Mark McClain: Winning as an incumbent at SailPoint in the age of AI

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Haleduk.

And I am Mahendra Ramasinghani. We have spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors Building the future of cyber.

We will talk about the hard parts of the founder journey, launching companies, getting to product market fit, raising capital, and scaling to an exit.

And yes, we will also be talking about epic failures.

But Mahendra, we're here to make the founder journey easier.

That is correct, Sid, but we cannot make it too much easier because startups are hard. And of course, you already knew that.

All right, you two, enough. Let's get started with this video.

Episode.

Some founders take a company public once. Mark McClain took the same company public twice, and the second time it was oversubscribed by 20 times. As CEO and founder of SailPoint Technologies, Mark created the identity governance market from scratch. Took the company IPO after 12 years, then took it private with Thoma Bravo for almost $7 billion. Not to be satisfied, 5 years later he brought the company back to public markets in 2025. Same company, same founder, an entirely different scale. Today SailPoint is a leader in identity security with over 3,000 employees operating in over 60 countries serving nearly half of the Fortune 500. Join us to hear the fascinating journey of a founder who, after two decades and two IPOs, brings his depth, wisdom, and above all, a delightful sense of humor. Our episode was recorded live at RSA Conference 2026 in San Francisco and is by far one of the more fun and insightful conversations on how identity is shaping up in the age of AI.

Let us get started.

And welcome to our first live onstage show. We're really, really excited to do this with you, Mark. And most importantly, this is also the first time that RSA Conference has hosted a live podcast onstage.

Oh, look at us.

So very thankful to Jenny, who's in the audience today, and Cecilia and other members of the team for making this a reality. Well, we're going to talk about a whole bunch of different things and we'll certainly get to SailPoint and the company you've built that has over a billion of ARR, over 3,000 employees, serves 50% of the Fortune 500. But before we get to all that, let's talk about the origin story and a little bit about the why. You've called yourself an accidental entrepreneur. You said, you know, you joined IBM out of college and you thought you'd retire there. Most founders tell the opposite story. Somehow they always knew, they had started that lemonade stand, they'd, you know, been a founder before, they thought they were a founder when they were a kid, but that wasn't your case. When you were at Tivoli Systems in the mid-'90s and the company sold for just under $750 million, were you thinking, hey, I can do this too? And what was the decision behind going and starting your own company?

Yeah, I'll tell you, obviously a very long story as quickly as possible. But yeah, I was literally the kid who mocked the lemonade stand kids. Like, mom will bring us lemonade. I want to go play baseball. What are you doing? So I thought that was silly and really had no exposure to entrepreneurship or anything like it. And as you pointed out, kind of joined IBM when— hard to imagine this now, but back then joining IBM was like joining Google. You thought, this is the coolest company and I'm going to retire there and it's awesome and I'll get to watch it. 25 years and all that cool stuff. And all of a sudden it just didn't work like that, right? IBM was having some challenges and then I went to HP for a minute and that was similar. And I went, okay, maybe the big company thing isn't my thing. So I joined the startup Tivoli in the mid-'90s that immediately found itself purchased by IBM. So I'm like, I can't seem to escape this. This is weird. So did that for a few years, but that's when a group of us kind of, this is the late '90s by then, and we sort of thought, okay, we've sort of seen this small company startup thing, maybe we should try this. And, you know, Mahindra would be around to remember this, right? Late '90s, everybody thought they should start a company because the internet was booming and, you know, let's go, let's go. So we did that. Then the internet bubble burst and it wasn't a great time to start a company. But as it turned out, I really would have said that it was that 4 to 5 year period where I joined a small business, sort of seen up close— till we had 200 people when I joined it— sort of seen up close when you could kind of get your arms around a whole company. I'd never seen that at IBM or HP, obviously. So I kind of got my first taste of that small early-stage company and I kind of got bit by the bug. I think like, well, this is fun, you know, I should try this. And then whole environment around us said, well, that's what you do. It's the late '90s. So off we went. And yeah, then I all of a sudden became an accidental entrepreneur.

Yeah.

Mark, you cut your teeth in marketing and sales at some of the largest players at the time, right? HP, IBM, Sun. In cyber, when we talk to the majority of the founders, a lot of them tend to struggle with the sales and the go-to-market side. They're very technical. They're absolutely brilliant on the technical side, but they might be lacking those skills and the exposure. How did that early exposure to the enterprise sales shape your DNA as a CEO? And what are some of the maybe early learnings from those times, from your time in go-to-market that is still baked into the SailPoint culture?

Yeah, I think what I learned along that journey was at the end of the day, if you've, uh, if you're familiar with the book StrengthsFinders or some of these books that kind of purport to help you think about the fact that you really actually need a really balanced team to win in the long run. I think it's partly knowing your own DNA. I had technical aptitude, but I had tried coding for a year in college on Fortran and went, this sucks. I'm not going to do this the rest of my life. So got away from that level of detailed understanding of tech, but liked tech, right? And so, and yet I had colleagues who we had gotten to work together, as I said, at Tivoli, where they were deep development engineering experts. And I think it was the strength of that founding team that had a lot to do with our success because we understood the importance of getting the product right. Is getting the requirements right, then building a great product and understanding how to market and sell that product. And so many, as you said, so many founding teams, particularly security founding teams, are coming from a deep technology understanding. And there's still a little of that, you know, Field of Dreams baseball movie, if we build it, they will come. I'm just gonna put the best tech out there and everyone will see it's the best tech and I will just win. And as we've all, some of us been around a long time know, the best tech does not always win. Microsoft. So at the end of the day, there's a way that you can have good enough tech often and great sales and marketing, or just catch a particularly great wave. I think we felt like we're not gonna be necessarily lucky enough to catch a wave completely, so let's make sure we have a really good understanding of what's needed and then make sure we build a great product and then make sure we have the kind of people who know how to go sell that to large-scale enterprises, which is a very unique skillset. So it, it kind of was all of those together and understanding the parts that a couple of key founders brought to that. We, we had a team of 4. At WaveSet, team of 3 at SailPoint. And we knew kind of where our strengths lie and where we needed to complement those strengths with others.

And what were some of the learnings that translated from what you've seen in the go-to-market in larger companies when you started the startup versus something that didn't translate?

Yeah, I think a lot of it was especially selling to the world's largest companies. Most of my career I've been in those kinds of environments, you know, the Fortune 1000 or 5000 or something. And you just learn that there's an awful lot that it takes to get products into those companies. I mean, there's political dynamics. There's massively complex buying centers. You know, your actual intellectual buyer might come along with you very quickly, but he's got to get finance and legal and procurement and everybody else aligned with him. And if you don't understand that, trying to sell into large enterprises, you're going to hit all kinds of struggles. And so I think we knew an awful lot about what it took to do that. And I'd say kind of differentiating marketing here for a moment, I think great positioning and compelling, you know, simple messaging is often undervalued by technical founders. Like, you know, there is this whole thing, you know, if you can't explain it to a third grader, you don't understand it yourself yet. And of course, third graders these days with AI are smarter than all of us. But anyways, at the end of the day, you have to kind of ruthlessly focus on simple, clear, compelling messaging. And especially I'm reminded of that every time I come to RSA, you know, like, wow, blah, blah, blah, Ginger. If you remember the old Far Side cartoon, like everybody's saying a handful of the same words. I pity the CISOs walking around this floor. Like, good luck trying to sort out the noise. So you have to try to cut through the noise with clear, simple, compelling messaging. So I think that's the other thing we learned from those early companies. Some were better than others at that.

So Mark, before we get on to SailPoint, let's talk about the first innings in the Field of Dreams, WaveSet.

Okay.

You know, talk to us about the trigger point and the motivations, but more importantly, you sold that company in 4 years for a respectable amount of $500 million. Many founders would have then said, the game is over. I'm going to go and enjoy the the fruits of my labor.

Yep.

So here you are 25 years later, still going strong. So help us understand not only the origin story, but also what keeps you going.

Yeah. And I think the only fair— I'll try not to go into some like lie down on the couch, tell you my life story thing, but I think there really is a personal and a professional thing there. I think professionally, like that was a good outcome, right? We had a good outcome. I think I was 44 or something like that when that deal happened to sell it to Sun. And I was just, Partly I had, this is the personal part for a second. I had kids that were like elementary and middle school, and I didn't really want them to see me hanging out on the couch watching Oprah while they busted their butt in school. Like, you guys should go work hard, pass me the ice cream, right? Like, that's just, it's not a good look. So I kind of had this personal motivation to kind of give a good example to my kids of, hey, I'm gonna keep working. But I think professionally it was like, well, that was a fun, good outcome, but it was, I went, company got to 100 people. You know, we immediately got sucked into the Borg of Sun. Which is another long story. Sun was great until it wasn't. And so we kind of went, man, maybe we could do that again. And the weirdness of the SailPoint story is we thought it would be the WaveSet story again, like run 4, 5, 6 years, build a nice product, some cool tech company will buy us and lather, rinse, repeat. Maybe we'll do that a couple more times. And that's almost what happened, but then it didn't. So I think there was a professional motivation to try to just keep going. Yeah, again, we did well. We didn't make, you know, so much money that we were buying islands. We were buying modest houses in the burbs. That wasn't like the end goal necessarily. And it wasn't so much the money as the sense of doing something interesting. I think that motivated me always, frankly. And but on the other side, personally, I just like, well, I have energy and interest and I'd like to stay in the game. I didn't anticipate SailPoint would be a 20-year journey. I really didn't. So that part was unexpected, but it's been a super fun journey. So I guess we'll talk a little more about that too.

So, well, let's talk a little bit about SailPoint.

You're welcome for the segue.

You're building the castle. SailPoint raised very little venture capital before partnering with Thoma Bravo. Yep. 2014.

Yep.

I believe the company was founded in 2005. Yep. You initially took the company public in 2017 and you were Thoma's first ever IPO of a portfolio company. That's what I believe. Still the only ever IPO.

Did they send you a thank you card? No, not the only.

They technically had 6 IPOs, but we are 2 of the 6, which is kind of an odd statistic.

That is very interesting. Yeah, it is.

It is, in fact.

At the time that PE firms were buying, you know, kind of companies, they weren't typically focused on buying innovative, high-growth software companies. And it was pretty unusual. You've said that you were pretty surprised that private equity was even interested. What got you excited about working with private equity versus venture capital and continuing to raise multiple rounds?

Yeah, no, I'll go ahead and tell the story as honestly as I can because what happened was I mentioned we thought this would be the same story as WaveSet. We had two aborted M&A deals. We almost got bought once. That one on a clock scale went to about 10:30. Then we almost got bought. That one went to 11:58. Like red lines back and forth. We think we're almost done. Deal blows up, which was not a good day actually in my life, but it led to like, okay, we're gonna keep going. Didn't really expect that outcome at that point. And so we went to raise what was then generally called growth equity, right? We'd been raising early stage venture, we're getting to a bit of scale. Let's go raise some growth equity. The banker that had been working on the M&A deal kind of said, well, let me help you guys. We'd never used a lot of outside help to raise capital 'cause we had these relationships with some of the VCs in Austin and such. And so we got down this journey and all of a sudden the people that seemed to be having a lot of interest in us were PE firms. And I was just like, huh? Like, what is that? Like, all I knew for the older folks, all I knew of PE was Michael Milken and LBOs, like leveraged buyouts. Like, that's not us. We're like a little fast-growing startup. What, what is happening here? And what was happening was that was the early stages of PE getting into growth equity. They were starting to see there were multiple ways to make money. One was to buy kind of quote unquote broken companies and fix them. Them and resell them, and they still did a lot of that. But the other was to kind of get in on the front edge of some industry. And to Thoma Bravo's credit, and they've still built, as we all know, amazing security industry franchise, they saw identity, I think, before a lot of people saw it. And so they literally were kind of almost kind of keeping an eye on the landscape for who was emerging as interesting identity players, and they connected with us and really liked the story. And next thing you know, when we thought we were just going to be adding investors. Instead, we had a PE investor who took everybody else out, which was not the expected outcome. And so that was a bit of a shock. But then to your point, we thought, okay, well, fine, we'll do this in a few years. We'll sell to a big strategic because that's what PE guys do. And then all of a sudden Wall Street's talking to us. They're talking to Thoma Bravo and like, you guys could take this thing public. We're like, what? Like, that was not the plan. So that's where we got to. Again, I try to be as transparent about this stuff as possible. It was not how we went into it. Didn't expect it.

Didn't always think I was going to be a public CEO.

I probably would've said at one time, I'm not sure I even wanna do that. Unlike the folks who seem like they wanna do that always. So that sort of evolved as the next natural step, but it wasn't really the game plan. And it really was because PE, Thoma particularly, I think was shifting into a mindset of multiple investment strategies. And, and one of them became growth equity. And ultimately Thoma now has an early-stage venture fund effectively, right? But back then that, there was no fund focused on that. We were really a misfit in their portfolio. We literally would have these conversations about EBITDA multiples and we'd be like, there is no EBITDA.

So that's what EBITDA—

yeah, what is EBITDA? We had that conversation first. So there was just a lot of cross-learning with those guys. And then, yeah, the public thing happened and then, yeah, we can go on the weird story from there.

Tell us a little bit about about Austin and building a company, a startup, particularly a technology startup in Austin versus here in the Valley. How was that like fundraising in, you know, a very different environment?

Yes and no different. You know, I think one of the things that you'll hear from, I'll call them grumpy Austinites, if there's any in the room, apologies, is, oh, you know, there's no money in Austin. Like, bull. There's money. You've gotta be attractive enough for it to find you. And it does find you. If you build a good business, the money will find you. And, you know, we were, we were first invested in by Austin Ventures, which was kind of the flagship fund at that time. But then Lightspeed, who many of you know out here, flagship VC firm was Round B in both companies. So they found good companies even based in Austin, right? But building a company there, there's some pros and cons compared to here, right? One is you've got a decent— less so back then than now— a very decent pool of talent, right? What you didn't have necessarily was as much executive talent out there, people who had been there, done that at like C-level jobs in fast-growing startups. That's different today. But 2006, No. And so finding that kind of talent was a little more challenging, I think, in that era. But there's a big difference in Austin. And now I'll diss on the Valley for a minute. I was dissing on Austin, try to be an equal opportunity offender. I think the thing about the Valley that's tough is you kind of get this suspicion. If you want to meet with me, do I need to talk to you? Why? What are you going to do for me? And Austin, there's like this openness, like, sure, I'll talk with you, I'll help you. Do you want to meet somebody? Oh, if I know them, I'll make that introduction. It's a very much more community collegiality, I think, that's kind of characteristic there. Some of you know the famous event we have down there, South by Southwest. And I told people, the guy who first built that didn't know how brilliant he was with that title, because Austin does kind of represent this meeting of the South, which is genteel and sweet and nice. And by the way, if somebody down there tells you bless your heart, they don't mean it in a good way, just so you know. But, but there's the South thing, but it meets the Southwest, which is sort of the West and the independent, rugged go do your own thing. And it's kind of— Austin's got both of those characteristics. It's really interesting. You get the niceness meeting the tough, independent innovator, and that's kind of who we are as a city. So for what it's worth, I felt like when I got there, I'm like, oh, this has kind of a different vibe than I was used to in the Valley. And that just turned out to be a great place for us to build a couple of businesses. So yeah, it is different than here. I think those, those differences are less than they were. So many folks have moved from California to Austin and just the whole thing is a lot more remote more friendly than it used to be. COVID taught us that, right? So now teams are sort of virtual and national, if not global. So it just, all of those things are still important, but maybe a little less so than they were.

For the longest time, identity was seen as just a compliance workflow.

Yep.

Yeah. What, like if you go back to those times, what did you see so early on that made you believe that it will change and identity is going to become one of those most critical control planes for the enterprise? Or maybe that in fact wasn't the belief and things just unfolded.

I try to be terribly humble, I will not tell you in '06 I saw where we would be today. No freak chance I saw that. But to be fair, we did see, Waveset had been kind of a lifecycle provisioning company. Then we started SailPoint as a compliance, and then over time those two sort of became the core of what's now called IGA, right? Governance and administration. And we certainly saw a lot of drivers for customers in that marketplace, right? Just the whole need, Sarbanes-Oxley became a thing and audits and compliance became a thing. But the whole operational provisioning side of identity was still a thing. So we kind of rode that wave. But pretty early on, I think we were starting to see these early, especially in SaaS, the shift to cloud and SaaS. Like, when you shifted from an on-prem data center model, which was kind of a castle and moat model, right? You have your own proprietary network, your own proprietary data center, you own those desktops. People have to come to work and work in the office on that desktop. That's how most of us grew up. Like, when the world became mobile and cloud, all of a sudden those core security fundamentals, they didn't go away, but what happened pretty quickly is we figured out they were insufficient. Like, you didn't not have a firewall or not have network security or device security, but a whole bunch of the time someone was on a device you didn't own over a network you didn't own going to an application you didn't own. So the common thread to an enterprise was the identity doing all of that. And so we kind of saw that and, and started to talk about more of identity security, not just identity governance and clients and sort of, I think we were a bit ahead of that curve, but it was not that we saw it 20 years ago, to be fair, Ross, we saw it maybe a few years before others and started to kind of shift our, our mindset there. And I think that's, you know, I kind of said this earlier and I'll highlight it just because I know some folks in the room think about doing companies and stuff. I would say the longest-term sustainable competitive advantage is listening better. If you listen better, you're going to be ahead of the curve on a lot of stuff. And this is where the tech founders sometimes get off track because they're really, really smart. And they think they know what the market needs and that's what they go build. And they didn't listen very well. And so if you continue to listen well and evolve and adapt, then you're more likely to kind of stay at or slightly ahead of most of the customers. And that's how you keep winning in the market. And we absolutely did that as things evolved.

So now, Mark, it's been 12 years. The company has gone public. The first company that you built, you sold it in 4 years. Yep. The second time it goes public after 12 years. And then you take it private within 5 years. Within 5 years. So help our audience, help the entrepreneurs who are trying to build companies understand the challenges through each of these stages. You know, company goes public, there are a bunch of challenges, then you have to take it back private. What's going on behind the scenes?

And then you go public again, then you go private again. I think I'm going to do this for another 30 or 40 years. I'm just kidding.

Only the bankers will be very happy.

The bankers would love me. My wife would shoot me. So we're going to go with staying alive as a strategy. Yeah, look, I think at the end of the day, one of the things that's not expected that I've now learned is as a CEO, you spend about 15 to 20% of your time with investors. That looks one way when you have 3 or 4 venture capital investors. It looks very differently when you have one PE investor. It looks very differently when you have hundreds of institutional investors. And it's really fun at the moment where you have both a dominant PE investor and hundreds of institutional investors all at once. Super fun. Sorry, that's public, isn't it?

Sorry.

It's great.

It's all, it's awesome.

It's great.

But, uh, at the end of the day, what I've learned is you always have people, unless you build something completely bootstrapped and got big, and that doesn't happen very often, you're always gonna have a set of investors to whom you answer. And so your job as a CEO is always to make sure that investment community, whoever it is, has confidence in your strategy, believes you have the right team on the field, and believes this market opportunity still looks like a great thing to pursue. And when you do that well, then they stay with you. I think the other obviously part of our job is inward facing. And at some level, what I've seen with all these changes in our cap table is that really about 3% of the company at most spends a lot of their time on that investment community. And 97% is just building software, marketing software, selling software, installing software, supporting customers. Like most people's job changes very little with changes on the cap table. And I try to remind them like, you stay focused on what you do. Let us worry about this investment stuff. When they get overly worried about that, it's not great. Right now it's not great 'cause everybody's watching the stock price be completely disconnected from the value. But we will see that change, I believe. Matter of fact, we famously said on one of our company meetings after the first IPO, every second you spend watching the stock price, you're doing absolutely nothing to help the stock price. That's, that's a good reminder for all of you if you're in a public company. So we, we try to get people focused on that and let, you know, the CFO and the CEO and the IR team worry about the investors and how that goes. And I think that's another thing you signal to how lead the company. If you're, if you're staying focused on customers, the market, the competition, the partners you need to win, most of the investments will work out. But if you get overly fixated on that side of it, some founders get so caught up in the fundraising and the this and the that, like you lost sight of the market, you lost sight of the competitive dynamics. Don't do that. So I think we've tried to make sure the handful of people that really need to focus on the investment community, whatever that investment community is, are thinking about that while the others are or just doing what they need to do to build a great business.

You know, in our, some of the background research that we did, found that you're the only entrepreneur who's taken the same company public twice, except two others, Michael Dell, who's also from Austin.

Sure.

It's an Austin thing about the South and the Southwest. Sure.

There you go.

And then the third one is Richard Branson.

Yeah.

I think the three of us should go have dinner and talk about this. This could be super fun. Hey, Rich, Mike, what do you think? Yeah, no, we should definitely do that.

But the second time around when you took the company private again and public second time, that was a 3-year window. What were the motivations the second time around? Was it the market that was pulling or did Thoma Bravo sort of play a role in saying this is a good window, grab it?

What were both? And great question, Mahendric. Yeah, both. And I mean, look, we don't feel it very much sitting here in March of '26, but about a year and a half ago, the market was buzzing. Not long after, a year and a half ago, we elected a president who was going to be super business friendly. You guys remember that? And so we got geared up to do an IPO, frankly, about a year to year and a half earlier than we were planning. When we went private in, I guess it would have been spring of '22, we expected that to be a 4-year private journey, like to right now.

Oh, wow. Ish.

And 2 and a half in, we're like, it's time to get ready and go again. The company had performed really well during that private period. Gotten much more profitable. We kind of did some more aggressive SaaS transformation. We did some more aggressive, you know, culling out some products that needed to be culled out as we continue to evolve. And all of a sudden we looked really attractive again for a public market offering. So we went and did that in February of last year, and then we all got liberated and that wasn't great. And so just now we're just navigating it like every other public company is navigating it. And obviously with the AI noise, you're navigating a particularly challenging set of investor dynamics. Topics of isn't AI going to kill everything in the software industry, which is ludicrous. But there is a lot of unknown as to how this will evolve. And so for the moment, investors are like, I should invest in NVIDIA because they're building a lot of data centers.

Very few companies have got 20 times oversubscribed at IPO.

So we did have a very good IPO back to the market was very healthy at that time and we were a great offering and came out right where we thought we would on valuation and all that stuff. Company's performed very well since then and the market is not reacted where you would think a market would in those situations. So we just have to be patient.

Well, we did all the nice questions.

Okay. Oh, look, I'm almost out of time.

Let's get, let's get into the hard questions and the reason that, that all of us are here today, which all that other part was just fluff. This was all, this was all just to, you know, get you excited and get prepared for what we're getting into, which is talking about, you mentioned it already, but the AI arms race and How do you win as an incumbent?

Yes.

SailPoint just crossed a billion of ARR. Yep. You launched 5 major products at your conference, Navigate 2025. Yep. And one of them was an agent identity security product. All of those 5, by the way, booked orders within the first month, which is awesome to hear. But here's the tension. 80% of organizations are already using AI agents. Yet yet less than half of them have policies to, you know, secure any of those agents. How are you adapting SailPoint's architecture and your team's mindset to govern AI that can think on its own, that can reason on its own, rather than just managing static human credentials, something that you've been doing for quite a while now?

Yeah, boy, this is the question of the day, isn't it? Look, at the end of the day, agentic is like other forms of identity and it's not. Right, both/and. At one level you've got an identity. And by the way, we've had other relatively static non-human identities before this, bots, service accounts. There've been non-human identities for a while now. The non-agentic flavor of that was not getting a lot of attention till the last few years until they became part of the attack vector, right? Once the bad actors started to figure out if I can break into that bot or that service account or something else, I like to say unlike our employees or our humans who we've trained to raise their hand and go, oops, I think I clicked on a link, think in the fishing thing, you should make sure I didn't screw up. There is no analogy to that in the non-human world. Like, if you manage to compromise that non-human thing, that non-human identity, it doesn't know that it's been compromised. It just keeps doing whatever it's asked to do. And that was sort of true in this non-agentic world where most of those were deterministic, predictable kind of behaviors. Now you enter this agentic world, and of course, as we all see every week, the world of agentic keeps morphing and changing. And how, how intelligent are these things? How autonomous are they? Well, in fact spawn and morph and create new subagents, all these things. I mean, I tell people, you want to freak out a security person, you tell them that a superagent can spawn subagents and you may not even know that happened. Like, how do I protect against that? And so we're rapidly seeing that there's a set of common capabilities. Like, you need to understand what this identity is, what its purpose is. We call that a role for humans, RBAC, role-based access. Is it still valid? Whatever it was set up to do, still meaningful? And then you watch what it does and theoretically report when you see anomalies. That's kind of how it worked for humans. Those kinds of things are going to be fairly true of non-humans, except some of it's going to happen at machine speed, which is wildly different. You know, a human can only hit so many keystrokes in a short time. An agent can do millions of things a second, like all computer things. So we're going to have a lot of different speed and adaptability challenges. And then that point you raised, Sid, of this idea of intelligent, you know, autonomous agents that can morph and change and they're mission-driven, to use an old phrase, right? Like I am being told to solve a problem, I will do whatever I need to do that I have access to to solve that problem. And what we're seeing, and I don't, some of these stories haven't hit out loud much, but we've heard some scary stories like customers who said, well, we set up this agent and it thought it needed a piece of data, so it tried to get to that data and it couldn't. So it found another little agent in the system and said, hey little agent, Can you get me into that system? It said, no, I can't. No, I can't. No, I can't. And it kept pounding on the little agent. This sounds like a children's story, I know, but it's really happened. It kept pounding on the little agent to say, do it. And it finally said, okay. And it went through and found the source code to that application and found a backdoor. And I mean, these stories blow your mind. Like when you tell these things to go accomplish a mission, they're gonna accomplish it. And they won't necessarily have morals or ethics as to how they do that. And all of a sudden you're like, oh my goodness, what am I going to do to protect against this stuff? So I think when we talk about the, the world of AI and how enterprises are adopting AI, there's probably never been a technology with more promise. I think we would all say that. And there's two big resistance. One is this, where there's a clearly understood risk profile that's not well managed yet. And the other is all the people who are like, so you want me to implement this technology that's going to put me out of a job? I'm not going to move too fast on that. So you got two real slowdowns, I think, happening, but they're going to get overcome. And we're going to see this stuff come like a freight train, I think, through the rest of this year. So at SailPoint, we are hyper-focused on what are the similarities, to your point, Sid, that we've seen about identity, what is unique and new and different about that. We're hiring lots of really smart people who have come from that world already and trying to blend that into a comprehensive view of how do you manage the entire identity ecosystem? Human and non-human agentic, and protect your data. At the end of the day, that's what we're trying to do is protect the data. And that's where we're focused.

You just said that machine identities already outnumber the number of human identities in most enterprises. And you also stated that the static policies that the identity governance has used to rely on for decades are not scaling. So what does that mean in your context? Does it mean that the very foundation on which SailPoint has built this technology was built for solving the wrong problem? Or does it mean that indeed that foundation is what enables you to expand and cover the new use cases that have been—

That's a very great question. And that's probably the heart of this incumbency question, isn't it? We do think that deep, rich understanding of identities through entitlements, getting to data is still foundational. The difference is, you said it was generally thought of as a static situation where you set it up and watched it and it didn't change until there was a reason for it to change. The person changed, jobs, the IT environment or application environment changed, now I have to rejigger, right? Well, I think what we're going to see is all that stuff happening now, not in days, weeks, months, but in seconds and minutes and sub-seconds. And the idea of ephemeral agents, right, where an agent is literally created to do something and disappears again, that's a completely new, you know, you didn't have employees who worked for 2 seconds at your company and left, right? That was not a thing. So we're going to have some new concepts are new challenges, I should say. Many of them are speed related. And obviously we've seen that coming. So we've been doing a lot to invest in how do you do these kinds of things, but at a, like, literally orders of magnitude faster than you could do them before in a dynamic environment. The other thing I think that's going to continue to change about this environment is what we always just call the context. Like there was sort of an assumed context a lot of times in human access, right? You're at your desk and you're on the computer system in the office and you're going to this application. And then that shifted to, as we said before, a mobile cloud context. Now you're gonna have not just the where are you and what device are you on, but this wonderful new word we're hearing a lot about, intent. What are you actually trying to do? And can you understand enough about what the intent of this agent or identity is and therefore keep it within the guardrails of its intent? That is some brand new technology, just to be really clear. And so we're all figuring out how do you define policies that kind of, you know, guardrail intent? How do you look for signals that the intent is being compromised? There's some really hard computer science here and I'm about to get outta my depth quickly on talking about this, but that's the kind of things we're having to wrestle with. And those are the things that our customers are telling us, those are the things we're gonna need to protect. So that's the part that's gonna morph continually as we keep going.

So Mark, now SailPoint is a large company. It was once a startup. Startup.

Yeah.

And you think about how you have a nice grip on the market. You have a large number of customers. You have loyalty built in there over the years. And on the flip side, there are a bunch of new startups. I mean, if you walk around the halls, RSA, I think AI, agentic identity are the three sort of—

Everybody is buzzword compliant.

Yeah.

They're all saying the right buzzwords.

So now you have this, I would call it attack vector of a different kind. Yep. You have startups that are coming after your market. And you have to obviously protect your turf. You obviously have to deliver the growth numbers that your investors care about, et cetera. So help our audience and entrepreneurs understand, how do you think about startups? How do you think about innovation? Is it a partnership strategy? Is it a head-to-head combat strategy? How do you play that game?

Both and. Gosh, I keep saying that, don't I? At the end of the day, it is both and, meaning we look at some of the emerging things happening.. And sometimes we look at those through the lens of, could that advance in the direction we know we need to go, but we'd have to go build it? The classic build-by thing. We know we need to move in that direction. Oh look, here's this young technology company that seems to have made some progress down that path already. That's where we get into potentially M&A conversations. And I think a lot of times you see larger companies, I guess we're mid, we're like a teenager. I like to say we're not small, we're not old, we're sort of middle. You know, you look at this stage of a company's evolution and often these are the things they're talking about is, should I I, you would've used to have said months, maybe it's weeks now with AI, but do I take some amount of time to go build something or can I advance my cause? And by the way, you all know this, you're not just buying the tech, you're buying the knowledge behind the team that built that tech, who you think can continue to advance that, right? On the other side, you definitely have some people that say, I'm going to, you know, disrupt SailPoint with a newer, better SailPoint. Here's where I think there is a little bit of miss in the industry today. There's folks coming out saying, I'm just gonna master the agentic world. And we're like, look, the agentic world will always operate under the direction of humans. This human is asking that particular agent to do something, or in some cases maybe it's policy, like the underwriting department in the insurance firm says we've created a series of agents to go make underwriting better and faster. So no one human drove it, but humans built that plan, that policy. That— so the idea that you're going to manage it set of agents without the context of all the controls that we've always had around what can identities do with data, I think is a misunderstanding that somehow magically you can do that just in the agentic world without understanding all the things it took to build policies that knew how to protect data for the right reasons at the right time. I think that's where the world's going to get a little bit of a wake-up call, we think. So we think we're going to head with our current franchise of knowledge in that direction. Additively, not displacing it. And we may do some of that by grabbing some of these early stage tech companies that have advanced that part of the solution. But we don't think they can ever win the whole game with just that. And their ability to grow back toward what we've done for 20 years in human is very hard. That is a very big lift.

This might be music to a lot of founders' ears, but to help them, help our founders understand what are some ways they can partner with a company like SailPoint? What are some techniques or strategies that you might have used so far?

Well, usually I try to say there's a park bench and if you want to drop a bag of cash, no, I'm kidding. That is not how it works. We're not Russian spies or anything like that. No, what we do, our corp dev and M&A strategy team is actually out very actively surveying the landscape at all times. We have folks here today and they are, if you're one of the startup companies, we're probably trying to figure out who you are, where you fit in the universe, and is that something that we should look at? And by the way, our friends at Thoma Bravo do that all day, every day. Are constantly, if you work in a small security company, somebody at Toma Bravo has probably called you.

They might know more about the founder themselves about that.

100 times, yes, that. So I mean, we're constantly in kind of, you know, scanning the landscape mode, right? And so I think a lot of it is, you know, you said it, Mahindra, sometimes people come at you combatively. I'm going to beat you at your own game. Other people say, look, I know I can't beat you at your own game, but I think I could help you in this way. That's obviously a better approach. Sometimes though, people say, I'm going to try to challenge you. And then you go, well, okay, you're challenging me now. I got to decide what to do about that. I would say today we aren't seeing— and literally we've been scanning very, very diligently— we haven't seen anything that makes us go, oh no, they've just figured out how to break the code and do what we do way better and faster. You know, part of the misnomer about startups, and I believe this when I was one too, you know, well, we're just smarter and faster and we're going to do it better. Well, that's when you were fighting against dinosaurs, frankly, that weren't innovating. And we're still a highly innovative company, and so we're not sitting on our laurels thinking we just don't have to do anything new and different. We're constantly looking for how the tech can be used to advance our cause. So there is a sense of we're looking for some very advanced folks pushing the boundaries on certain things while we ourselves have been trying to do most of that as well. And sometimes you say, wow, that's interesting, but that's kind of what we're already working on inside the company. You just don't know it yet. Or wow, that is a new and different approach than we had seen, and that's smart and that could advance the cause. So I think we're constantly looking at that range of players. Which you guys know this, in the identity landscape, there's a lot of noise about convergence and overlap and the world's gotten pretty confusing. But I think we still feel like where we're starting from in this kind of deep identity governance and admin heritage, I think we know kind of the things that we think would help us advance toward a really robust agentic AI future. We're building an awful lot there. We're not sitting on the sidelines, but on the other hand, we're for sure looking at ways to kind of move that faster. And sometimes these companies will help.

A lot has happened in the world of identity, but I'm sure, and certainly, you know, with all the new aspect of, you know, new technology that's come out with AI and AI agents, how are you thinking about using some of these tools internally? I mean, obviously we saw Block announced that they're reducing headcount by 40% and, you know, using agents to go and supplement a bunch of work. How do you think about where do we enhance our current employee AI, and, you know, make them significantly more efficient in their work? And where has AI disappointed you internally?

Well, not a lot of the latter yet, but I'd say we're kind of in the middle. I think as a security vendor, I would imagine you talk to some of the large ones here, we would share this. A lot of us are leaning in, like a lot of companies are, heavily on engineering. Like, how do I build faster, better, cheaper, all those things, right? And, and I— we're leaning in very heavily on that. Everything from, you know, Copilot and Cursor and Cloud Code and you, you name it, you know, we've got that stuff going on. And I don't think there's almost any tech company that's worth paying attention to that isn't leaning in heavily on these technologies. I think it's sort of when you get outside of the core engineering function, and I'd say not just engineering, by the way, I think, I think the world of product management's changing pretty dramatically too. Like how do you decide what requirements are important? How do you vet those quickly with some iterative cycles with customers? How do you know who to listen to? How do you to get early demo pilot wireframes in front of customers to test out what you think they're looking for, all that stuff. When you get outside of engineering and product, I think it varies quite a bit depending on the kind of company you are. We're a heavy enterprise selling company. No offense, not in my lifetime are you replacing super sophisticated sellers to call on Fortune 100 companies. That, those guys aren't gonna be talking to AI agents to spend millions of dollars on software. That's crazy. The early parts of that selling cycle though, kind of the DSR world, the digital sellers and the folks looking for pipeline growth and all that. Oh yeah, that's a heavy investment in, in technology right now. Marketing tools to do better fit intent mapping, get better understanding of that customer's environment. How do you prepare for, for an engagement with that customer? That's heavy. We're using it in HR, as you might imagine, to make sure we don't accidentally hire North Koreans. No offense, right? So like, there's all kinds of places. And even in G&A, that's probably one of the least heavy places right now, but we're looking for opportunities there.

There.

But I think, you know, we, we see it like every company does. I think particularly tech companies as a way to advance and accelerate. Probably not a cost-cutting thing. I, you know, I don't— I can't speak to what Dorsey did there at Block, although Elon came into his other company and cut half the company too. Maybe they just build companies with too many people, but I don't know. But I think there's a sense of— a lot of tech companies I think are finding to figure out how to maybe not so much take cost out as accelerate innovation. Efficiency, not necessarily do the same thing with less people. How about same people do more, right? And I think that's how a lot of us are thinking. I don't know quite what to make of, uh, you know, in the security conference, but, you know, Mr. McDermott at ServiceNow said we're going to grow revenues whatever, 20% compounded, keep our profits in the 40% range, and not hire anybody. I'm like, feels hard. That's, that's amazing. I want to check back on you in a couple years and see if that came true. But we'll see. But I think, yeah, there's some bold things being said about what we can do there. I think we're just trying to be kind of aggressively pragmatic. We want to move aggressively. We don't want to move so rapidly that we do something stupid and expose ourselves.

Nothing has disappointed you in terms of some of this tooling. I mean, one of the things I've noticed is that in this world where everyone is saying AI efficiency is going to, you know, save us all a bunch of time, at least here in the Valley, it feels like everyone's working overtime trying to figure out how to use Claude, Cowork, and some of these other tools.

I don't know how many again, Poked Mahindra and I with our white hair here, you know, I remember the claims of the 4-hour workweek because all this amazing automation technology, we were only going to be working 4 hours a week and then I'm still waiting for those days. Me too. Yeah, we seem to always as humans find more to do.

Yeah.

Not just hang out and do less. So I, I think what AI is going to do is it's going to accelerate a lot of things and we're going to find many other things to do. But I think we're all going to see some serious productivity gains and a lot of knowledge work, to use that term. But I don't think I believe we're going to find that everybody's like, oh great, now I can work you know, 28 hours a week, that'll be awesome.

I—

the world keeps creating new problems for us to go work on. So I'm not, you know, I think maybe the folks at the DMV are hoping to work less hours, but most folks, that isn't their goal, right? So I think we're trying to figure out how do we, how do we do more with this technology faster, better? You know, you used to be in product, you always had this three-way trade-off between function, speed, and quality. Absolutely. Those were intention. Now, ideally with AI, you can move faster better, with higher quality, cheaper. Like that's never happened before, right? And so we're going to have to see if we can make that happen.

Where do startups have a legitimate edge over SailPoint today? Like if you were a 30-year-old founder walking on the floors of RSA.

You're asking me how would I beat myself, which is always fun.

Yes, exactly. What can the startups, you know, if you're a seed stage founder, what can you build that SailPoint cannot do today?

You should invest heavily in COBOL developers. That's what you should do. Um, uh, by the way, you might want to emphasize what COBOL stands for.

Yeah, never mind.

If you don't know what COBOL means, you should look it up on AI. But no, I think realistically the advantage they have is they don't have baggage, and that's just the right term, right? They, they don't have the 'but this is the way we've done it,' because most of those startups are going to be populated with younger, highly innovative people who've been learning on these tools for the last 5 or 6 years. That's just different than developers who've been doing it for 25 years and they had to learn Agile, they had to learn a bunch of new things in the last 10 or 20 years. But on the other hand, what I think is wildly undervalued today, and where I think we're gonna start talking a lot more about it, is what I call domain knowledge, right? Like you can't take an AI tool, point it at our company, get it to say, show me how to beat SailPoint, and then actually go build that company. It'll show you a bunch of words on a screen of things you could do, and then you may or may not have the context to know what the hell that means. I like to flip it around the other way. Like, I can't use AI to say, help me beat Workday. Like, I don't know crap about the HCM marketplace. I don't know how those people think, what they buy, why they buy it. And you can't replace that domain knowledge. I like to, if I really wanna challenge people, like, are you ready to fire your doctor and just do it all yourself with AI?

No.

No, of course you're not, right? Like, I'm gonna fix my own health. I don't understand chemistry. That would be a bad idea. So like, there's a whole thing there of domain knowledge really does matter. So I think the people that are gonna do well, this is where the advantage a startup has is they're fast moving and they're kind of coming at it with an up, we've used this term, born in AI, AI native, whatever you wanna call it. But what they don't have is the experience of working with big organizations and how these things actually work in real life. And the difference between theory and reality of how companies actually do some of these things. So I think what we're gonna find is domain knowledge coupled with aggressive innovation is gonna be the guys that win. And so the two guys that lose are either the guys that only have aggressive innovation that don't understand the problem, or the guys with domain knowledge that aren't aggressive about adopting the technology. So if you're in my chair, you better aggressively adopt the technology, and that's what we're doing. You know, the guys that are in trouble are saying, you know, I don't think this stuff's real. We're not gonna spend time on it. On it, no chance. So the startups, the advantage they have is no baggage, and the disadvantage they have is no domain knowledge.

So you're not giving the founders any specific ideas, are you?

I'm not generally a fan of here's a gun, please shoot me with it, right? That's generally not my, my general approach. But, but no, I think like founders, they should— somebody said this, and I think this is true— you kind of think around the edges. This is your question, Andrew. If you want to come straight at the heart of a big player today, That may be a fool's errand, a little Quixote-ish, right? But on the other hand, if you look at where a, where a company's got a nice franchise, but there's all kinds of stuff around that that is a need that's unmet today, that's where I think you could surround it and say, and look, ultimately we're all worried about being disrupted, completely disrupted. I get it. But, but I think in the long run, if you're paying a lot of attention, your best bet as a startup today is probably for betting on the odds. Go build something that helps supplant and supplement one of those guys and you could find yourself in a great M&A situation. That's what we did the first time, right? It's harder to take on a massive strong player head on early on. You might say, I'm gonna start here, maybe I'll grow in toward that if I don't get bought. But you know, there's a lot of folks that think they're gonna go, who was the company that was making all the noise about disrupting Salesforce? And then a couple people tried it, went oops. I mean, Salesforce has their issues, but like, you know, that's a big franchise after all these years. That's a little tough to go straight at them. That franchise.

I think many, many founders who have reached the scale that you have often talk about this, that do not underestimate the challenges that you have when you are entering a mature market.

Yes.

And secondly, empathize with the buyer. The CISO has to deal with, you know, they're not getting up every morning saying, what a beautiful sunny day, let's go and go shopping for Agentic AI. That's the last thing on their minds. Right? So I feel like when you look at the startups that are trying to enter the new markets, obviously that's a great point that new markets are much more accepting as opposed to mature markets. You know, the lights are starting to flash up here, Mark. So as we wrap up this session, two questions. One is, you've been in this industry for well over 250 years. Yes. You know, your hair was probably as black as mine when we started our careers. Let's just, you know, you have all the lines in the right place. You've been smiling for too long. That's a good point.

Okay. That's enough on the whole thing. I'm with you. Go, I got you.

So how have your belief systems evolved when you started your career and where you are today? What are something that you believe over cybersecurity looking into the future?

Well, there's a lot of talk today about platforms, right? Notably here, we talk a lot about Palo Alto Networks and CrowdStrike as massive potential security platforms. And I think having lived not my whole career, but a lot of it in security, you will always feel this tension in the large-scale enterprise that's a little a little different than SMB. The whole move toward consolidation, fewer vendors, more under one roof, every procurement person in the world wants that. And many technical buyers want it. But what happens is you move up the scale of complexity in enterprises, they will make a trade against a single vendor approach to what I really need to solve the problem. And that in security, that's part of the reason we have such a fragmented security industry. It's a bunch of very specific, complex problems. And you know, it's difficult to, as the world keeps evolving and changing, keep being one player who can plug all those holes. I mean, our friend Nikesh is trying to do it by buying a bunch of stuff. We'll see how well that actually stitches together into a true platform. And our friend George is mostly building it. But again, they had a core center of gravity and they've extended some beyond that, but not a ton yet, truthfully, right? So I mean, it's just, it's difficult. So I think what I believe today, even stronger, I don't know if it's a change, Sandra, is like, this market will always have a level of fragmentation to it because there's probably nothing that's evolved evolving faster. Like, how do you make a product in manufacturing certainly evolves. How do you fight security threats keeps evolving because the, the actors keep evolving as to how they threaten you. So you have to just be completely, you know, evolutionary there. And I think that's just a reality of the security landscape. So I would say the platform pull will always be there from the buyers, but in the enterprise— and again, I can't speak to SMB, it's not my space— but in the enterprise buyers, that tension will always be up against, but I really need to solve problem. And so I would tell my younger self, go find a specific unsolved or undersolved problem. This is my advice to the startup guys. Go find something that you hear from customers they are frustrated with either the current offerings or there's just no offering. Go solve that problem and you'll find a market.

I think that's all the time we have today. Please join me in thanking Mark sharing his wisdom.

Thank you, Mark.

Thanks, guys. Pleasure. Thank you all for coming.

Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email. Or LinkedIn.