SailPoint, Inc. Common Stock Investor update

Good afternoon, everyone. Or I guess good morning for many of you. Thank you all for joining us today. My name is Scott Schmitz, with investor relations here at SailPoint, and we are very excited to show you all the highlights from our Navigate conference next week, which was a great event. Before I get started, a little bit of housekeeping. Today's presentation and discussion are strictly reserved for research analysts, shareholders, and members of the financial investment community. If you do not fall into these categories, please disconnect from the webcast at this time. Additionally, please note that the development, release, and timing of any features or functionality described for our products that are not currently available remains at our sole discretion on a when and if available basis. It may not be delivered at all and should not be relied on in making, purchasing, or investing decisions.

We will not discuss the financial impact of products on this call. Our agenda today is fairly simple. Chandra, our EVP of Product and Chief Technology Officer, will recap key messages from Navigate, and then in the spirit of showing versus telling, Levent and Dan Martellotti will demo the platform. For Q&A, the chat function is enabled, so please type your questions as we go and we'll aggregate and address at the end. Let me turn it over to Chandra.

Thank you, Scott. Welcome everyone to the super intelligence security briefing, is the way I would describe it. Look, we are at AGI, or at least near AGI, and I think this is pretty important context for the conversation today because the speed at which these machines are operating, the scale and the complexity all is being driven by the fact that we are at or near AGI. With that, I'll really start with what are the key messages that we really delivered last week and that we would like you to take away today. One is, look, given we are at AGI, you can't really solve, or you can't really secure AI by having human in the loop all the time. I'll kind of walk you through more in detail.

We announced our autonomous agents vision, a class of red, blue, and green agents. I'll talk to you more about it, but that was a big announcement last week. We delivered and announced the very first operational identity platform that can truly deliver least and zero standing privilege. This has been an ideology for about 20, 25 years, getting to least privilege and zero standing privilege as the true north of being very secure. There's never been an operational platform that delivered it. With what we GA'd at Black Hat and what we announced last week, the combination is the very first operational platform, both for human and for AI. Atlas, which is our platform, that is the core service layer that underpins everything we do. We have completely rewired it. I'll walk you through the changes.

We have also made Atlas extensible, because our platform has got to be extensible. We announced some major capabilities around plugins and application builder and marketplace. In fact, we conducted a hackathon with 250 to 300 developers, hugely successful on using Atlas extensibility. We have continued to innovate on the core because we have more than 2,000 cloud customers. The core innovation has been going just as fast as these other things. Lastly, on the operational side, we announced a few new regions, support for things around EU, Sovereign Cloud, FedRAMP High, as well as we showed a completely reimagined user experience. Those are the key messages that you should be taking away by the time we are done today. I want to start with how we are solving the problem.

The foundation is really solving it as a human plus AI problem, because you cannot really have two platforms, one for human, one for AI anymore. You have to solve both of those in the same place, which is what we are doing. When you really introduce AI into the mix, you have speed, machine speed. The platform has to be real time, and you have to be in line with threats. On the scale side, we have done the math. We are beginning to see this in our platform already. There are somewhere between 75 to 150 million agentic interactions a day at any of our large customers. Think of a Global 2000 corporation. When you give an agent a task, it calls multiple LLMs, APIs, data, and so on.

When you do the math on all of that, it is somewhere close to 100 million interactions a day. At that scale, it is not just the scale, it is the topology and the complexity of those interactions, the surface areas that you have to deal with. This concept of zero trust, which was really invented 20 years ago for the human world, will no longer work. This is why we announced our vision for autonomous identity. We were very, very excited to launch our SailPoint autonomous agents. We really describe them in three classes, to really simplify this. It is not like one red, one blue, and one green agent. It is a class of red agents, a class of blue agents, and a class of green agents. Let me really bring this to life for you because we showed our vision around about 10 of these.

Let me really bring this to life. In a red agent, a good example is, let us say you are on PTO, you have a bunch of agents working on your behalf. You have a Microsoft Copilot agent that is taking some notes in the meetings that your teams are doing. You might have an Agentforce agent inside Salesforce and a Claude agent built for you on top of Google Cloud. What if those agents are accessing data that they were not supposed to, that you do not have permission for? This is what a red agent will catch. It will basically say, "Wait a second. This agent is accessing data, critical data, that its human owner was not even supposed to access, and while they are on PTO. This does not look right." A red agent will catch that. A blue agent, now, is actually a defensive agent.

A red agent is an offensive agent. A blue agent will be like, "Oh, okay. Looks like the red agent found something. Let me go do further diagnosis on this." If it actually determines there was a breach, it will stop that breach. Meaning, if this agent that is working on your behalf is accessing critical data that it's not supposed to, a blue agent will automatically stop it. A green agent is what we call a peacetime agent. A good example is automating certification. Look, our customers, these are the large ones, the complex ones. When they run a certification campaign today, even just on the human side, not even including the AI side, a lot of them have between 5, 8, 10 million line items in a cert campaign. That's huge complexity. Our contention is 95% of that should be automated, because we are moving to policy-based governance.

In a policy-based world, you should be able to apply intelligence and automate 95%. That's what a green agent does. It's not just a vision. We announced that we will be launching a few of these, at least in the next few months. In fact, last week at Navigate, we signed up one of the largest banks in the world as a design partner to actually build and deliver on the green certification agent by the December-January timeframe. We are quite excited. This was extremely well-received. The reality of today is 99% of the world is in standing privilege. It's going to take a journey to go from where we are today to get to autonomous identity.

That's why going through least and zero standing privilege is critical. This is why our announcement with what we GA'd at Black Hat and what we announced last week, we are the very first operational platform that can truly deliver on least and zero standing privilege. We spoke to you. I walked you through this exact picture on Investor Day. I think many or most of you would have been there. As well as at Black Hat, we announced a lot of this, or we generally made these available. What I'm going to do in the next few minutes is really give you a glimpse of what's new that we announced last week so that you know what's coming. I'm not going to rehash what is already in the market because we have talked with you about that already.

The first of the newness I'm going to talk about, I'll start here. Which is, look, the SailPoint value proposition across both Agentic Fabric and the human side is discover, govern, and protect. On Investor Day and at Black Hat, I actually talked about protect, and I said, "Protect is where all the runtime controls are." This was extremely well-received last week. In fact, there was a massive reinforcement that the world is sort of moving from doing discovery to really wanting to act on things they are finding and starting to do audit and governance, which is under govern. This was extremely well-received. But I also want to say, because there continues to be a question about when SailPoint says runtime controls, how does it play with other IDP players?

It could be an Okta, it could be a Microsoft Entra or a Ping, so on. What they do is, the IDPs do authentication. Right? Both for human and for AI. They are really the front office or the front gate, or the front door. Once they come in, what we have done now is with all the runtime controls, we have actually introduced another gate. Right? Which is what we call a policy decision point. Right? In the flow of traffic, you can get authenticated and get token exchanged, and a policy decision point will actually evaluate the risk of that access. Right? And determine whether, even though you have the right credentials for accessing a critical piece of data, whether or not you should at this moment. Right? That's what a policy decision point does.

Protect, there are five runtime controls. This is a big deal because you want to have discover, govern, and protect in the same platform. You don't want them in different platforms. In terms of newness, let me quickly give you a sense, and then Levent and Dan will actually show you. As you know, we acquired Entro about 90 days now. I'm thrilled to be announcing that SailPoint Agentic Fabric and Entro will be completely integrated come November, and the fully integrated product will be generally available. At least in my experience and our experience, this is one of the fastest software integrations you will see. We have been very ambitious here. Given the pace of innovation in the market, we wanted to make sure that we had one product that actually brought everything together.