Ping and SailPoint: A Look at Thoma Bravo’s Identity Rollup
Thoma Bravo is a private equity company with ~$100 billion in AUM and a strong track record investing in software businesses according to a presentation given to the Pennsylvania State Employees' Retirement System in February.
The firm seems to be rolling up the identity space with the acquisition of SailPoint for $6.9 billion announced on April 11th followed by the acquisition of Ping Identity for $2.8 billion announced on August 3rd.
The Identity Industry
Identity and access management are critically important for enterprises. Think about who has access to what servers, mainframes, databases, and applications: which employees should have access to these resources, and what happens if that employee is fired or leaves the company?
Now imagine a world where this access problem is multiplied across the thousands of SaaS applications used by modern enterprises as well as their entire cloud infrastructure.
Then, widen this perimeter to include outside vendors, partners, consultants, and finally, customers.
Managing all this is a complex problem and the industry believes its total addressable market is in the tens of billions of dollars.
As is typically the case in the tech industry, solutions were created for these problems decades ago and now represent a large installed base of on premise business. Newcomers have sprung up over the years to attempt to replace these technologies with more modern iterations, or to complement them with hybrid or cloud-native solutions.
With the advent of the internet, the problem of identity and access management became even more critical since everything is connected and subject to attack by hackers and phishers. This has given rise to multi-factor authentication, passwordless authentication, the use of machine learning to verify users, and other ideas.
In many cases, the vendors of these systems must integrate and collaborate with each other because customers often deploy a variety of solutions across their IT systems.
SailPoint
SailPoint and Thoma Bravo go way back. In August 2014—exactly eight years ago—Thoma Bravo formed a holding company to acquire SailPoint, which had been created in July 2004.
SailPoint’s founder Mark McClain still leads the company. The company offers both cloud-native and on-premises solutions. It has recently completed the shift from selling perpetual licenses of software to subscription SaaS. The company’s 2021 analyst day presentation gives a good overview of the business.
In March, McClain answered a question during the Morgan Stanley conference—incidentally, the bank that was negotiating its soon-to-be-announced acquisition by Thoma Bravo—and laid out the stickiness of the platform and the competitive landscape:
Mark D. McClain SailPoint Technologies Holdings, Inc. – Co-Founder, CEO & Director
Yes. I think in general, the -- like you say, we have a very strong, very healthy and growing relationships with all the big SIs. In most of the cases, by the way, we're the largest security services practice they have, right, for a lot of those big global SIs. They do more services work with us than any other security vendor. Some of that is the nature of what we do. It is a heavier lift. This is always the pro and con of that fact, right? We don't deny that there's a fair amount of lift that customers have to go through to get these products into their environment and appropriately configure to address their needs that, on the backside of that, leads to tremendous stickiness, as we've said. We've talked about far above 95% renewal rates historically. How much far above 95% can you get?
But at some level, I think what we're finding is those SIs are willing to bring in multiple best-of-breed vendors to help the customer solve their problem, and that's still the norm. They will have Okta or Microsoft or Ping or ForgeRock or others, sometimes in the access category. We win more than our fair share in our category. And CyberArk, frankly, still wins more than their fair share in their category. Is there some pressure towards consolidation there? I think there's always consolidation pressure. I think as we see the market evolving and the breadth and depth of what customers are asking us to focus on, they're just not very concerned about that consolidation point, at least at this point. We're not feeling it at all yet. We're very attuned to listening for it, by the way, but we're not feeling it yet.
(I’m not sure what “far above 95% renewal rates historically” means; SailPoint has always said “above 95%, not “far above”. Maybe they were dropping a message to Thoma Bravo.)
The company generated $370m of ARR (annual recurring revenue) for the calendar year 2021 and guided to $520m of ARR for fiscal year 2022. SailPoint went public in November 2017. From Q4 2017 through Q1 2022, SailPoint generated total free cash flow of $116m although that is after adding back $138m of stock-based compensation. The diluted share count increased by 36 percent over that period. The company’s TTM free cash flow margin was -3 percent.
Clearly, SailPoint is not making any money. But perhaps that’s because it was investing heavily in growth. Total R&D during the period was $310m and sales and marketing spend was $743m.
The company thinks it can be profitable in the future. This exchange from September 2021 is interesting:
