SailPoint acquisition deal shows identity security market is on fire

With its agreement to be acquired by private equity firm Thoma Bravo for $6.9 billion, SailPoint will gain the chance to “potentially go faster and even more aggressively” in its expansion within the enterprise identity security space — potentially through M&A activity of its own, CEO Mark McClain told VentureBeat.

The deal comes as research firm MarketsandMarkets forecasts that spending on identity and access management (IAM) will surge to $25.6 billion by 2027, up from an expected $13.4 billion this year.

In an interview Monday, McClain said that the planned acquisition by Thoma Bravo could enable SailPoint to do more around acquiring other vendors, as well as accelerate its in-house development of new capabilities. “They do see … both organic and inorganic” growth opportunities, he said.

“We have places where we know we can build and develop additional capabilities, and launch products or extend our product offerings,” McClain said. “But we also see opportunities around us to potentially accelerate some of our vision through potential acquisition.”

While SailPoint has made “small” acquisitions in the last few years, “potentially now we can do those at either greater speed or greater scale. And that’s part of the attraction,” he said. “The speed and the scale at which we can do some of that, as a mid-cap company, is different than when we have a parent with a very deep checkbook.”

Ultimately, “I think their view of SailPoint is as a core platform that’s of interest to the enterprise — a security platform that they can build other things around, to establish an even more strategic relationship with the customer,” McClain said.

SailPoint’s platform focuses on managing the access that individuals — both employees and contractors — are provided with to the core systems used by the business. Today, however, workers are increasingly accessing cloud environments and software-as-a-service (SaaS) applications, which aren’t necessarily managed by the company, McClain noted.

And businesses now have to worry about more than just human identities, as machine identities now must be secured, as well, he said. A study commissioned by One Identity suggests that nearly all organizations — 95% — report challenges in digital identity management.

The broad reach of identity today is “just incredibly difficult for companies to keep their arms around,” McClain said. “That’s the opportunity for us. It’s all the identities — and increasingly, the non-human identities — accessing [more than] just their traditional core systems.”

More freedom

By going private, SailPoint “gets an influx of cash, and also some more potential freedom to innovate,” said Henrique Teixeira, senior research director at Gartner, in an email.

And this ability to expand its capabilities will be critical, given that identity security technologies are increasingly converging, Teixeira said.

IAM offerings that provide converged capabilities are growing in popularity because they deliver a greater range of solutions on one platform, along with easier adoption, he said.

In this vein, it’s notable that Thoma Bravo also backs other identity security companies, Teixeira said. “SailPoint going private could give them more freedom to work on an alliance that converges IGA (identity governance and administration) and privileged access management (PAM), for example,” he said.

Thoma Bravo is also highly familiar with SailPoint, given that the private equity firm was the majority investor in the vendor prior to its initial public offering in 2017.

In addition to the greater financial resources, the acquisition of SailPoint by Thoma Bravo also does “potentially free them up” by reducing some of the requirements that publicly traded companies have, said Merritt Maxim, a vice president and research director at Forrester.

This could equate to making more acquisitions, or to investing more heavily in product development, without worrying about the scrutiny of the public markets, Maxim said.

Notably, the price tag for the acquisition — which is slated to close in the second half of the year — represents a nearly 32% premium over SailPoint’s closing stock price on Friday. It’s also 48% above the company’s 90-day volume-weighted average price, according to SailPoint.

Thoma Bravo “certainly did offer a pretty big premium on the share price,” Maxim said. “So they clearly see value and upside in SailPoint … This was not a fire sale — this was a strategic sale.”

Hot market

This premium is another indicator of the sizable opportunity ahead in the identity security market, where SailPoint is among the most-established players. McClain, who cofounded the company in 2005, says that recent decades have seen companies view security “through the lens of data, through the lens of the network, through the lens of the endpoint.”

“There’ve been big businesses built around those various ways of looking at [security in] the enterprise,” McClain said. “But really, the concept of security through the lens of identity is a fairly new concept. Businesses haven’t really been focused there before.”

However, the move away from the corporate network, and into wide usage of cloud-based systems — accelerated by the pandemic and working from home — has forced businesses to begin focusing more on identity, he said.

While businesses may no longer control the network, they do have an opportunity to control identity, McClain said.

“We know who the people or the things are that are supposed to be touching our systems and data,” he said. “And that’s a new galvanizing concept that really hasn’t been in place.”

Indeed, Teixeira said that the concept of “identity-first security” is going to be very crucial going forward, as it places identity in the center of how a business designs its security architecture.

And given that network-based approaches no longer suffice, he said, “the importance of identity-first security is growing.”