5 Years of SentinelOne ThreatOps: Defense from the Ground Up to Global Threat Championships

For five years, SentinelOne™’s ThreatOps has inspired a global defender movement. What began in 2020 as a threat hunting webinar has grown into an industrial-scale gamified platform that has trained over 19,000 blue teamers, influenced over $661 million in closed-won revenue (September 2023–September 2026), and spawned the Sentinels League Threat Hunting World Championship.

As we mark five years of ThreatOps innovation, defenders worldwide are gearing up for the ultimate showcase: the Sentinels League Grand Final, hosted live on stage at OneCon 2026 in Las Vegas from October 20–22, 2026.

The Evolution of ThreatOps

The origin of ThreatOps dates back to April 2020, when Solutions Engineer (SE) Director Ryan Merrick launched a two-hour threat hunting webinar covering MITRE ATT&CK concepts, indicators of compromise (IOCs), and the distinction between hunting and searching. While educational, the team recognized that defenders needed hands-on experience interacting with real product telemetry.

In May of 2020, SE Joseph Poyner sketched a vision in a team chat channel: standing up a Capture the Flag (CTF) game that would walk players through the product, requiring them to search deep visibility telemetry for malicious process connections to find hidden flags. 

With the support and guidance of SE leaders Tommy Hui, Dave Gold, Keith Weisman, and Jared Phipps, the team secured a dedicated CTF line item in the FY21 budget, turning a side project into an official initiative. That initial sketch defined the exact game format ThreatOps still runs today. By August 2020, the team had stood up a dedicated console and created a parallel ransomware workshop track. 

The first live game ran in October 2020 for SentinelOne's product management team, followed by the first customer workshop in EMEA. Rapid scaling and industrialization soon followed:

• Public Challenges and Accreditation (2021): In March 2021, ThreatOps launched its first public challenge featuring cash prizes, expanding across named accounts, partner channels, and UK regional teams.
• Industrialization & Platform (2022): PJ Norris built a game-creator program to train SEs globally while securing CPE accreditation. At the same time, Brian Martin created a platform to automate game provisioning, data replays, and self-service registration. This new platform reduced workshop setup times from two days to under five minutes.
• Hackathon (2023) & Content Editor: In September 2023, the team met for the first ThreatOps Hackathon in Detroit, Michigan, where SEs spent a week building content, including the new Purple AI game (featuring GLaDOS). Shortly thereafter, Ryan O’Grady built a new game editor that streamlined the process for creating and publishing new game content.
• Multi-Surface & AI Expansion (2024–2025): The program expanded into every surface SentinelOne ships, including a new SDL Deep Dive game, Cloud Security, the Need for Speed-themed Hyperautomation game featuring live API interactions, and the Data Pipelines games. These games were made possible by collaboration with SE champions, including John Pease and Marco Rottigni.

Through continuous craft and automation, ThreatOps transformed threat hunting from a manual class into an enterprise-grade operational standard.

Enterprise Protection and $661M+ Revenue

The impact of ThreatOps shows up in two places: the number of defenders it has trained and the revenue it has influenced.

Empowering 19,000+ Global Defenders

What started as an internal workshop has grown into a massive global educational engine. Between September 2023 to September 2026, ThreatOps has built and deployed 5,215 game instances across 9 unique game types, generating a total of 27,899 player seats and reaching 19,211 unique players across 5,869 email domains.

The program's core audience is overwhelmingly enterprise-focused, with 87.4% corporate participation representing over 16,700 unique corporate defenders. Practitioners from world-class organizations regularly refine their skills in ThreatOps competitions, including teams from Orange and Orange Cyberdefense, Exclusive Networks, Cloud4C, GoDaddy and many more. This global footprint is sustained by an active internal community of 407 game owners.

$661.8M+ Closed-Won Revenue Influence

Beyond skill development, interactive threat hunting has become one of SentinelOne's most potent catalysts for customer acquisition and technical evaluation. Our analysis reveals that ThreatOps engagements have influenced $661.8 million in closed-won revenue across 6,435 deals and 1,538 corporate accounts (Sept 2023–Sept 2026).

The data points to a clear correlation between ThreatOps participation and commercial success. Opportunities where prospective accounts engaged in a ThreatOps game saw a 3.7x higher mean deal value, averaging $103,000 per closed-won deal compared to $28,000 for non-participating accounts. 

This commercial lift is driven by strategic timing: 80.4% of games execute mid-cycle while sales opportunities are actively open, serving as a decisive technical proof point during active Proof of Concept (POC) and Proof of Value (POV) evaluations.

The Sentinels League World Championship

In August 2025, Steve Regini, SVP of Global Solutions Engineering, and theater leadership (Keith Weisman, Amit Sabharwal, Lloyd Webb, and Wayne Phillips) approved turning ThreatOps’ game cadence into a global tournament: the Sentinels League Threat Hunting World Championship.

Presented in partnership with Dropzone AI, Google Cloud, and Mimecast, the Sentinels League features a $100,000 prize pool. Defenders compete across four critical attack surfaces in 30-minute CTF qualifiers: Endpoint, Cloud, AI Security, and Autonomous SOC. Prizes are awarded at every stage: qualifier winners earn cash, regional semifinal winners take home $3,000 and a trip to the Grand Final, other semifinal placers are rewarded too, and the top three finishers in the Grand Final all win prizes.

• Season 1 (2025): At OneCon 2025 in Las Vegas, Derek Render of ProCircular was crowned the first Threat Hunting World Champion, alongside runners-up Arnau Osso (T-Systems) and Ethan Chew (Intfinity).
• Season 2 (2026): Season 2 expanded to 49 qualifiers worldwide. It was led by Ryan O’Grady (Director of SE Operations) and Andy Wool (Senior Marketing Manager), with major contributions from PJ Norris (Lead Technical Enablement Manager) and Michael Logan (Senior Solutions Engineer).

Catch the Grand Final Live at OneCon 2026 in Las Vegas!

After months of regional competition, three elite regional champions have earned an all-expenses-paid trip to Las Vegas for the Grand Final:

• John Paul Lonie, aka “grumpycat” (Iress)
• Jodie McDonald, aka “jodie” (LevelBlue)
• Jason Walker, aka “tresscross” (Five9)

These three finalists, each of whom has already won $3,000 as a regional winner, will compete live on stage at OneCon 2026 for the $5,000 grand prize, the World Champion trophy, and a matching charitable donation made through the S Foundation.

Experience OneCon 2026: October 20–22, 2026

OneCon 2026 is SentinelOne's premier annual cybersecurity conference in Las Vegas. Beyond witnessing the Grand Final live, attendees will experience:

• Visionary Keynotes: Exploring AI-driven defense and autonomous cybersecurity.
• The OneCon Expo: Live technology demos and direct interaction with SentinelOne experts.
• Special Advisory Panels: Exclusive Customer and Partner Advisory Board sessions featuring unfiltered industry insights.
• OneCon After Dark: Evening networking at Jason Aldean's Kitchen + Bar featuring live music, dinner, and drinks.

Register Today!

Five years after a single wild idea, ThreatOps has elevated threat hunting for tens of thousands of defenders worldwide. Be there live in Las Vegas when the 2026 World Champion is crowned! Visit onecon.io to explore the full agenda.