Identity & Access Management
,
Security Operations
Repeat IPOs Have Been Very Rare in Security – Don’t Expect SailPoint to Change That
The second time around has rarely been the charm for cybersecurity initial public offerings. Despite promises made by private equity firms, cybersecurity firms that are taken private rarely return to the public markets.
See Also: How to Unlock the Power of Zero Trust Network Access Through a Life Cycle Approach
But the private equity firm that owns SailPoint is hoping to defy the odds.
Thoma Bravo is in initial discussions about a second IPO for SailPoint – joining just one prominent cybersecurity vendor in recent memory that went public not once, but twice: McAfee.
The Silicon Valley-based antivirus pioneer raised $75 million in its first initial public offering in 1999 and was sold to Intel in 2011 for $7.68 billion. Then in October 2020, TPG-owned McAfee raised $740 million on a $9.5 billion valuation during its second initial public offering. McAfee’s second stint as a public firm was short-lived, and Advent and Permira took the company private in March 2022 for $14 billion.
Now, a second cybersecurity vendor is looking for IPO déjà vu. Austin, Texas-based identity governance and administration vendor SailPoint first went public in November 2017, raising $240 million on a $1 billion valuation, and was taken private by Thoma Bravo in August 2022 for $6.9 billion in what was then the sixth-largest cybersecurity acquisition of all time (see: Identity Firm SailPoint to Be Bought by Thoma Bravo: $6.9B).
Just over two years later, the Chicago-based private equity firm is eyeing the exits and has begun interviewing underwriters as it explores an IPO for SailPoint, Bloomberg said Thursday. Thoma Bravo hasn’t finalized details, including the timing of a potential listing for SailPoint, Bloomberg reported. Thoma Bravo declined to comment, while SailPoint didn’t respond to a request for comment.
How Thoma Bravo Exited Other Cyber Investments
If history is any guide, Thoma Bravo is far more likely to sell SailPoint to another private equity firm or technology company than to take the identity governance firm public. On the private equity side, Thoma Bravo sold Barracuda to KKR for a reported $4 billion in August 2022, Centrify to TPG in March 2021 for an undisclosed amount and Veracode to TA Associates in March 2022 at a $2.5 billion valuation.
Thoma Bravo has also sold some portfolio firms to larger cybersecurity vendors. This includes the $4.65 billion sale of Blue Coat to Symantec in 2016 and the $3.6 billion sale of Imperva to Thales in December 2023. In other cases, Thoma Bravo joined portfolio firms together, notably ConnectWise and Continuum in October 2019, Ping Identity and ForgeRock in August 2023 and Exabeam and LogRhythm in July 2024.
But if Thoma Bravo wanted to forge a new path and take SailPoint public again, the company is certainly big enough. The company in September 2023 notched nearly $600 million in annual recurring revenue and a more than 50% year-over-year boost in SaaS revenue in the first half of 2023. Given that investors now want cyber firms to have at least $500 million in revenue before going public, SailPoint has the size.
A SailPoint IPO would break a yearslong dry spell in initial public offerings for pure-play cybersecurity vendors. Granted, Silicon Valley-based Rubrik went public in April 2024, raising $752 million on a $5.6 billion valuation, though the company’s heritage in backup and disaster recovery and focus on data protection straddles the line between security and storage.
The most recent IPO from a vendor that exists solely in the cybersecurity realm requires going all the way back to September 2021, when San Francisco-based identity and access management company ForgeRock raised $275 million on an IPO valuation of $2 billion.
How SailPoint Has Fared Under Thoma Bravo
Like most Thoma Bravo portfolio companies, SailPoint has been active on the acquisition front under the private equity firm’s control, making two tuck-in deals to boost the company’s total addressable market. SailPoint purchased U.K.-based privileged access management vendor Osirium for $8.3 million in August 2023 and bought Fall River, Massachusetts-based third-party identity risk firm SecZetta in January 2023 (see: SailPoint to Buy Privileged Access Vendor Osirium for $8.3M).
The company’s technology is well-regarded by analysts, with SailPoint topping Saviynt, Omada and six others in the November 2021 Forrester Wave for identity management and governance. The technology analyst firm praised SailPoint for its use of AI/ML around access requests, access certification, and role mining but criticized the company for average segregation of duties enforcement and risk management.
SailPoint hasn’t reported earnings since being public in 2021, when the firm’s revenue surged to $439 million, up 20% from $365.3 million the year prior. But SailPoint’s net loss increased to $61.6 million, or $0.67 per share, 473% worse than the net loss of $10.8 million, or $0.12 per share, SailPoint recorded in 2020.
Despite the economic headwinds, SailPoint’s headcount has continued to climb under Thoma Bravo’s control, rising nearly 24% from 2,206 staff when the acquisition closed in August 2022 to 2,733 workers today, according to IT-Harvest. Nearly 60% of SailPoint’s staff is based in the United States, and the rest is spread across India, the United Kingdom, Canada, France, Australia and Germany, IT-Harvest found.
Even with this growth, Nasdaq or the New York Stock Exchange would be an unusual home for SailPoint. The public markets are typically home to either the largest and most well-capitalized cybersecurity platforms or red-hot emerging vendors that are either solving a new problem or offering a new way to solve an old problem.
Given that SailPoint is approaching its 20th birthday and has just 30% the annual recurring revenue of pure-play identity security leader Okta, the company doesn’t fit the bill on either count. A Thoma Bravo exit via private equity or strategic buyer seems far more likely than a repeat IPO for SailPoint.