SailPoint, Inc. (SAIL)

Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our condensed consolidated financial statements and related notes included elsewhere in this Quarterly Report.

Our fiscal year end is January 31, and our fiscal quarters end on April 30, July 31, October 31, and January 31. Our fiscal years ended January 31, 2027 and January 31, 2026 are referred to herein as "fiscal 2027" and "fiscal 2026," respectively.

Overview

We deliver solutions to enable adaptive identity security for the enterprise. We do this via the SailPoint Platform that unifies identity data across systems and identity types, including employee identities, non-employee identities, machine identities, and AI agents for real-time governance. Our SaaS and customer-hosted offerings leverage intelligent analytics to provide organizations with critical visibility into which identities currently have access to which resources, which identities should have access to those resources, and how that access is being used. Our solutions enable organizations to establish, control, and automate policies that help them define and maintain a robust security posture and achieve regulatory compliance. Powered by AI, our solutions enable organizations to overcome the scale and complexity of managing identities in real-time across dynamic, complex IT environments. Our solutions empower organizations to maintain a robust security posture and achieve regulatory compliance. Today, we offer a range of solutions to meet the varied needs of our customers across a broad set of deployment options including: Identity Security Cloud, our SaaS-based cloud solution built on our unified SailPoint Platform, and IdentityIQ, our customer-hosted identity security solution. These solutions are designed to enable our customers to make more effective decisions regarding access, improve security processes, and provide them with a deeper understanding of identity and access.

Recent Developments

On June 29, 2026, the Company completed the acquisition of Entro for total cash consideration of approximately $122.6 million and restricted stock consideration of approximately $7.3 million. For more information regarding the equity consideration, see Part II Item 2 of this Form 10-Q. Entro is a cloud-based platform specializing in NHI and secrets security, providing discovery and governance capabilities across over 1,200 types of credentials, tokens, and certificates within cloud and hybrid environments, including CI/CD pipelines, codebases, and container registries.

The acquisition extends the Company's Identity Security Cloud product suite and complements the recently launched SailPoint Agentic Fabric solution, which is designed to discover, govern, and secure autonomous AI agents and machine identities at enterprise scale. Together, Entro's NHI-focused security controls and SailPoint Agentic Fabric are intended to deliver an integrated identity security solution spanning human, machine, and agentic identities.

Entro's solutions are available to SailPoint customers as standalone offerings, with native platform integration ongoing. See Note 5 "Acquisitions" in the notes to our consolidated financial statements included in this Quarterly Report for additional information regarding the purchase price allocation.

Our Business Model

Our customers include many of the world’s largest and most complex organizations, including large enterprises across all major verticals and governments. The approximate number of total customers and customers at each annual recurring revenue ("ARR") level are as follows:

21

Table of Contents

The number of customers with $250,000 or more of ARR as of July 31, 2026 increased 22% on a year-over-year basis, and the number of customers with over $1,000,000 of ARR as of July 31, 2026 increased 27% on a year-over-year basis.

For Identity Security Cloud, our SaaS-based cloud solution, and IdentityIQ, our customer-hosted solution, our customers typically enter into three-year contracts, with annual billing upfront.

For Identity Security Cloud, our pricing is tiered and based on the suite, with the option for the customer to purchase additional products and capabilities à la carte. We price our IdentityIQ term subscriptions based on a number of factors, including the number of digital identities governed with the solution. Customers also have the option to purchase additional products and capabilities.

Key Factors Affecting Our Performance

Our historical financial performance has been, and we expect our financial performance in the future to be, driven by our ability to:

Add New Customers within Existing Markets. Countless organizations still use a combination of legacy solutions and home-grown tools. Furthermore, we estimate that over 60% of organizations in our target market still have a fragmented identity experience or use a mostly manual process based on our internal research. As a result, we believe that there is a significant opportunity for us to accelerate the growth of our customer base by enhancing our marketing efforts, increasing our sales capacity and productivity, and expanding and further leveraging our use of channel partners, including managed service providers. Our ability to attract new customers depends on a number of factors, including the effectiveness and pricing of our solutions, our ability to drive awareness of them, and the offerings of our competitors.

Generate Additional Sales to Existing Customers. We believe that our existing customer base provides us with a significant opportunity to expand incremental sales. Most new customers initially purchase one of our SaaS suites (Standard, Business, or Business Plus). We focus on expanding our customer relationships over time through up-selling and cross-selling opportunities, including suite upgrades and additional products. Additionally, we are focused on continuing to migrate customers of our customer-hosted solution to our SaaS suites, which typically results in increased ARR because of the additional functionality that our SaaS suites offer. Our ability to increase sales to existing customers will depend on a number of factors, including our customers’ satisfaction with our products, competition, pricing, and overall changes in our customers’ spending levels.

Increase Share of Revenue Derived from SaaS. Our go-to-market motion is focused primarily on Identity Security Cloud, our SaaS offering. While we expect that an increase in SaaS contracts will drive growth in ARR, it is also expected to have a near term negative impact on revenue growth, driven by differences in revenue recognition policies between SaaS subscriptions and term subscriptions, and gross margins, as we incur hosting costs for our SaaS offering. Our ability to increase our revenue from SaaS subscriptions will depend on a number of factors, including our customers’ specific circumstances, some of which necessitate their preference for our customer-hosted identity governance solution, IdentityIQ.

Deepen our Penetration in International Markets. We expect to continue to invest in our sales and marketing efforts and channel partner network to expand our reach and deepen our presence in existing geographies and to expand into new geographies. We believe that our global market opportunity is large and growing in response to the evolving IT and threat landscapes. For the three and six months ended July 31, 2026, we generated 66% and 65% of our revenue from the United States, 20% and 21% from Europe, the Middle East and Africa ("EMEA"), and 13% and 14% from the rest of the world, respectively. For the three and six months ended July 31, 2025, we generated 64% and 65% of our revenue from the United States, respectively, 22% of our revenue from EMEA and 13% from the rest of the world for both periods, respectively. Our ability to deepen our penetration in international markets will depend on a number of factors, including the competitiveness of our solutions, the efficacy of our channel partner network, and our sales and marketing efforts.

22

Table of Contents

Sustain Technology Leadership Through Extending Identity Security Portfolio. We recently launched new offerings in agentic security, non-employee risk management, data access security, access risk management, and cloud infrastructure entitlement management. We are thoughtfully investing in AI, both to increase the capabilities of our solutions, as well as to help our customers protect their organizations while adopting AI for their own use cases. We intend to continue investing to extend our position as the leader in identity security by developing or acquiring new products and technologies and extending our portfolio into additional identity security use cases. Our future success is dependent on our ability to successfully develop, identify, market, and sell existing and new products to both new and existing customers.

Factors Affecting the Comparability of Our Results of Operations

Our historical results of operations may not be comparable from period to period or going forward. During fiscal year 2026, we incurred a significant increase in equity-based compensation expense due to the conversion and vesting of equity awards issued prior to the IPO as well as the issuance of equity awards to certain employees in connection with the IPO. On January 31, 2025, the Board approved modifications to accelerate the vesting of certain incentive units, EARs, and cash-settled awards subject to the pricing and closing of the IPO. Upon the IPO, the vested incentive units were considered redeemable. As a result of the modifications and the closing of the IPO during our fiscal year 2026, we recognized $113.8 million of equity-based compensation expense in the consolidated statement of operations, which was comprised of $61.5 million, $12.6 million, and $39.8 million of expense for the modified incentive units, EARs, and cash-settled awards, respectively, with no comparable activity in the current fiscal year. See Note 9 "Equity-Based Compensation" in the notes to our consolidated financial statements for additional information.

Impact of Current Economic Conditions

Worldwide economic and political uncertainties and negative trends, including financial and credit market fluctuations, tariffs and increasing trade protectionism, changes in government spending levels, uncertainty in the banking sector, rising interest rates, inflation, and other impacts from the macroeconomic environment have, and could continue to, adversely affect our business operations or financial results. As we continue to monitor the direct and indirect impacts of these circumstances, the broader implications of these macroeconomic and political events on our business, results of operations, and overall financial position remain uncertain. See the section titled "Risk Factors'' included under Part I, Item 1A of the fiscal 2026 Form 10-K for further discussion of the possible impact of these factors and other risks on our business.

Key Business Metrics

In addition to our financial information prepared in accordance with GAAP, we monitor the following key business metrics to help us measure and evaluate the effectiveness of our operations. Although we believe we have a reasonable basis for each of these metrics, we caution you that these metrics are based on a combination of assumptions that may prove to be inaccurate over time. Please see the section titled “Risk Factors” included under Part I, Item 1A of the f

[Excerpt truncated for page length; source filing is linked above.]

Overview

We deliver solutions to enable adaptive identity security for the enterprise. We do this via the SailPoint Platform that unifies identity data across systems and identity types, including employee identities, non-employee identities, machine identities, and AI agents for real-time governance. Our SaaS and customer-hosted offerings leverage intelligent analytics to provide organizations with critical visibility into which identities currently have access to which resources, which identities should have access to those resources, and how that access is being used. Our solutions enable organizations to establish, control, and automate policies that help them define and maintain a robust security posture and achieve regulatory compliance. Powered by AI, our solutions enable organizations to overcome the scale and complexity of managing identities in real-time across dynamic, complex IT environments. Our solutions empower organizations to maintain a robust security posture and achieve regulatory compliance.

Today, we offer a range of solutions to meet the varied needs of our customers across a broad set of deployment options including: Identity Security Cloud, our SaaS-based cloud solution built on our unified SailPoint Platform, and IdentityIQ, our customer-hosted identity security solution. These solutions are designed to enable our customers to make more effective decisions regarding access, improve security processes, and provide them with a deeper understanding of identity and access.

SailPoint was founded in 2005 by industry experts to develop a new category of identity solutions, address emerging identity security challenges, and drive innovation in the identity market. After establishing leadership in on-premises identity solutions, SailPoint pioneered standalone identity governance and administration SaaS solutions with advanced analytics. Today, SailPoint delivers a robust, extensible SaaS platform for identity security that is ready for the AI age with modern data architecture and just-in-time access to critical data for advanced use cases.

In recent years, we have transitioned our business to a subscription model. This transition is substantially complete with subscription revenue, which consists primarily of SaaS, maintenance, and term subscriptions, comprising 94%, 92% and 89% of our total revenue for the year ended January 31, 2026, 2025 and 2024, respectively.

Our customers include many of the world’s largest and most complex organizations, including large enterprises across all major verticals and governments. Most new customers purchase one of our SaaS suites, Standard, Business, or Business Plus. We believe we deliver exceptional value to our customers and as a result benefit from high customer retention. Our go-to-

55

Table of Contents

market approach tends to result in a larger land, with future opportunities for expansion. We focus on expanding our customer relationships over time with significant up-selling and cross-selling opportunities, including suite upgrades and additional products. In recent years, our expansion motion has grown rapidly, demonstrating the growing value proposition of our solutions. For the last twelve months ending January 31, 2026, over 95% of new SaaS customers landed with a suite offering.

For Identity Security Cloud, our SaaS-based cloud solution, and IdentityIQ, our customer-hosted solution, our customers typically enter into three-year contracts, with annual billing upfront. For Identity Security Cloud, our pricing is tiered and based on the suite, with the option for the customer to purchase additional products and capabilities a-la-carte. We price our IdentityIQ term subscriptions based on a number of factors, including the number of digital identities governed with the solution. Customers also have the option to purchase additional products and capabilities.

Key Factors Affecting Our Performance

Our historical financial performance has been, and we expect our financial performance in the future to be, driven by our ability to:

Add New Customers within Existing Markets. Countless organizations still use a combination of legacy solutions and home-grown tools. Furthermore, we estimate that over 60% of organizations in our target market still have a fragmented identity experience or use a mostly manual process based on our internal research. As a result, we believe that there is a significant opportunity for us to accelerate the growth of our customer base by enhancing our marketing efforts, increasing our sales capacity and productivity, and expanding and further leveraging our use of channel partners, including managed service providers. Our ability to attract new customers depends on a number of factors, including the effectiveness and pricing of our solutions, our ability to drive awareness of them, and the offerings of our competitors.

Generate Additional Sales to Existing Customers. We believe that our existing customer base provides us with a significant opportunity to expand incremental sales. Most new customers initially purchase one of our SaaS suites (Standard, Business, or Business Plus). We focus on expanding our customer relationships over time through up-selling and cross-selling opportunities, including suite upgrades and additional products. Additionally, we are focused on continuing to migrate customers of our customer-hosted solution to our SaaS suites, which typically results in increased ARR because of the additional functionality that our SaaS suites offer. Our ability to increase sales to existing customers will depend on a number of factors, including our customers’ satisfaction with our products, competition, pricing, and overall changes in our customers’ spending levels.

Increase Share of Revenue Derived from SaaS. Our go-to-market motion is focused primarily on Identity Security Cloud, our SaaS offering. We define incremental ARR as the increase in ARR from the prior period to current period. While we expect that this increase in SaaS contracts will drive growth in ARR, it is also expected to have a near term negative impact on revenue growth, driven by differences in revenue recognition policies between SaaS subscriptions and term subscriptions, and gross margins, as we incur hosting costs for our SaaS offering. Our ability to increase our revenue from SaaS subscriptions will depend on a number of factors, including our customers’ specific circumstances, some of which necessitate their preference for our customer-hosted identity governance solution, IdentityIQ.

Deepen our Penetration in International Markets. We expect to continue to invest in our sales and marketing efforts and channel partner network to expand our reach and deepen our presence in existing geographies and to expand into new geographies. We believe that our global market opportunity is large and growing in response to the evolving IT and threat landscapes. We generated 65% of our revenue from the United States, 21% of our revenue from EMEA and 14% from the rest of the world, billed primarily in U.S. dollars, for the year ended January 31, 2026. Our ability to deepen our penetration in international markets will depend on a number of factors, including the competitiveness of our solutions, the efficacy of our channel partner network, and our sales and marketing efforts.

Sustain Technology Leadership Through Extending Identity Security Portfolio. We recently launched new offerings in non-employee risk management, data access security, access risk management, and cloud infrastructure entitlement management. We are thoughtfully investing in AI, both to increase the capabilities of our solutions, as well as to help our customers protect their organizations while adopting AI for their own use cases. We intend to continue investing to extend our position as the leader in identity security by developing or acquiring new products and technologies and extending our portfolio into additional identity security use cases. Our future success is dependent on our ability to successfully develop, identify, market, and sell existing and new products to both new and existing customers.

Impact of Current Economic Conditions

56

Table of Contents

Worldwide economic and political uncertainties and negative trends, including financial and credit market fluctuations, tariffs and increasing trade protectionism, changes in government spending levels, uncertainty in the banking sector, rising interest rates, inflation and other impacts from the macroeconomic environment have, and could continue to, adversely affect our business operations or financial results. As we continue to monitor the direct and indirect impacts of these circumstances, the broader implications of these macroeconomic and political events on our business, results of operations and overall financial position remain uncertain. See the section titled "Risk Factors'' included under Part I, Item 1A above for further discussion of the possible impact of these factors and other risks on our business.

Key Business Metrics

In addition to our financial information prepared in accordance with GAAP, we monitor the following key business metrics to help us measure and evaluate the effectiveness of our operations. Although we believe we have a reasonable basis for each of these metrics, we caution you that these metrics are based on a combination of assumptions that may prove to be inaccurate over time. Please see the section titled “Risk Factors” for more information.

Total Customers and Customers by ARR Level

The approximate number of customers at each ARR level are as follows:

As of January 31, 2026, the number of customers with $250,000 or more of ARR and with over $1,000,000 of ARR increased 26% and 34%, respectively, on a year-over-year basis. As of January 31, 2025, the number of customers with $250,000 or more of ARR and with over $1,000,000 of ARR increased 26% and 78%, respectively, on a year-over-year basis. We expect the increase in our overall customer count to continue as customers realize the growing value proposition of our solutions.

Annual Recurring Revenue

We believe ARR is a key metric to measure our business performance because it measures our ability to generate sales with new customers and to maintain and expand spend with existing customers. The way we define ARR normalizes the impact of revenue recognition differences between SaaS contracts and term subscription agreements. In recent years, ARR has grown faster than revenue, as a greater share of incremental ARR has been driven by SaaS contracts which have ratable revenue recognition compared to term subscription agreements where a portion of the contract value is recognized as revenue up-front.

We define ARR as the annualized value of SaaS, maintenance, term subscription, and other subscription contracts as of the measurement date. To the extent that we are actively negotiating a renewal or new agreement with a customer after the expiration of a contract, we continue to include that contract’s annualized value in ARR until the customer notifies us that it is not renewing its contract. The amount included in our ARR calculation related to these contracts was less than 1% as of the end of each period shown in the ARR table below. We calculate ARR by dividing the active contract value by the number of days of the contract and then multiplying by 365. ARR should be viewed independently of revenue, as ARR is an operating metric and is not intended to be combined with or to replace revenue. ARR is not a forecast of future revenue, which can be impacted

[Excerpt truncated for page length; the complete text is on the linked full-MD&A page.]