SentinelOne

Cybersecurity Risk Management

As part of our overall enterprise risk management program, we maintain a robust cybersecurity risk management program led by a cross-functional team which includes members of our information security, data privacy and product security personnel, including members of our senior management team. Our cybersecurity program is designed to identify, monitor, evaluate, and respond to cybersecurity threats and incidents, including those associated with third-party software, cloud infrastructure and services. This framework includes steps for identifying the source of a cybersecurity threat or incident, including if such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing severity and overall risk, implementing countermeasures and mitigation or remediation strategies, and escalating to our senior management team, and for material threats or incidents, which then informs the Audit Committee and our Board of Directors.

We engage third parties, including vendors, counsel and other external service providers, to support our cybersecurity and data privacy processes. For example, we regularly engage independent third parties for penetration testing and evaluation of our various security compliance standards. We also conduct internal assessments of our cybersecurity risk management program. We review and update our cybersecurity policies, standards and procedures as needed, to account for changes in the threat and operational landscapes, as well as in response to legal and regulatory developments. Our team has established a continuous improvement process through which we regularly update our risk register to reflect the evolving capabilities of threat actors and incorporate findings from internal and external testing. Further, we require mandatory training for all employees and contractors on our cybersecurity and privacy policies. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as risks from third-party systems that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. Although we have continued to invest in our diligence, onboarding, and monitoring capabilities over our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information assets owned or controlled by such third parties.

A cross-functional incident response team, comprised of representatives from information security, information technology, privacy and legal, is responsible for monitoring and responding to data breaches, intrusions, and other security incidents in accordance with our incident response plan. Our incident response plan includes processes and procedures for assessing potential internal and external threats, escalation and stakeholder notification, law enforcement notification where required, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of our information assets.

In fiscal 2026, and through the filing of this Annual Report on Form 10-K, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such an incident could potentially have a material effect, including on our business strategy, operating results, or financial condition.

For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K.

Cybersecurity Governance

Our Board of Directors has oversight responsibility for our overall enterprise risk management, and cybersecurity risk management in particular is regularly reviewed and overseen by our Audit Committee. The Audit Committee reviews management policies, processes, and procedures designed to identify, monitor, evaluate, and respond to cybersecurity risks to which the company is exposed. Management regularly reports to the Audit Committee regarding its process and procedures to mitigate or remediate cybersecurity risks, threats and incidents, as well as monitoring activities of the cybersecurity team.

Our Audit Committee provides oversight of our cybersecurity program and receives quarterly cybersecurity updates from our Chief Trust Officer (CTO). Our CTO has over 25 years of experience leading technology and security transformation at large-scale, public technology organizations. This expertise, supported by a leadership team of seasoned information security professionals with experience at globally recognized organizations, ensuring a robust and comprehensive approach to cybersecurity oversight.

Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to monitor potential cybersecurity risks and implementing appropriate mitigation or remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our CTO, who is a member of our executive management team and closely coordinates as needed with other senior management personnel, including the President, Product and Technology and the Chief Legal Officer, who collectively possess significant experience in evaluating, managing and mitigating security and other risks, including cybersecurity risks.