Thoma Bravo finalizes the Darktrace acquisition
Thoma Bravo completed the $5.3 billion all-cash acquisition of Darktrace, removing the cybersecurity firm from the FTSE100 Index on the London Stock Exchange. Each shareholder receives $7.75 in cash per share, which represents a 20% premium over the closing share price from the previous trading day. Jill Popelka took over as CEO after Poppy Gustafsson resigned from the company. This transition follows the death of early backer Mike Lynch in August and the death of former COO Stephen Chamberlain. The acquisition follows a period where Darktrace saw revenue grow from $158.12 million in 2020 to $453.47 million in 2023. EBITDA for the company rose from a deficit of $2.21 million in 2020 to $63.92 million in 2023. Thoma Bravo also aims to expand the technical capabilities of the 2,400 employees who support 10,000 customers.
SentinelOne financial performance and valuation
SentinelOne reported revenue of $291.98 million for the first quarter of 2026, which is a 20.6% increase over the $242.18 million reported in the prior year quarter. The company recorded a net loss of $93.4 million and a diluted earnings per share of ($0.27). Total annual recurring revenue reached $1.218 billion, representing 22% growth. The company also saw its number of customers with annual recurring revenue of at least $100,000 rise by 13% to 1,715. The current Price to Sales ratio for SentinelOne is 6.7x, which is higher than the software industry average of 4.0x. The discrepancy between the current share price and the intrinsic value estimate indicates the stock is 34.6% cheaper than the cash flow model suggests, even as market multiples suggest it is expensive. You know the basics of these two companies, but the divergence in their financial health and technical architectures defines the current market.
Darktrace AI and technical architecture
Darktrace uses its ActiveAI Security Platform to provide protection across cloud, email, identities, operational technology, endpoints, and network domains. The system uses a multi-layered AI engine that incorporates natural language processing and behavioral analysis. This approach allows the platform to detect threats by learning the unique patterns of life for each customer in real time. The company has filed over 200 patent applications for these technologies. Darktrace / EMAIL specifically uses these tools to identify phishing and social engineering threats that bypass other security layers. The platform achieved a 4.8 rating on Gartner Peer Insights based on 249 reviews.
SentinelOne endpoint capabilities
SentinelOne focuses on autonomous, agent-driven response through its Singularity platform. The company maintains its behavioral AI engine locally on the endpoint to ensure protection remains active when connectivity to the cloud drops. This local processing helps protect field workers and remote industrial sites. The platform provides visibility into lateral movement threats by gathering data from endpoint security events. SentinelOne also provides one-click automation remediation and a rollback feature to restore an endpoint to a previous state. The company holds a market share of 12% to 16% as of late 2025.
Comparison of platform specifications
| Feature | Darktrace ActiveAI | SentinelOne Singularity |
|---|---|---|
| Primary Domains | Cloud, email, identities, OT, endpoints, network | Endpoint, cloud, identities |
| AI Engine Location | Cloud and distributed | Localized to the endpoint |
| Detection Method | Self-learning patterns and NLP | Behavioral AI and machine learning |
| Automation | Autonomous response | One-click remediation and rollback |
| Customer Scale | 10,000 customers | 1,715 customers with $100k+ ARR |
Darktrace email security and market position
Darktrace / EMAIL received a Challenger designation in the first Gartner Magic Quadrant for Email Security Platforms. The product protects against business email compromise and novel phishing techniques. The platform uses behavioral profile analysis to spot account compromises before an attacker sends a payload. This capability helps identify about 38% of phishing and social engineering threats that other solutions fail to capture. Darktrace has gained nearly 5,000 customers since the launch of this specific product in 2019. The company serves customers ranging from small businesses to large enterprises. Will the transition to private ownership allow Darktrace to integrate its AI more deeply into the broader Thoma Bravo software portfolio?
SentinelOne market pressure and risks
SentinelOne faces significant competitive pressure from Microsoft and CrowdStrike. Microsoft uses its Microsoft 365 E5 bundling to push Defender for Endpoint into enterprise deals. CrowdStrike maintains a market share of 18% to 22% and focuses on its Falcon platform. SentinelOne experiences a bear case where reliance on large partners like AWS and hyperscalers creates long-term risk. If these partners prioritize their own native security offerings, SentinelOne faces potential revenue loss. The company also faces a valuation risk because its current Price to Sales ratio of 6.7x exceeds the tailored fair ratio of 5.6x.
The verdict on AI cybersecurity
Darktrace wins on its specialized AI for email and network security. The platform provides deep insights through its self-learning engine and successfully manages a large customer base of 10,000 organizations. SentinelOne wins on endpoint autonomy and local processing capabilities. Its ability to function without constant cloud connectivity provides a distinct advantage for remote and industrial environments. Darktrace is the better choice for organizations requiring specialized email and identity protection through a unified architecture. SentinelOne is the better choice for organizations that require an autonomous, agent-driven endpoint solution with local rollback capabilities.
