SailPoint: 11% of the Identities Under Governance Aren't Human

SailPoint reported FY2026 two weeks ago. The headline numbers are clean: $1.1 billion in ARR, 28% growth, 97% gross retention. At this scale, that combination is genuinely rare in enterprise software.

But the number that stopped me was buried in the earnings call. 11% of all SaaS identities governed by SailPoint's platform are now non-human — service accounts, API keys, machine credentials, and increasingly, AI agents. That share grew by 25% in Q4 alone.

This is the kind of number that changes how you think about a company's addressable market.

The Core Business at Scale

SailPoint's core business is straightforward: companies need to know who has access to what. Employees, contractors, partners — every human who touches enterprise systems needs to be provisioned, monitored, and deprovisioned when they leave. It's a compliance requirement, a security requirement, and increasingly a board-level concern.

The retention numbers confirm this is mission-critical infrastructure. 97% gross retention means essentially nobody leaves once they're on the platform. Net retention of 113% means existing customers spend more each year. And the SaaS transition — now 66% of ARR, up from 62% a year ago — is making the revenue stream more predictable with each passing quarter.

At $1.1 billion in ARR, SailPoint has proven the core business. The question is what comes next.

The Non-Human Identity Wave

What comes next, apparently, is machines.

SailPoint's newer product lines — covering AI identities, machine identities, and data access security — contributed 17% of net new ARR in Q4, more than doubling from the prior quarter. Over 500 transactions closed around new product innovations in FY2026. New SaaS customers had a 40%+ attach rate on add-on modules.

The thesis is intuitive: as companies deploy AI agents to perform tasks — booking travel, processing invoices, writing code, querying databases — each agent needs identity governance. Who authorized this agent? What data can it access? When should its access be revoked? The same questions that apply to employees now apply to software entities, except there will be orders of magnitude more of them.

SailPoint has two decades of infrastructure for answering these questions at scale. The extension to non-human identities is a natural platform expansion, not a pivot.

The Guidance Puzzle

Here's where it gets interesting. Despite all the positive signals — record net new ARR quarter, accelerating SaaS adoption, emerging product traction — management guided FY2027 ARR growth to 21%. That's a 700 basis point step-down from the 28% they just delivered.

Management's explanation: conservative starting point, expect weaker new term business as customers shift to SaaS. Their track record supports this framing — in FY2026, they beat initial ARR guidance by over 500 basis points. The "guide low, beat high" playbook is well-established here.

But the cynical read deserves attention. Maintaining 28% growth at $1.1B+ ARR would require approximately $315 million in net new ARR. The most SailPoint has ever delivered in a single year is $248 million. Net retention compressed from 115% to 113% — modest, but the direction matters. Expansion is not accelerating despite having more products to sell into the base.

And here's the detail that frames the AI opportunity honestly: management explicitly stated they factored "very little" AI contribution into the FY2027 guide. If the agentic identity opportunity is as large as the narrative suggests, this creates asymmetric upside. But if enterprise-scale AI agent deployments take longer to materialize — which remains the more likely near-term scenario — the guide may simply reflect the natural deceleration that comes with scale.

What I'm Watching

Two numbers will tell the story over the next 12 months.

Emerging product mix. If AI and machine identity contributions cross 25% of net new ARR, the platform expansion thesis is real and the growth math fundamentally changes. At 17% and doubling quarter over quarter, the trajectory is promising — but one strong quarter doesn't make a trend.

Net retention direction. The compression from 115% to 113% needs to stabilize. If NRR keeps declining even as the product portfolio expands, it signals that land-and-expand is losing steam at exactly the wrong time — when the company needs it most to offset natural deceleration at scale.

SailPoint is a high-quality franchise doing something genuinely hard: growing 28% at billion-dollar-plus scale with near-perfect retention. The non-human identity wave is a credible growth catalyst with early proof points. But the numbers today say the inflection is ahead of us, not behind us. The guidance tells you management isn't ready to bank on it yet either.