Ping and SailPoint: A Look at Thoma Bravo’s Identity Rollup
Thoma Bravo is a private equity company with ~$100 billion in AUM and a strong track record investing in software businesses according to a presentation given to the Pennsylvania State Employees' Retirement System in February.
The firm seems to be rolling up the identity space with the acquisition of SailPoint for $6.9 billion announced on April 11th followed by the acquisition of Ping Identity for $2.8 billion announced on August 3rd.
The Identity Industry
Identity and access management are critically important for enterprises. Think about who has access to what servers, mainframes, databases, and applications: which employees should have access to these resources, and what happens if that employee is fired or leaves the company?
Now imagine a world where this access problem is multiplied across the thousands of SaaS applications used by modern enterprises as well as their entire cloud infrastructure.
Then, widen this perimeter to include outside vendors, partners, consultants, and finally, customers.
Managing all this is a complex problem and the industry believes its total addressable market is in the tens of billions of dollars.
As is typically the case in the tech industry, solutions were created for these problems decades ago and now represent a large installed base of on premise business. Newcomers have sprung up over the years to attempt to replace these technologies with more modern iterations, or to complement them with hybrid or cloud-native solutions.
With the advent of the internet, the problem of identity and access management became even more critical since everything is connected and subject to attack by hackers and phishers. This has given rise to multi-factor authentication, passwordless authentication, the use of machine learning to verify users, and other ideas.
In many cases, the vendors of these systems must integrate and collaborate with each other because customers often deploy a variety of solutions across their IT systems.
SailPoint
SailPoint and Thoma Bravo go way back. In August 2014—exactly eight years ago—Thoma Bravo formed a holding company to acquire SailPoint, which had been created in July 2004.
SailPoint’s founder Mark McClain still leads the company. The company offers both cloud-native and on-premises solutions. It has recently completed the shift from selling perpetual licenses of software to subscription SaaS. The company’s 2021 analyst day presentation gives a good overview of the business.
In March, McClain answered a question during the Morgan Stanley conference—incidentally, the bank that was negotiating its soon-to-be-announced acquisition by Thoma Bravo—and laid out the stickiness of the platform and the competitive landscape:
Mark D. McClain SailPoint Technologies Holdings, Inc. – Co-Founder, CEO & Director
Yes. I think in general, the -- like you say, we have a very strong, very healthy and growing relationships with all the big SIs. In most of the cases, by the way, we're the largest security services practice they have, right, for a lot of those big global SIs. They do more services work with us than any other security vendor. Some of that is the nature of what we do. It is a heavier lift. This is always the pro and con of that fact, right? We don't deny that there's a fair amount of lift that customers have to go through to get these products into their environment and appropriately configure to address their needs that, on the backside of that, leads to tremendous stickiness, as we've said. We've talked about far above 95% renewal rates historically. How much far above 95% can you get?
But at some level, I think what we're finding is those SIs are willing to bring in multiple best-of-breed vendors to help the customer solve their problem, and that's still the norm. They will have Okta or Microsoft or Ping or ForgeRock or others, sometimes in the access category. We win more than our fair share in our category. And CyberArk, frankly, still wins more than their fair share in their category. Is there some pressure towards consolidation there? I think there's always consolidation pressure. I think as we see the market evolving and the breadth and depth of what customers are asking us to focus on, they're just not very concerned about that consolidation point, at least at this point. We're not feeling it at all yet. We're very attuned to listening for it, by the way, but we're not feeling it yet.
(I’m not sure what “far above 95% renewal rates historically” means; SailPoint has always said “above 95%, not “far above”. Maybe they were dropping a message to Thoma Bravo.)
The company generated $370m of ARR (annual recurring revenue) for the calendar year 2021 and guided to $520m of ARR for fiscal year 2022. SailPoint went public in November 2017. From Q4 2017 through Q1 2022, SailPoint generated total free cash flow of $116m although that is after adding back $138m of stock-based compensation. The diluted share count increased by 36 percent over that period. The company’s TTM free cash flow margin was -3 percent.
Clearly, SailPoint is not making any money. But perhaps that’s because it was investing heavily in growth. Total R&D during the period was $310m and sales and marketing spend was $743m.
The company thinks it can be profitable in the future. This exchange from September 2021 is interesting:
Rob Owens Piper Sandler – Analyst
And historically, SailPoint was a very profitable company. And I think a rule of 40 company before, even before 40 was a thing. If we think about the transition that you would go into and measure ARR growth and probably free cash flow margin is the other, the profitability metric. Is this a rule of 40 type of business once we get through this transition? And I'm guessing given the cashflow scenario of a term license there's probably a year or two lag that has to happen as well.
Josh Harding SailPoint Technologies Holdings, Inc. – SVP of Finance & Operations
Yes. That's spot on. So there is a little bit of a shifting cash flow dynamic during this transition, largely in 2021. There's also the added piece of -- we are investing heavily to drive continued growth. We believe that there's a massive opportunity still in front of this business and we're investing heavily as we have shown for the first half of the year in sales and marketing and R&D, and we'll continue to do so in the second half of this year and beyond.
So you will see or have seen a little bit of an impact to operating margins and the cash flow profile of this business in the short term. But it is something that we think will dissipate as we get to the other side of this transition. And as we said at the Analyst Day back in February, we're already seeing great gross margins on the SaaS side. We think they can even improve from here. So the gross margin profile of this business should be very, very strong. And then on the operating margin side, we believe there is no reason why this business shouldn't be able to put up a 25-point-plus operating margin in due time.
But SailPoint was impatient to get there. During that same quarter, it had hired Morgan Stanley to help the company evaluate possible acquisitions in the data governance space, the same segment of identity in which SailPoint is strong. But the parties concluded that given market conditions—the volatility of SailPoint’s stock and high valuations for competitors—that the time was not opportune, according to the merger proxy (it's called a merger proxy because even though it's an acquisition, the existing company is technically merging into a newly formed company).
Then, in early December 2021, SailPoint executives reached out to their friends at Thoma Bravo:
In early December 2021, in the context of the Company’s continuing review of the strategic direction for its products and SaaS services, management determined that it would be sensible to approach Thoma Bravo for outside input on SailPoint’s Identity Security vision as a longtime former investor in the Company and one that is highly knowledgeable about SailPoint and the infrastructure software and cybersecurity sectors generally. Prior to meeting with Thoma Bravo, management consulted with members of the Board about this determination. On December 7, 2021, members of Company management met with representatives of Thoma Bravo and discussed with them the Company’s Identity Security vision, challenges and market environment and opportunity. Company management did not solicit, intend to solicit or expect any indication of interest from Thoma Bravo to undertake any strategic transaction or partnership with the Company.
Cue the Wandavision meme:
I am being unfair; there’s nothing to indicate that there was anything untoward here, even if SailPoint’s board members have multiple connections to Thoma Bravo, and even if SailPoint’s CEO would earn a $22m golden parachute if the company got bought out. Maybe this is why Thoma Bravo named the entity into which SailPoint would merge "Project Hotel California Merger Sub, Inc."
In any case, after a drawn-out negotiation, Thoma Bravo finally cinched the deal and it was announced on April 11. Importantly, Okta certainly had an opportunity to bid before the deal was signed since Morgan Stanley reached out to six strategic parties and Okta most certainly was among them. After the deal was signed there was another go-shop period in which 41 counterparties were contacted.
Thoma Bravo really wanted this deal, as its bid of $65.25 per share was a premium of three percent above SailPoint’s all-time high and a substantial 48 percent above the previous three-month average price.
In the deal proxy, SailPoint disclosed its financial projections through 2036. Even though the company generated only $116m of free cash flow in the past four years and change, it projects free cash flows of $168m in 2025 and brisk growth thereafter:
This is either fantasy, or a reflection of the shift to SaaS and away from perpetual licenses (or perhaps a blend of both). But given Thoma Bravo’s track record and their willingness to buy the company at such a premium, it’s probably more of the latter.
Financing the Acquisition
Thoma Bravo has calculated total funds of $7.5bn required to close the acquisition. About $1.6bn of that is reported to come from debt financing, leaving the equity piece at $5.9bn.
This back of the envelope return on equity for Thoma Bravo doesn’t look too exciting. But my guess is Thoma Bravo has other plans.
Ping Identity
On August 3rd Thoma Bravo announced it would acquire SailPoint’s competitor Ping Identity for $2.8 billion. There is no deal proxy yet, so we don’t know what Ping’s future projections are.
Ping went public in late 2019. Like SailPoint, Ping also made very little in the way of free cash flow since then, while investing heavily in sales and marketing.
Since Q4 2019, here’s how much Ping and SailPoint have generated in FCF, and how much they’ve spent in each expense category in total:
Like SailPoint, Ping has promised to generate free cash flows in the future as it transitions to SaaS. Historically, Ping’s revenues have predominantly been from their on premise offerings and for 2021, 58 percent of Ping’s revenues came from term licenses, 19 percent from subscription SaaS and 16 percent from maintenance and support.
Ping’s 10-K offers a useful section on competition:
We face competition from (1) legacy providers, (2) cloud-only providers and (3) homegrown solutions.
Legacy providers include Broadcom, IBM and Oracle, among others. These providers generally designed their solutions when enterprise applications were monolithic and on-premise. Their solutions utilize proprietary architectures, which require customized features and integrations to scale. Today, these solutions have the reputation of being complex, costly and increasingly fragile. Thus, legacy providers often struggle to offer a single comprehensive solution that spans all IT environments, including cloud and on-premise.
We also compete with cloud-only providers, such as Okta and One Identity. These providers have solutions that are historically geared towards small and medium-sized businesses that have IT infrastructures hosted entirely in the cloud. The vast majority of large enterprises do not have the ability to operate their businesses solely with cloud infrastructures, and thus require enterprise solutions that support complex hybrid IT environments and the wide variety of applications and workloads found in enterprise IT portfolios. Thus, a cloud-only IAM solution cannot deliver a single comprehensive solution that enterprises require to provide end-to-end coverage across their complex IT landscape.
Microsoft also competes in our market and has tied its identity services to both Azure and its Office365 offerings. However, we partner with Microsoft to provide SSO, security control and adaptive MFA where non-Microsoft environments require integration or independence is preferred. Microsoft’s integration and interoperability with our solutions benefits enterprises while providing optionality and choice. We also compete against providers such as ForgeRock, that offers highly customizable solutions for both the customer and workforce use case and on-premise and cloud deployment options. We believe that these solutions require a longer and less predictable timeline for implementation due to custom coding requirements, while Ping Identity is typically able to offer more efficient and predictable implementation of its enterprise products.
We believe the principal competitive factors in the IAM market include: (1) the ability to address all primary use cases from one platform; (2) the ability to deploy in large, complex hybrid IT environments; (3) the ability to integrate easily with all applications (cloud and on-premise); (4) technology uptime, reliability, scalability and performance; (5) the ability to support open standards; and (6) customer, technology and platform support. We believe we compete favorably on these factors.
These slides from Ping show how it views itself among the other players in the industry (note that Okta now owns auth0):
The first thing to note about this diagram is that it’s not exclusive, meaning, many customers deploy several or all of these solutions. Customers of Okta also use SailPoint for governance and CyberArk for privileged access. Okta has noted that 95 percent of its customers use Microsoft’s Active Directory. So there is a lot of overlap.
It would make sense to combine these companies. One go-to-market team could sell both solutions and G&A could be consolidated. Some R&D would also likely overlap and could be eliminated.
SailPoint’s CEO likes to talk about these vertical bars as “swim lanes” and because each swim lane—privileged access, governance, workforce, and customer—has its set of players, they have co-marketing efforts. Here’s SailPoint’s COO McMartin in September 2019:
J. Cameron McMartin SailPoint Technologies Holdings, Inc. – COO
Yes. It's been a market that's been characterized for a long time by really 3 fundamental segments. Let me walk you through those segments. First is privileged account management. That is the public company name, I'm sure you all know, is CyberArk there. And that is an organization that focuses on both access and governance around the highest-risk users in the enterprise, those CIS admins. So that's an important swim lane in an identity marketplace.
Ours is a second swim lane. That's identity governance. That is the underlying back-office fabric of connecting people to the applications and, within the applications, the sub-elements of those systems that they need to do their jobs, but only that which they need to do their job. Big historic marketplace as well there.
And the third is access management best known by Okta in this space as the new player delivering SSO and 2-factor authentication solutions. And so to date, this market has been characterized by each of us being very focused on a couple of things. One is leadership from a best-of-breed standpoint in solving the problems within that swim lane. So ourselves, Okta and CyberArk are all investing to really optimize the benefit of our solution for the customer. And then we recognize that we need to work together on 2 levels in going to market. The first is making sure our solutions connect well together. So we have long relationships with both CyberArk and Okta that interconnect our solutions to theirs as a fundamental way to deliver good value to the client.
And the second is in the way we go to market. And we routinely jointly market into the target customer base, so that we can help articulate the identity fabric that exists. And by working together, you deliver a comprehensive solution. So our co-marketing efforts with Cyber and Okta and, for that matter, BeyondTrust and others, have been pretty robust for a number of years now.
And it's interesting. I was telling somebody downstairs in one of the one-on-ones earlier today, second quarter was our best quarter in history of those technology partnerships that we've built contributing to the results for the quarter. They're maturing nicely. So inevitably, I think there is some noise about water washing from one swim lane to the other. And inevitably, my long experience in technology is that markets do tend to consolidate, but we see the demand opportunity here very attractive. For many years now we've all been sub-10% penetrated in our target markets. And so we believe, for the near term, this approach that we're all taking to best-of-breed and working cooperatively together will pay dividends for all of us. But we know, in time, that will change. We just -- we're focused today on winning in our space.
There might be as much as $285m in “synergies” to be obtained from combining both companies:
If that’s the case, and if we assume Ping could generate the same revenue growth and standalone free cash flow margins as SailPoint’s projections, the combined company might look something like this (assuming Thoma Bravo borrows about $650m of debt to finance Ping):
These IRRs are several percentage points above a standalone SailPoint deal, which would point towards the necessity of merging SailPoint and Ping.
Implications for Okta, CyberArk and ForgeRock
This is what comp valuations look like right now:
The growth adjusted column adjusts the ARR multiple by the expected YoY ARR growth rate, so that lower is cheaper. Relative to the take-out multiples of SailPoint and Ping, therefore, all three public competitors look undervalued.
ForgeRock clearly looks subscale. It has the smallest scale of the group and is burning cash.
Okta on the other hand seems to have enough scale. It has guided to $1.8 billion of ARR this year and expects $4 billion of revenue by 2026 as well as a 20 percent free cash flow margin by then. This would make it a third larger than the combined Ping and SailPoint business.
Consolidation: Good or Bad?
Consolidation tends to be favorable for industry economics. With fewer teams battling each other for customers and consolidated functions such as S&M and R&D, industry profits should increase. Customers also prefer to deal with one vendor rather than a handful of vendors.
The most obvious next targets would be both ForgeRock and CyberArk. Both are within the size range that Thoma Bravo has played in, and would likely provide similar synergies with a combined SailPoint-Ping. CyberArk in particular would provide exposure to the privileged access part of identity, which no other company has, at least not to any similar scale.
Okta, which is focused on entering the governance and privileged access markets with cloud-native solutions, is unlikely to be a bidder. But it too would benefit from further consolidation among its competitors.
