SentinelOne, Inc. OneCon 2026

Hello, everyone. Woo. Good evening. First of all, welcome to OneCon 2026. Come on, give it a round of applause. I know you're tired. You had a long day. Same here, by the way. This is just a warm-up, okay? This is just the pre-show. Tomorrow is kind of the big kickoff. However, we wanted to do something interesting this year, so we have a couple of evening sessions for you. Really, just one session and one. Actually, two sessions. One of them is from our Chief Customer Officer, Steve Stone. Yeah. He will talk about how we are combining AI and experts together, everything that we've done within the Wayfinder Threat Hunting services, and a lot of things that you can take with you to your own environments, because we learned a lot of lessons by using AI and experts together.

The second session is actually the Sentinels League Threat Hunting World Championship, where from thousands and thousands of participants, we came all the way to the finalists, and we're going to choose the one clear winner. So again, tomorrow we'll do all the things about housekeeping, and apps, and parties, and schedules. Tonight is just to get into the groove, okay? So take a deep breath, relax, start enjoying the show. And first up, it's our Chief Customer Officer, Steve Stone.

Thanks as always. All right, folks. As Eran said, we're trying some new things here this year, and I love that we are starting off with threat hunting tonight. I think when we run a business, it's really easy to forget about what we do every single day. And threats, how we find them, that's what we're here to do. So we're really excited to have all of you here with us in Vegas. I'm pretty happy here, being my third OneCon. How many of you is this your first OneCon? Look at that. Lot of first OneCons. All right. I love that. So what I want to kind of start with is, let's do some typical Vegas stuff. Let's do some accountability. Vegas loves that. When you hear Vegas, you think accountability.

I think if you go buy one of those magnets in the lobby that says, "What happens in Vegas," let's hold onto it for a year and then talk about it with 1,000 people. It's really awkward on a magnet. But that's what I want to do here. We're going to talk about threat hunting, and we're going to talk about AI, but what I really want to talk about is, are we delivering on what we promise you when we stand on stages like this? When we look back at the last year, what we promised you, are we delivering that? And we want to be transparent and accountable, so then we can talk about what we're doing, how we see it changing the world, and where we are going as SentinelOne. And for today, we're going to really focus on that AI and expert piece.

It's hard to overstate how much changed in the last year. I had the benefit of being on stage and talking about predictions, what we thought was going to happen. I went back and checked our scorecard. I'd give us, like, a B-minus. I think we did pretty good. But with AI, our assessment was, it's going to change fast, and we don't really know what that's going to be. That's kind of a mulligan of a prediction. You kind of get that one right, and that one turned out to be true. If we look at the big headlines from cybersecurity, all of them come back to something to do with AI. We can start with the Hugging Face incident, I know we are all very familiar with. We can start with multiple governments having multiple clashes with AI companies. We can talk about international disputes around chips.

We can talk about how we in the U.S. talk about Anthropic and OpenAI and NVIDIA, and then we look in China and see DeepSeek, particularly their V4, and it running on Huawei's Ascend chips. These are things we just didn't talk about. But if I had to give one example of what's really driving this change, I'd pick the example from the U.K. government. The U.K. government put out an assessment about 3 months ago, and their official government assessment is that the frontier models are doubling their offensive cyber capability every 4 months. That means since the last time we were here, for those this is your second, third, or fourth OneCon, that offensive capability from those models has tripled. That's a change in pace we have not seen before in this industry, and it's really driving a lot of things.

I think it's really important we just talk about this is moving so fast, and this is the pace we must meet. When we talk about the things we owe you as customers, this is the pace that we owe you. And I think it's also fair to say we stood on this stage, and we made a bunch of promises. We rolled out a bunch of products. I am really, really excited for you folks to see what Chris Corde and his team's going to roll out tomorrow. Tomer's going to provide his vision. But it's hard to dive into those things if we don't instill confidence in all of you that what we say we're going to do, we do. And when we look back at last year, we talked a lot about AI. We talked about the expansion of Purple AI. We talked about agentic investigations.

We relaunched our threat services with AI being the single thing that ran through every one of those elements. We launched our own frontier AI services, and what I'll talk about here as an example of our commitment to you is our AI-driven hunting, because I think ultimately, the thing we focus on the most at SentinelOne is pairing the right technology with the right people. That's how we see AI really changing this market, and honestly, that's how we see it having the greatest impact in securing your organizations. Let's talk about where we see AI and where we fit in hunting. At SentinelOne, the base of every single thing we do is detections, period, hard stop. This is the first and last thing we do every single cycle. As we dive into that, for those who have done detections, the concepts are not complicated.

The work is incredibly difficult. We start with fragile detections, what we talk about with indicators of compromise. We will take any advantage we have to find and stop attackers. If they want to give us things that we can go track, we will do that. Although we try not to rely on that, because what matters today could be irrelevant tomorrow. The command and control that we are seeing for key intrusions can be worthless in 30 seconds, but we will use that advantage. Second, like everyone else in the cybersecurity industry, we use signatures. We write specific content to look for specific things and really try to focus on how to be impactful for there. What has always made SentinelOne different is our focus on autonomous models. SentinelOne's first patent ever in 2014, 12 years ago, was for an autonomous model to detect malware.

We sit and watch a lot of organizations struggle to move into the AI area. We were already here. This is where we started as SentinelOne. This excitement that we feel, it just feels like we get to really focus on the things that started with us and that we really get to do well here. Our autonomous models will always be the core of how we approach detections. Last year, one of the things we stood on this exact stage and talked about was we relaunched our threat services. I do not want to spend any time with marketecture. I do not want to talk about offerings, but I do want to talk about one of the core components that we built into every single level was a multi-tiered threat hunting capability. As we looked at this, we felt this is critical. Detections are the base. Detections are key.

But if we combine that with hunting, we can move faster, we can pivot, we can identify and flag things to our analysts that we would never pass on in a product. There is a huge difference between something being viable for hunting and being production-grade ready for a platform. We want to leverage these two different things so they are complementary and not competitive. At SentinelOne, you can see we are pretty original with our names. We have threat intel-based hunting, where we use intel. We have real-time hunting, which is where we hunt in real time, and retrospective hunting, where we do more computationally intensive and requires more analysis type of work, and then we time-bound that. But the thing that we launched that we had never done before at SentinelOne was our AI-based threat hunting.

This was our first foray into this, and when we talk about our commitment to technology and experts, I think this is the single best example we can give you of how we approach that. I want to give you three examples of why we think this is important and where we see successes and where we are going to build around in the future. Ultimately, our overall goal is to tie all of these things together. Our goal is to create as many layers, as many traps, as many ways that we can detect, find, isolate, prevent, and respond to threat activity, and we will do this in any way we possibly can. This is always part of our whole. So when we talk about the benefits from AI-assisted hunting, we have to think about it as part of this whole.

This is how we approach the strategy here at SentinelOne. Let's just kind of give some metrics. Everybody in Vegas loves metrics. We'll go through this one pretty quickly. We talk about scope and scale for artificial intelligence. What does that mean? Where does that actually apply? How does that actually manifest in your organizations and in our work? If we look at the last year, market analysis says the typical organization will grow their endpoints about 16%. That matches what we see at SentinelOne. We typically see an environment grow about that same amount. By extension, we should have 16% more detections and hunt findings than we did last year because we have that much more surface area.

As we focus on those autonomous models and the ability to scale, we see that a 50% increase in our true positive detections in that last year. We've identified more than 14 million true positives to our customers in the last calendar year, and that's growing faster than we see overall endpoints and environments. But where we see AI-assisted hunting providing the greatest benefit as part of that larger capability is the ability to move at speed and scale. Let's show how that fits in here. We launched AI-assisted threat hunting at OneCon. It went live on 1 December. In the first quarter we had it, we saw a 380% increase in our ability to find malicious activity using that methodology. That's fine. Any of us that have built something, your first iteration, you're going from nothing to something. All right, that's great. We love it, but that's not really a meaningful number.