Good morning. I'm Robbie Owens with Piper Sandler. I co-head our tech research and I manage our security and infrastructure software practice. Really pleased to be speaking with SailPoint this morning, both Brian and Matt, who are in finance and sales roles, leadership roles at the company. As we were just discussing before we walked on stage, a nice early morning yesterday with earnings and early by Nashville standards. Maybe just, Brian, a quick recap of highlights of what came out in Q2.
Sure. I mean, we were really pleased with the quarter in general, 28% year-over-year ARR growth. We had strong margins, 20% margins, 33% revenue growth. We actually had record free cash flow as a company for the quarter. Really durable growth drivers. Best new SaaS logo ARR quarter ever as a company. Really pleased with that, with a net revenue retention rate of 114%. A nice balance between new logo acquisition and expansion within our existing customer base. We're also landing larger. We saw a 30% year-over-year increase in the size of the net new SaaS ARR that we landed as a company. We're really, really pleased with the quarter on a multitude of fronts, beat on all guided metrics.
I've got the question from investors just around guidance because you beat by a lot. You didn't raise the back half by as much as you beat. Kind of your guidance philosophy, if there's something different that investors should interpret here.
I wouldn't read too much into it other than, you know, it's prudency, and we want to be consistent and deliver on what we can deliver upon and what we say. I think we feel really good heading into the second half of the year.
You did note that there's about $7 million in federal business that renewed in the quarter, that you're more conservative as you were forecasting. Not only did that revenue pull out of Q3 into Q2, but then margins came along with it.
That's right. Exactly. Heading into our fiscal Q2 and Q3, we have to make a judgment call in terms of U.S. federal government renewals. As you know, U.S. federal government year-end is September 30th. That falls within our Q3. We didn't want to make the assumption in terms of our guidance that we were going to close all 100% of our federal renewals. The positive thing is we did. We closed 100% of our federal renewal business. That's term-based renewals. Did not impact ARR. It was already sitting in ARR. It did have the revenue impact in Q2 of about $7 million that we were estimating was going to close in fiscal Q3. We adjusted that in terms of our guidance, in terms of revenue, and also adjusted operating income for Q3.
Given all the noise that we've seen around the federal vertical over the last six months, were you surprised to renew them kind of at the contract value?
I think we were pleased with the efforts of our renewals team. Most importantly, you really have to get ahead of these things. You can't just wait until the last week. It's a process that goes along several months in advance. We were pleased that we were able to close them on time.
The federal from an overall percentage, and just is, so our public sector business.
Public sectors, yeah.
Is about 12% to 14% of our total company revenue. Our U.S. federal is less than half of that number.
Right.
As we think about the federal opportunity going forward, obviously there's a lot of opportunity, but there's still change going on within the U.S. federal government. Maybe you could articulate just where you think that vertical is, Matt.
Yeah, look, to be fair, we've been relatively conservative, right? We haven't seen anything in our business that would indicate that there's softening or anything's being delayed. We're encouraged. I think the other thing is, you know, now we are FedRAMP certified. Pretty much all of our customers over there in the U.S. federal government public sector are using our software product. Now we're going through the process of starting the process of migrating them to our SaaS solution. From our perspective, a lot of interesting upside. You know, we're kind of, I don't know if I can say we're post-DOGE, right? I mean, a lot of the big cuts have taken place. From our vantage point now, there's an opportunity for consolidation and re-energizing some of these projects that might yield some new opportunities. We continue to remain positive about the Fed space.
I think one of the interesting characteristics of the quarter was landing larger, right? There's a lot of different things at play. You've gone through the model transition, having gone private and back to public at this point. Going in, I think SailPoint was always seen as a very lumpy, big deal company. Now your deals are getting bigger, but it feels like some of that lumpiness has gone away. Maybe you can just speak overall to the environment, what you're seeing. 28% ARR growth makes you the fastest growing security company in Q2. Congratulations on that.
Thanks.
Maybe talk about the environment overall and what you're seeing. Then we can maybe delve into this agentic topic that I'm sure you guys are getting a few questions on.
Yeah, look, you know, Rob, I don't know that the big deal landscape's changed, right? You're doing big deals, you're probably doing them with bigger companies. The bigger companies are pretty sophisticated buyers, and they're going to always take you down to the 11th hour, right? They just are. I think one of the things that's complicated that closing process now, and it's not, you and I might have talked about this the other day, it's not necessarily the last 30 days, although that's where it shows up. You've got all the complexities of the environment we're in, right? Virtually every one of these contracts now has an AI addendum to it. You've got the DPA, which is a security component questionnaire. Then you've got people with a red team that bring in their own specific set of requirements.
You've got all the potential things if you're doing a deal outside of the United States, especially regulatory, privacy. All of these things in and of themselves kind of make that last closing piece a little bit more complicated, a little bit more elongated. I would tell you that it's built into, it's not a one-quarter deal. It's built into the process thus far. We're not seeing anything creative that's causing lumpiness, right? I think the other thing for us is we're getting bigger, right? When you're bigger now, you've got broader scale. We're probably creeping a little bit further down market, right? Those deals are a little bit less complex, a little bit easier to get through, giving us a little bit better balance relative to the overall quarterly posture.
Sure. Brian, from your perspective, what about forecastability in the model? It was an issue historically under the prior CFOs. Since I took you public the first time around, I lived through that with you guys. Where do you think the company's at now versus where it was? What's your crystal ball?
Sure. I wish I had a crystal ball, but I'll do my best.
No, but in all seriousness, over the last several quarters, even during the IPO roadshow and before that and during, we've been seeing this really nice balance between new customer acquisition and expansion within our existing customer base. We talk about the 28% year-over-year growth. A little bit more than half of that came from new customer acquisition and new logo growth, and the other half roughly came from expansion within our existing install base. What's nice is that we see a nice dispersion among many different growth vectors within the expansion story. We see anything from more upsell opportunities, more identities, cross-sell opportunities with new modules that we've introduced over the last year, especially around the non-employee risk management, Machine Identity Security, Data Access Security. We also see suite upgrades. These are basically customers that are on our SaaS platform upgrading from one level of suite to the other.
Typically, that carries a 25% price uplift to that. We also are, and it's still relatively early stages, migration and platform modernization within our existing install base. Those customers that are with our on-prem solution called IIQ wanting to upgrade to our Identity Security Cloud platform. That's our SaaS-based solution, and with that, we typically see a 2 to 3x uplift on the annual ARR spend that they're spending with us today. They'll trade in basically their annual support contracts, get into a brand net new SaaS arrangement with us, multi-year arrangement. We'll see a 2 to 3x uplift on their ARR spend. All of that factors into the 114% net revenue retention.
Therefore, what we really like in terms of back to your crystal ball question, if we can keep this kind of combination of new customer acquisition, a lot of greenfield opportunities, but then expansion within our existing install base. What we're really excited about, and which we can touch on a little bit more, is the depth and breadth of our product offerings, especially that are coming out at Navigate, which is our customer conference in another couple of weeks. Two weeks, yeah. We'll see you there.
Yeah.
Matt, you were brought in before to disrupt that install base.
Right.
Having come out of Oracle, who was sunsetting a lot of the technologies, in the go private period, you re-platformed common code base, common data architecture, and now you have these tiers in SaaS that have effectively allowed you to sell differently. Maybe you can talk about how many different arrows you have in your quiver as a result, because you truly have become a platform with a tiering capability and add-on modules, some of these emerging solutions. Just how has that changed go-to-market and customer receptivity?
Yeah, I mean, look, I think one of the things that's happened over the last few years that shows up in the NRR is, you know, it's a selling motion, right? Selling into that install base is a muscle that you got to learn. It goes along with, you know, we like to say SaaS is a team sport, right? You can get all the new logos you want, but if you can't keep them, right, and you can't drive GRR, right, you're not going to get NRR. I think one of the things we benefit from is we have a customer base that likes us and wants to buy more from us. I think if just being honest, you look back, you know, we've not had a ton of new stuff, right, to go sell. I think that's changing.
I think the environment's, you know, given us a really good platform to bring these new things to market. I think that's pretty significant. I think the other thing I would tell you, Rob, is, look, I think probably the most difficult buck to bring into a company is a direct sales dollar. That's a hard dollar. I think as companies start to grow and they're trying to drive, sustain, grow, you got to get to these other, you know, avenues of new money, right? You saw us roll out this MSP platform last year. I think today we've got about 14 new MSPs we've added. The thing that's interesting about it is it's outside of our target account list and it's outside of our field sales, right? We're selling independent of them. It's really our first foray into resale, right? It's early, right?
Now that we've got 14 of them out there, I think, you know, we're hopeful of having 15 to 20 by the end of the year. This is a new avenue for us to be able to gather, you know, incremental extension of our reach, right? Those kind of things I think are helpful. As Brian said, in a couple of weeks at Navigate, I think we're going to probably have, for those of you who don't know, Navigate is usually where we launch new things, new products. I think we're going to have the biggest Navigate in the history of our company here in a couple of weeks.
We'll be announcing things like Agentic AI, which I think everybody's, you know, interested in, observability, threat intelligence, you know, just a lot of new things that I think are going to, for our install base, but also our, you know, potentially prospective new customers.
Excellent. Before we pivot to Agentic and Navigate, one final question just in terms of before and after implementation. How has it changed? I mean, the world seems to be getting more complex, not less. Yeah, are you able to reduce implementation times? Because one of the big knocks, of course, your competitors would say is SailPoint never gets implemented. That's why we don't look at SailPoint into the future as a competitor, which we vehemently disagree with relative to Agentic. Just relative to that implementation, I know you have customer care teams and you guys have done a great job from that perspective.
Yeah, look, I think this. I think IGA in general carries a legacy much like the old ERP, overpromised, under-delivered. I think, you know, when we go in and sit down, I myself in particular, I sit down with executives, that's the first thing they hit on, the cost and the complexity of getting these things delivered. One of the things that we try to drive home now is that this is not a project any longer. This is a program. This is really not going to end with the acceleration of the threat landscape, you know, just the normal keeping up with joiner, mover, leaver. You know, it's not going to end. I think that's a big part of it. We've also taken on some of this ourselves, understanding we think we're innovating quite a bit and you're going to see it.
We're innovating in terms of putting instrumentation so that people can deploy this much more accelerated and much more affordable. Case in point, you saw us announce what we call SailPoint Accelerated Application Management. We were kind of going down this path already, had a lot of it developed, but we had an opportunity to poke at this little company called Saviy. I think you should look at it as a tech, you know, I'll say tuck in. They've got some really, really neat technology that is going to make our Accelerated Application Management program even that much better. I think that right there is going to, you know, I hear some of our competitors talk about 30 days, you know, we can have it up and running from an application perspective. We think it's hours, not days, not 30 days, not a month.
We're excited to be able to get that to market and show, you know, the community of the market, you know, what we're doing with that. That in and of itself is going to take a lot of time, if you will, you know, out of the implementation. Now in a matter of hours, you can see your entire application landscape. We'll classify it and we'll actually prioritize it for you. We'll be able to say, look, here's your top risk areas. You need to do something with these applications sooner than later. Here's the ones that need to be SOC compliant. That's hugely new for us. We think it's going to really accelerate, you know, some of the concern with us from an implementation perspective.
Machines, service accounts, Agentic. Maybe you hit on the new paradigms for growth within identity. As I look across those categories, one and the same, but all completely different, they get lumped together a little too much. Why does SailPoint have a right to win there?
Yeah, I'll just kind of start off with, you know, machines have been around for a long time. Service accounts have been around for a long time.
All of a sudden, we're paying attention to them.
Yeah, that's right. That's right. Because all of a sudden, they've shown up on the threat landscape. It's front and center. Now, with the posture management tools, like all the discovery and the classification stuff, companies are able to identify what machine identities are out there. I will tell you, after selling our machine solution for the last three quarters, I think one of the biggest things you understand is that most companies don't know how many machine identities they have. Probably the exception to that is service accounts, but they're not managed, right? If I told you some of the stories that CIOs and CISOs have told me about how they manage.
Can you explain a service account for some of the generalists real quick?
Yeah, I mean, a service account is basically, you know, you might have multiple of them, you know, administrative accounts for things like salesforce.com, Workday, right? The administrative component of it. They've been around a long time. At the end of the day, probably not that big a deal if you've got two or three apps. All of a sudden, if you have hundreds of apps, service accounts are, there's a lot of them. I mean, we got a customer too that's got 500,000 service accounts, right? You get into password rotation and trying to keep up with that. It's a nightmare. That kind of falls into this machine identity.
If you just took service accounts and you said that's one type of machine identity, and you looked at, you know, RPAs, you look at bots, you look at, you know, digital IoT, you got a ton of stuff to manage. The problem across the whole board is I got to be able to govern them. I got to be able to treat them like any other identity. That's the piece that's missing, right? With our Machine Identity Security solution, you're going to be able to discover, you'll be able to classify, you'll be able to assign ownership, and you'll be able to actually certify, right? You'll be able to manage it, the full lifecycle management. I think that's a big, big, it's a big problem solved, right, from a security perspective. Everybody's looking to how do you size this thing.
I think we get asked all the time about durability and, you know, you're going to run out of identities. Everybody's got their view of this. I like to recite one of them that I heard that actually makes me smile because it talks about the size. It starts off with something ridiculous, like there's 8.2 billion people in the world. You know, 4 billion of us are working, right? When you start talking, and those are humans. When you start looking at things like, you know, the digital or non-human, and you start playing with multiples, if you say, look, let's just use a 5x multiple, we're going to plop roughly 20 billion new identity types on corporate America. They're woefully unprepared to be able to handle it, you know, from a system perspective, not to mention from a policy perspective.
For us, and even if that's a magnitude off, there's a ton of new identities being brought into the marketplace. I don't think our success is going to be determined by the lack of opportunity. I think it's going to be determined by our ability to execute it. For anybody else that jumps into the arena. I'll touch, I'll go quick on Agentic.
Please, we've got time.
For those of you that might venture into Austin here at the end of September to our Navigate conference, that's our annual customer conference. It's typically where we make big announcements on product every year. We have a number of things we're bringing to market this year, but nothing with any more interest than Agentic AI. I'll try to do this in a manner that gives you a little bit of a perspective here. We look at agents in what we're going to call base agents, right? They'll look very similar to a machine, right? In accordance with that, it'll be priced very similar to a machine. When you look at how we price machines today, it's about a third of a workforce, right, human, right? We've been talking that.
I think we've been pressed as we've gone through the roadshow and everything else going public about how do you quantify this opportunity. That's where we've started. When you look at what we're going to announce and deliver at the end of this month, it starts with base Agentic or base agent. What you get with that is the ability to discover an agent, the ability to classify that agent, like in terms of agent type. This is where you start getting into the really important stuff. Be able to assign ownership. We believe every non-human's got to have a human agent, a human being assigned to it. You'll be able to assign that owner or owners, right? The last piece is you'll actually be able to certify. Now you're actually getting these agents into the governance process.
We don't think there's a ton of people that can do that today, right? I don't want to go so far as saying nobody, because then, but there's a short list of being able to discover, categorize, assign ownership, and then start to certify. That's what we'll deliver at the end of this month. The next step in this is advanced, right? You should think of the simplest way to explain it as the autonomous agents, right? Now you're getting into the data and the real hard security problem. We'll deliver that at the end of our fourth quarter, maybe the first of our first quarter, right, in that range. Now you're going to be able to pull data in, right? Think of data, you know, not necessarily just from our Data Access Security solution, but things like Sierra, Security AI, Big Idea. We will pull that data in.
You'll be able to add an identity context to it, right? You now start to have this fine-grained entitlement to understand permissions. Who has access to what? I think the other thing I would tell you is I don't think this is solved by any means. I think we're going to be step one, and I think there will be a step two and a step three when you start talking about these agents nesting, Rob, and then agents reporting to multiple humans with multiple sets of permissions. I think this is complex. We will have our first delivery on that at the end of this year, in the first quarter of next year. We're pretty excited about it. From a pricing perspective, we think that agent, that autonomous agent is, we'll call him a superhuman or get a superhuman.
We're going to price it in accordance with our workforce price, workforce identity, so it will be very similar to that. I think at the end of the day, as these things start to proliferate, the market is ultimately going to get to where it's going to get to as it values them. We'll be there for that.
Great. Any questions at this point? Go ahead, Ethan.
Yeah, look, we're actually seeing an uptick in the legacy market, legacy replacement. I'll say this. If you understand how we market, how we go to market, we're relatively focused in terms of who we market to. Virtually every new logo we chase, we're replacing something, right? A lot of times it's a combination of things, but we're replacing something. What we're looking at now is, you know, if you take the Gartner data, it says there's probably $2 billion to $2.5 billion of legacy, we call it maintenance, that's out there really available. We believe a lot of that's our business, and that's kind of how it's proven out. When you think about the opportunity for us, think of it like any other migration. It's, you know, based on what they're paying, it's a two to three uptick for us. It's a pretty nice chunk of new opportunity.
We think what's going on here in the market around machines and around Agentic is actually causing these companies to have to move quicker than maybe they have historically.
With respect to our install base, it's still relatively early days. We've migrated and upgraded probably a little more than 10%. We're modeling internally about 10% per year to migrate towards Identity Security Cloud. It is much more ahead of us than behind us in terms of that opportunity, and we still see that two to three X uplift on the annual spend.
Yep.
Good time for one more question. Maybe hit possibly on the data opportunity relative to what your customers are looking to do. Because if I look at Agentic AI, there is that governance of access to apps and there's that governance of access to data.
Yeah.
You have had a loose data play for years, but probably not as successful as you've wanted.
Yeah.
Where is SailPoint in the next 30 seconds? What are customers requiring from you at this point?
Yeah, look, I think this. I think data, if you're going to secure agents, then you're going to have to secure the data. Clearly, we've got a data play, but I think part of it is going to be what we can ingest and then what we can assign permissions to. The other piece of this I will tell you is you're going to see us talk about observability, right? To that end, we'll have a graph, an identity graph, and we'll have the ability to pull in data. These are customer requests. Customers that are, for instance, customers of CrowdStrike and us, they want that threat graph inter-commingled, if you will, with our identity graph. They want our identity data commingled in their graph, right? These are the kind of things that are going to allow them to get much closer to being able to have remediation, right?
Other than, you know, if you're a CrowdStrike cutting the wire. Now they're going to be able to actually, you know, get a little bit further ahead and get what we can actually pinpoint, you know, in session, if you will, remediation.
All right. That's all we have time for. Gentlemen, thank you.
Thank you, sir. Appreciate the opportunity.
Thank you. Thanks, Robbie.
Thanks, Brian. Thank you.