Mark McClain and the business of knowing who belongs

Mark McClain thought he might spend his working life at IBM. It was an entirely respectable plan: join a large company, climb the ladder, retire. The ladder, however, proved less interesting than the people standing around it. After IBM came HP, then smaller companies, then a discovery that would make the retirement forecast look rather optimistic. He liked assembling a team and trying to build something together.

By February 2025, McClain was taking SailPoint into the public markets for the second time. The company he helped start in Austin in 2005 had already gone public once, been bought, and gone private. Now it was back. A career chosen partly for security had produced a considerable amount of uncertainty, much of it voluntarily renewed.

There are two questions running through his working life. SailPoint asks who should have access to a company’s systems and information. McClain’s writing asks how a company should treat the people inside it. Both become more difficult as an organization grows. A directory can identify an employee. It cannot tell a manager how to behave.

A second start, with familiar company

McClain’s background was commercial. He studied economics at Point Loma Nazarene University, earned an MBA at UCLA, and worked in sales and marketing at IBM and Hewlett-Packard. His later experience included IBM’s Tivoli business. Before he became a founder, he had spent time inside the sorts of large organizations he would eventually serve.

In 2000, he founded Waveset Technologies. Sun Microsystems acquired the identity management business in 2003, and McClain became Sun’s vice president of software marketing. A sale had supplied a perfectly plausible stopping point. Instead, after their time at Sun, he and Kevin Cunningham returned to the startup business, joined by Jackie Gilbert. SailPoint began at the end of 2005.

The second venture grew from listening. Cunningham recalled the founders examining what customers still struggled with after the first generation of identity companies had been acquired. Businesses needed a way for technology staff, managers, auditors, and risk teams to understand access together. The earlier tools had largely helped administrators do their jobs. The next problem required more people around the table.

That distinction matters to McClain’s story. He returned with colleagues, customer knowledge, and experience of an unfinished problem. Starting again meant finding out what had changed while they were away.

The question behind the password

Identity governance can sound like a meeting that ought to have been an email. Its central question is quite direct: who has access to what, and should they? Getting someone into a system is only part of the job. An organization also needs to understand whether that person’s permissions fit their responsibilities, and whether those permissions should change.

Consider an illustrative employee who changes departments. The login can still work perfectly while the access underneath it becomes inappropriate. Old permissions can outlive the job that justified them. SailPoint’s business grew around making such relationships visible and manageable across an enterprise, rather than leaving every application to tell its own incomplete story.

The company’s history charts an expanding answer: identity governance, then cloud delivery, then greater use of intelligence and automation. The vocabulary has become more elaborate as the participants have multiplied. The underlying responsibility remains recognizable. Someone needs to know why the door is open.

Two listings and an unfinished job

SailPoint first went public on the New York Stock Exchange in 2017. McClain later recalled walking around a corner in New York and seeing the company’s banner at the exchange. The occasion became unexpectedly personal when the exchange’s chief executive acknowledged how unusual it was for the original founders to be there to ring the bell. McClain found himself emotional at what he had expected to be a business event.

The next ownership turn came in 2022, when Thoma Bravo took SailPoint private in a transaction valued at approximately $6.9 billion. In February 2025, SailPoint returned to the market, this time on Nasdaq. The offering was priced at $23 a share, with 60 million shares offered. McClain was still chief executive.

A public listing makes a satisfying final scene. A second listing rather spoils that convention. It asks the reader to imagine what happens after the photograph: the same customers with new requirements, the product decisions, the managers who still need an answer on Monday.

Values get the first word

McClain’s view of culture begins with a suspicion of office theater. His personal website takes aim at the idea that ping-pong tables and a beer fridge amount to an organizational culture. Amenities are easy to photograph. Keeping a commitment is harder to put in the recruitment brochure, especially when keeping it becomes inconvenient.

SailPoint’s four stated values are innovation, integrity, impact, and individuals. The useful question is what those words require in practice. They describe an expectation of useful work, commitments honored, results that matter, and people treated as individuals. The list is short enough to remember. Applying it requires more than remembering.

In his essay about values and vision, McClain reverses a familiar business sequence. Leaders often begin by describing the future they want, then choose principles to guide the journey. He argues for deciding first how people should be treated and what kinds of conduct are acceptable. Otherwise, values risk becoming adjustable whenever the destination demands it.

It is a practical position for someone whose business has changed products, scale, and ownership. A plan can need revision. The treatment of colleagues should not depend entirely on whether this quarter’s plan happens to be working.

“The enemy is out there.”

Mark McClain, on keeping colleagues on the same team

You can care about someone and still need a different team

His writing becomes more revealing when it reaches the awkward cases. Calling a company a family sounds warm until a leader must decide that someone’s work no longer fits. McClain has described making difficult calls about colleagues who were compatible with the culture but unsuitable professionally. Affection did not make the decision disappear.

He prefers the team metaphor, with qualifications. Teams have goals, expect performance, and can change their membership. They can also become ruthless or split into competing factions. His answer is to lead a team with care and compassion, while preserving the ability to make decisions about the work. The small sentence about the enemy being outside is meant to keep internal disagreement from becoming internal warfare.

This gives his people-first argument some necessary friction. There are standards to meet and relationships to respect. A manager has to carry both responsibilities into the same conversation. Anyone hoping that a values statement will spare them an uncomfortable afternoon is likely to be disappointed.

The book has room for a laugh

McClain put his leadership ideas into Joy and Success at Work: Building Organizations That Don’t Suck the Life Out of People. Even the title makes a bid for usefulness over ceremony. He wanted a guide managers could consult when a problem arrived, with topics they could find quickly and humor along the way.

The lighter register fits his public conversations. He jokes about the size of his book audience and shares the credit for the company’s work. In an interview about his early life, he also supplied a detail absent from most cybersecurity biographies: he played the tuba from grade school through college, using school instruments. Graduation ended the arrangement. A serial founder had once depended on borrowed brass.

A new kind of colleague needs permission

By 2026, the identity question included AI agents that can perform work across company systems. In a live RSAC conversation published that May, McClain discussed how an established security company adapts as identities become autonomous and operate at machine speed. Having spent years building a business around one problem, he now faced customers encountering a different version of it.

The scale is measurable. SailPoint reported $1.231 billion in annual recurring revenue as of July 31, 2026. ARR describes the company’s recurring business, rather than cash collected in that quarter. For McClain, the larger number comes with a larger obligation to keep learning what customers need.

At Navigate in October, SailPoint announced expanded controls for human and machine identities, including AI agents, and capabilities designed to replace permanent access with temporary permissions. In an interview that month, McClain addressed accountability and the limits of an AI kill switch. The vocabulary has moved some distance from employee onboarding.

Yet his July discussion of agent governance returned to people: even autonomous agents operate under policies and oversight established by an organization’s humans. Responsibility still has to land somewhere. The work has acquired faster actors without losing its human consequences.

His 2026 thinking about leadership reaches beyond his own office. In a conversation about evaluating future chief executives, he described looking for candidates who had worked in both large companies and genuine startups. Each setting teaches something the other can miss. He also wanted to know how candidates understood their responsibility for culture. His own route gives those interview questions a biographical basis: he has worked inside the large machine, left it, built a smaller one, and watched it grow.

McClain’s original retirement plan would have made a much shorter story. Instead, he has kept returning to the work of assembling people, listening to customers, and deciding what should happen next. Two stock exchanges later, there are still permissions to reconsider and promises to keep.