5 Years of SentinelOne ThreatOps: Defense from the Ground Up to Global Threat Championships

* ThreatOps began in April 2020 with a threat hunting webinar by Ryan Merrick covering MITRE ATT&CK concepts and IOCs.
* A Capture the Flag (CTF) game concept was sketched by Joseph Poyner in May 2020.
* The initiative received a budget line item in FY21 for development.
* Public challenges launched in March 2021, featuring cash prizes across named accounts and partner channels.
* A game-creator program was built to train SEs globally, securing CPE accreditation by 2022.
* A platform was created to automate game provisioning, reducing setup time from two days to under five minutes in 2022.
* A ThreatOps Hackathon was held in September 2023, featuring the Purple AI game and a new game editor.
* The program expanded to include games across various SentinelOne surfaces by 2024–2025.
* ThreatOps engaged 19,211 unique players across 5,869 email domains between September 2023 and September 2026.
* ThreatOps engagements influenced $661.8 million in closed-won revenue across 6,435 deals between September 2023 and September 2026.
* The Sentinels League Threat Hunting World Championship was approved in August 2025.
* Season 1 of the championship featured Derek Render as the first world champion at OneCon 2025.
* Season 2 of the championship featured Ryan O’Grady and Andy Wool leading the competition, with results from 49 global qualifiers.
* The Grand Final for the World Championship is scheduled for OneCon 2026 in Las Vegas.

The narrative constructs a powerful trajectory: transforming educational content into an industrial-scale, monetizable engagement engine. The system shifts threat hunting from an abstract skill to a quantifiable, reproducible competitive asset. This moves the value proposition beyond simple training toward demonstrating operational proficiency that directly impacts commercial decision-making. The mechanism of scaling involves layering game mechanics onto product telemetry, which provides both experiential learning and a highly specific context for sales validation—a powerful technique where the proof of concept itself becomes the sales collateral.
The implication rests in the delegation of expertise. By empowering 19,000 defenders and linking participation to revenue multipliers (3.7x mean deal value), the structure channels complex technical interaction into a standardized format that drives enterprise engagement. The world championship component further formalizes this by creating an aspirational narrative for high-level competition, suggesting that mastery of threat hunting is a global benchmark worthy of mass spectacle. However, the focus remains heavily on growth and influence ($661M revenue) and culminates in a specific event, which risks overshadowing the continuous process of skill development and the underlying assumptions about what constitutes "threat hunting" versus game mechanics.
What systems of value are being established through this gamification? If success is defined by participation numbers and deal value metrics, where is the space for purely theoretical security advancement that does not immediately translate into a measurable competitive edge or revenue driver? Furthermore, who benefits most from positioning threat hunting as an intrinsically playable, high-stakes game? What happens to defensive strategy when operational reality becomes gamified performance targets?