CrowdStrike, SentinelOne and Evoke Security claimed the same seat inside Anthropic's Claude Cowork in 24 hours
Anthropic's agent workspace created a security blind spot no endpoint tool can watch; SentinelOne, Evoke Security and CrowdStrike each claimed the seat inside it within about a day, and none disclosed what the seat pays. CrowdStrike shareholders are paying a category premium of 168 times forward earnings for it.
Vincent Jiang · 3 min read
Anthropic's$350B — Anthropic, private, latest valuation $350B Claude Cowork lets employees hand real work, files and credentials to agents that run inside a virtual machine on their own device, a space conventional endpoint tools cannot watch 1. Within about 24 hours, three security vendors claimed the seat inside that machine 1.
Startup Evoke Security announced an integration it says is planned for a future release on November 2 3; SentinelOne+1.17% — SentinelOne, up 1.17 percent today said the same afternoon it would place its own agent inside the VM itself 1. On November 3 CrowdStrike−0.60% — CrowdStrike, down 0.60 percent today answered at its Fal.Con Europe conference, bringing Falcon Guardian AI detection and response natively into Cowork, built with Anthropic and backed by a Mondelēz International CISO quote 2.
The blind spot is real, and priced
The prize is real. Cowork's users run business processes, not code, across more than 600,000 organizations by Anthropic's own May sampling, and business process and operations accounted for 33.4% of sessions 6.
In July, the security firm Armadin published an attack chain that reached root access inside Cowork's Windows virtual machine, and its broader finding was that local virtual machines create visibility gaps endpoint products struggle to monitor 6. Anthropic called that one a non-issue because it required prior local access 6. That visibility gap is the concern all three integrations are selling against, which is why the same seat drew three claims in a day.
Two stocks, one seat, two valuations
CrowdStrike carries the story's price tag. Its shares rose 114% in 2026 through October 30, near $250, and it traded around 168 times forward earnings on October 22 against a five-year average of 114 5. The agent-security line justifies part of that premium: AI detection and response ARR nearly tripled between the April and July quarters 5.
Now the same seat CrowdStrike sells is contested on the same machine by SentinelOne, whose stock trades near $23.16 with an overall SELL rating on StreetInsider's tape 1. The record does not show that SentinelOne investors have priced in a Cowork seat: the announcement carries no financial terms, and the tape offers only the price and the rating. The gap is the market's answer so far, 168 times earnings against a stock at $23 with a SELL next to it 1.
CrowdStrike books about five times SentinelOne's revenue every quarter
- CrowdStrike
- SentinelOne
Data
| CrowdStrike | SentinelOne | |
|---|---|---|
| Q3 '24 | $1,010M | $210.65M |
| Q4 '24 | $1,059M | $225.52M |
| Q1 '25 | $1,103M | $229.03M |
| Q2 '25 | $1,169M | $242.18M |
| Q3 '25 | $1,234M | $258.91M |
| Q4 '25 | $1,305M | $271.15M |
| Q1 '26 | $1,386M | $276.66M |
| Q2 '26 | $1,471M | $291.98M |
CrowdStrike's net new ARR: $256M, a record $333M, then guided $343M to $347M
CrowdStrike beat its own July guide by about $47M; the December 1 print is the next test
Data
| Value | |
|---|---|
| Apr Q (actual) | $256M |
| Jul Q (actual) | $333M |
| Oct Q guide low | $343M |
| Oct Q guide high | $347M |
Announced seats are not revenue
The receipts stop where the releases stop: none of the three discloses commercial terms, and CrowdStrike's own statement flags that some referenced features are unreleased and subject to change 2.
Timing sharpens the check. CrowdStrike guided October-quarter net new ARR to $343 million to $347 million, 29% to 31% growth, a slowdown from July's 51% 5, and it reports that quarter after the close on December 1 7. That print lands before any Cowork seat can generate disclosed revenue, so it tests whether the agent-security premium holds on the existing engine, not the new one. The second tell: which vendor's Cowork agent ships to general availability first.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
