to better secure tens of thousands of cloud workloads with Singularity Cloud. This was a strategic decision by the customer, and it was driven by our platform's ability to support hybrid cloud visibility and deliver hyper automation. This enterprise cited Singularity's AI-based security and user experience as key factors for choosing SentinelOne. Lastly, the largest deal in the quarter was a significant win under the SentinelOne Flex model with a multinational conglomerate, a solid platform win that included endpoint security across hundreds of thousands of endpoints, Singularity Cloud to secure cloud assets, AI SIEM for data analytics and retention as well as Purple AI and Hyperautomation. These incredible wins and customer engagement journeys reflect SentinelOne's clear differentiation, enterprise traction and broader platform adoption. On the partner ecosystem, we continue to expand and deepen our engagements. Our partners are a force multiplier, helping expand our reach and scale. We're seeing strong traction driven by increasing platform adoption across AI SIEM, Purple AI, CNAPP and broader platform solutions. In the managed security market, we continue to strengthen our position across the MSSP ecosystem as we help new and existing partners build managed security practices. For instance, SentinelOne was named Pax8 most valuable vendor in Q2, reflecting our leadership and traction in the MSSP ecosystem. Further, we're deepening our engagements with hyperscalers. AI SIEM, Purple AI and Singularity Cloud are now listed in the AWS AI agents and tools marketplace, increasing our market presence and ease of adoption for customers through AWS. In Q2, we were also a launch partner for the AWS Security Hub, reinforcing our position as a key security player for cloud-native environments. Now, let's dive into the innovation engine that is fueling our growth. At SentinelOne, we're not just delivering security solutions. We're helping enterprises lay the foundation for the infrastructure of the future. Modern infrastructure requires platforms that don't just defend, but actively enable innovation. Our innovation engine is focused on delivering AI-native building blocks that allow organizations to operate securely, intelligently and at scale, making security an integral part of modern architecture. Our broader platform solutions continue to scale and achieve strong growth. In Q2, approximately half of our quarterly bookings once again came from non-endpoint solutions, underscoring the growth, diversity and expanding value of our platform. Let's take a look at our latest innovations across platform solutions, starting with Purple AI. Purple AI continues to outperform our expectations, emerging as a key driver of our quarterly results. At its 1-year mark since general availability, Purple AI achieved record momentum in Q2, growing triple digits with attach rates surpassing 30% of licenses sold during the quarter, the highest level to date. This level of adoption curve in such a short time frame is rare in our industry, and it speaks to both the strength of the product and the urgency of the problem it solves. Purple's growth is being driven by strong adoption from both new and existing customers. It's helping enterprises operate with greater speed and efficiency, reducing the workload on security teams by orders of magnitude. We're now landing 7-figure ARR wins with just Purple AI, underscoring its scalability as a stand-alone solution and growing strategic importance for enterprises. According to IDC's latest study, SentinelOne's Purple AI users experienced 55% faster threat remediation, 60% lower likelihood of major incidents and an impressive 338% return on investment over just 3 years. Purple AI is a rigorous, measurable and scaled production-grade AI security solution that is already making a tangible difference for enterprises. This is SentinelOne's AI advantage in action, and we're delivering it today. Q2 was also an outstanding quarter for our data solutions. Its booking growth accelerated, delivering a company record contribution to total bookings in the quarter. We're seeing an increasing adoption of our data solutions by large enterprises where data visibility and management are paramount. Today, we're delivering the only AI-native SIEM in the market. Our AI SIEM is redefining how organizations manage security data, delivering enhanced visibility, real-time detection and streaming data, faster investigations and autonomous response. Our AI SIEM now listed in the AWS marketplace is unlocking new sales motions and expanding our presence. With AI SIEM, we're enabling organizations to unify and correlate data at scale with AI-driven insights and Hyperautomation at the core, allowing security teams to operate with more context, confidence and speed. In cloud security, we continue to expand both agent-based and agentless solutions. We're consistently winning with customers looking for a unified runtime and CNAPP offering to secure their cloud assets. Most recently, our CNAPP solution was recognized as a strong performer in CSPM by Gartner Peer Insights, further validating the momentum. As cloud environments grow in scale and complexity, we're delivering cloud-native security that keeps pace with infrastructure growth while enabling customers to simplify operations through unified AI-powered security platform. In endpoint, we continue to be the technology and growth leader by delivering industry-leading efficacy, performance and user experience. As noted by IDC's Worldwide Modern Endpoint Security Market share 2024, SentinelOne was the leading endpoint growth vendor among stand-alone cybersecurity vendors. In Q2, our endpoint bookings growth accelerated to the highest level in the past year, reflecting strong demand and competitive momentum in this area. And for the fifth consecutive year, we were recognized as a leader in the Gartner Magic Quadrant for Endpoint Protection Platforms. In parallel, SentinelOne was named top-performing vendor in the 2025 Frost Radar for endpoint security. Our innovations, industry accolades and customer adoption continue to highlight the breadth and growth potential of our business. To extend our innovation lead and further differentiate our AI-powered platform, we also announced the acquisition of Prompt Security, a pioneer in securing generative AI at run time, preventing GenAI-related data leakage and delivering security for AI agents. GenAI adoption is exploding across all industries, which brings a new class of risks and exposure. As GenAI and Agentic AI fundamentally reshape how businesses operate, new risks are emerging around visibility, compliance, data leakage and control. Prompt Security enhances the Singularity platform with the ability to monitor, govern and control GenAI usage across the enterprise. These are critical capabilities that every CIO and CISO is now prioritizing. Prompt Security stands out as the only technology available today that enables enterprises to safely adopt GenAI at scale. It is designed to protect organizations from the risks introduced by widespread and uncontrolled AI usage. Its platform integrates seamlessly across browsers, desktop environments and APIs, delivering real-time visibility into how AI tools are accessed, what data is being shared or stored and enforcing policies to prevent Prompt injections, sensitive data leakage and misuse. This acquisition is a strategic step forward for us in one of the fastest emerging and most urgent domains in cybersecurity. Let me highlight 2 important points on this. First, the challenge of securing GenAI adoption. Prompt enables organizations to adopt GenAI safely as enterprises accelerate their use of LLMs, AI assistant and agentic tools, the need for real-time visibility, policy enforcement and governance is becoming critical. Prompt's technology is aligned with the most urgent demands and needs in cybersecurity. Second, immediate visibility and control. Regardless of where an organization is in its GenAI adoption journey, Prompts seamless and frictionless deployment enables instant visibility and control to ensure safe and responsible AI adoption without slowing innovation. It's a natural extension to the Singularity platform that also enables us to enter the DLP space directly from the endpoint without relying on additional dependencies. This move positions us to lead in one of the most important long-term growth areas in cybersecurity. Following the strong reception of Black Hat earlier this month, we're already seeing significant interest from both customers and partners. The addition of Prompt to the Singularity platform further strengthens its value proposition. Importantly, this unlocks a new frontier of growth for our company and reinforces our role in defining AI-native cybersecurity in the future. As an industry, we're at a defining inflection point where the convergence of data and AI will reshape how security is delivered, operated and measured. AI is transforming how businesses operate, but its promise can only be realized if it's secured. Simply put, AI adoption cannot occur without security. In fact, we believe AI makes security more critical than ever. As attack surfaces grow and threats evolve, security must scale with intelligence and precision. That's where AI steps in, not just as a risk vector, but also as an enabler. Cybersecurity has always been a data problem and AI allows us to process and act on the right data in real time, delivering protection at unprecedented speed and scale. When done right, this convergence of AI, data and security creates a safer, more resilient digital world for everyone. We're providing the secure framework and infrastructure enterprises need to adopt AI with confidence, ensuring AI can run safely at scale. At SentinelOne, we've been building towards this moment for years. From day 1, we architected the singularity platform with AI at its core, well before AI became table stakes in the industry. That early conviction in AI-powered data and security continues to differentiate us. Now, we're beginning to see the returns. Our investments in data infrastructure and AI native security are unlocking meaningful opportunities for us and delivering tangible value for customers. With Singularity, we're unifying AI, data and security into a single platform that's purpose-built for modern real-time security. The rules have changed. Threats move at machine speed. Attacks evolve by the second. The old playbook, reactive, fragmented, overwhelmed doesn't work anymore. So we rewrote it. Our AI-powered security stop threats before they start, silently protecting everything and preventing breaches before they happen. As we look ahead, we're encouraged by positive demand signals, improving execution and continued market momentum. And our teams remain focused on delivering durable growth, driving operating leverage and expanding our leadership in AI-powered cybersecurity. We've accomplished a lot this quarter from delivering industry-leading growth and margin expansion to expanding our platform with the acquisition of Prompt Security. Most importantly, keeping our customers secure with the right technology at the right time. These results are a testament to the strength of our platform, the resilience of our business and the clarity of our long-term strategy. In closing, I want to take a moment to thank our customers and partners for their continued trust in SentinelOne. Congratulations to all Sentinels for a landmark quarter. Their relentless focus, dedication and execution drives our success. And thanks to our shareholders for their continued support. Our mission to be a force for good remains unwavering. Thank you again for joining us today. With that, I'll hand it over to our CFO, Barbara Larson.

Thank you, Tomer, and thanks to everyone for joining us today. Let's review the details of our Q2 financial performance and our guidance for Q3 and fiscal year '26. As a reminder, all comparisons are year-over-year and financial measures discussed here are non- GAAP, unless otherwise noted. In Q2, we continued to deliver top-tier growth alongside strong margin expansion. Our total ARR grew 24% and surpassed $1 billion, a significant milestone in our growth journey. We added net new ARR of $53 million in the quarter, which significantly exceeded our expectations. This outperformance was driven by broad-based momentum in both new customer acquisition and platform adoption by our existing customers. We're gaining market share and mind share across our platform solutions, notably AI, data, cloud and endpoint. These results reflect strong execution and healthy demand across the business. In Q2, revenue grew 22% year-over-year to $242 million. International markets grew 27% and represented 38% of total revenue, reflecting balanced growth and an expanding global footprint. Customers with ARR of $100,000 or more grew 23% to 1,513. Our average deal size or ARR per customer reached a new company record, highlighting our broader platform adoption. This performance reflects the value our customers realize from our platform and our continued success in driving multiproduct expansion. Our net retention rate remained strong and well into expansionary territory, driven by customer adoption of our broader platform solutions, including data, cloud and Purple AI. Turning to margins. We maintained an industry-leading gross margin of 79%, highlighting healthy pricing and platform unit economics. We also achieved operating profitability of 2% in the quarter, with operating margin improving by more than 500 basis points year-over-year. Looking ahead, we expect to sustain quarterly operating profitability and remain on track to deliver our first full year of operating profit this fiscal year. We also achieved our fifth consecutive quarter of positive net income margin, which increased to 5% in Q2. On a trailing 12-month basis, we delivered a free cash flow margin of 2%, and we expect this to improve further as we move through the second half of the year. Complementing this performance, remaining performance obligations grew 26% to $1.2 billion, a testament to the trust we've established with our customers and our commitment to innovation. Turning to the balance sheet. We ended the quarter with $1.2 billion in cash, cash equivalents and investments and no debt. Our strong balance sheet provides the flexibility to allocate capital strategically, fueling growth initiatives while driving long-term value creation. In line with this strategy, we extended our market leadership with the announcement of our acquisition of Prompt Security. This acquisition represents a strategic step forward in our vision to build the world's definitive AI security company, redefining what it means to protect the modern enterprise. Prompt's technology is highly complementary to our AI strategy and our Singularity platform. It creates a unique integrated layer for securing AI in the enterprise. As organizations race to adopt AI, our combined capabilities will enable customers to embrace this transformation securely and at scale. With Prompt, we're not just adding capabilities. We're opening a new frontier of platform growth. The purchase price for Prompt security is approximately $180 million. We expect the top line financial impact of the transaction to be minimal in fiscal year '26 with immaterial ARR and revenue contribution and an estimated 80 basis point impact to full year operating margin. The deal is expected to close in Q3 of this fiscal year. Before turning to guidance, I'd like to briefly comment on the broader macroeconomic and market environment. Cybersecurity remains a top priority across industries, and this is reflected in the strong demand we're seeing for the Singularity platform. Our Q2 results highlight both the momentum we've built and the solid execution of our team in a dynamic environment. That said, we remain mindful of evolving macro conditions, which can influence deal timing and sales cycles. Turning to our guidance for Q3 and fiscal year '26. For the third quarter, we expect revenue of approximately $256 million, reflecting 22% year-over-year growth. Following a strong second quarter performance, we're raising our full year revenue outlook while maintaining prudent assumptions given the dynamic macro environment. For fiscal year '26, we now expect revenue in the range of $998 million to $1.02 billion, $1 billion at the midpoint, representing 22% year-over-year growth. This outlook is supported by a strong pipeline, continued customer and partner momentum and growing contributions from our emerging products. At the same time, we are factoring in the potential for variability in the timing of larger deals. Turning to our outlook for margins. We expect Q3 gross margin to be approximately 78.5%. For the full year, we expect gross margin to be between 78.5% and 79%. This reflects our pricing discipline and healthy unit economics while continuing to invest in services and support as we scale. In Q3, we expect our operating margin to be about 4%, representing a year-over-year improvement of approximately 900 basis points. For the full year, we expect an operating margin of about 3%, an improvement of approximately 600 basis points compared to fiscal year '25. Our operating margin outlook incorporates both the anticipated foreign exchange headwinds from a weaker U.S. dollar and the impact of the Prompt acquisition discussed previously. That said, we are reaffirming our commitment to delivering positive free cash flow for the full year, which we expect to be a few points higher than operating margin. Taking a step back, our momentum, technology leadership and competitive position remains strong, and we are delivering top-tier growth at scale with continued operating leverage. Our investment approach strikes a thoughtful balance between maximizing long- term growth opportunities and maintaining a strong, responsible and profitable financial profile, a strategy that is key to scaling SentinelOne to a multibillion-dollar business. At the same time, we're instilling operational discipline by enhancing productivity and efficiency across the business. In summary, we're uniquely positioned at the intersection of AI, data and cybersecurity, and we're leading the industry into the next era of intelligent autonomous security. As enterprises accelerate their AI adoption, one fact is clear, AI's promise cannot be realized without security. Security is no longer just a safeguard. It's a strategic enabler of AI, and that makes our role more critical than ever. We're executing on our strategy, delivering top-tier growth and margin improvement while continuing to invest in the strategic priorities that will shape our long-term success. With a strong financial foundation, a differentiated AI-powered platform and a growing market opportunity, we remain firmly committed to creating long-term value for our shareholders. Thank you all for joining us today and for your continued interest in SentinelOne. We're excited about the road ahead. And with that, we'll now take your questions. Operator, please open up the line.

[Operator Instructions] Our first question will come from John DiFucci with Guggenheim.

Nice improvement in business momentum, Tomer and Barbara and team. It's a big difference. And also, by the way, it makes the rest of the year look more reasonable. It looked like tougher after last quarter -- after first quarter. Listen, you said, Tomer, you benefited from new logos and expansions along with AI. And I'd like to talk about that expansion part. Given the stage of where you are as a company, new logos are still a big driver, but Barbara also said that platform adoption by existing customers also drove the results this quarter. You said NRR also remains strong, but are there any other metrics or commentary to help us understand if your singularity platform message is not just driving larger initial deals, which you talked about, but also catching on with your existing customers?

Of course. Our Q2 performance, as I mentioned, was really broad-based with strong contributions both from new logos and expansion with existing customers. I would say it's been very consistent also in the past few quarters where we kind of get like an even split between new customers and expansion, which is exactly what we strategically want to see. And it's broad-based in terms of the solutions that are participating. It's strong endpoint growth -- it's emerging solutions like AI, data and cloud that are growing rapidly. Purple AI and data, they remain our fastest-growing solutions. We also had record bookings from data and Purple AI continue to grow triple digits. So all in all, I mean, these are solutions that are applicable both for new logos, but also for expansion. So they're really driving both. And obviously, with the introduction of SentinelOne Flex, that really improves our ability to talk to both existing customers that are renewing and net new customers and just land bigger or expand with those that are renewing. So overall, the business momentum is strong across the board, and we continue to gain market share across pretty much every growth area we have.

Our next question will come from Rob Owens with Piper Sandler. [Operator Instructions]

Obviously, a lot of variability throughout the first half as we contemplate just what you've done in net new ARR. Curious, looking at Q3, if there's any guardrails you'd like to put around it to shape our thinking. I appreciate the timing and variability of larger deals that was in your script relative to revenue. But anything we should be thinking about relative to that net new ARR as we move into the back half and in particular, Q3?

I'll go ahead and take that one. Thanks for the question, Rob. We don't provide formal ARR guidance, but you can approximate it just based on our revenue outlook that we've provided as well as the underlying business model assumptions. I would say, overall, Q2 results and the updated revenue outlook implies a relatively improved view on net new ARR for the full year.

Our next question will come from Brad

Congrats on a good quarter, especially the strong net new growth. I wanted to ask about Flex. Tomer, it's good to see how Flex is driving nice wins for you. How much of this is really new versus formalizing things that you were already doing and how it might compare to other similar concepts in the market? And then just for Barbara, can you talk to us a bit about how a Flex deal flows through the financials, specifically the impact to ARR into revenue?

Of course. So we just launched SentinelOne Flex this quarter. For us, it's obviously a major step forward in how customers are adopting the overall platform. The reception has been outstanding. Flex deal, as I mentioned, already delivered an 8-figure in deal value. The target is really everybody that's renewing, everybody that's mid- and large-sized organizations, and they have any type of a dynamic licensing need. It's very reflective for what other vendors are doing in the space. And it just gives customers the flexibility to adopt more and obviously remix whatever they choose to acquire, choose to consume. In all, we're seeing it's getting customers to the point where they sample more from our platform and thus, it drives more consumption of different modules across the board. So all in all, it's still early days for us, but obviously, this is a superior way to consume our platform capabilities, which today span close to 30 different distinct capabilities and about 7 different platform solutions. When we introduced Prompt Security, obviously, and announced that acquisition, that's going to become part of Flex. So as you can imagine, now that we have all these different growth frontiers in our platform, Flex is the enabler for our customers to now easily consume and enjoy these new offerings.

And from a financial perspective, Flex will be very similar to our other ARR contracts, which is TCV divided by duration and revenue will be recognized ratably over the duration of the contract.

Our next question comes from Joseph Gallo with Jefferies.

Congrats on the Prompt AI acquisition. Tomer, if we step back, I'm just curious your thoughts on when the security of AI results in cyber revenue. Obviously, there's a massive need for cyber, but if you look at most tech transformations, it can take time. I believe you said there was immaterial ARR from Prompt. How should we think about the ramp or ability to drive top line from Prompt?

Generative AI adoption is exploding. I think that is something we can all attest to, and it's across all industries, and it really brings a new class of risk. We're seeing regulated usage and unregulated usage, shadow AI usage and Prompt is a pioneer in securing exactly these types of use cases and really putting guardrails on generative AI usage in run time at real time. So when we look at the biggest pain points for enterprises today, it's clearly getting their employee usage under any form of governance and control, and that is directly what Prompt is here to solve. This is why we've been very excited about this acquisition. This is why we believe that the best place to regulate generative AI usage for the enterprise is actually on the endpoint, as closest can be to the user or the operator that's actually running the models and putting data into these models. So for us, when we think about what is the biggest enabler for generative AI usage, what is top of mind for every CISO that sees their employees now accessing all these different API and AI gateways, obviously, they want to get immediate visibility. They want to know what people are doing. They want to know what data is being shared, and they want to put guardrails around it. That's exactly what Prompt is bringing to the Singularity platform. So we believe -- and just by the early traction and customer reception that we're seeing that it's going to be a significant contributor in years to come.

Our next question will come from Rudy Kessinger with D.A. Davidson.

I'm curious. Barbara, I hear you saying kind of your inherent net new ARR assumptions are up for the balance of the year, but you had a really, really strong Q2. I guess I'm just curious if there's any other color you could provide as to why we're not seeing revenue taking up more for the balance of the year.

Yes. So you're right, we had a really strong Q2. We're improving our second half revenue outlook, and that's driven by those strong Q2 results, the momentum we see going into the back half, a healthy pipeline, platform momentum. But at the same time, we're being mindful and incorporating prudent assumptions about the back half of the year.

Our next question will come from Michael Cikos with Needham.

Congrats on the quarter. I like the similar comments. For Tomer, I just wanted to get a better understanding, and this probably goes back to the top of the Q&A with John's question. But great to hear on the new logos, the expansions, the pro-based product adoption. If you think about the ARR outperformance that we saw this quarter, though, is there a way to force rank what was the largest driver of upside when we think about that net new ARR? I know you said or had some very positive comments on the Purple AI and what you're seeing there, but any way to parse that out more specifically, please?

Yes. I've been trying to do so. I mean it is really broad-based. I mean you're talking about pretty significant beat to our net new ARR expectation along the lines of about 40%. So obviously, it doesn't come from just one thing. We got great expansion motion and great emerging capabilities that are a good, I think, point in time for customers to go and consume to solve real problems right now. So our expansion motion is strong. Net new logo acquisition is something we've been putting emphasis on for the past few years. We want that motion to keep on going. We want more customers joining our estate. It's a big focus of ours. So that's working well. And then obviously, when you start looking at some of our data capabilities, when you start looking at the deal sizes that we now are able to sign, you're joining that with Flex. I mean, that is really starting to paint a broad-based picture. And as I mentioned, triple-digit growth, that's becoming a significant contributor. And data with the strongest contribution we've had is another big contribution here. So again, quite broad-based. I would say we are seeing the platform starting to really take hold for us. We said last quarter, it's about 50% of booking. It followed this quarter as well. So all of these are really great trends for us.

Our next question will come from Shrenik Kothari with Baird. [Operator Instructions]

Congrats on the broad-based net new ARR pickup and the record non-endpoint contribution. So in the past, you have noted, of course, the reps on -- especially on the data and non-endpoint been ramping and it's work in progress. Now, with Flex with a strong start and following on the partner, the GSI, MSSP initiatives. Just on go-to-market, can you talk a little bit about the progress in terms of the ramp metrics, especially around the non-endpoint and also anything around the enablement comp plans with the new approach?

Of course. So definitely strong execution this quarter. Our teams executed well and above our expectations. You can see that again, both through record net new ARR, but also ARR per customer. So all in all, we've made significant strides in enabling our workforce, in streamlining our offerings and how we lend, how we pitch our platform. So going from product to platform is a journey, and I think we're moving in the right direction. This quarter is a great attestation of that. All in all, we're quite pleased with how we're lending and also how we're expanding. There's always more work to do. It's a constant evolution. The introduction of Flex, I think, has gone tremendously well. I think it's actually a simplifying factor for us on how we talk about our platform. So it's actually a force multiplier. So all in all, these constructs have come for us at the right time as the platform capability set is expanding dramatically.

Our next question will come from Brian Essex with JPMorgan. [Operator Instructions]

Congrats on a nice rebound quarter here with strong net new ARR. Maybe, Tomer, for you, I wanted to zero-in on a comment that you made about your AI native SIEM capabilities in the market. And I think we've seen a few peers make acquisitions recently on the ability to address enhanced real-time detection with streaming data. How do you see, from your perspective, the market evolving in terms of what enterprises are choosing to store and query and perform threat analysis that way versus the demand for real-time ingestion streaming data and perhaps more efficient storage of data from that perspective.

I'll split it in 2. I think that customers today want 2 main things. One is they want control over their data. And I think that's where when we talk to customers, it's all about where is the data, how do I get my hands around the data and how do I get it flowing to the end destinations that I want. So that's one part of it. And the second part is real time. It's really, really clear with the onslaught of attacks that we're seeing right now, they're starting to be more and more AI-driven that this notion that we've been talking about for many years now of machine speed attacks is now taking wholesale approach by adversaries out there. So to counter that, you really have to start ingesting and processing your data in real time, which is something we've been advocating for many years now. We've been the leader in that space. We'll continue and expand that leadership. To us, the ability to gain data and insights and processing of data in real time is the unlocking factor to how you drive AI across the entire enterprise data set. So it's less about, is it the SIEM? Is it something else? It's more about the outcome itself, which is ingestion and processing of real- time data and streaming data, and that is something we've been championing for a few good years now.

Our next question will come from Ittai Kidron with Oppenheimer. [Operator Instructions]

Again, solid numbers. I guess 2 things from you, Barbara. One is, can you give us some more color on the U.S. versus international mix this quarter, how that performed? And then also on RPO, you talked about, I think you mentioned 26% growth in RPO. Can you tell us if duration changed over there?

Yes. Thanks for the question. So on the U.S. versus international, so this quarter, international was 38% of our total revenue, and that's an increase from prior quarter. So real nice performance there. And then your second question was around RPO. So very strong growth in RPO this quarter. So 26%. Keep in mind, this can be impacted by duration. We did see that duration was relatively stable this quarter. So no major changes to call out there. But it is impacted by duration and the timing of renewals, which is why we refer to ARR.

Our next question will come from Shaul Eyal with TD Cowen. [Operator Instructions]

Good to see the stability. Maybe one for Barbara. Thanks for that commentary on the Flex offering. I know it's very early days, pretty much first quarter. But long term, how do you see the potential revenue uplift by those customers that are adopting Flex? And maybe is it fair to assume that pipeline is at record levels right now?

So thanks for the question on Flex. As you said, it's early days right now on Flex. But overall, we would expect this to be positive for deal sizes, duration, overall platform adoption. We're excited about the early momentum and feedback and more to come on this later. And then in terms of pipeline, we're excited about the momentum we're seeing in the business, very healthy pipeline that's growing.

Our next question will come from Roger Boyd with UBS. [Operator Instructions]

I wonder if you could provide an update on where you're at with the Lenovo partnership. I think you're about a year into that. What sort of momentum are you seeing from that? And just any color you can provide around your assumptions around ARR revenue from that?

Sure. We have many exciting partnership opportunities across the partner ecosystem. This is really one amongst quite a few. Specifically on Lenovo, overall, it's a contributor and on track relative to our expectations. We don't really discuss any details of any individual deal, but we're encouraged by the traction. We're definitely seeing more and more market motions with Lenovo coming up online for us. So all in all, it's on track. It's where we want it to be, and it's going to be one out of many contributors to our yearly outlooks going forward.

Our next question will come from Yun Kim with Loop Capital.

Great. Congrats on a solid execution. On the initial success of Flex pricing, is the flex pricing kind of improving your visibility, especially around large deals since it removes at least one element of the negotiation process? And also, should we expect Flex pricing to perhaps lead to early renewals, especially as customers try out new products and realize the value and upgrade the contract?

Yes. It's definitely streamlining the sales process for us. So we are, I think, unlocking a bit more velocity in the sales process given Flex is allowing customers to just think more broadly and they don't need to lock themselves into one specific construct. So on that front, I think that Flex is definitely an enabler. We're not going to be doing anything unnatural. I mean, we always just work at the pace of customers, both at renewal time and obviously, in our net new logo motion. For us, it's, again, just providing the best tools we have for our customers to procure what they need from our platform.

Our next question will come from Jonathan Ho with William Blair. [Operator Instructions]

Let me echo my congratulations as well. I think you basically described Singularity Cloud as seeing some significant success in this. Can you help us understand whether the transition and value proposition in the cloud to more runtime security as well as your fundamental architectural differences have helped you in this area?

We actually started with runtime security. So for us, it was never a transition to runtime security. We started with cloud workload protection. We always felt that is the most important part of protecting cloud footprints, and that's where we're seeing continued traction. Obviously, today, we have a broad-based cloud security platform that contains all the cloud security posture management capabilities, both agent and agentless as well as DSPM capabilities, CDR capabilities and more. So when we think about our cloud security suite today, first and foremost, it's designed to protect workloads in real time, which is something that we believe customers today are laser-focused on. It's both for on-premise environments, private cloud, hybrid cloud environments. So it really is one of the best coverage type solutions out there in the market today. And obviously, when you couple that with the same level of visibility we have for our EDR product with the same level of analytical capabilities we have with our data lake with the same access that Purple AI can give you, but now on cloud workloads, that becomes a very, very compelling capability for customers because it spends beyond just the innate workload protection, runtime protection capability, you enjoy all other platform capabilities that we have, and that is creating a compounded value for our customers.

Our next question will come from Gabriela Borges with Goldman Sachs. [Operator Instructions]

Barbara, I wanted to better understand your comments on the guidance. If I look at how much you beat in the quarter on net new ARR, I get to about $15 million in net new ARR upside. And so my thought is that, that should be at least $7.5 million in benefit to your full year revenue guidance. And you mentioned the comment earlier on being prudent. So if I'm understanding this right, what is making you more prudent today on the guide for the back half than you were maybe 90 days ago? Are you seeing something in the data or the signals that's making you more prudent than before?

Thanks, Gabriela, for the question. So overall, our second half revenue outlook has improved, and that's driven, as you said, by the strong second half results. We are seeing strong momentum, but we're being prudent about our assumptions in the second half. And that's really as you look at deal timing, overall macro, federal, and we're just trying to take all of that into account and be measured about how we're thinking about the back half and ultimately, the full year. But very pleased with the Q2 performance and the revenue outlook raised for the second half.

Our next question will come from Trevor Walsh with Citizens. [Operator Instructions]

There you go. Can you hear me now?

We can hear you, Trevor.

Great. I wanted to circle back on the acquisition. Tomer, I was just curious, I understand it's early days, but can you maybe tell us about trends that you're seeing around kind of the buyer personas around AI security? Are those people kind of within the core SOC team? Is it someone more kind of cloud infrastructure oriented? I guess, are these relationships that you're going to -- that you already have or kind of new people that you're going to have to go out and kind of engage with?

There's 2 facets to it. One is the employee use case where I think you can really think about it as akin to the DLP motion. This is GenAI DLP. Eventually, we will work to extend that capability set to actually be a fully-fledged DLP for the endpoint. That is obviously a well-established TAM. That is something that is classically on the endpoint. These are the same teams that we're working with, the same footprint, the same deployment model. Obviously, this is incredibly complementary to our market motion today in the endpoint market. The second facet is securing the actual AI runtime usage for models. And that is sometimes more in the realm of the cloud security teams, which we obviously talk to today with our cloud security software. So these are kind of the 2 biggest facets, 2 kind of main buying centers for Prompt capabilities. Again, one is very adjacent to the endpoint and kind of spends into the DLP territory. And the other is more in kind of the AI workload deployment of model, deployment of workloads of the different generative AI endpoints. Those are going to be more cloud-oriented. But again, all in all, we got interfaces with all these teams today.

We have no further questions at this time. I will turn the call back over to Tom Weingarten for closing remarks.

Thank you. Our second quarter performance reflects strong execution and progress in scaling the business. As organizations look to elevate cybersecurity, our ability to deliver value across multiple platform categories is resonating. We remain focused on delivering durable growth, driving operating leverage and expanding our leadership in AI-powered cybersecurity. Thanks again for joining us today.