SailPoint

Prospectus Summary

PROSPECTUS SUMMARY This summary highlights selected information that is presented in greater detail elsewhere in this prospectus. This summary does not contain all of the information you should consider before investing in our common stock. You should read this entire prospectus carefully, including the sections titled “Risk Factors” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and the related notes included elsewhere in this prospectus, before making an investment decision.

Unless the context otherwise requires, the terms “SailPoint,” the “Company,” “we,” “us” and “our” in this prospectus refer to SailPoint Technologies Holdings, Inc. and its consolidated subsidiaries. The term “Thoma Bravo Funds” refers to Thoma Bravo Fund XI, L.P., Thoma Bravo Fund XI-A, L.P. and Thoma Bravo Executive Fund XI, L.P., and the term “Thoma Bravo” refers to Thoma Bravo, LLC, the management company and ultimate general partner of the Thoma Bravo Funds.

SAILPOINT TECHNOLOGIES HOLDINGS, INC.

Our Vision

Our fundamental belief is that identity is power. Our mission is to enable enterprises to grow and innovate, securely and efficiently. To do so, we have created our open identity platform that empowers users and governs their access to applications and data across complex, hybrid IT environments.

Overview

SailPoint is the leading provider of enterprise identity governance solutions. Our team of visionary industry veterans launched SailPoint to empower our customers to efficiently and securely govern the digital identities of employees, contractors, business partners and other users, and manage their constantly changing access rights to enterprise applications and data. Our open identity platform provides organizations with critical visibility into who currently has access to which resources, who should have access to those resources, and how that access is being used. We offer both on-premises software and cloud-based solutions, which provide organizations with the intelligence required to empower users and govern their access to applications and data across hybrid IT environments, whether comprised of on-premises, cloud or mobile applications. We help customers enable their businesses with more agile and innovative IT, enhance their security posture and better meet compliance and regulatory requirements. Our customers include many of the world’s largest and most complex organizations, including commercial enterprises, educational institutions and governments.

Organizations globally are investing in technologies such as cloud computing and mobility to improve employee productivity, business agility and competitiveness. Today, enterprise environments are more open and interconnected with their business partners, contractors, vendors and customers. Business users have driven a dramatic increase in the number of applications and data that organizations need to manage, much of which sits beyond the traditional network perimeter. Because of these trends, the attack surface is expanding while well-funded cyber attackers have significantly increased the frequency and sophistication of their attacks. As a result, IT professionals need to manage and secure increasingly complex hybrid IT environments within these extended enterprises.

Attackers frequently target the identity vector as it allows them to leverage user identities to gain access to high-value systems and data while concealing their activity and movements within an organization’s IT infrastructure. According to the Verizon 2017 Data Breach Investigations Report, 81% of hacking-related breaches involve the misuse of identity credentials, leveraging stolen and/or weak passwords. The consequences of a data breach can be extremely damaging, with organizations facing significant costs to remediate the breach and repair brand and reputational damage. In addition, governments and regulatory bodies have increased efforts to protect users and their data with a new wave of regulatory and compliance measures that are further burdening organizations and levying severe penalties for non-compliance. As a result of these trends, enterprises are struggling to efficiently manage and secure their digital identities.

We believe that our open identity platform is a critical, foundational layer of a modern cyber security strategy that complements and builds upon traditional perimeter- and endpoint-centric security solutions, which on their own are increasingly insufficient to secure organizations, and their applications and data. We deliver a user-centric security platform that combines identity and data governance solutions to form a holistic view of the enterprise. In combination with our technology partners, we create identity awareness throughout our customers’ environments by providing valuable insights into, and incorporating information from, a broad range of enterprise software and security solutions. Our governance platform provides a system of record for digital identities across our customers’ IT environments while allowing them to remain agile and competitive. Our adaptable solutions integrate seamlessly into existing technology stacks, allowing organizations to maximize the value of their technology investments. Our professionals work closely with customers throughout the implementation lifecycle, from documentation to development to integration.

Our solutions address the complex needs of global enterprises and mid-market organizations. Our go-to-market strategy consists of both direct sales and indirect sales through resellers, such as Optiv, and system integrators, including Accenture, Deloitte, KPMG and PwC. As of June 30, 2017, more than 750 customers across a wide variety of industries were using our products to enable and secure digital identities across the globe.

Our leadership in identity governance has been recognized by independent research firms. Gartner has named us a leader in their Magic Quadrant for Identity Governance and Administration for the fifth consecutive time.⁽¹⁾ Also, SailPoint has been named a leader in Forrester’s Identity Management and Governance Wave report and a leader in KuppingerCole’s Identity as a Service Leadership Compass.

Our revenue grew at a compound annual growth rate of 41% from the year ended 2011 to the year ended 2016. For the years ended December 31, 2015 and 2016 and for the six months ended June 30, 2016 and 2017, our revenue was $95.4 million, $132.4 million, $56.9 million and $74.7 million, respectively. During such periods, purchase accounting adjustments reduced our revenue by $5.6 million, $1.4 million, $0.8 million and $0.1 million, respectively. For the years ended December 31, 2015 and 2016 and for the six months ended June 30, 2016 and 2017, our net loss was $10.8 million, $3.2 million, $4.2 million and $6.6 million, respectively. For the years ended December 31, 2015 and 2016 and for the six months ended June 30, 2016 and 2017, our net cash provided by operations was $3.6 million, $6.5 million, $4.5 million and $6.0 million, respectively.

Industry Background

Enterprises are Adopting New Technologies, Resulting in Complex IT Environments

Modern Organizations Have Hybrid IT Environments. Organizations have invested trillions of dollars over the last several decades in building large, complex IT environments to automate business processes, improve efficiency and gain a competitive advantage. Historically, the vast majority of this spend was for technologies deployed on-premises. While organizations are shifting a portion of their IT budgets to invest in technologies such as cloud computing, the majority of IT investment remains on-premises. Consequently, organizations continue to operate highly complex hybrid IT environments, and will do so for many years to come.

The Extended Enterprise Increases Risk. Enterprises increasingly allow business partners and customers to access their IT environments. While providing this access is critical in today’s competitive and highly-connected world, it significantly increases the number of digital identities that enterprises need to manage and exposes enterprises to new risks.

Unstructured Data is Exploding within Enterprises. Enterprises are increasingly digitizing business activities to improve and transform their operations, leading to unprecedented growth in data volumes. According to IDC estimates, over 13 times as much data was created in 2016 as compared to 2010. A byproduct of enterprise digitization is the massive growth and sprawl of unstructured data, such as text documents, emails and other user-generated content, which is often highly sensitive or critical. Comprehensively securing access to all enterprise data is becoming increasingly difficult.

Advances in Robotic Process Automation (“RPA”) Software and Internet of Things (“IoT”) Further Increase Complexity and Present Unknown Risks. A digital identity no longer correlates only to a human user. The notion of what an identity encapsulates has expanded to include a range of intelligent software, like RPA which can mimic the activity of a human operator, and connected devices. RPA software and IoT devices represent billions of new identities for organizations to potentially secure, govern and manage.

Security Threats are Raising the Stakes for Organizations Everywhere

Cyber Criminals are Launching Highly Sophisticated, Stealthy and Targeted Attacks on an Unprecedented Scale. Advanced attacks are multi-staged, unfolding over time and utilize a range of attack vectors with military-grade cyber weapons and proven techniques such as spear phishing and social engineering, leaving organizations and users at high risk of being compromised. According to a study by Risk Based Security, in 2016, 4.2 billion data records were lost or stolen, up from the previous high in 2013 by more than 3 billion. Breaches occur daily and there is significant financial and brand value destruction associated with attacks.

Attacks are Increasingly Focused on the Identity Vector. The vast majority of data breaches, whether conducted by a cyber attacker from inside or outside of the organization, involve the misappropriation of digital identities and user credentials. These credentials are used to gain legitimate access to sensitive systems and high-value personal and corporate data. Many large, well-known organizations have been subject to cyber attacks that exploited the identity vector, including Advocate Health Care, Home Depot, Société Générale, Target, the U.S. Office of Personnel Management and Yahoo!, demonstrating that even organizations with significant resources and security expertise have challenges securing their identities.

Organizations Face Growing Regulatory and Compliance Requirements

Regulatory Pressures are Increasing. New and evolving regulations and compliance standards for cyber security, data protection, privacy and internal IT controls are often created in response to the tide of cyber attacks and will increasingly impact organizations. Existing regulatory standards require that organizations implement internal controls for user access to applications and data. In addition, data breaches are driving a new wave of regulation, such as the European Union’s General Data Protection Regulation (“GDPR”), with stricter enforcement and higher penalties.

Complying with Regulations is Difficult and Costly. Regulatory and policy-driven obligations require expensive and time-consuming compliance measures. The fear of non-compliance, failed audits and material findings has pushed organizations to spend more to ensure they are in compliance, often resulting in costly, one-off implementations to mitigate potential fines or reputational damage. The high costs associated with failing to meet regulatory requirements, combined with the risk of fallout from security breaches, has elevated this topic from the IT organization to the executive and board level.

Legacy Identity Solutions are Struggling to Meet Evolving Enterprise Requirements

Most legacy identity solutions were initially developed 15 to 20 years ago, when the IT environment was significantly different and operational, security and compliance challenges were far less demanding. These identity management solutions have struggled to meet evolving enterprise requirements in today’s complex, hybrid IT environment given their inherent limitations. These legacy identity solutions are:

While some legacy identity management vendors have attempted to evolve their solutions to address today’s challenges, we believe their legacy architectures have limited their ability to effectively meet enterprise requirements. These shortcomings have increasingly led customers to replace their legacy solutions.

Access Management and Identity Governance are Distinct Categories

In recent years, in response to the adoption of cloud computing and mobility, many access management solutions have been developed to provide convenient access to cloud applications and data. These products enforce real-time access, offering functionality such as single sign-on, multi-factor authentication and mobile access, emphasizing user convenience rather than organizational control or improved security. Organizations seeking to govern their complex IT environments effectively and efficiently need to invest in a robust identity governance platform to properly manage and secure user access to applications and data throughout the enterprise.

Our Opportunity

We believe our platform addresses a significant capability gap in today’s complex and hybrid world. Our open identity platform provides a solution that is able to accommodate customers as they grow, expand and respond to security, regulatory and competitive challenges. As organizational complexity continues to increase, our solutions will become increasingly essential to govern users and their access to applications and data.

Our Solution

We were founded by identity industry veterans to develop a new category of identity management solutions, address emerging identity governance challenges and drive innovation in the identity market. In 2007, we pioneered identity governance through our release of IdentityIQ, our on-premises identity governance solution. In 2010, we revolutionized provisioning by integrating it with governance into a single solution. In 2013, we introduced the first cloud-based identity governance solution. In 2015, we extended identity governance to manage unstructured data, a rapidly growing area of risk. In 2017, we announced our advanced identity analytics solution which is designed to enable rapid detection of security threats.

Our platform offers a comprehensive approach to identity governance by delivering compliance controls, user lifecycle management, password management and data access governance for users, applications and data across cloud and on-premises environments. We have built an open platform that is highly flexible and scalable, addresses the challenges of the hybrid enterprise and is adaptable to changing IT, security and compliance requirements.

Key benefits of our open identity platform include:

Our Growth Strategy

Risks Related to Our Business and Investment in Our Common Stock

Investing in our common stock involves risk. Before investing in our common stock, you should carefully consider all the information in this prospectus. In particular, please read the section titled “Risk Factors,” which describes certain known risks and uncertainties that may offset our competitive strengths or have a negative effect on our strategy or operating activities, which could cause a decrease in the price of our common stock and result in a loss of all or a portion of your investment. These risks and uncertainties include, but are not limited to, the following:

Our Equity Sponsor

We have a valuable relationship with our equity sponsor, Thoma Bravo, who has made significant equity investments in us. In August 2014, Thoma Bravo formed SailPoint Technologies Holdings, Inc., a Delaware corporation. On September 8, 2014, SailPoint Technologies Holdings, Inc. acquired all of the capital stock of SailPoint Technologies, Inc. We refer to this transaction as the “Acquisition.”

Thoma Bravo is a leading private equity investment firm, with a history of more than 30 years of providing equity and strategic support to experienced management teams and growing companies. Thoma Bravo targets control investments in companies with strong business franchises led by experienced executives who aspire to achieve industry leadership. The firm works in close partnership with a company’s management team to implement operating best practices, invest in growth initiatives and make accretive acquisitions to rapidly improve revenue and earnings and increase equity value. Thoma Bravo has invested in many fragmented, consolidating industry sectors but is known particularly for investments in application software, infrastructure software, cyber security software and technology-enabled services sectors. Thoma Bravo currently manages a series of private equity funds representing more than $17.0 billion of equity commitments.

Upon completion of this offering, the Thoma Bravo Funds will own approximately % of our common stock (or % of our common stock if the underwriters’ over-allotment option is exercised in full) and will therefore be able to control all matters that require approval by our stockholders, including the election and removal of directors, changes to our organizational documents and approval of acquisition offers and other significant corporate transactions. Thoma Bravo’s interests may not coincide with the interests of our other stockholders. See “Risk Factors—Risks Related to this Offering and Ownership of Our Common Stock—Thoma Bravo has a controlling influence over matters requiring stockholder approval, which could delay or prevent a change of control.” Additionally, Thoma Bravo is in the business of making investments in companies and may, from time to time, acquire and hold interests in businesses that compete directly or indirectly with us. See “Risk factors—Risks Related to this Offering and Ownership of Our Common Stock—Thoma Bravo may pursue corporate opportunities independent of us that could present conflicts with our and our stockholders’ interests” and “Description of Capital Stock—Anti-Takeover Provisions in Our Charter and Bylaws—Corporate Opportunity.”

Corporate Information

Our principal executive offices are located at 11305 Four Points Drive, Building 2, Suite 100, Austin, Texas 78726, and our telephone number at that address is (512) 346-2000. Our website address is www.sailpoint.com. Information contained on, or that can be accessed through, our website does not constitute part of this prospectus, and inclusions of our website address in this prospectus are inactive textual references only.

The SailPoint design logo and our other registered or common law trademarks, service marks or trade names appearing in this prospectus are the property of SailPoint Technologies, Inc., our wholly-owned subsidiary. Other trademarks and trade names referred to in this prospectus are the property of their respective owners.

Emerging Growth Company

The Jumpstart Our Business Startups Act (the “JOBS Act”) was enacted in April 2012 with the intention of encouraging capital formation in the United States and reducing the regulatory burden on newly public companies that qualify as emerging growth companies. We are an emerging growth company within the meaning of the JOBS Act. As an emerging growth company, we may take advantage of certain exemptions from various public reporting requirements, including the requirement that we provide more than two years of audited financial statements and related management’s discussion and analysis of financial condition and results of operations, that our internal control over financial reporting be audited by our independent registered public accounting firm pursuant to Section 404 of the Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”), that we provide certain disclosures regarding executive compensation, and that we hold nonbinding stockholder advisory votes on executive compensation and any golden parachute payments not previously approved. We may take advantage of these exemptions until we are no longer an emerging growth company.

In addition, under the JOBS Act, emerging growth companies can delay adopting new or revised accounting standards until such time as those standards apply to private companies. We intend to take advantage of the longer phase-in periods for the adoption of new or revised financial accounting standards under the JOBS Act until we are no longer an emerging growth company. Our election to use the phase-in periods permitted by this election may make it difficult to compare our financial statements to those of non-emerging growth companies and other emerging growth companies that have opted out of the longer phase-in periods permitted under the JOBS Act and who will comply with new or revised financial accounting standards. If we were to subsequently elect instead to comply with public company effective dates, such election would be irrevocable pursuant to the JOBS Act.

We will remain an emerging growth company until the earliest to occur of (i) the last day of the fiscal year in which we have more than $1.07 billion in annual revenue; (ii) the date on which we become a “large accelerated filer” (the fiscal year-end on which at least $700 million of equity securities are held by non-affiliates as of the last day of our then most recently completed second fiscal quarter); (iii) the date on which we have issued, in any three-year period, more than $1.0 billion in non-convertible debt securities; and (iv) the last day of the fiscal year ending after the fifth anniversary of the completion of this offering.

See the section titled “Risk Factors—Risks Related to this Offering and Ownership of Our Common Stock—For as long as we are an emerging growth company, we will not be required to comply with certain requirements that apply to other public companies” for certain risks related to our status as an emerging growth company.