INVESTIGATIVE INTELLIGENCE BRIEF

TO: Senior Leadership
FROM: Senior Investigative Analyst & Intelligence Directorate
DATE OF ASSESSMENT: October 2, 2026
SUBJECT: Comprehensive Entity Profile & Federal Exposure Analysis: SentinelOne, Inc.
CIK: 0001583708 | TICKER: S (NYSE) | STATUS: Active Large Accelerated Filer

1. CONFIRMED PRIMARY-SOURCE FACTS

The following records derive directly from primary-source documentation (SEC EDGAR filings, court dockets, government databases, procurement vehicles, and statutory registers).

SentinelOne, Inc. (and Direct Subsidiaries)

Partner & Channel Integrators (Carahsoft, immixGroup, Deloitte)

2. KEY FINANCIAL & POLITICAL FLOWS

       [ U.S. Federal Agencies / DoD / SLED ]
                         │
                         ▼ (Indirect Task Orders / GSA Schedule 70)
       [ Tier-1 Resellers / Prime Contractors ]
       • Carahsoft (GS-35F-0459X / 47QTCA25D000K)
       • immixGroup (GS-35F-0565Y)
       • CDW-G, GuidePoint, SHI, Deloitte
                         │
                         ▼ (Wholesale Product / License Remittance)
              [ SentinelOne, Inc. (DE) ] ◄─── Capital Allocation ───► [ Acquired Entities ]
              • Revenue: <10% Total Gov.                             • Scalyr ($2020/21)
              • Reserves: $22.7M Litigation (FY24)                   • Attivo Networks ($616M, 2022)
              • SEC CIK: 0001583708                                  • PingSafe (2024)
                         │
                         ├───────────────────────────────────────────┐
                         ▼ (R&D Transfer Pricing)                    ▼ (Dues / Indirect Advocacy)
             [ SentinelOne Israel Ltd. ]                     [ Industry Trade Associations ]
             • Herzliya, Israel                              • BSA | The Software Alliance
             • Core Engineering / Unit 8200 Founder Base     • Cyber Threat Alliance (CTA)
                                                             • TechNet / IATI

1. Federal Procurement Dollar Flow:
   Federal procurement dollars for SentinelOne software flow through authorized GSA Multiple Award Schedule (MAS) primes—predominantly Carahsoft Technology Corp. and immixGroup. These primes invoice federal civilian and defense agencies directly; SentinelOne recognizes indirect wholesale subscription revenue through its channel program. In annual 10-K filings, SentinelOne confirms government revenue remains below the 10% reporting concentration threshold.
2. Corporate Acquisitions & Technology Transfers:
   Capital outlays include the acquisition of Scalyr (2021), Attivo Networks (2022, introducing federal deception technology and preexisting DoD relationships), and PingSafe (2024, cloud security).
3. Litigation Outflows:
   In its FY2024 Form 10-K, SentinelOne established a balance-sheet reserve of $22.7 million for legal settlements, linked to civil and shareholder litigation defenses.
4. Political & Regulatory Advocacy:
   Direct political contributions and direct company-level LDA lobbying expenditures for 2023–2025 stand at $0. Financial contributions to federal policy influence flow via membership dues to trade associations (BSA, CTA, TechNet, and Israeli industry bodies such as IATI) that lobby on FedRAMP modernization, Software Bill of Materials (SBOM), and Cybersecurity Maturity Model Certification (CMMC).

3. NETWORK CONNECTIONS

• Corporate Core (The Hub): SentinelOne, Inc. (Delaware) operates as the commercial, financial, and SEC reporting vehicle. Founders Tomer Weingarten, Almog Cohen, and Ehud Shamir maintain executive and operational control.
• The Intelligence / Technical Nexus: SentinelOne Israel Ltd. (Herzliya) houses core algorithmic R&D. The founding personnel's background in IDF Unit 8200 creates an operational bridge between Israeli defense-cyber technical tradecraft and commercial enterprise endpoint detection and response (EDR).
• Procurement Aggregation Nodes: Carahsoft Technology Corp. acts as the central institutional node for U.S. public-sector market entry. Carahsoft insulates the parent vendor from direct federal prime contracting overhead and public USASpending visibility.
• Corporate Legal Interfaces: Federal litigation is centered in the U.S. District Court for the Northern District of California (handling the 2021 IPO class action and 2023 Scalyr derivative action), while international employee and intellectual property agreements are subject to Israeli jurisdiction (Net Hamishpat) and JAMS mandatory arbitration.

4. INFERENTIAL CLAIMS

All statements below represent analytical deductions and are explicitly labelled with confidence ratings.

Absence-of-Evidence Rule Verification (Mandatory Evaluation)

Before evaluating SentinelOne's absence from direct prime contractor databases, the strict absence criteria must be tested:

• (a) Expected Baseline Rate: Public cybersecurity firms with $10B+ valuations (e.g., CrowdStrike, Palo Alto Networks, Fortinet) typically hold dozens to hundreds of prime awards in USASpending and file continuous quarterly LDA disclosures.
• (b) Contextual Deviation: SentinelOne records zero prime contract entries in USASpending under its primary corporate name and CAGE codes.
• (c) Mundane Explanations: Mundane factors completely explain this variance: SentinelOne operates an explicit two-tier channel distribution model, relying on GSA Schedule aggregators (Carahsoft, immixGroup, CDW-G). Subcontract awards and reseller task orders are booked under the prime reseller's DUNS/CAGE. Furthermore, direct corporate lobbying is commonly eschewed by mid-tier software providers in favor of multi-client trade associations (BSA, CTA).
  Conclusion: The absence of direct records is a function of commercial channel architecture, not evidence of federal operational exclusion, regulatory concealment, or covert disqualification.

Analytical Inferences

1. [INFERENCE: HIGH CONFIDENCE] Absence from Direct USASpending Prime Records is an Artifact of Channel Distribution, Not Regulatory Exclusion.
   Reasoning: SentinelOne's SEC 10-K explicitly states that federal and public-sector sales are mediated through channel partners. Carahsoft, immixGroup, and Deloitte maintain SentinelOne products on their GSA Schedules. Products holding FedRAMP Moderate and DISA DoD IL5 certifications would not obtain or maintain such accreditations without active agency sponsorship and deployment.

2. [INFERENCE: HIGH CONFIDENCE] Source Database Contamination Derived from Faulty Ingestion Rather than Targeted Disinformation.
   Reasoning: The research database exhibited records with 100% missing SEC accession numbers and forward-dated entries (e.g., 2026-03-19, 2027). A date-validation failure or automated bulk-scraping script running on EDGAR RSS feeds without CIK-to-accession mapping regularly causes offset timestamps. SEC technical controls reject periodic reports dated more than 12 months in advance, demonstrating that the future-dated records were internal database artifacts rather than authentic filings.

3. [INFERENCE: MEDIUM CONFIDENCE] Foreign Ownership, Control, or Influence (FOCI) Risk is Mitigated Mechanically via Resellers and U.S. Subsidiaries.
   Reasoning: While SentinelOne originates from Israeli Unit 8200 alumni, peer comparators (Palo Alto Networks, CyberArk, Check Point) have operated in the federal market for decades without structural bans. SentinelOne maintains domestic Delaware entities (SentinelOne, Inc., Attivo Networks) and restricts its documented DoD deployment to Controlled Unclassified Information (IL5/NIPRNet). The lack of classified prime contracts eliminates the immediate requirement for a DCSA-mandated Special Security Agreement (SSA) or Voting Trust.

4. [INFERENCE: MEDIUM CONFIDENCE] Federal Policy Influence is Delegated Entirely to Industry Coalitions.
   Reasoning: Rather than deploying internal lobbyists subject to individual LD-2 quarterly reporting, SentinelOne relies on BSA | The Software Alliance and the Cyber Threat Alliance. These entities lobby directly on CMMC, FedRAMP reform, and NIST requirements, allowing SentinelOne to advance its procurement interests without entity-specific lobbying visibility.

5. GAPS & CONTRADICTIONS

Unverified Claims & Direct Factual Contradictions in Source Data

1. Conflicting GSA Direct Schedule Holdings:
   Contradiction: Primary facts #15, #68, #126, and #253 state that SentinelOne directly holds GSA Schedule 70 contracts (citing GS-35F-0516Y, GS-35F-313DA, GS-35F-0017V, and GS-35F-0564X). Conversely, facts #51, #113, #125, and #173 state that SentinelOne holds no direct GSA Multiple Award Schedule contracts in the GSA eLibrary, operating exclusively through third-party resellers.
   Resolution / Status: Unverified. Requires direct retrieval of GSA eLibrary schedules to determine whether SentinelOne held legacy MAS contracts that expired or currently operates strictly through Carahsoft/immixGroup schedules.
2. Spurious or Unindexed Direct Federal Contracts:
   Contradiction: Fact #138 claims a direct FY2023 DOJ award of $15.3M (15DDC023P0000095), and Fact #252 claims an FY2023 U.S. Army award of $3.2M (W91QVP23P0066). However, facts #2, #3, and #239 demonstrate that these contract IDs are completely absent from USASpending.gov and are not acknowledged in SentinelOne's FY2024 10-K.
   Status: These specific award claims cannot be verified in public databases and must be classified as unconfirmed or spurious reporting artifacts.
3. Fiscal Year-End Discrepancy:
   Contradiction: Fact #204 asserts SentinelOne’s fiscal year ends September 30 (citing the June 2021 IPO prospectus). This is directly contradicted by official Form 10-K filings (facts #66, #92, #105, #119), which confirm that SentinelOne's fiscal year concludes on January 31, with Form 10-K filings executed in late March.
4. Litigation Record Contradictions:
   Contradiction: Early database premises asserting "a complete absence of public court cases" are refuted by PACER records documenting Case No. 3:21-cv-09653 (IPO class action) and Case No. 3:23-cv-06423 (derivative action), alongside a documented $22.7M legal settlement reserve.

Search Scope Limitations (vs. True Absence)

• USASpending.gov Scope: Simple entity searches for "SentinelOne" fail because federal procurement accounting records the transaction under the prime reseller (e.g., Carahsoft CAGE 1T8M8). The absence of prime awards is a search constraint of USASpending's parent-entity aggregation.
• PACER & Legal Databases: Searches limited to U.S. federal district courts fail to capture labor or commercial disputes involving SentinelOne Israel Ltd., which must be queried via Israel's judicial index (Net Hamishpat).

6. RECOMMENDED RESEARCH DIRECTIONS

To resolve open evidentiary contradictions and map unrecorded exposure, investigative efforts should focus on the following targeted steps:

1. GSA eLibrary Contract Vehicle Audit:
   Action: Conduct an exact contract-number retrieval on GSA eLibrary and the Federal Procurement Data System (FPDS-NG) for contracts GS-35F-0516Y, GS-35F-313DA, GS-35F-0017V, and GS-35F-0564X. Determine whether SentinelOne, Inc. was ever the direct signatory or if these numbers represent legacy/reseller vehicles.
2. Carahsoft Schedule Line-Item Analysis:
   Action: Subpoena or pull public catalog line-item price sheets for Carahsoft (Contract GS-35F-0459X and 47QTCA25D000K) and immixGroup (GS-35F-0565Y) under Special Item Number (SIN) 132-51 / 54151S. Extract specific Singularity XDR SKU procurements by federal agency buyers to quantify indirect federal revenue.
3. Defense Counterintelligence and Security Agency (DCSA) & CFIUS Inquiries:
   Action: Inspect DCSA registers for facility clearance (FCL) status associated with SentinelOne Federal, LLC (Delaware, 2022) and Attivo Networks LLC. Verify whether an SSA, Proxy Agreement, or standard foreign ownership exclusion is filed.
4. Israeli Judicial Portal (Net Hamishpat) Discovery:
   Action: Execute Hebrew-language corporate litigation queries on Net Hamishpat for סנטינל וואן ישראל בע"מ (SentinelOne Israel Ltd., Company No. 514459833) to identify intellectual property inventorship or employment actions omitted from SEC disclosures.
5. EDGAR Clean Baseline Reconstruction:
   Action: Retrieve primary Form 10-K and 10-K/A filings directly from the SEC EDGAR system using accession numbers under CIK 0001583708 for FY2023, FY2024, FY2025, and FY2026 (filed March 2026), specifically reviewing Note disclosures on Legal Proceedings (Item 3) and Segment Reporting (Item 1) to reconcile the $22.7M litigation reserve and indirect channel reliance.