Investors hope Palo Alto will end SentinelOne’s long sale saga

Israeli cybersecurity company SentinelOne had one of its best trading days on Wall Street on Monday since its 2021 IPO. Already in the early hours of trading, the stock, which has significantly underperformed major Wall Street indexes since the start of the year, began to surge on unusually high volume. At its peak, the stock jumped 15% and closed the day up 10%. But more notable than the rise itself was the massive trading volume: by the closing bell, turnover was nearly seven times higher than usual.

Behind the surge are reports that Palo Alto Networks, the world’s largest cybersecurity company, is in talks to acquire SentinelOne. SentinelOne has not commented, while Palo Alto initially denied the talks to U.S. media before changing its statement to “We do not comment on rumor or speculation.” It remains unclear whether negotiations will lead to a deal, but the speculation has revived optimism among SentinelOne’s shareholders, many of whom have seen mostly disappointments since what was once the largest cybersecurity IPO in history, which debuted at a $9 billion valuation in 2021.

SentinelOne IPO.

Despite offering one of the strongest endpoint security technologies on the market, SentinelOne has struggled to convert its early hype and $1 billion-plus IPO proceeds into sustainable financial success. Even after Monday’s rally, the stock remains about 50% below its IPO price and reflects a current market cap of roughly $6.5 billion.

For Palo Alto, whose market value is near an all-time high at $134 billion, acquiring SentinelOne would be its largest deal yet, but as SentinelOne is publicly traded, a share-based transaction is possible. Until now, Palo Alto has focused on buying private companies, spending $4.5 billion on 16 acquisitions since 2018. In SentinelOne’s case, CEO Nikesh Arora and founder Nir Zuk could offer a generous premium, potentially pushing a deal close to $10 billion. That would provide shareholders with a valuation above the IPO price and close to 50% higher than the company’s current worth, a level that might ease approval. A deal at this scale would imply a sales multiple of about 10 times projected revenue, broadly in line with Palo Alto’s own trading multiple.

Yet despite what would be a landmark deal for Israel’s cybersecurity sector, any speculation should be treated with caution. This isn’t the first time SentinelOne has been at the center of takeover rumors, and it may not be the last. After SentinelOne’s profit warning two years ago, the younger Israeli startup Wiz made an approach when SentinelOne’s value fell to $4.5 billion. Back then, Palo Alto and private equity firm Thoma Bravo were also floated as potential suitors, and more recently there was talk of a deal with Catalyst Partners.

Why is SentinelOne frequently put up for sale? The answer lies in the cybersecurity niche it operates in: endpoint security (EDR) for devices like laptops on corporate networks and extended detection and response (XDR) for broader cloud and network perimeter security. This market is mature, highly concentrated, and dominated by giants. CrowdStrike, which commands the biggest market share with its Falcon system, is a $120 billion behemoth with annual revenue nearing $4 billion. Its dominance was underlined by a high-profile system glitch last year that briefly knocked out systems worldwide, yet even this failed to strengthen its rivals.

Microsoft is the second key player, bundling its edge security solutions with its cloud offerings and Office suite, particularly targeting large enterprises and government agencies. SentinelOne, by contrast, is the third-largest pure player but focuses more on small and mid-sized businesses. Despite ending 2024 with revenue of $820 million, more than double its 2023 figures, the company is still far from profitability. Last quarter, SentinelOne posted an operating loss of 38% on revenue of $229 million, an improvement from 43% a year earlier but still deep in the red.

Marketing and sales remain SentinelOne’s biggest expense, as it battles massive competitors while relying on a fragmented base of smaller clients. This inherent structural challenge makes SentinelOne a perennial takeover target: it has strong technology but struggles to scale profitably on its own.

This makes it an obvious fit for Palo Alto, the fourth-largest player in the segment, whose shares also rose 2% on the takeover rumors. A deal wouldn’t topple CrowdStrike but could dent Microsoft’s stronghold. Palo Alto’s extensive sales machine and cross-sell reach could help accelerate SentinelOne’s XDR push and boost Palo Alto’s own growth, which has slowed slightly. The same logic could attract Cisco, IBM, or a private equity firm like Thoma Bravo, which specializes in cybersecurity assets.

SentinelOne’s stock held steady when trading resumed on Tuesday, signaling investors see potential in an exit that would close a turbulent chapter. Today, most shares are held by U.S. institutions, while retail investors own about 20%. Insight Partners, an early backer with an 8% stake, may be instrumental in driving a deal, as it was when it encouraged, in which it also held a significant stake, to sell to Google.