SailPoint, Inc. (SAIL) Earnings Call Transcript & Summary

All right. Good morning. I'm Rob Owens with Piper, and I manage our technology practice and cover cybersecurity and infrastructure software. Pleased to be joined on stage with Mark McClain from SailPoint, and we'll just dive right in. Okay. I'll leave a little time if there's questions from the audience as well.

So interesting news over the weekend relative to the slowing and better understanding of AI and what these things can do. And as maybe the -- I can't call you the little boy, but the one who cried wolf, if you will, to say, hey, guys, we're going to have to manage this stuff. There's just -- there's a lot of proof points that point towards SailPoint's value proposition. So I don't want to say take us through the last 72 hours because this has been ongoing since the advent of AI. But maybe you can articulate your view on what just happened over the weekend and how it speaks to where the need that SailPoint serves in the marketplace.

Yes. I think if it wasn't already apparent, I think it's become more apparent that at least part of the risk of what's happening in the world with AI and agentic is the fact that these are a flavor of identity, these nonhuman identities. And now what we've seen is, particularly in the Hugging Face incident, the idea that they are somewhat not only just autonomous but incapable of self-regulating what should or shouldn't happen in a given context. And so what people are recognizing is -- I'm feeling tremendous pressure that we serve mid- to large enterprises, I think most folks know. I'm feeling tremendous pressure from my Board, from my senior leadership to implement AI technologies to become more efficient, more effective, more productive all across my organization with these tools. And I'm now once again presented with a very clear and present danger that I don't know that I have the right tools and technologies in place to help guard and protect myself from the way these things seem to go off the rails. And so I think it's that some people I'm not sure in my 40 years in tech, I've ever seen something quite so much a foot on the gas, foot on the brake scenario where people are feeling tremendous pressure to go faster and adopt this tech and feeling tremendous pressure to keep their foot pretty hard on the brake until they feel that they can safely navigate these technologies. And we just got reminded again that we need tools that apparently we don't have yet to keep these things in check.

Yes. Can you talk about SailPoint's right to win? You've got an enterprise customer base, and you definitely provided a much needed capability around governance [indiscernible] by everybody to the new governance world. Maybe you can help us connect the divide.

Yes. And we've now decided to kind of articulate what we think are 3 core pillars of what's needed in this new world. We talk about you have to discover, govern and protect. One of the things that wasn't...

What's the hardest part of that?

Protect.

Because everybody has a discovery. You go to RSA, it was all about discovery. You can't protect what you don't know, right? But it was more so an understanding of what you don't know than it was protecting, in my opinion.

100%, Rob. I think what you found was everybody saying, in the realm of human identities, you might not have had perfect visibility, but you had a pretty darn good handle. You theoretically knew everybody you were paying on your payroll, and you hopefully had a pretty good handle on all the nonemployee humans that were engaging with your technology. Could be contractors, could be business supply chain, distribution chain. You theoretically understood all the humans that were interacting with your systems. What's very clear today is companies do not have a great handle on the nonhuman identities that have access to their systems. And this goes back, by the way, not just to the agentic revolution we're in now, but even for a number of years, we've had other flavors of nonhuman identity, software bots, intelligent devices. Even service accounts that could take action or at least provide access to systems. And very rarely were those things tracked, cataloged, classified. And so this discovery is step one. That's what I was talking about. You can't secure or govern what you can't see. So you have to find it, understand it, classify it, would be the term. Then you have to governance. So now let's share what is governance, right? In our mind, governance has always been, do you have the ability to determine what policy you want to enforce in your environment? Can you describe it and postulate in a way that the technology can implement that policy and you can hold people to that policy. Ultimately, that's what all the policy IGA has been about, which was mostly life cycle and compliance certifications. But it was, do you know what should be true in the environment? And can you validate that what you expect to be true is actually true, right? That was really what governance has been all about. But now we've got this whole thing about protect, which is if I can find it and classify it, if I can set up policies to determine what should be true and compare my actual to my desired state, the third really hard problem is and when can I detect that something has gone awry or is going awry and what do I do about it? And I think the reason you said why -- what's the hardest, because that third pillar is absolutely not going to be solved by any one security vendor. I think there's a little bit of a dialogue in the investor community of who's going to win, who's going to win in this agentic age, who's going to win? The answer is multiple winners, I believe. Like you will need the collaboration of all the various lenses we bring to security. You need to understand what's happening on the network. You need to understand what's happening on the device. You need to see what you can see traversing the cloud, but you absolutely need to understand from an identity lens, what these things are and what they're supposed to be doing and whether they're doing what you expect. And that's the lens that's the newest because you're the longest-term security analyst as far as I know these days. You've seen all these various evolutions of security technologies. Identity is a relatively recent focusing lens on security, and we're just now beginning to...

You used to be an infrastructure play. That's identity.

You had to have it. You didn't know who had access to your systems, but it wasn't really that security oriented. Now we're learning it has to be secured.

So the devil's advocate asks, why does a legacy governance player have a right to win? What have they done to change their platform? And how is this a modern approach? Where you're seeing other people, I would argue do governance lite. They're buying lightweight cloud type of governance solutions. So why does the big behemoth? What have you done?

[indiscernible] this is new for me.

Where have you changed architecture? And why do you have a right to win moving forward if you think about where the world is going?

Well, number one, even though we are 20 years old, we resist the term legacy. That's reserved for the really legacy people like IBM and Oracle. But at the end of the day, I think our right to win comes from a couple of things. One is when we did our re-IPO last year, we kind of reminded people that if you understand the identity landscape, you probably had a taxonomy of 3 core areas. You had access, think SSO and MFA, Okta being the dominant player there. You had privilege, PAM, CyberArk being the dominant player there. But what you might not have thought about is what was sort of their purview or their approach. The nature of access and SSO is think very wide and very shallow, right? Okta and players like that, Ping and even Microsoft are very good at covering the landscape of all of the identities you cared about. This is human identities, but very shallow, meaning they got you logged in. They didn't really do much after that. They didn't really know what you could do after you logged in. They just said, I'm going to make sure you're really Rob, and I'm going to make sure you can log into the stuff you're supposed to and not log into the stuff you're not supposed to. But a lot of security happens after log in. We've often drawn this metaphor of a security guard in a skyscraper in New York, right? You go to a New York banker meeting and you check in at the ground floor and you have your little license and you say, hi, I'm Mark, here's my picture. I'm really Mark. You walk around that security guard's desk to the elevator and go up there. They have no idea where you go, what you do. Did you try to break into something? Did you try to get into the executive suite where you're not supposed to be? That security guard's job was just to make sure you entered the building and you were really who you said you were. That is pretty analogous to SSO, MFA. I know who you are, I let you in. I don't know what you're doing after that. So there's a lot of security risk that's unmanaged with just that shallow wide piece. Privilege was the opposite, right? It's very deep, but limited control over limited applications. After Nikesh and Palo bought CyberArk, he came out and said, look, we typically, with that tooling, manage 3% to 5% of the identities in a total enterprise, right? We're managing the super important critical access of database guys and systems administrators and SAP administrators. Yes, super important. You don't touch 97% of the identities in the enterprise, and that was the human identity. So the challenge these other identity landscape players have is they're coming from either a shallow wide or a narrow deep offering. SailPoint's nature has always been deep and wide. That's who we are. It's what we do. We had to understand all the identities you cared about and very deeply understand what they could do. What's new for us, Rob, and you know this, is protection has to be very real time. Well, that's new for SailPoint. We had to learn to say we're going to have to get into these real-time authorization decisions because I think 2 words we're going to hear a lot in the world of AI and agentic agents is context and intent. What we just saw with Hugging Face was these things went way out of bounds on both the context they were supposed to stay in and the intent of what they were supposed to do. That's why in a world of agentic, we're going to have to understand context and intent and have the power to say, I see something that's either about to or actually going off the rails, I got to stop it right now. And that's real time. And that's new for SailPoint. We will have the ability to either do that for things that are happening or talk to the right associated security tool to go make that stop. Sometimes we won't have the control to shut off a network segment or a device, but CrowdStrike or Palo or Zscaler or somebody will have that power, but we'll have to be collaborative. What they won't have, though, is the identity context. That's what we'll have.

I think it's important to understand relative to the SailPoint story, if we can call it the go-private period, if you will, there was a rearchitecting during that period, right? Single data layer, ability to kind of build applications on top of that. So maybe you can speak to where the platform is now? Because I think some people still remember the struggle between SaaS versus on-prem and parity of function and things of that nature.

Yes. We started 20 years ago as an on-prem software business. And I remind people that we were on-prem because that's what the market told us they would buy. It's hard to remember that 20 years ago, people didn't put important things in the cloud because the cloud wasn't secure enough. And then about 8 years into AWS and Azure and Google Cloud, people started to go, oh, wait, I think that's more secure than my own data center. I'm going to put the most secure things in the cloud. Well, that's when we shifted into a SaaS offering, and it took a while, like you said, to close some of those gaps functionally from our very robust on-prem product. But we did that a while ago. And now what we've been focused on is these modern capabilities that are needed to manage this incredibly complex landscape. And back to that right to win question, Rob, a little bit. Here's what I tell people about the craziness about, oh, you can just hire a bunch of kids out of Stanford and they can go build any tool. Really, like I couldn't hire a bunch of 23-year-olds and say, let's go take on Workday because I don't understand HCM and they don't understand HCM. It takes more than just tooling to know how to go win in an enterprise market space. You have to know the nuances of those issues. You have to understand why buyers buy what they buy, what issues are important, what aren't as important. We spent 20 years getting best in the world at that for identities. And now we're applying that depth of knowledge, but like the latest, greatest Silicon Valley start-ups, we're applying all the AI technologies to do that faster, better and more sophisticated ways than we ever have. So I'd like to say, if you want to bet, do you want to bet on the brand-new kid without domain knowledge who's got AI tools or the guy who really understands the problem and is using those same AI tools to deliver a solution, your choice.

And you put up a very good quarter recently, 25% ARR growth, which is one of the faster, I think, in cyber right now, but not showing the acceleration that the Street wants. Now you've always been an optimistic but conservative guy, at least over our relationship...

I'll take that, moniker.

Okay. And you're talking about acceleration a couple of years out relative to the business. So maybe square things for investors in terms of where you're at now, where you're seeing the opportunity and why gunslinger Mark McClain is willing to sign off -- you are from Texas, willing to sign off on acceleration.