What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2026-03-19 compared with 2025-03-27 · 162 added, 96 removed, 301 unchanged (46% of the section changed)

SailPoint, Inc.

(together with its consolidated subsidiaries, as appropriate, “SailPoint,” the “Company,” “our” or “we”) delivers solutions to enable comprehensive identity security for the enterprise.

We do this by unifying identity data across systems and identity types, including employee identities, non-employee identities, and machine identities.

(together with its consolidated subsidiaries, as appropriate, “SailPoint,” the “Company,” “our,” or “we”) delivers solutions to enable adaptive identity security for the enterprise.

We do this via the SailPoint Platform that unifies identity data across systems and identity types, including employee identities, non-employee identities, machine identities, and AI agents for real-time governance.

Our SaaS and customer-hosted offerings leverage intelligent analytics to provide organizations with critical visibility into which identities currently have access to which resources, which identities should have access to those resources, and how that access is being used.

1 unchanged sentence

Powered by AI, our solutions enable organizations to overcome the scale and complexity of managing identities in real-time across dynamic, complex IT environments.

The evolving threat landscape requires a more comprehensive identity security approach than ever before.

The evolving threat landscape requires a more adaptive, context-aware identity security approach than ever before.

The number of cyber attacks continues to increase at an accelerating rate, fueled in part by the adoption of AI by threat actors.

In 2023, 90% of organizations surveyed experienced an identity-related incident according to Identity Defined Security Alliance .

In June 2024, a significant volume of data was stolen via compromised login credentials from customers of a data warehouse, including data from a large ticketing company and a major bank.

Hacking groups extensively use compromised identities in their operations, conducting spear-phishing campaigns to access email accounts, harvesting multifactor authentication codes, and leveraging compromised service accounts to infiltrate victims.

Once compromised, insufficiently governed identities enable attacks to access sensitive applications and data, presenting a significant risk to organizations.

Identity security is complicated by an evolving and increasingly complex IT environment.

Increasingly distributed and remote workforces, the proliferation of infrastructure as a services and SaaS applications, and an explosion of data have significantly contributed to this new IT paradigm.

Non-employee and machine identities, AI-enabled or otherwise, are driving a significant expansion in the number and scope of identities that organizations must manage.

Organizations lack both the people and expertise needed to manage complex ecosystems, and the personnel and skills gap is widening as identity sprawl continues to proliferate.

These factors are further exacerbated by regulatory trends toward greater data privacy requirements, leading organizations to demand more effective solutions for managing identity and data security risk.

We believe identity is core to enterprise security.

We pioneered the market for enterprise identity governance almost two decades ago, and our leadership in the sector has been recognized by independent research firms.

From this foundation, we have evolved our offerings to address the most challenging dimensions of identity security today.

During our nearly 20-year history, we have continuously evolved our offerings to address the most pressing challenges in identity security.

This has lowered the barrier for sophisticated attacks and enabled threat actors to scale their efforts with unprecedented efficiency.

The consequences are significant, and the attack surface has expanded dramatically with the rapid growth of non-human identities in recent years, which now vastly outnumber human identities.

Every AI agent and automated process requires an identity to access data and systems, creating thousands of new potential targets for attackers that often operate outside of traditional security processes.

These compromised identities, both human and non-human, enable attackers to access sensitive applications and data, presenting a significant and growing risk to organizations.

A fundamental shift, driven by the proliferation of AI, is reshaping the IT environment and expanding the complexity of digital identities organizations must manage.

This complexity arises from the convergence of three dimensions:

the identities themselves, the systems and data they access, and the risk level of that access.

Identities have expanded beyond human users to include a rapidly growing number of non-human identities like AI agents and machines.

These identities require access to sensitive data distributed across complex multi-cloud environments, and how they access these resources has become increasingly dynamic.

This new reality makes traditional, static security insufficient.

Instead, an adaptive security layer is needed that understands the context between every identity, data asset, and access attempt.

These challenges, compounded by a widening cybersecurity skills gap and increasing regulatory pressures, create a clear demand for more effective identity security solutions.

We believe that providing this adaptive layer of identity security is fundamental to securing the modern enterprise.

We pioneered the market for enterprise identity governance and have evolved our solutions to address these complex, converging dimensions of enterprise security.

The SailPoint Platform is designed to deliver deep, rich, and real-time identity context, enabling organizations to effectively secure their business and data.

During our 20-year history, we have continuously evolved our offerings to address the most pressing challenges in identity security.

We offer multiple identity solutions to meet the diverse needs of our customers across a full range of deployment options.

The SailPoint Identity Security Cloud is built on our unified Atlas platform and enables organizations to consume our identity solution as a SaaS offering.

The SailPoint Identity Security Cloud is built on our unified platform and enables organizations to consume our identity solution as a SaaS offering.

It delivers the critical elements needed to build, maintain, and scale a strong enterprise-class identity security environment.

IdentityIQ is our customer-hosted identity security solution and meets the needs of organizations that are not able or ready to implement a SaaS solution.

Our Identity Security Cloud, built on Atlas, enables organizations to deliver the critical elements needed to build, maintain, and scale a strong, enterprise-class, identity security environment.

Our solutions address nearly all types of systems and identities, including data and applications, employee identities, non-employee identities, and machine identities, and enable smarter access decisions, improve business processes, and provide deeper understanding of identity and access.

Together, our solutions address nearly all types of enterprise identities, including both human and non-human identities and their access to many types of enterprise resources, spanning data and applications.

This enables smarter access decisions, improves business processes, and delivers a deeper understanding of identity and access across the enterprise.

Our solutions are underpinned by several key differentiators:

• Our modular, extensible, and scalable Atlas platform, with its unified architecture and deep integration capability, provides us with the foundation for continued product innovation;

• Our Identity Cube provides a 360-degree view of every enterprise identity, enabling a multidimensional approach to access management that encompasses various aspects of identity such as attributes, entitlements, and effective permissions;

• Our use of AI and automation throughout our platform enhances decision-making, accelerates risk detection, and delivers seamless integrations.

• The foundation:

Deep identity context

We map the complex relationships between different types of identities, including humans, machines, and AI agents and the applications, entitlements, and sensitive data they can access.

This creates a single source of truth for identity, which we believe is the essential bedrock for building an effective security strategy.

• The intelligence layer:

AI-driven governance

SailPoint enriches this foundational data with a powerful layer of artificial intelligence and decades of governance expertise.

This transforms raw data into actionable security insights.

Key capabilities include providing AI-driven recommendations to automate and improve access decisions.

• The outcome:

Real-time & adaptive identity security

Building on the foundational context and AI-driven intelligence, SailPoint's vision is to deliver the next generation of identity security that not only manages identity but actively and autonomously defends the enterprise in real-time through advanced capabilities like securing modern AI and machine identities and integrating identity information directly with security operations.

Our customers include many of the world’s largest and most complex organizations, including large enterprises across all major verticals and governments.

11 unchanged sentences

As our customers adopt new technologies such as AI, continue to add non-employee and machine identities, and implement more comprehensive identity security strategies, we see a substantial opportunity to increase our relationships with existing customers through the increased adoption of our solutions.

We have invested in enhancing our solutions by organically adding capabilities including data access governance, activity management, application onboarding, identity threat detection, and response and cloud identity entitlement management as well as inorganically adding non-employee risk management and privilege access governance through our acquisitions of SecZetta and Osirium.

We have invested in enhancing our solutions by organically and inorganically adding new capabilities, including securing and managing agents and machines, identity graphs for context, data access governance, and application onboarding and management.

Continue to Leverage and Expand Network of Partners and Alliances

Our go-to-market partners and alliances help us extend our reach, serve our customers more effectively, and expand our addressable market.

We see a significant opportunity to increase the number of customers we can serve through our systems integrator and managed service proMSP partnerships.

Additionally, our technology alliance partners help us extend our reach throughout a customer’s IT environment with integrations with products like Amazon Web Services ("AWS"), CyberArk, Proofpoint, SAP, and ServiceNow.

We see a significant opportunity to increase the number of customers we can serve through our systems integrator and managed service provider ("MSP") partnerships.

Expand our Global Footprint

Today, we offer our solutions in more than 65 countries.

During the years ended January 31, 2025 and 2024, we generated 32% of our revenue from outside of the United States.

During the fiscal years ended January 31, 2026 and 2025, we generated 35% and 32%, respectively, of our revenue from outside of the United States.

We believe there is a significant opportunity to deepen our existing global footprint and drive incremental sales and new client acquisitions in new territories by leveraging our existing relationships with global system integration and channel partners.

Continue to Innovate and Expand Our Portfolio

We built a reputation as an innovator and leader in identity security.

We recently launched new offerings in non-employee risk management, data access security, access risk management, and cloud infrastructure entitlement management.

We are investing in AI, both to increase the capabilities of our solutions, as well as to help our customers protect their organizations while adopting AI for their own use cases.

We intend to continue investing to extend our position as the leader in identity security by developing or acquiring new products and technologies and extending our portfolio into additional identity security use cases.

As a recognized leader and innovator in identity security, we actively work to define the future of the market and deliver the next generation of identity security.

We have strategically expanded our pioneering portfolio with the recent launch of innovative capabilities:

agent identity security, observability and insights, and universal privilege features.

Our commitment to innovation is further demonstrated by our significant investment in AI.

This dual-pronged strategy enhances our own solutions with intelligent capabilities while simultaneously empowering our customers to adopt and secure their own AI initiatives with confidence.

Identity Security Cloud

SailPoint Identity Security Cloud is our cloud-based identity security solution, which allows organizations to centrally discover, manage, and secure all enterprise identity types, and the data and cloud infrastructure associated with them.

This offering is built on Atlas, our unified, extensible, multi-tenant SaaS platform.

The Atlas platform enables Identity Security Cloud to unify several capabilities into a single pane of glass and is extensible to allow for the development of new capabilities and modules over time.

Identity Security Cloud is our cloud-based identity security solution, which allows organizations to centrally discover, manage, and secure all enterprise identity types, and the data and cloud infrastructure associated with them.

This offering is built on the SailPoint Platform, our unified, extensible, multi-tenant SaaS platform.

SailPoint Atlas is the intelligent foundation of the SailPoint Platform, engineered to unify identity, data, and security intelligence for comprehensive identity security.

It provides the core services that connect every identity, entitlement, and risk signal across the enterprise.

It powers Identity Security Cloud and its advanced capabilities by bringing together AI, automation, and a scalable architecture to centrally discover, manage, and secure all identity types across enterprise applications, data, and infrastructure.

The SailPoint Platform enables Identity Security Cloud to unify several capabilities into a single pane of glass and is extensible to allow for the development of new capabilities and modules over time.

Throughout our SaaS transformation, we were intentional in taking a longer and more expensive path, decomposing logic that held key intellectual property and rebuilding those same components in a new scalable micro-services-based architecture, to ensure our ability to maximize customer value into the future.

Atlas serves as the foundation for SailPoint Identity Security Cloud and delivers the critical elements needed to build, maintain, and scale a strong, enterprise-class identity security program.

The platform is designed to utilize AI to enable rapid development and easy integration into new capabilities, acquired technologies, and customer environments.

2 unchanged sentences

• Lifecycle Management:

Empowers organizations to securely and cost-effectively manage access to applications and data throughout a business user’s lifecycle within an organization, reducing risk to the business, brand, and bottom-line.

Whether that business user is an employee, contractor, or business partner, our self-service access request capability empowers business users to take an active role in managing changes to their access through an intuitive user interface, greatly reducing the burden on security and IT organizations.

Automates the entire identity journey, from day one and beyond.

We streamline access with Automated Provisioning based on user lifecycle events and roles, while our self-service portal allows users to request access with configurable approvals.

To drive smarter, faster decisions, our platform provides AI-powered Access Recommendations based on peer group analysis and leverages generative AI to generate clear, easy-to-understand descriptions for technical entitlements.

With our offerings, business users can actively change user access through automatic provisioning via a large library of direct connectors for thousands of applications such as Workday and SAP or synchronization with IT service management solutions such as ServiceNow.

7 unchanged sentences

Leverages AI to turn vast quantities of data including attributes, roles, and history into actionable insights to make better decisions faster, spot risky access sooner, and improve overall business security.

In addition to tracking, reporting, and gauging the value of an organization’s identity security program, this capability provides an audit trail and complete visibility into access changes and historical information on entitlements, roles, and governance.

In addition to tracking, reporting, and gauging the value of an organization’s identity security program, this capability provides an audit trail

and complete visibility into access changes and historical information on entitlements, roles, and governance.

With our analytics offering, customers can view activity data at the application level, compare usage with peers, and discover identities with access anomalies.

• Harbor Pilot suite of AI agents:

Streamlines identity security operations by translating natural language into powerful actions.

The Admin Search Agent enables administrators to ask complex questions and receive real-time insights about security risks and compliance within their environment.

Similarly, the Documentation Agent allows any user to find precise answers instantly from a vast repository of documentation and policies.

To accelerate automation, the Workflows Agent leverages simple prompts to expertly build sophisticated workflows, which administrators can then review and implement with ease.

In addition to the core integrated capabilities, organizations can extend the value of our Identity Security Cloud with additional products, including:

• SailPoint Agent Identity Security:

Delivers comprehensive governance, compliance, and security outcomes for AI agents, enabling organizations to aggregate and discover identities from various platforms, assign ownership, and certify and govern those identities within a single platform.

SailPoint Agent Identity Security (“AIS”) is designed to govern the new AI workforce from the ground up.

With AIS, customers can gain the confidence to innovate, knowing that every identity, whether human, machine, or AI, is secured under one comprehensive identity platform.

• Machine Identity Security ("MIS"):

Enables organizations to achieve governance, compliance, and security outcomes for machine accounts.

With MIS, organizations can discover, classify, assign, certify, and oversee ownership of service accounts, bots, and other machine accounts with minimal configuration adjustments and without extensive manual processes.

MIS consolidates the securing of machine accounts to allow for full lifecycle coverage and reduces the risk of orphaned or unmanaged accounts.

With an intuitive interface, MIS can assign human owners, periodically and consistently review configuration, and enhance compliance across the IT infrastructure while safeguarding critical systems.

• SailPoint Observability & Insights:

Enables enterprises to move from raw data to contextual insight, providing clarity into access relationships across the business.

With advanced visualization, enriched metadata, and powerful analysis features, organizations can confidently govern identity access, reduce exposure, and respond faster to threats.

SailPoint Observability & Insights delivers a continuous, interactive view of identities, entitlements, and access relationships.

It helps organizations improve identity hygiene, spot risky access paths, and strengthen governance through graph visualization and contextual metadata.

It bridges the gap between identity and security teams by providing clarity into who has access to what and how.

• SailPoint Accelerated Application Management:

An intelligent, scalable solution for application governance that gives enterprises immediate visibility into application landscapes and reduces reliance on application owners and IT teams without long implementation cycles.

• Non-Employee Risk Management:

4 unchanged sentences

• Data Access Security:

Secures access to the growing amount of unstructured data stored in cloud storage systems to empower organizations to discover, govern, and secure crucial unstructured data and protect it from critical security

Designed as an integrated SaaS solution with Identity Security Cloud, our Data Access Security offering delivers enhanced intelligence on critical data to improve data security posture, reduce risk, and streamline compliance efforts.

1 unchanged sentence

• Password Management:

Provides business users an intuitive, self-service experience for managing and resetting passwords from any device and from anywhere, reducing the reliance on IT and security staff, and enforcing greater password security.

password security.

Our Password Management offering enforces consistent and secure password policies for all users across all systems from the cloud to the data center by detecting password changes initiated outside of the Identity Security Cloud and synchronizing them to maintain a stronger organization-wide password security posture.

5 unchanged sentences

• Cloud Infrastructure Entitlement Management ("CIEM"):

Empowers organizations to extend identity security to their cloud infrastructure, including AWS, Google Cloud Platform (“GCP”), and Microsoft Azure, to ensure compliance and security throughout their entire technology ecosystem.

Empowers organizations to extend identity security to their cloud infrastructure, including AWS, Google Cloud Platform, and Microsoft Azure, to ensure compliance and security throughout their entire technology ecosystem.

CIEM enables customers to discover, manage, govern, and remediate enterprise cloud infrastructure access with a single approach, gaining deeper understanding of their cloud resources and better visibility into their business user’s cloud privileges.

4 unchanged sentences

With PTA, organizations can reduce their reliance on advanced privileged access capabilities and empower general IT staff to provide better service, accelerate adoption, and improve productivity.

• Machine Identity Security:

Enables organizations to achieve governance, compliance, and security outcomes for machine accounts.

With machine identity security (“MIS”), organizations can discover, classify, assign, certify, and oversee ownership of service accounts, bots, and other machine accounts with minimal configuration adjustments and without extensive manual processes.

MIS consolidates the securing of machine accounts to allow for full lifecycle coverage and reduces the risk of orphaned or unmanaged accounts.

With an intuitive interface, MIS can assign human owners, periodically and consistently review configuration, and remain compliant across their IT infrastructure while safeguarding critical systems.

• SailPoint Application Onboarding:

A capability for Identity Security Cloud that uses AI-driven recommendations to quickly apply core identity security functionality to enterprise applications.

IdentityIQ is our customer-hosted identity security solution providing large, complex customers, who are highly interested in data localization in territories where we do not host our cloud software, a unified and highly configurable identity security solution.

16 unchanged sentences

Proactively provides visibility at speed and scale to determine access needs and potential security breaches associated with risky access policy to optimize security management.

Our SailPoint AI capability is built to provide our IdentityIQ customers with additional AI features, such as recommendations and role discovery, by leveraging elements of our Atlas platform to streamline management.

Our organization has invested significant time and effort to remain a pioneer in innovation, continually emphasizing sophisticated and differentiated solutions to provide the best outcome for our customers.

1 unchanged sentence

As the regulatory conditions evolve, and the threat environment introduces new demands and requirements, we view our technology as fundamental to the competitive advantage we hold in the market and our ability to maintain this moat in the future.

Unified Platform

Our Atlas platform allows customers to manage all types of identities and their access needs across all environments through a single pane of glass, providing the underlying infrastructure critical to powering our Identity Security Cloud.

Our Atlas platform is the culmination of both years of investment and the expertise of our management and technical teams.

Taking the lessons learned from our experiences with prior generation identity solutions, our engineers and architects designed a modern identity platform with internet scale, comprehensive cloud, hybrid, and customer-hosted environment coverage, and openness to optimize customers’ existing technology investments.

This extensible, enterprise-grade platform is critical to enabling the management of not only employees, but also non-employees and machine identities, with varying levels of privilege, spanning cloud platforms such as AWS, GCP, and Microsoft Azure, SaaS applications, customer-hosted applications, and datacenter infrastructure such as servers and databases.

Tools including AI, analytics, workflows, and app onboarding are embedded throughout our unified platform, powering enhanced decision making, differentiated insights, and frictionless automation.

Our purpose-built platform provides the controls essential to govern and secure digital identities in today’s complex IT environments to support real-time, risk-based, and policy-driven management of the constantly evolving breadth and depth of enterprise identities, ensuring the right identities have access to the right data.

Key features of the Atlas platform include:

• Extensibility:

Enables deep configuration across security systems, empowering customers to easily thread identity security across their ecosystem.

• Personalized insights & reporting:

Personalized action-oriented insights and reporting putting the most important identity information at the fingertips of administrators, managers, and end users.

Rich library of ML models designed for better-optimized enterprise identity security practices and improved decision-making.

The SailPoint Platform

SailPoint delivers a security platform engineered to unify identity, data, and security intelligence in real time.

This integrated context is what enables adaptive identity with the ability to continuously adjust access and security decisions in response to threat signals, context, and business dynamics.

At its core, our vision for the SailPoint Platform embodies six design principles that we believe define modern identity security:

• Identity-first, data-first:

Every access decision is informed by integrated identity and data context.

• Unified Context:

A single platform where human and digital identities, policies, and data all interconnect through one data model and one graph as needed.

• AI as a Core Fabric:

Machine learning drives entitlement classification, privilege definition, and informed decision making.

• Just-in-time and real-time:

Access is dynamic, as needed, and risk-aware, shifting away from static, standing privilege.

• Security In-Line:

Identity context flows directly into the security operations center for proactive detection and rapid response.

• Robust extensibility:

SailPoint’s robust extensibility layer uses event triggers, APIs, and shared signals to automate access decisions, enforce policy, detect issues early, and reduce identity risk across systems.

SailPoint Atlas is the intelligent foundation of the SailPoint Platform, engineered to unify identity, data, and security intelligence for comprehensive identity security.

It provides the core services that connect every identity, entitlement, and risk signal across the enterprise.

It powers Identity Security Cloud and its advanced capabilities, enabling organizations to establish a robust and automated identity security posture.

By leveraging a unified data model, advanced AI services, and a powerful policy engine, Atlas provides the identity context necessary to move from static controls to dynamic, adaptive governance.

It fortifies enterprises by strengthening access

controls with unique insights and simplifying governance, ensuring security, efficiency, and adaptability in a dynamic digital landscape.

Common services include:

• Connectivity:

Expansive library of application and resource connectors that allow organizations to consolidate all access and identity information into a single solution.

• Event-driven orchestration:

Automated simple and complex identity use cases through custom workflows and forms to reduce or eliminate manual intervention.

Connect the entire ecosystem with tens of thousands of integrations that extend identity context across hybrid environments, enabling centralized visibility, management, and control of access.

• Extensibility:

Extends identity security across the ecosystem with SailPoint’s extensible framework—connecting HR, ITSM, IaaS, and SIEM systems through APIs and event triggers to automate workflows, enhance visibility, and strengthen the security posture.

• Data Model:

Creates a connected data fabric that normalizes identity, entitlement, and risk data.

This establishes a single source of truth for identity context, eliminating silos and powering AI-driven insights.

• AI Services:

Embeds AI and machine learning to analyze patterns, provide entitlement descriptions, detect anomalies, and drive intelligent access recommendations, continuously improving governance accuracy.

• Workflow Infrastructure:

Automates complex identity lifecycle processes, from onboarding to offboarding, through no-code, configurable workflows and adaptive, multi-step approvals.

• Security Infrastructure:

Enables dynamic, real-time coordination between identity and security ecosystems.

By integrating with SIEM, SOAR, and other security tools, it facilitates automated, identity-centric threat response actions.

• Privilege Infrastructure:

Enables discovery and real-time control of privilege across all identities.

• Policy Engine:

Enables consistent, dynamic enforcement of intuitively defined rules and conditions in real time across a wide variety of features including SoD, access request and approval, certifications, non-employee risk management, and privilege access including just-in-time access.

• Insights and Reporting:

Turns identity data into actionable insights to make better decisions faster, spot risky access sooner, & maintain an optimized access model for better security.

Unified Data Model

12 unchanged sentences

The operational data derived from the data layer is organized into structured tables that represent real-world entities and their relationships.

SailPoint’s account correlation, orphan account management, and risk scoring capabilities allow security professionals and business managers to track who has access to what and how often they use it and to rectify risky or dated access.

With the help of Identity Cube’s context and the data layer, operational and security systems can make informed decisions about access and perform key remediation and change requests on our identity platform via our standardized application program interfaces and software development kits.

32 unchanged sentences

Our customers include leading organizations in a diverse set of industries including financial services, media, energy and utilities, technology, life sciences, and healthcare, as well as government agencies and public universities and represent 53% of the Fortune 500 and 29% of the Forbes Global 2000.

Our business is not dependent on any particular customer, and no customer accounted for more than 10% of our revenues for the year ended January 31, 2025, 2024, or for the period from August 16, 2022 to January 31, 2023 (Successor) and from the period from February 1, 2022 to August 15, 2022 (Predecessor).

Our business is not dependent on any particular customer, and no customer accounted for more than 10% of our revenues for the year ended January 31, 2026, 2025, and 2024.

Research and Development

3 unchanged sentences

Along with our global approach, we also staff our research and development team with both experienced industry engineers and the next generation of talent well versed in advanced technology and AI development.

As of the year ended January 31, 2025, 2024, the period from August 16, 2022 to January 31, 2023 (Successor) and the period from February 1, 2022 to August 15, 2022 (Predecessor), our research and development expenses totaled approximately $169.7 million, $180.8 million, $78.2 million, and $81.3 million, respectively.

As of the year ended January 31, 2026, 2025, and 2024, our research and development expenses totaled approximately $223.0 million, $169.7 million, and $180.8 million, respectively.

Additionally, we have been, and will continue to be, deliberate and programmatic in leveraging technology acquisitions.

12 unchanged sentences

Our sales process includes developing thorough business cases and proofs of value, providing customers with a clear and prescriptive path to successful implementation.

This method is supported by overlay resources, including technical specialists who assist in the sales process, ensuring that our solutions are presented with the necessary technical depth and clarity.

This method is supported by overlay resources, including technical specialists and forward deployed engineers who assist in the sales process, ensuring that our solutions are presented with the necessary technical depth and clarity.

Identity security is regarded as essential business infrastructure and critical for securing complex identity environments.

5 unchanged sentences

This integrated approach highlights our commitment to understanding and addressing the specific needs of our customers, delivering high-value identity security solutions, and continuously expanding our market presence through both direct and indirect channels.

Our marketing charter is to be a digital-first, data-driven, and customer-obsessed team that relentlessly accelerates our growth and innovation.

Our marketing charter is to be an AI-first, data-driven, and customer-obsessed team that relentlessly accelerates our growth and innovation.

Our strategy is focused on the following core areas:

driving strong global brand awareness and differentiation for us, leveraging digital marketing tools to engage potential buyers and create a strong and targeted pipeline for our sales force, and helping our customers accelerate their adoption and success as their trusted partner.

driving strong global brand awareness and differentiation for us, leveraging digital and AI marketing tools to engage potential buyers and create a strong and targeted pipeline for our sales force, and helping our customers accelerate their adoption and success as their trusted partner.

Our data-driven digital approach to marketing is tightly aligned to the needs of our addressable market and provides agility to leverage market opportunities in a targeted and timely fashion.

3 unchanged sentences

Our programs include digital campaigns and webinars, Account Based Marketing (ABM), virtual/physical events such as Navigate and other conferences, and executive roundtables.

We also work closely with our key partners to extend the reach to a broader spectrum of the targeted accounts and audience that our partners have strong relationships with.

We also work closely with our key partners to develop joint solutions, run joint go-to-market motions, and extend the reach to a broader spectrum of the targeted accounts and audience that our partners may have strong relationships with.

• Our customer engagement efforts include customer onboarding and education communications, customer reference development, executive advisory boards, and community development and engagement.

2 unchanged sentences

Our typical audience includes IT and security professionals, including Chief Information Officers, Chief Information Security Officers ("CISOs"), and key identity decision makers, and has recently expanded to include key lines of business decision makers in finance, legal, HR, and accounting as identity security has become a greater strategic imperative.

With the expansion of digital identities for agents and machines, we are also targeting new personas such as application owners and data and AI leaders.

Every year we host our flagship user conference, Navigate, followed by a global conference roadshow to demonstrate our strong commitment to enabling our global customers to succeed, while also serving as an opportunity to create pipeline for new sales to prospective customers and additional sales to existing customers.

25 unchanged sentences

Program offerings include access to SailPoint SDKs and APIs, developer support, and cloud-based certification services.

The program comprises over 120 technology and implementation partners and has produced over 100 certified integrations.

The program comprises over 130 technology and implementation partners.

We have partnered with industry leaders across a spectrum of technologies that enable organizations to integrate their entire security, mobility, cloud, and applications infrastructure into our platform so that breaches can be better identified, mitigated, and contained and operations can be streamlined.

Solutions from companies such as AWS, CyberArk, Proofpoint, SAP, and ServiceNow that are plugged into our open identity platform through APIs provide our customers value-added capabilities to build an identity-aware enterprise.

Solutions from companies such as AWS, Palo Alto Networks (CyberArk), Proofpoint, SAP, and ServiceNow that are plugged into our open identity platform through APIs provide our customers value-added capabilities to build an identity-aware enterprise.

System Integrators

26 unchanged sentences

Our annual “Crew’s Views” global employee engagement survey gives us the data we need to focus on areas where we can make the most impact.

Over each of the last three years that we conducted the survey, employee participation exceeded 75% and overall team member satisfaction exceeded 82%.

Over each of the last four years that we conducted the survey, employee participation exceeded 80% and overall team member satisfaction exceeded 82%.

Externally, we’ve been recognized as an employer of choice for parents and millennials.

Since November 2021, we’ve been a certified “Great Place to Work,” and we’ve been noted as a Best Workplace in Texas five years in a row.

We’ve also been noted as a Best Workplace in Technology and been featured on “Best Places to Work” lists from Glassdoor and Built In.

Since November 2021, we’ve been a certified “Great Place to Work,” and we’ve been listed as a Best Workplace in Texas six years in a row.

We’ve also been noted as a Best Workplace in Technology the past three years and have been featured on several other “Best Places to Work” lists, including Fortune, Built In, and Glassdoor.

As we work to execute our growth strategy, we continue to invest in human capital resources that will sustain and fuel that growth.

1 unchanged sentence

While most organizations post-pandemic have reverted to requiring mandatory days in-office, we recognize that there’s no perfect one-size fits all solution.

We have realized many benefits in allowing crew to continue working remotely, so we treat our people like adults and empower team leaders to get their crew members together when it makes sense.

We have realized many benefits in allowing crew to continue working remotely, so we seek to provide them with flexibility and empower team leaders to get their crew members together when it makes sense.

This approach supports crew wellbeing and reflects our commitment to providing an environment for all our team members to succeed and thrive.

19 unchanged sentences

We operate in a highly competitive market characterized by constant change and innovation.

Our competitors include large public companies, such as IBM, Microsoft, and Oracle that offer identity solutions within their product portfolios, and identity centric solution providers, including CyberArk, Okta, and One Identity.

There are also a number of smaller scale, regional, or specialist identity security solution providers that we compete with in certain situations.

There are also a number of smaller scale, regional, or specialist identity security solution providers that we compete with in certain situations, in addition to emerging technologies that leverage AI and agentic AI in an effort to compete in this market.

We believe the principal competitive factors in our market include:

5 unchanged sentences

• Enterprise security, scalability, and performance;

• Ability to innovate and respond to customer needs rapidly;

• Ability to innovate, including the ability to leverage AI, and respond to customer needs rapidly;

• Quality and responsiveness of support organizations;

3 unchanged sentences

Some of our competitors have significantly greater financial, technical, and sales and marketing resources, as well as greater name recognition, in some cases within particular geographic regions, and more extensive geographic presence than we do.

See Part I, Item 1A, “Risk Factors—Risks Related to Our Business and Industry—We face intense competition in our market, both from larger, well-established companies and from emerging companies, and we may lack sufficient financial and other resources to maintain and improve our competitive position.” However, we believe we compete favorably with our competitors based on all the factors above.

See Part I, Item 1A, “Risk Factors—Risks Related to Our Business and Industry—We face intense competition in our market, both from larger, well-established companies and from emerging companies and technologies, and we may lack sufficient financial and other resources to maintain and improve our competitive position.” However, we believe we compete favorably with our competitors based on all the factors above.

Intellectual Property

4 unchanged sentences

and international copyright and trade secret laws.

As of January 31, 2025, we had 79 issued patents and 16 patent applications pending in the United States and eight issued patents and no patent applications pending internationally, in each case relating to certain aspects of our technology.

As of January 31, 2026, we had 80 issued patents and 22 patent applications pending in the United States and no issued patents or patent applications pending internationally, in each

case relating to certain aspects of our technology.

Also as of January 31, 2026, the expiration dates of our issued patents ranged from 2026 to 2044.

5 unchanged sentences

Tel Aviv, Israel;

and London, United Kingdom and under coworking arrangements in various locations in North America, Europe, and Asia.

and London, United Kingdom and under coworking arrangements in various locations in North and South America, Europe, and Asia.

We believe that our facilities are adequate for our current needs and anticipate that suitable additional space will be readily available to accommodate any foreseeable expansion of our operations.

6 unchanged sentences

We are committed to protecting critical business information belonging to SailPoint and the customers and partners we serve.

In support of this commitment, we maintain an Information Security Management System (ISMS) in accordance with ISO/IEC 27001:2013 that extends to additional controls defined within ISO/IEC 27018:2019 focusing on protection of Customer Personal Data in the cloud.

Even before the enactment of the European General Data Protection Regulation (“GDPR"), and the many privacy regulations since then, our customers have been focused on ensuring their personal information is handled with the upmost care.

SailPoint is certified with the EU-U.S.

In support of this commitment, we adhere to and maintain a number of security and privacy related certifications, attestations, and governance frameworks, which include the following:

• Information Security Management System (ISMS) in alignment with ISO/IEC 27001;

• Privacy Management System (PIMS) in accordance with ISO/IEC 27701;

• Controls defined in ISO/IEC 27017:2015 for cloud service security and ISO/IEC 27018:2019;

• Certification with the EU-U.S.

Data Privacy Framework, the Swiss-U.S.

Data Privacy Framework, and the UK Extension to the EU-U.S.

Data Privacy Framework, demonstrating our commitment to privacy principles and regulations.

In addition, we have Standard Contractual Clauses in place that apply to any restricted transfers of data from customers to SailPoint, transfers between SailPoint entities, and transfers to our subprocessors.

On a product level, our product certifications include SOC 1 Type 2, an examination of controls at a service organization relevant to entities’ internal control over financial reporting, and SOC 2 Type 2, which is a report on controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy.

SailPoint has also published SOC 3 Reports, which similarly address controls relevant to security, availability, processing integrity, confidentiality, and privacy.

On June 5, 2024, SailPoint achieved U.S.

Federal Risk and Authorization Management Program (“FedRAMP") Moderate ATO (Authority to Operate) for our SaaS-based solution, SailPoint Identity Cloud.

The Federal Risk and Authorization Management Program (FedRAMP®) is a government-wide program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security and risk assessment, authorization, and continuous monitoring for cloud products and services.

FedRAMP empowers agencies to use modern cloud technologies, emphasizing the security and protection of federal information and accelerating the adoption of secure cloud solutions.

As a FedRAMP-authorized cloud service provider (CSP), SailPoint meets the security requirements necessary to support the most sensitive federal agencies, critical infrastructure, and the defense industrial base at the moderate impact level.

In Australia, our SailPoint Identity Security Cloud has been assessed to the Information Security Registered Assessors Program’s (IRAP) PROTECTED level control requirements, which are based on controls identified in the Australian Signals Directorate and Australian Government Information Security Manual.

This IRAP assessment is a prerequisite for many Australian government departments seeking to adopt platforms and tools from cloud service.

Our compliance certifications demonstrate our commitment to the rigorous security and privacy measures taken to protect the confidentiality, integrity, and security of our customers’ data and the security of our platform.

Data Privacy Framework;

• Product assessments that include SOC 1 Type 2 reports and SOC 2 Type 2 reports;

• C5 (Cloud Computing Compliance Criteria Catalogue) Type 2 report;

• TISAX® (Trusted Information Security Assessment Exchange) Assessment Level AL3 and Assessment Level AL2.5;

• CSA STAR Level 2 certification under the Cloud Security Alliance’s Security, Trust, Assurance, and Risk (STAR) program;

• Assessment under Australia’s Information Security Registered Assessors Program (IRAP) at a PROTECTED level;

FedRAMP® (Federal Risk and Authorization Management Program) Moderate ATO (Authority to Operate) for our SaaS-based solution, Identity Security Cloud;

• GovRAMP™ (Government Risk and Authorization Management Program) authorization;

• Common Criteria (CC) certification.

Collectively, these certifications, attestations, and governance frameworks demonstrate our continued investment in maintaining robust security controls, meeting evolving regulatory expectations, and strengthening the trust placed in us by customers, partners, and investors.

Corporate Information

12 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business