SentinelOne, Inc. Goldman Sachs Communacopia + Technology Conference 2026

Our pleasure. Super happy to be here.

Yeah. I think what's really important, more than anything else, is to separate the hype from the actualities of these attacks. I think what's interesting in these recent incidents that we've seen, fundamentally, there's nothing new, and I would try and unpack that a bit. What these agents have done is nothing that a human attacker has not done in the past. In essence, we're not seeing any type of new behavior. We are seeing a new level of velocity, we're seeing a new level of speed, but we're not seeing new techniques. I think that's where it's becoming really, really interesting when you start to peel back, okay, what should people do right now? There is no magic solution out there from any cybersecurity vendor.

No matter what you heard, there's nothing that solves the issue that we're facing right now in terms of the speed and the velocity. But with that, if you invest in better fundamentals, and you can actually achieve better fundamentals faster, that is really your best shot at mitigating risk. Note that I'm saying not stopping the breaches, mitigating risk. I think in this day and age, if you claim that you stop breaches, that's unreliable. That's not credible. We're seeing all these breaches happen. You read about all these breaches happen. Products are failing. Everybody's failing. So this notion that we can stop it, we can prevent it, we can live in a world where these things are not happening, it's misguided. We can reduce the risk.

I think that is the number 1 thing that we're letting our customers do, is figure out, okay, where should I be focused? There's an ocean of different ways where attackers can actually leverage AI right now to find these nooks and crannies to get in your environment. Another reality is that nobody is able to fix all of those. Maybe a few companies, but the level of hygiene that you need is extreme. I'll take us as an example. We're a company, too. We need to protect ourselves as well. And our hygiene has been extremely high for many, many years. Pre-MITRE, post-MITRE, all that stuff doesn't really matter to us as much when you think about the fundamentals that are needed. Being vulnerability-free, you don't need MITRE to tell you that you need to be vulnerability-free and fix all your vulnerabilities.

The fact that awareness is expanding doesn't really mean that the problems were not there to begin with. I would even extend this to say that AI is not good at cybersecurity at all. We are bad at building secure infrastructure, all of us combined. That's why AI, which is a great search engine, is able to find all these things that we have basically fucked up for many, many years. So we got to really think about what's happening. It's not that AI suddenly is becoming so proficient. The problems were there. People were sitting on vulnerabilities for years. People were not fixing and configuring their environments for decades. The complexity, security vendors are also part of the issue. They're introducing more complexity into the mix. You're buying a platform. You're actually buying sometimes 7 different platforms from the platform provider. You're trying to stitch everything together.

You're applying manual policies for something that moves at machine speed. There's complete misalignment between the pace of technology and the pace that AI brings, and the status quo of our infrastructure. I sincerely don't believe that AI, at this point in time, is so remarkably good, specifically and surprisingly, just in cybersecurity. We were talking so much about cybersecurity. The problem is not AI getting better, it's the state of cybersecurity itself.

Yeah. I think you need to do two or three main things. One, visibility. We've talked about it, I think, throughout years on this stage, in the context of AI, but also not in the context of AI. You need visibility. There's this nomenclature saying in cybersecurity, you can't secure what you can't see. It's very true. You got to really have visibility into each and every one of these workloads, those parameters. Every piece of your environment needs to be monitored, and that, I think, is the basis for anything that follows.

Then I think what's lacking is how do we get to the same type of velocity and speed to match what we're seeing with AI, and that comes through more automation, and leveraging AI or machine learning in these environments to basically take the visibility but find the signal fast enough before it turns into something that somebody else finds for you. The last piece, and I think this is where it gets really interesting, it's about building more and more generic ways to understand that something different is happening. I'll give you a simple story. This is, I don't know, maybe 4 months ago, and it seems like it was a lifetime ago, but we had all these supply chain attacks, Log4Shell, Axios, all these libraries that developers are using have been poisoned.

People using AI for development, Claude, Codex, all these tools, were automatically downloading these poisoned libraries, and Claude was just executing those on the device itself. So in essence, in a complete automated manner, hundreds of enterprises, Fortune 500 companies, got completely compromised. By the way, the moment Claude executed that innocent library, all the secrets, all the passwords, everything you had also laterally in your network was being pulled and sent out, which means that your collateral damage now, and the need to fix all the derivative kind of damages that happened because of it, is also a pretty long haul remediation story. We, on the other hand, with a piece of software that was built 10 years ago, the logic, we didn't know generative AI is coming 10 years ago. I don't think anybody did, including the people that built it, right?

With that technology focused on the most generic aspect of cybersecurity, which means behavior, not exploits specifically, not viruses, not signatures, not Trojans, not ransomware, not the actual private cases of how you do badness, but focus on what badness generally looks like or how different it looks like from benign behavior, we've been able to stop all of these attacks with no prior knowledge, no prior understanding. The system just saw something. It didn't care if it was Claude or the user or an attacker. It didn't really matter because what it exhibited looked different. So the more we focus on generic ways to take visibility and then discern good behavior from bad behavior, whether it's a human user or the agent that's running on the machine or some SaaS workload that's now downloading stuff that it shouldn't, to me, that's the only answer.