SailPoint and the keys nobody takes back

When ASDA separated from Walmart, it inherited a peculiar rebuilding job. The supermarket still had shops, warehouses and customers. But its employees had belonged to Walmart's digital identity infrastructure. All 138,000 needed new identities. You can change the name above a shop overnight. Untangling who can open which digital door takes rather more care.

SailPoint works in that space between having an account and having a good reason to use it. The distinction sounds fussy until someone changes departments, a contractor leaves, or an automated process keeps permissions nobody remembers granting. Identity security becomes interesting precisely where an organisation's memory becomes unreliable.

01 / The password is only the beginning

Consider a hypothetical employee who moves from finance to marketing. Signing in successfully proves something about the person. It does not settle whether that person should still approve supplier payments. SailPoint's business is helping companies answer that second question, across applications and data, repeatedly.

Its tools collect identity and access information, support requests and approvals, provision accounts, and organise access certifications. Managers can review permissions; policies can flag incompatible responsibilities. The point is to make access follow someone's current work, rather than preserve a little museum of every job they have ever held.

This places SailPoint in identity governance and administration, within the wider identity and access management market. Authentication and governance meet, but solve different problems. A company may use an existing sign-in provider alongside SailPoint. Buyers also evaluate governance alternatives including Saviynt, Microsoft Entra ID Governance, Okta Identity Governance and Omada.

02 / A second attempt at the identity problem

Mark McClain co-founded SailPoint in 2005. His earlier company, Waveset, had been acquired by Sun Microsystems in 2003. Fellow SailPoint founders included Kevin Cunningham and Jackie Gilbert. This was a team returning to familiar terrain, with experience of how large organisations actually administer access.

SailPoint's own history marks 2007 as its identity governance milestone and 2013 as its move into SaaS. That sequence matters. Governance came before cloud delivery. The persistent problem was connecting business responsibility to technical permissions; the way customers bought and operated the software could change around it.

There is a cultural version of that emphasis, too. SailPoint calls its values the Four I's: innovation, integrity, impact and individuals. Values printed on a website prove little by themselves. Here, they at least name a tension worth watching: security software must impose discipline while remaining usable by the people expected to make decisions.

03 / The supermarket's inconvenient lesson

ASDA chose Identity Security Cloud and Non-Employee Risk Management as it rebuilt after the demerger. Its CISO, Simon Langley, described a deliberate move toward cloud services, avoiding infrastructure ownership. His previous experience with SailPoint also informed the decision.

The harder lesson concerned the information underneath the software. ASDA had to reconcile multiple sources and agree who owned the data. Langley also recalled insufficient training and business change management at his previous employer, Morrison's. The lesson he brought forward was to involve colleagues, clarify responsibility and resist reshaping good software around a bad process.

“You can't treat identity as a technology project”Simon Langley, ASDA CISO, in SailPoint's customer interview

That is the part another organisation can copy: establish an accountable owner for each identity source, explain what access reviewers must decide, and improve the process before automating it. Otherwise, automation can distribute an old mistake with impressive efficiency.

04 / What the enterprise is buying

SailPoint's cloud offering is built on Atlas, its shared platform foundation. The current portfolio describes Human Fabric for people and Agentic Fabric for AI and other non-human identities. Additional capabilities cover sensitive data, non-employees, cloud infrastructure entitlements and access risks. IdentityIQ remains the customer-hosted option for complex environments.

The distinction is practical. Some customers want cloud operations; others need control over where software runs. The buying decision involves application coverage, local requirements and implementation expertise. SailPoint's case rests on governing a mixed enterprise estate, with connectors and integrations extending beyond one application vendor's world.

Subscriptions underpin the business. Customers select suites and additional capabilities through a sales process. The budget also needs room for integration, data preparation, training and ongoing administration. Accenture, for example, offers planning, implementation and migration work around SailPoint. Buying a licence does not assign an owner to a neglected application.

05 / Public, private, public. Still counting keys.

SailPoint first went public in 2017. Thoma Bravo took it private in 2022 in a transaction valued at approximately $6.9 billion. Its February 2025 return to the public markets priced 60 million shares at $23, an aggregate $1.38 billion offering including shares sold by existing holders. Those are ownership transactions, not customer deployment costs.

The business is substantial, but growth and profitability remain separate questions. In the quarter ended July 31, 2026, SailPoint reported $309 million in revenue and a $59 million GAAP operating loss. Its company-reported adjusted operating income was $63 million. Readers should keep those accounting labels attached.

06 / The colleague without a desk

At Navigate in October 2026, SailPoint announced autonomous agents, expanded agent discovery, temporary provisioning and agent shutdown controls. These were product announcements, with availability varying by capability. The direction is clear: governance is being pushed toward continuous detection and response as software starts acting on behalf of people.

The enterprise still has to know which systems matter, who owns them and what appropriate access means. Smaller, simpler environments may need less machinery. For a sprawling organisation, the useful test is refreshingly plain: can you explain a permission, identify its owner and take it away? The impressive part is doing that again tomorrow.