SailPoint, Inc. Common Stock 2027 Q2 Earnings Call

Please go ahead. Good morning, and thank you for joining us today to discuss SailPoint's fiscal second quarter 2027 financial results.

Joining me today are SailPoint's founder and CEO, Mark McClain, and our Chief Financial Officer, Brian Carolan. For the Q&A portion of today's call, we will also be joined by our President, Matt Mills. Please note that today's call will include forward-looking statements, and because these statements are based on the company's current intent, expectations, and projections, they are not guarantees of future performance, and a variety of factors could cause actual results to differ materially. This call will also include references to non-GAAP results, which exclude certain items that do not reflect our underlying business performance. Please reference this morning's press release and our supplemental earnings presentation posted on investors.sailpoint.com for further information regarding our forward-looking statements and non-GAAP financial measures, including reconciliations to the nearest comparable GAAP financial measures.

Additionally, please note that the development, release, and timing of any features or functionalities described for our products that are currently not available remains at our sole discretion on a when and if available basis, and may not be delivered at all or should not be relied on in making, purchasing, or investing decisions. With that, I'd like to turn the call over to Mark.

Thank you, Scott. Good morning, everyone, and thank you for joining us. Our strong second quarter highlights the compounding power of our identity security platform and new product innovations, with AI playing an increasingly larger role in our success. We finished the second quarter with ARR of $1.231 billion, up 25% year-over-year, exceeding the midpoint of our guidance by $11 million. SaaS was especially strong, growing 36% year-over-year, with SaaS net new ARR increasing 34% year-over-year. In Q2, early adopters of our new solutions moved quickly to secure access to our Agentic Suites ahead of the planned Q3 release. Combining this momentum with our existing solutions, our total AI-driven ARR has already crossed $70 million as of the end of Q2.

This momentum gives us tremendous confidence in our FY 2029 year-end targets, which include at least $2.1 billion in ARR, while continuing on our path of delivering greater than 20% durable growth. Today, millions of non-human identities, from serviced accounts to autonomous AI agents, are exploding across the enterprise landscape. Yet we believe the vast majority remain completely ungoverned. In fact, in our research released last month, we found that 97% of AI agents now have access to sensitive enterprise data, while only 21% of organizations surveyed say they are highly confident in their ability to manage that risk. Competitors are treating these agents as isolated identities. We view identity as a human plus AI challenge that needs to be solved with a unified approach, and we are doing it at scale for many of the world's largest enterprises. You cannot safely secure an agent identity without deep, accountable human context.

Conversely, you can no longer govern human access without knowing what agents those humans own and operate. For every agent, an organization must know its origin, what data it can touch, and which human is accountable when it goes off script. We believe no company is better positioned to solve this complex intersection than SailPoint. This is no longer a future trend. It is the law. The EU AI Act contains specific human oversight and audit logging requirements, which are scheduled to become enforceable as early as 2027. We believe regulators will increasingly ask who is accountable for this agent and its actions. We built our identity platform to answer that question before regulators even chose to ask it. Real-time human and agentic identity governance is no longer just an IT operational task. It is now a CISO and boardroom priority.

As our strategic relevance elevates to the offices of the CISO and the chief AI officer, we are unlocking significantly larger enterprise budget opportunities, accelerating our pipeline, and paving a clear multipronged path to our fiscal 2029 targets. This momentum is evident in our results. In the second quarter, our SaaS customer count grew by 16% year-over-year. Our average ARR per SaaS customer grew 17% to over $400,000. Our AI-driven pipeline has more than doubled since our investor day, which was less than three months ago. When recent headlines detailed how frontier AI models broke out of their digital sandboxes, many labeled these as AI safety issues. We see them for what they are, identity governance failures, a massive problem which we expect will get even more challenging as AI usage expands in the future.

The question I am constantly asked by CIOs and board members of other companies is simple: Can SailPoint protect our enterprise from these autonomous agent breakouts? The answer is yes, because securing and governing all identities, including agentic identities, is the exact problem our company was built to solve. Let me give you an example of how we recently expanded our market position in non-human identity security at a global Fortune 500 company. Within a week of a proof of concept, we connected to a majority of their data sources, leading to discovery of more than 10,000 unknown agents and thousands of associated risks in their environment. This resulted in a multimillion-dollar contract for our Digital identity Flex offering alongside Entro. In another example of this momentum, we closed a three-year, seven-figure commitment with a global software company.

This new customer is leveraging our core Identity Security Cloud with advanced digital identity governance across thousands of machine identities while establishing a direct path to upgrade to our Agentic Business Suite as they scale their AI infrastructure. Our go-to-market engine is significantly more versatile than it was six months ago. We expanded our entry points across CISOs, Chief AI Officers, and other C-suite leaders to win new customers, securing human workforces, autonomous agent fleets, or both together. In Q2, we also expanded our ecosystem with new agent identity security connectors for Snowflake and Databricks. We introduced our Cursor Enterprise connector for autonomous coding agents and launched a cloud enterprise integration utilizing Anthropic's compliance API. Whether an agent is writing code, analyzing data, or querying an LLM, SailPoint provides comprehensive visibility and human accountability in a single independent platform. Let me expand on our innovation.

Our approach is grounded in a continuous intelligent security loop across three pillars. First, we discover every identity across all platforms and map their entire lineage so you know exactly what permissions they hold and who authorized them. Second, we govern them under a strict policy of zero standing privilege, dynamically orchestrating life cycle policies across millions of agentic and non-human identities with support for global compliance frameworks. Third, we will protect the enterprise with the ability to deploy a kill switch when an agent violates a guardrail. We are working to enable real-time authorization, prompt security, and response and remediation capabilities integrated with the SOC. To deliver on these pillars, we fundamentally advanced our platform this quarter with the launch of SailPoint Identity Security, featuring two purpose-built products, Agentic Fabric, which is now generally available, and Human Fabric, which is the evolution of Identity Security Cloud.

This enables organizations to move beyond static compliance into real-time, threat-aware enforcement across both human and non-human identities. These are not future promises. These real-time detection, SOC integration, and automated enforcement capabilities are available right now. Unifying AI and human identities under one control plane creates an immediate compounding effect. All of this runs on our core technology foundation, SailPoint Atlas. Atlas provides one unified data model, a powerful, comprehensive identity graph, and a shared set of AI services engineered for agent scale, real-time telemetry, and inline threat response. We also accelerated our roadmap by acquiring Entro Security, and we are rapidly integrating its capabilities directly into the SailPoint Agentic Fabric. This expands our discovery capabilities to over 1,200 non-human identity types and provides deep lineage context.

While other vendors are racing to bolt on session visibility or point-in-time threat detection, we believe we are one of the first to bring deep machine credential discovery and full agent lifecycle governance under one enterprise-grade control plane. Already this quarter, demand generated from live demonstrations of these capabilities at major industry events like Black Hat and Ai4 has translated directly into enterprise deals in our pipeline, with evaluations and POCs at an all-time high. Overall, the market response to our architecture and product roadmap has been exceptional, with our AI-driven solutions accounting for more than 30% of our net new ARR in Q2. Enterprises are also using agentic AI governance as a catalyst to accelerate cloud migrations. Through SailPoint Agentic Acceleration, we have dramatically simplified the migration process from on-prem to SaaS. Let me give you an example.

This quarter, a global financial services firm signed a multi-year agreement to modernize with our SaaS platform to manage over 300,000 identities. By utilizing our automated onboarding tools, we dramatically reduced implementation friction and accelerated their migration by reducing weeks of configuration time to less than 10 hours. Ultimately, our ability to deliver rapid time to value remains a major differentiator. As part of this modernization, the company also adopted our Digital Identity Flex model to help ensure long-term flexibility in managing non-human identities. I'd like to turn to the competitive landscape. While many vendors market non-human identity or Agentic AI governance, we differentiate on three fronts. First, monitoring is not the same as security. Simply watching an agent go rogue is just a dashboard of active breaches. Regulators and CISOs require proactive governance. SailPoint is designed to enforce accountability before the agent ever takes action.