SAIL

Thank you for standing by, and welcome to SailPoint's fourth quarter fiscal and full year 2026 earnings conference call. At this time, all participants are in a listen only mode. After the speaker presentation, there will be a question and answer session. To ask a question during the session, you will need to press star one one on your telephone. To remove yourself from the queue, you may press star one one again. I would now like to hand the call over to Scott Schmitz, VP of Investor Relations. Please go ahead.

Good morning, and thank you for joining us today to discuss SailPoint's fiscal fourth quarter and full year 2026 financial results. Joining me today are SailPoint's founder and CEO, Mark McClain, and our Chief Financial Officer, Brian Carolan. For the Q&A portion of today's call, we will also be joined by our President, Matt Mills. Please note that today's call will include forward-looking statements, and because these statements are based on the company's current intent, expectations, and projections, they are not guarantees of future performance, and a variety of factors could cause actual results to differ materially. This call will also include references to non-GAAP results, which exclude certain items that do not reflect our underlying business performance.

Please reference this morning's press release and our supplemental earnings presentation posted on investors.sailpoint.com for further information regarding our forward-looking statements and non-GAAP financial measures, including reconciliations of such financial measures to the nearest comparable GAAP financial measures. With that, I'd like to turn the call over to Mark.

Thank you, Scott. Good morning, everyone, and thank you for joining us today. We just completed fiscal year 2026 with outstanding results that underscore our ability to deliver growth at scale. This has been a remarkable year for SailPoint as we continue to perform at an exceptionally high level. Our performance puts us at a level that we believe few companies in software and cybersecurity can claim. To back that up, let's look at the key metrics for fiscal year 2026. We crossed the $1 billion ARR threshold. We delivered 28% overall ARR growth and a consistently strong 38% SaaS ARR growth. These are incredible results. To put this in perspective, our ARR growth of 28% year-over-year, plus our adjusted operating margin of 18% gives us a rule of 46.

This places us in a rare stratum of high-performing companies at greater than $1 billion in scale. Our journey to this point is the result of relentless innovation and unwavering execution. These efforts have enabled us to effectively meet the increasing demand for modern adaptive identity solutions. The combination of visionary product development and operational excellence has positioned SailPoint as a leader in the market, driving our continued success and instilling confidence in our ability to deliver value to our customers well into the future. This past year was also defined by a rapid pace of product advancement. We believe we've pushed our industry forward, making identity security more adaptive, more real-time, and more integrated within security operations. At a time when organizations are being pressure tested due to the extraordinary rise of agentic AI, we believe we are delivering the modern security foundation they need.

Our 38% year-over-year SaaS ARR growth is a powerful indicator of both new and existing customers actively choosing to modernize with SailPoint. Our SaaS customer count grew by 16% year-over-year, and our ARR per SaaS customer accelerated to 19% year-over-year growth in fiscal 2026. Our recently introduced flexible pricing model and new AI-fueled innovations are turning customer interest into tangible growth and reinforcing the clear momentum in our SaaS business. The second piece of context for our performance is the topic at the top of everyone's mind, AI. Now, there is a very active debate happening in the market right now about what AI means for the future of software. I want to address this head on because from our perspective, the answer is clear. The more autonomous and agentic software becomes, the more essential enterprise identity security becomes.

This isn't just about human users anymore. We are experiencing an era defined by an expansive non-human workforce. Armies of AI agents are being built by business users operating at machine speed and creating an explosion of identities and access points that legacy static security models simply cannot handle. While the scale of this agentic workforce is new, the core challenge of securing non-human identities is not new to us. We have been governing service accounts, bots, and other machine identities for years. For us, securing this new army of AI agents isn't a reactive pivot, but a natural evolution for a platform architected for this very complexity. In this new world, you cannot secure what you cannot see, and you cannot govern what you cannot define. The fundamental question of who or now what has access to what doesn't go away. It becomes exponentially more critical and complex.

For SailPoint, this isn't a disruption to be managed. We believe it is the single greatest market expansion driver we have ever seen, and that solidifies our position as a foundational security control plane for the modern AI-powered enterprise. Because now enterprise security is identity security, and we believe no one is better positioned than SailPoint to help customers navigate into this new world. That is why we believe SailPoint is a significant beneficiary of the AI revolution. Our confidence rests on four deep compounding advantages that we believe are unique to us. First, experience. We have spent two decades exclusively focused on solving the most complex identity challenges for many of the world's largest organizations. It's a deeply vertical and horizontal challenge that cannot be solved by general-purpose AI alone. Second, data and context.

Our experience has allowed us to build a strategic moat through our use of data and context to deliver unparalleled precision and intelligence. Third, ecosystem. We are the control plane for its enterprise security, deeply woven into our customers' operations with thousands of entitlement-level integrations. New AI agents don't replace this. They must plug into it, making our platform the essential foundation. Finally, all of this culminates in our most valuable asset: trust. Many of the world's most complex organizations choose us because we are proven and battle-tested. This trust is our currency in a market that cannot afford to risk its enterprise on unproven technology. We believe AI, coupled with our extensive domain knowledge built over decades, will prove itself a true game-changer in the coming years. Today, our solution for solving the AI identity challenge integrates AIS, MIS, and DAS solutions with more capabilities coming.

We've packaged these for easier adoption as part of our Digital Identity Flex pricing package. This approach is rooted in our long-standing philosophy of securing every identity, not just counting seats. It aligns our business model directly with the explosion of both human and non-human identities, helping to ensure we grow and benefit as our customers' agentic workforce expands. Therefore, when you think about our role as an AI beneficiary, it's critical that you look beyond a single product line. The right mental picture is to see how the vast majority of our portfolio is built with AI to secure the AI movement. From our extensive connectivity framework to our entire AI-enabled platform, we believe that all that we've developed has prepared us to be the guardrails for the agentic future. We believe we are built for this new world, and our customers are validating this strategy with their investments.

In total, we closed more than 500 transactions directly tied to our new innovations. In Q4 alone, our AI solutions have seen remarkably fast uptake, with numerous Fortune 1000 companies among the early customers. In fact, non-human identities accounted for approximately 25% of our SaaS identity growth in Q4 and now represent 11% of our SaaS identities under governance. In parallel, our Navigator select pricing model also continues to gain traction, helping to accelerate adoption of our new offerings. Finally, let me share two examples from the quarter around how our customers are adopting our latest innovations to tackle these emerging identity challenges. First, take the example of a global semiconductor leader. As they undertake a massive modernization initiative to reduce technical debt, they face a critical challenge. Securing their highly automated environments.

They chose SailPoint to govern their explosion of AI agents, service accounts, and machine identities at scale. In addition to modernization as a main driver, their decision hinged on a desire to innovate at full speed, knowing that every identity, human and non-human, is secure and under control. Second, a major technology infrastructure provider chose SailPoint's agent and machine identity security solutions to meet a mandate centered around preventing over-permissive access between human users and AI agents while enhancing compliance with regulatory requirements such as SOX and GDPR. These proof points support our belief that our strategic advantage is real. Now let's pivot to how we plan to capitalize on this momentum and convert our unique position into even greater scale. Looking ahead, we expect FY 2027 will be the year of AI adoption.

This is a reality being shaped by a market that is rapidly evolving and a platform built for this exact moment. For us, this isn't a single motion, but a two-pronged engine for durable growth. First, we plan to deepen our footprint within our existing customer base. As customers accelerate their shift to SaaS and confront the explosion of AI identities, we believe we are the right partner to help them navigate this shift. Our adoption of a flex pricing model and our AI-powered platform are designed to help our customers expand their programs and modernize with us. Second, we believe our platform's power and clarity of vision make us more attractive to new customers than ever before. We are seeing increasing demand from organizations that want to build their security program on the right foundation from day one.

The same advantages that make us essential to many of the world's largest companies are creating a clear opportunity for SailPoint in the era of AI. Our ability to drive both of these motions is enabled by our platform's true moat, our governance foundation. In a world of AI agents operating at machine speed, static, periodic governance is no longer sufficient. We are defining the new standard of adaptive identity, a standard that ultimately drives toward real-time governance. For us, that means enabling two critical states, least privilege access, and wherever possible, zero standing privilege. This is made possible by our differentiated ability to link users, machines, agents, applications, and pieces of data in a single correlated data model. The power of that foundation creates what we call identity context. This comes to life in two critical dimensions, visibility and intelligence.

We provide the visibility to extend the governance across the entire universe of identities, confronting application sprawl and securing every entitlement. We've recently extended this visibility to help customers explore the depths of AI usage across their enterprise with our just-announced SailPoint Shadow AI Remediation solution. Visibility is just noise without context. That's why we also deliver the deep intelligence to understand the meaning behind that access, moving beyond who has access to answer what they can do, when, and at what risk level. This identity context combination of visibility and deep intelligence is our most significant advantage. It's what enables our customers to move from simply asking who has access to confidently being able to answer whether that access is appropriate, safe, and being used correctly right now. Competitors may offer a fraction of one or the other.

We deliver both with the granularity and depth that have always been the hallmark of SailPoint. This is such an exciting moment for the company. We believe we have the right strategy, the platform, and the team to continue defining the market through our leadership for years to come. Now, to walk you through the financial details of this outstanding year, I'll hand it over to Brian, our CFO.

Thanks, Mark. Good morning, everyone, and thank you for joining us today. We finished the year with a great fourth quarter, bringing our annual recurring revenue to $1.125 billion. This represents 28% year-over-year growth, a rate we have consistently maintained for the past three quarters, underscoring the strong and sustained demand for our identity security platform at scale. This growth rate is more than 500 basis points better than our initial FY 2026 ARR guidance. Our SaaS ARR continues to be a powerful growth engine, delivering ARR of $746 million, an increase of 38% year-over-year, and accounting for 90% of our net new ARR for fiscal Q4. This strong performance is a testament to our SaaS-first strategy and growth in our emerging products.

In fact, net new ARR from our emerging products more than doubled quarter-over-quarter, accounting for approximately 17% of our net new ARR in fiscal Q4. What's even more impressive is that the total ARR from existing customers who adopted our AI Identity solutions, which includes AIS, MIS, and DAS, or DAS, expanded by more than 50% year-over-year. We believe this is an excellent leading indicator of our future growth, demonstrating that as customers prioritize a comprehensive identity security strategy, they are turning to SailPoint for innovation. As a result, we're seeing customers commit to larger deals to secure their environment. This past fiscal year, our average ARR per SaaS customer grew to over $380,000. That's an increase of 19% from last year and more than double what it was four years ago.

We closed the fiscal year with 215 customers exceeding $1 million in ARR. That's a 34% increase from the previous year and a clear indicator of our success in both landing large new enterprise customers and expanding our relationships with existing ones. Our customers are increasingly choosing to modernize by migrating from our on-premise IdentityIQ solution to our Identity Security Cloud, or ISC. They are making the strategic move to leverage the continuous innovation we are building into our cloud platform. This trend is not only growing but also broadening. Initially, it was primarily our perpetual license customers moving to SaaS. Now we are engaging in more of these strategic conversations with our term license customers as well. This expanded migration trend represents a significant opportunity for growth.

Our existing perpetual and term license customers combined represent approximately $350 million in ARR. With a typical 2x-3x uplift upon migration, this translates into an opportunity approaching $1 billion. We view this as a durable growth tailwind and confirmation that the market is moving toward our strategic vision. It reinforces the incredible momentum we see in our SaaS business and a significant interest from customers ready to modernize their identity programs. Importantly, our gross retention has remained strong and steady at 97% this year. We believe this speaks volumes about the value our platform provides and the trust we've earned from our customers, in addition to representing an exciting path to ARR expansion. In the fourth quarter, our net revenue retention remained strong at 113%.

Looking at our overall financial performance for the fiscal fourth quarter, we delivered revenue of $295 million, an increase of 23% year-over-year, with SaaS revenue growing 37%. Our adjusted operating margin in Q4 was 20.6%, an expansion of 160 basis points year-over-year. We also continued to generate strong cash flow with $64 million of cash from operating activities and $57 million of free cash flow, which represents a 19.5% free cash flow margin. For our fiscal year 2026, we delivered revenue of $1.071 billion, an increase of 24% year-over-year, with SaaS revenue growing 35%. Our adjusted operating margin for the year was 18.1%, an increase of 270 basis points. Turning now to guidance.

For simplicity, I will refer to the midpoint of our guidance ranges where applicable. Full details can be found in this morning's press release and supplemental earnings deck, where you can also find additional modeling notes. For the fiscal first quarter of 2027, we expect ARR to be $1.155 billion, up 25% year-over-year. We expect revenue to be $275 million, an increase of 19% year-over-year, with adjusted operating margin of 11.1%. We expect our diluted share count to be approximately 568 million shares and adjusted EPS to be $0.04-$0.05. For our fiscal year 2027, we expect ARR to be $1.361 billion, up 21% year-over-year.

We expect revenue to be approximately $1.265 billion, an increase of 18% year-over-year, with adjusted operating margin of 18.5%. We expect our diluted share count to be approximately 580 million shares and adjusted EPS to be $0.32. We expect to generate approximately $200 million of free cash flow in fiscal year 2027. Our guidance assumes a continued shift towards our cloud platform, with 90%-95% of net new ARR coming from SaaS in FY 2027. If we assumed no change in SaaS mix relative to FY 2026, our guidance for revenue growth would be approximately 300 basis points higher, and our adjusted operating margin would be approximately 200 basis points higher.

We believe making a more conservative assumption with our term forecast is the right approach given the increased interest in our SaaS solutions. In summary, we believe our strong results, consistent growth at scale, and innovative product roadmap position us well for continued success in the AI-powered future. We remain committed to driving durable, profitable growth, and we are optimistic about our ability to deliver long-term value to our shareholders. With that, let's invite Matt Mills, our President, to join us and open the call for questions. Operator?

Thank you. As a reminder, to ask a question you will need to press star one one on your telephone. To remove yourself from the queue, you may press star one one again. We ask that you please limit yourself to one question to allow everyone the opportunity to participate. Please stand by while we compile the Q&A roster. Our first question comes from the line of Saket Kalia of Barclays. Saket, your line is open.

Okay. Well, hey, good morning everyone, and thanks for taking my question here. Brian, maybe for you. I'd love to jump right into the ARR guide here for fiscal 2027. You know, I think the moving parts in the revenue guide make a ton of sense just given the strength you're seeing in SaaS and what that means for rev rec on term. From an ARR perspective, can you just talk about how you're thinking about the on-prem component next year in terms of churn versus conversion? Zooming out, whether the guided philosophy on ARR is different going into fiscal 2027 versus fiscal 2026.

Good morning, Saket. Good to hear from you. Thanks for your question. First of all, we feel like this is the appropriate place to start the year for our initial guidance to start the year out. We obviously have strong momentum heading into the year. We've demonstrated 28% ARR growth for the past three quarters in a row. We're doing this at scale, well above $1 billion at this point, with 38% SaaS ARR growth. So I think, you know, we're demonstrating healthy demand. We have a strong pipeline. We've demonstrated strong and steady gross retention at 97%, which is a great place to be. I think, you know, the innovation is really driving customers towards SaaS, both new customers and existing customers.

We do have a very strong migration pipeline. As I mentioned on the script or call, we have a $350 million opportunity that's broken down between about $210 million of term with the remainder of $140 million coming from perpetual maintenance. I think we've said in the past, we typically see a 2x-3x multiplier on that at the time of migration, and then it grows from there, with emerging products and other add-ons and cross-sell opportunities. There's really no fundamental change in our business. There's no change in the competition or win rates. We feel like we're simply taking a prudent approach to start the year. We feel good about this. We feel it's the right place to start, and, you know, we'll take it from there.

Very helpful. Thank you.

Thank you. Our next question comes from the line of Matt Hedberg of RBC. Please go ahead, Matt.

Great. Thanks for taking my question, guys. You know, you guys launched Navigators recently, and it really does feel like that's going to help customers think through even longer-term usage of SailPoint, whether it's humans or non-human identities. I guess I'm curious kind of, you know, initial reaction to that. You know, when we think about AIS's impact to fiscal 2027, how have you thought about the impact of that, I guess, Brian, from kind of that initial guide? Thanks, guys.

Yeah. Go ahead, Matt. You can take the pricing one and on.

Yeah. Hey, Matt. Look, I think like any of these new pricing models, it takes a bit to get them going. It showed up big in our fourth quarter. I think we'll talk about this later, but the migration, it was a strong migration quarter. Our Flex monetization was pretty significant in driving a lot of that. Just to remind you what that is, it's kinda taking the economics of having two sets of IP being the SaaS and the perpetual, right? Running it into a single economic stream. It makes it much easier for these customers to get going. Quite frankly, you know, it's always year one, right? Year one, maybe year one and a half that they try to get through from an economic perspective. This Flex Premier monetization has been instrumental in helping us really get through that and accelerating our migrations.

Matt, I'll take the other one just in terms of the AI identity solutions. I think I mentioned on the call, about 17% of our net new ARR came from what we call emerging products, and a good portion of that, significant portion, comes from the AI identity solutions. That includes AIS, MIS, and also DAS, Data Access Security. We're actually to start the year, we're factoring in a little into our initial guide. We expect that to ramp throughout the year as we go along.

Thanks, guys.

Thank you. Our next question comes from the line of Rob Owens of Piper Sandler. Your line is open, Rob.

Great. Good morning. Thanks for taking my question. Wanted to build on socket's question a little bit. Mark, I appreciate your commentary around this being the single greatest market expansion driver you've ever seen. If we look at fiscal 2026, we saw moderating ARR beats throughout the year. Then if we look at the initial guide for ARR, it's not really showing durable growth. Maybe help us understand just how this year played out relative to your expectations. Then as you look forward in the coming fiscal year, just what's in the guide for AI and agentic and that potential inflection, or have you discounted all of that out of the guide? Thank you.

Hi, Rob. It's Brian here. I'll start, and I think Mark might add some color commentary on this. I think we've been able to demonstrate very consistent growth throughout the year. We feel good about doing this in a very balanced manner. It's a balanced growth in terms of half of that came from new customers and half came from existing. We view that as, you know, durability going out to the future. Certainly, there's gonna be an inflection point with a lot of the emerging identity types on the non-human identity side. When that inflection point happens, you know, we can't pinpoint precision with that, but we do know it's gonna happen. We're factoring very little into the initial guide, but we do think it's gonna build over time.

We feel like this is the right place to start the year. I think we've been able to demonstrate an outperformance, as the year went along, in FY 2026. Hopefully, we can continue that into FY 2027, but we simply wanna be prudent, with the starting point and then build from there.

Yeah. Rob, thanks again for the question. Good to talk to you. Yeah, look, you've known us a long time. We're not kind of prone to overhyping things. I think when we talk about this being a significant TAM expansion, it's because of the momentum we see building with these large strategic customers where we spend the great majority of our time. Obviously, as Brian says, we see some ramp coming from the customers as they get into the quote, unquote, "the year of deployment." We've talked a lot about how last year was a lot of, I don't know if I'd call it experimentation, but a lot of trying out various parts of the agentic and AI world in large customers, and now people seem to be ready to move into more production.

They are talking to us very actively about how they need to secure this agentic environment. That's the kinda demand curve we see building. It's just prudent in our minds not to kinda build that into an initial commitment to the street here, but we see it coming. We don't think anybody actually in the market doubts that, honestly, Rob. I think what everybody's questioning is who's gonna be the winners. Our contention continues to be to manage this well, you have to have the things that are kind of unique to our traditional value, which is a breadth of understanding all the identities in the landscape and a depth of the detailed entitlements and data those identities can access.

That just gets more complex and much more real-time in this emerging world of agentic. We just feel like we are very well positioned to capture that opportunity. Our customers and prospects, and Matt probably can pick this up later in the conversation maybe, but that's what we're hearing from them, and we're seeing that interest, and they're talking to lots of vendors, obviously. They seem to be very pleased with what we're describing as where we're headed here and what we're already delivering. We've been out in the market for a few months in many cases where people are now just making announcements with future delivery dates. I would kinda highlight that.

Great. Thank you.

Thank you. Our next question comes from the line of Brian Essex of J.P. Morgan. Your line is open, Brian.

Hi, good morning, and thank you for taking the question. Maybe Brian, I know we're gonna get a lot of questions on this today, so I just wanted to, you know, put a finer point on, you know, the ARR guidance and, you know, maybe from the perspective of what you saw this year versus what you're contemplating for next year. I think, you know, if I look at what you delivered this year, you know, $248 million of net new ARR growing 27%, which was phenomenal. Gross retention rates are best in class, so we don't really seem to have to worry about filling a leaky bucket. But the top end of your guide implies maybe $241 million of net new ARR.

Just wanna understand, you know, from what you were able to deliver this year from a sales productivity perspective, how should we think about the levers that you have in place and the assumptions with the guidance next year, just so we can get a sense of the level of conservatism and how much effort from sales productivity and investment in sales and marketing is required to kind of like, you know, exceed that expectation. Thank you.

Sure. Thanks, Brian. I think we've demonstrated that durability in the growth profile, and I think that's what gives a lot of confidence going into this year. Again, we feel like this is the right starting point. We hope to build from there as the year goes along. We still see a lot of opportunity both in new logo acquisition. We still see a lot of opportunity in what we call our target account list. We're about 15% penetrated. That's a 15,000 named account list that we continue to go after. Lots of white space there. We are landing larger deals. We're up about 20% on average for ARR per customer for the past two years. Once we land them, we keep them.

We have a 97% gross retention rate, and then we expand with them consistently, in that 113%-115% range throughout the year. We still feel like it's early in terms of the emerging products and cross-sell opportunities that we're seeing. Not only the explosion of identity growth, especially non-human identities. Again, we started seeing contributions right away from the emerging modules, which contribute 17% of our net new ARR growth. Then let's not forget about the migration opportunity. We have about a $350 million opportunity. That means only about 15% of our on-prem ARR has been penetrated. We still have $350 million to go.

You start doing a 2x-3x multiple on that at the time of migration, and then it grows from there over the next several years. I think we look out into FY 2027 and beyond, and we have a lot of tailwinds in our favor, a lot of opportunity, again, from new logos and also expansion within our existing customer base.

Thank you.

Thank you. Our next question comes from the line of Meta Marshall of Morgan Stanley. Your line is open, Meta.

Great. Thanks. Wanted to ask a question. You know, the 50% uplift in ARR from those adding the new modules stat was particularly interesting. I guess I just wanted to get a sense, is that kind of what we would expect as the normal uplift? Or, you know, they might have just adopted one of the three products, and so that's not kind of a fair, necessarily kind of total uplift potential calculation, if that makes sense. Thanks.

Hi, Meta, it's Brian here. I would say it's still early days. You know, we're very pleased with the early traction and early success that we're seeing. Hopefully that's a leading indicator of what's to come in FY 2027 and beyond. I think it's resonating with customers. I mean, you know, these emerging products, many of which were just unveiled over the last six months, are starting to take hold. More importantly, I think they're showing up in customer conversations and funnel and pipeline opportunities.

Thank you. Our next question comes from the line of Keith Bachman of BMO. Your line is open, Keith.

Excuse me. Hi, thank you very much, and sorry to go back to the guide for a second, but what is compressing? If I think about the formula, you've been growing ARR, as you mentioned, 28%, and you're getting about 114 net retention rate. If you think about the guide, 21%, and all the attributes that go with it, is it you know, is the assumption that the net retention rate will continue to compress and/or new logos will slow? Because all the characterization that you've given about the on-premises migration potential new products, I'm just a little bit surprised about the implied rate of deceleration, even if we assume some conservatism. Is it a slowing of the retention rate or new logos or both? Any color you could give there would be appreciated. Many thanks.

Hi, Keith. It's, Brian, and I'll take that. Again, we feel this is the right place to start. There is no fundamental change in the business. There's no change in competition or win rates. We're simply taking a conservative approach to start the year. We feel good about this. I would say that we are leaning more towards, SaaS and term migrations. We probably would see a little less new term business in FY 2027 if we had to call one thing out, because I think customers are going right to SaaS. One example is in Europe.

You know, they doubled their SaaS business year-over-year in FY 2026. They have really leaned into it in terms of the customer base and our selling motion. That's going to be very strong, and we're counting on that to be very strong. Again, no fundamental change in the business. We understand that the starting point is, you know, probably a little bit lower, but we feel it's the right place to start. We feel good about it, and we hope to build from here.

Just to be clear, should we expect the net retention rate, though, to slow a little bit from the 113% level?

I would not.

Okay. All right. Many thanks.

We've been very consistent in that range.

Okay. Many thanks.

Thank you. Thank you, Keith.

Thank you. Our next question comes from the line of Jonathan Ruykhaver of Cantor Fitzgerald. Jonathan, your line is open.

Yeah. Thanks and good morning. I want to ask about some announcements from last week around expanding visibility across privileged access and non-human identities. I think, Mark, you did touch on this to some extent, but I'm curious specifically what the gaps are that these upgrades address. Just looking at the strategy related to, you know, to privilege, can you just elaborate on how you're thinking of that? Is it a situation where, you know, you see the opportunity to compete directly against the PAM vendors? Is it, you know, a broader opportunity just based on privileged controls, you know, across, you know, human and non-human identities and not necessarily a direct competitive situation against legacy PAM? How are you thinking of that?

Yeah. Thanks, Jonathan. You're right on it there at the end of your comment or question there, I'd say, in that we are, we're not focused at this point on the traditional PAM market, which is kind of a static privilege assignment. You know, the acronym unpacks to privileged account management, right? Like, an account is sort of permanently privileged in that model. And it's obviously, as we all know, kind of the history of that was permanently privileged users like database administrators and systems administrators. And what we're all talking about, and I'd say this is coming from even the folks, you know, like Palo Alto Networks, who bought CyberArk and others in the, in the market, that the world is shifting to a much more universal sense of managing privilege across all identities and a much more dynamic sense of privilege, not static.

When we look at that evolution, and by the way, you know, Jonathan, particularly now applied on that dynamic vector to agents, which will probably be so dynamic as to potentially be almost ephemeral. There might be agents that literally exist for seconds and do a job and go away again. Well, in that environment, obviously, we think it is gonna be that breadth and depth capability that we possess, we think is strong as anyone in the market, if not stronger. That is to see that range of identities, and we're doing tons of investment in technology to see, to have visibility to all of that range of identities, and then to have the breadth, excuse me, the depth to go deeply into the detailed entitlements or data access rights that allow a particular identity to get to particular data.

Again, we've differentiated this since our IPO about a year ago that the other two parts of the traditional identity market, you know, the access part, which is very wide, covers a lot of identities. They're certainly talking to those vendors about covering the new agentic identity world, but they would struggle, I would argue, to go into the depth that's required to really control these things at a granular level. On the other side, those coming from the privilege heritage, obviously very deep in their coverage of human identities, and I think they're gonna certainly claim that they'll provide that to non-human. Their challenge is breadth.

They just have typically covered, I think the quote from the leader at Palo Alto Networks was that typical CyberArk shop, they've covered 3%-5% of the identities in that enterprise, and we've covered 100% of those identities in those enterprises. It's just a very different starting point to go after this market. We do believe that those fundamental characteristics and then the ways in which we're leaning into this dynamic need is gonna put us in a very good position as these markets unfold and as customers go to volume, right? We do think that's kind of a unique position we're starting from, and others are saying a lot of words and not necessarily we're sure how they're gonna deliver on those words.

I think this game is gonna be a proof game in our fiscal 2027, this calendar 2026. It's gonna be a proof of who can deliver what the customers actually need and the technology they need to solve these problems. We do kind of encourage you to keep watching how that unfolds this year. Like Brian said, for a lot of reasons, we think we're starting from the right place with our financial guidance. We're making sure you hear us clearly on our confidence in our technical abilities and where we're going. That's where I would say that's true. Hopefully, that's helpful.

Yep. Yeah, very much so. Thank you.

Thanks.

Thank you. Our next question comes from the line of Gabriela Borges of Goldman Sachs. Your line is open, Gabriela.

Hi. Good morning. Mark, I wanted to get your thoughts on what Anthropic has announced on being able to accelerate COBOL migration through the lens of we know that IGA migrations are sort of painful for your enterprise customers to switch on to SailPoint and then for SailPoint to do the implementation as well. My question for you is, how does AI make those types of migrations easier? The potential opportunity seems to be around your classic market share gains in IGA. The risk would potentially be if the switching cost goes down. Yeah, would love to hear you chat about that a little bit. Thank you.

Yeah. I think if I understood that, Gabriela, I apologize. The line was a little choppy, but I think I got most of that question. I apologize if I didn't quite. Can you please clarify? No, I think what we're seeing is, the AI tools being released rapidly and then evolving rapidly in the market certainly help us do a lot of things to be more efficient and effective at moving customers forward. We're leveraging those tools, right? We always talk about AI for us has three or four characteristics, right? It is potentially enabling bad actors and threat actors to be more effective. We have to protect against that.

It's enabling us to be far more effective in what we do, and it's creating this demand curve that we talked about with Rob earlier about our customers are deploying it, and we think we can be there to help them manage it. It's got a lot of characteristics. In the sense that what does it do to help us do what we do more effectively, which I believe was your question, and how do we therefore maybe potentially fend off kind of newer competitors who are coming, say, from a pure AI agentic world. I think a term we're all going to be talking about a lot this year, Gabriela, and not just in our space, but in a lot of spaces, is domain knowledge, right?

You can't enter a space with zero domain knowledge and be that threatening to a partner who's already in that space and also leveraging AI, right? I think our secret sauce and many vendors' secret sauce, this is the whole software AI debate, will be as we leverage these amazing technologies and filter them through our very deep and rich understanding of what it takes to be successful in these enterprise environments, we think that puts us in a very good position. Yes, we're actively looking at ways to use AI to discover agents and technologies, how to quickly leverage policies and put them into our product, how to quickly help customers define security policies. There's some new guidelines from NIST out recently, very recently, that start to define what's going to be needed to audit agents.

Something we've been telling people, "Get ready, this is coming," right? You're not going to see this explosion of agents without auditors wanting to ensure you can defend what agent was given what power and why. I think there's just going to be a ton of aspects of this market that are unfolding, and we're going to leverage all kinds of AI technology in our products to go after that, but also make sure we are helping customers protect themselves as they deploy AI. It's really a both/and here, but I hope. Is that, Gabriela, let me make sure. Did I get at the question you were really asking?

Yes. Yeah. Thank you.

Thanks.

Thank you. Our next question comes from the line of Patrick Colville of Scotiabank. Your line is open, Patrick.

Mark and Brian, thank you for having me on. I mean, lots of drivers that you guys have called out, you know, SailPoint's cloud transition, you know, the SKU upgrade motion, more identities, agentic. I think there have been a lot of questions on the fiscal year 2027 guide. Actually I would want to ask my question about Q4 specifically. Q4 ARR, the beat was a little bit skinnier than we might have hoped. Was there anything unusual in 4Q of like push or pull in ARR into different quarters? And then actually, similarly, when I look at operating margin, the outperformance there versus the guide provided three months ago was perhaps a little bit less than we've seen throughout fiscal 2026. Again, like with cost, was there anything that kind of pushed or pulled in the quarter? Thank you.

Hi, Patrick. I'll go first. This is Brian here. I think, you know, we look at this and we think the business is very healthy and, you know, we're pleased with the results. We're in line to slightly above all of our guided metrics. We grew net new ARR 34% year-over-year. That was the best quarter ever by at least $20 million, and that was driven by SaaS, which that net new ARR was up 41% year-over-year. I think we demonstrated growth at scale. We had a steady gross retention rate and net revenue retention rate. New products are ramping. We're seeing momentum there. As I mentioned, 17% of our net new ARR came from emerging customers.

Margins improved 270 basis points over the course of the year. We're doing this with growth in a very responsible manner, and we also demonstrated significant free cash flow movement. You know, as I mentioned, a lot of customers now are starting with SaaS. That's in accordance with our strategy. This is playing out as we expected with an intentional shift to SaaS, with 90% of our net new ARR in Q4 coming from SaaS. I think I mentioned that, you know, more new customers are starting with SaaS, especially in geographies like Europe. You know, EMEA, SaaS, net new ARR doubled in FY 2026. You know, we possibly saw like a little bit of less on-prem expansion bookings through term business, but we're not reading into that.

Actually, I think, you know, we're viewing this as a positive in terms of now customers embracing SaaS, going right to it, and also migration opportunities are going to be a tailwind for us, as I mentioned, moving forward.

Yeah. Patrick, this is Matt. I would just add, I mean, I think, you know, since Navigate, where we announced a ton of new innovations, it's really kind of accelerated this migration process. I think that was, you know, probably some of the curtailing of or maybe some of the slowdowns you saw in perpetual licenses add-on. I think our business is strong. I'd also call out, you know, new logos. I know that's always a concern, but it's, it continues to grow. The largest companies in the world are selecting almost every day SailPoint to help them with this challenging agentic security landscape. Our ASP, our new logo ASP for this last quarter was 22% growth. We had a really good fourth quarter as it relates to new logos and new logos ASP.

Very clear. Thank you.

Thanks, Patrick.

Thank you. Our next question comes from the line of Joseph Gallo of Jefferies. Please go ahead, Joseph.

Hi, guys. It's Annick Baumann for Joe Gallo. Thanks for taking our question. Non-human identities seem to be making deals larger and more complex. Any changes to the sales cycles? And then can you talk about pricing? Previously, I think you talked about a 40% pricing for a non-human identity relative to human. Thank you.

Yeah. Hi, this is Matt. I'll give it a shot, and then the other guys can add in if they want. Look, I do think sales cycles have elongated a little bit over the last six quarters, but I don't think there's anything that we've seen as of late that's changed that narrative.

I think when you look at our approach to strategic pricing these agents, you know, we kind of start with the fundamental basis of that, the simple principle that agents need to be deployed securely, and their lifecycle will be intrinsically tied to the human identities, right? I think there's a lot of companies that are looking at it very similar to us. You cannot secure one without governing the other. Our aim really is to meet our customers and prospects where they are. This is still relatively new to a lot of these folks, and you know, they're looking for some approaches to be able to get into this that helps them mitigate, in their mind, a potential risk of moving forward with agentic AI.

Our model and our approach to this, it starts with humans, and then we apply some level of a ratio to it. And, you know, if you remember the Jensen Huang theory, right, that his company's gonna have 2,000 agents to every one employee. Well, that's a little bit of an extreme example, but it gives you a point of reference on how we're thinking about that. And then the last part of this thing is, you know, how do you charge for this? And, you know, it's a bit of a consumption model because we want these customers to be able to deploy it without limits over the period of time, the contract.

The contracts we've done like this basically all start with a price point, and then it's what does the renewal look like? This gives us a pretty solid foundation to be able to say, "Here's the cost point, here's the ability to access and to deploy over the period, and then here's how the follow-up of the renewal would come." Those are the long poles in the tent. The last piece I'll add, because it's very important, is a fair use policy. All these proposals have a fair use policy versus sustainability to make sure that if a customer is using it outside of our expectations, right? The way you should think of it is anything over 95% of the broader customer base, right?

There's some components in there that actually protect us from runaway costs. That's—I don't know if that's helpful or not. I hope it is. But it gives you a little bit of a view in terms of how we're looking at pricing this non-human world.

Thank you. Our next question comes from the line of Peter Levine of Evercore. Your line is open, Peter.

Great. Thank you, gentlemen, and good morning. Yeah, maybe to you know, Matt, the last question maybe to a final point, and maybe for you as well, Brian, is how should we think about you know, monetization, you know, in a more consumption flex-driven model, right? Or the directional metrics you can share with us if it's revenue per identity or per AI workflow, just to kind of help frame the opportunity or for you know, for us to kind of just see what the revenue build looks like. Again, it's just I guess it's more so just quantify for us as you're securing more AI agents, just how that translates into revenue, higher attach rates, increased consumption, or again, just metrics like revenue per identity. How should we best think about that? Thank you.

Yeah. This is all about flexibility and adoption for us. We wanna get customers going on, you know, whatever their non-human identity footprint is, being able to secure that right away. Those Flex models that we've introduced, and yes, we do view this as more akin to consumption-based, but that's not how we're gonna recognize it. We're gonna actually just have a fixed fee for a period of time, let them deploy as they need to, and then monitor them and then come back to them with any kind of over usage.

Yeah. Yeah. I would say it's not a metered model. Yeah. Peter.

Great.

We recognize it financially just like we would any other kind of deal.

Certainly, this is gonna be incremental. I mean, it's hard to put an exact, you know, ten-point precision on that. But we know that the ratio of non-human to human is going to be significant. This will play itself out over time in terms of price and volume, but we do know it's gonna be incremental.

Yeah. And look, our point of view on this is we're trying to make this really, really easy for companies to do business with us and mitigate the risk, as I mentioned before. This is all about adoption. The customers that we've seen thus far, once they get in, they start to understand what they can do, what they can't do. It becomes far easier for these to make greater investments in the move. These kind of flexible pricing models that we're talking about kind of take that away and says, "You know, let's get on with the business of agentic AI.

Thank you.

Thank you. Our next question comes from the line of Gray Powell of BTIG. Please go ahead, Gray.

Okay, great. Thank you very much. Appreciate the questions. So yeah, just what are you seeing in terms of the appetite for customers to replace legacy IGA solutions this year from folks like, you know, Oracle and IBM? And are you seeing AI playing a bigger role in those conversations? Is it potentially driving any acceleration of, you know, legacy product migration?

Hey, Gray, this is Matt. I'll give you a perspective. I mean, we've really seen, I'll just use our own migrations as a point of reference, right? Once we announced all the innovations here at Navigate last year. Significant difference in these customers that are large customers that have probably made a lot of customizations, even with our own tools, feeling this overwhelming urge that they gotta move. I think these agents and agent AI. I think they've all realized this is not gonna be a we wanna move or not. It is coming at you 100 miles an hour. I think it's caused not only the legacy ones that you're talking about, the Oracle and maybe the CA of the world, but anybody who's not on a platform that can actually handle this accelerated agent AI that's coming at them. It's out the window.

That's really helpful. Thank you.

Thank you. Our next question comes from the line of Shrenik Kothari of Baird. Please go ahead, Shrenik.

Yeah. Thanks for taking my question. You closed 400+ deals tied to new innovations and emerging products contributing 17% net new ARR, which is clearly a very strong start and encouraging early signal. Just given your own commentary, many of these are still in early innings. On the go-to-market side, right, how do you view the current transition from selling a more core governance sales motion towards this more complex multi-product expansion playbook? Do you feel from training, enablement, field structure, how are you viewing you are already in place to sell this broader platform from day one? Thanks.

Yeah. I'll take a shot at that, Matt may jump on too. I think couple things, right? We just had, as you all know, our Navigate conference in the fall, and then we just had our sales kickoff just literally a few weeks ago. Big focus on a couple of different things. One is making sure people feel confident that as any customer wants to move forward with, we'll call it traditional IGA, they're very confident in what we're doing vis-a-vis our kinda current competitors and the legacy players we've seen. I think particularly on that kinda continuing to add fuel to the fire of that 17%, you know, of our ARR coming from these emerging products, a large portion of the enablement at our sales kickoff this year was around making sure people are ready and equipped to go have those conversations.

I'll point to one particular thing Matt and the team have done, and maybe Matt will give a little more color here. For the first time, we've put kind of a focused, targeted sales team around the agentic topic area. We've been bringing in new reps and SEs who come from that kind of a heritage, and that's really opening up a different sales motion to the chief AI officer or whatever the company calls their lead AI person, right? We're still obviously engaged with CISOs and identity leaders about that, but we're finding that some of the pull, the demand we've been talking about is actually coming from that AI part of the organization.

Shockingly, maybe not shockingly, sometimes they aren't as connected to the identity team as they probably should be, and sometimes we're the ones helping that bridge get built. Matt and Gary, who leads our whole field team, have kind of put a focused effort on that. Matt, maybe you can expand a little bit on what we're doing there and what we hope to accomplish there.

Yeah. Think of them as product-oriented sellers, right? They walk in the door with a set of skills to be able to talk about agentic and not only you know the value prop but also the challenges these companies have in deploying it. I think the other thing that's really important is that as Mark said it feels to us that a lot of the budget now is locked up in this head of AI or chief AI officer whatever they call it and that through going through that route we're unlocking a lot more budget and a lot more opportunity than maybe just simply going up the traditional stovepipe of you know identity up to the CISO. That's become very interesting.

Great. Appreciate your answer. Thanks.

Thank you. I would now like to turn the conference back over to Mark McClain for closing remarks. Sir?

Well, thanks everyone again for the time. We really appreciate it. Again, we'll kinda end where we started. We feel very good about the results for all of last year. We feel very good about the starting position for this year and the tailwinds we see coming from these technological shifts in our customers and our position to win. We invite you to kinda go on the journey with us this year. We feel very good about where we're at and where we're headed, and look forward to continuing to engage with a lot of you individually. Thanks for the time this morning.

This concludes today's conference call. Thank you for participating. You may now disconnect.

Goodbye

Thank you for standing by, and welcome to SailPoint's third quarter fiscal year 2026 earnings conference call. At this time, all participants are in a listen-only mode. After the speaker presentation, there will be a question and answer session. To ask a question during the session, you will need to press 11 on your telephone. To remove yourself from the queue, you may press 11 again. I would now like to hand the call over to Scott Schmitz, VP of Investor Relations. Please go ahead.

Good morning, and thank you for joining us today to discuss SailPoint's Fiscal Third Quarter 2026 Financial Results. Joining me today are SailPoint's Founder and CEO, Mark D. McClain, and our Chief Financial Officer, Brian Carolan. For the Q&A portion of today's call, we will also be joined by our President, Matthew Mills. Please note that today's call will include forward-looking statements. Because these statements are based on the company's current intent, expectations, and projections, they are not guarantees of future performance, and a variety of factors could cause actual results to differ materially. This call will also include references to non-GAAP results, which exclude certain items that do not reflect our underlying business performance. Please reference this morning's press release and our supplemental earnings presentation hosted on investors.sailpoint.com for further information regarding our forward-looking statements and non-GAAP financial measures, including reconciliations to the nearest comparable GAAP financial measures. And with that, I'd like to turn the call over to Mark.

Thank you, Scott. Good morning, everyone, and thank you for joining us today. We are thrilled to share our most recent quarterly results that include a significant milestone for the company. In fiscal Q3 2026, we surpassed $1 billion in annual recurring revenue, or ARR. With this exciting milestone, I wanted to use today's call to emphasize three key themes. First, our reimagination of identity security. Second, our accelerated pace of innovation. And third, our confidence as we look ahead to Q4 and beyond. Let me start with the broader transformation happening in identity security. The market is moving beyond static, compliance-first approaches toward real-time adaptive identity, an approach we were one of the first to champion. By unifying identity, data, and security intelligence with the SailPoint platform, we are helping organizations gain the visibility, control, and scale needed to defend against an ever-expanding threat landscape in real-time. We believe our Q3 results validate that strategy, reflecting our disciplined execution, the impact of sustained innovation, and the accelerating demand for identity security as the control point for enterprise security. This leads to my second theme, innovation. Our newer product introductions continue to drive strong interest, fueling our robust cross-sell growth. Customers see clear value in how these capabilities extend the reach and intelligence of identity across their enterprises. This is especially true of our SailPoint machine identity solution, which remains our fastest-growing launch to date. We also just completed our largest-ever global user conference series, called Navigate, where we unveiled a family of innovations that together represent what we believe to be the most significant product launch in our company's history. These innovations center on four key themes: real-time identity governance, expanded protection for digital identities like agents and machines, a universal and dynamic approach to privilege, and deeper integration of identity intelligence into the security operation center, or SOC. All of this uses our Atlas platform as the foundation. The response has been immediate and extremely positive. Customers have confirmed that these innovations bring our real-time adaptive identity vision to life in a way they have been waiting for. The early momentum we are seeing across products signals that organizations are adopting this vision quickly and with conviction. A few areas in which we are seeing particularly strong interest include SailPoint agent identity security for deeply managing the exploding landscape of agent identities, SailPoint accelerated application management for helping enterprises quickly onboard the hundreds or thousands of applications they use and to put strong governance controls around them, and SailPoint observability and insights for delivering real-time identity intelligence, stitching together signals from across the IT ecosystem to reveal hidden risks while strengthening security for all identity types. Importantly, this wave of customer interest and adoption is reinforcing the strategic path we have been driving for years. Gartner's 2025 market guide for IGA validated what we have long believed: that identity is no longer a compliance checkbox. It is a critical control for securing the modern enterprise. The industry is only beginning to recognize this shift, but our customers are already benefiting from innovations we built on this very premise. As we continue expanding our family of identity security solutions, we are also evolving how customers can acquire and adopt that innovation. We recently introduced our new flex licensing model that is designed to meet customers where they are, not only in their identity journey but in how they prefer to buy and deploy our solution. With digital identity surging, customers need the ability to take advantage of new capabilities quickly and efficiently. Our flex licensing model is built for exactly that, giving organizations more choice, more flexibility, and a clear path to adopt the innovations we are bringing to market at the pace that makes sense for them. Another growth driver this quarter is the ongoing opportunity to help our IdentityIQ customers migrate to SailPoint Identity Security Cloud. These migrations are not only modernizing their environments but also strengthening their long-term alignment with our platform. For example, one of the largest US-based logistics and shipping providers is migrating to SailPoint Identity Security Cloud. As part of this migration effort, they also added SailPoint Machine Identity Security to identity security, choosing SailPoint for our scalable, automated, and intelligent approach. With Identity Security Cloud, they will be able to support a large and growing number of digital identities and applications, giving them a clear path to expand into agent identity security and other areas like identity threat detection. Organizations are making these modernization moves because they know we can scale with them as their journey evolves. At the same time, customers are strengthening their investment with us as their identity and digital landscapes continue to expand in the number and variety of identities they manage and in the volume of applications, systems, and data those identities need to access. Our Q3 results reflect this trend. We believe this is a clear sign of the trust customers place in SailPoint to secure their rapidly growing identity service. As just one example of this expansion trend, a large energy and utility company experienced such a successful migration to Identity Security Cloud that they significantly extended their investment with us, adding SailPoint machine identity security, agent identity security, observability and insights, accelerated application management, and Atlas Enterprise, all through our flex licensing model. This combination of new product offerings attracting new customers and our existing customers expanding with us shows the strength and balance in our business model. It also underscores our clear differentiation: the breadth of identities we protect and the depth of context we provide. The SailPoint platform delivers adaptive identity by unifying identity, data, and security intelligence in real-time. The platform also enables organizations to continuously adjust access security decisions based on risk and business dynamics. We believe this combination is unmatched in the market today, and it is why customers continue to choose SailPoint to grow with us over time. And finally, it has never been easier to deploy with SailPoint. We understand that innovation only matters if customers can quickly realize its benefits, which is why we are focused on simplifying deployment and accelerating time to value across our new solutions. The recent introduction of SailPoint accelerated application management allows customers to intelligently discover and onboard all, not some, but all of their applications for immediate governance. Our digital agent, Harbor Pilot, further simplifies the administration of identity programs through natural language prompts. And our partner ecosystem is leveraging AI to streamline and accelerate application onboarding, expediting time to value for our joint customers. Taken together, our results speak to a company executing with focus, delivering value for customers today while positioning ourselves for the next stage of growth. This brings me to my third theme, confidence. Just as important as what we achieved in Q3, what it signals about the path ahead. Our pipeline remains strong and diversified, and we continue to see strong engagement across both new and existing customers. As the attack surface expands and agent-based threats accelerate, organizations are turning to SailPoint faster than ever. Our most recent Horizons of Identity report underscores why. The majority of enterprises are still early in their identity maturity in horizons one or two, and moving forward requires stronger agent management and a unified identity data model. We believe we are uniquely positioned to help them advance. While we are focused on finishing the year strong, we are equally committed to building for the long term. Our strategy is grounded in what we believe has always set SailPoint apart: the depth of identity context we deliver and the breadth of identities we protect. With governance at our core, our platform provides a level of precision and granularity that we believe others cannot replicate. It is also what enables us to expand the definition of identity security and support an adaptive identity model that protects enterprises efficiently and effectively in an increasingly dynamic environment. As an independent player, a market more recently defined by consolidation and bundled point solutions, SailPoint is emerging as a strategic identity layer in the security landscape, with a common cross-vendor fabric that delivers clarity and context across all security signals. To that end, we are continually investing in innovation that continues to push the boundary of modern identity security. More intelligence, more automation, and deeper connectivity that embeds identity context across the security ecosystem. As identity becomes the control center of enterprise security, SailPoint is defining and leading a new era for the industry. I want to thank our customers for their trust, our partners for their collaboration, and our employees for their incredible commitment and execution as we continue driving this mission forward. And with that, I'll hand it over to our CFO, Brian Carolan, to walk through the financials in more detail. Brian?

Thank you, Mark, and good morning, everyone. Thank you for joining us today. As Mark noted, this quarter, we surpassed $1 billion in ARR, closing fiscal Q3 at $1.04 billion, representing a 28% year-over-year increase. SaaS ARR grew 38% year-over-year and now stands at $669 million, representing 64% of total ARR. The consistency of our growth at scale is something we believe few in the cybersecurity market have been able to accomplish. This quarter, the durability of our growth was once again due to many drivers across both new and existing customers. The strength was also broad-based across geographies and industry verticals. We were especially encouraged by the strong initial interest in the new products we introduced at our Navigate conference. In fact, we booked orders for each newly available product despite only being generally available for one month. The demand behind these new offerings is contributing to the healthy expansion of our pipeline. Overall, we experienced strong growth in our cross-sell motion, driven by our nonemployee risk management, machine identity security, and data access security solutions, which collectively more than doubled in ARR year-over-year. As Mark noted, we also had a strong migration quarter, which we refer to as platform modernizations. The strength of our platform and ability to govern and secure all identities, from human to machine to AI agents, has led enterprises to conclude that now is the time to modernize their environment. It is also worth noting that more than half of our platform modernizations included at least one of our emerging cross-sell products. And with our new flex licensing model, we are making it simpler for customers to adopt and deploy our platform and future innovations. Additionally, we continue to see a shift towards our most fully featured business plus suite, which accounts for more than half of our suite-based ARR. The combination of strong suite-based adoption, cross-sell expansion, identity upsell, and platform modernizations demonstrates customer alignment with our strategic vision of adaptive identity security. These expansion motions contributed to our net revenue retention, or NRR, of 114% this quarter. Moving on to the P&L. In fiscal Q3 2026, we delivered revenue of $282 million, an increase of 20% year-over-year, with subscription revenue growing 22% on top of strong growth in the year-ago period. We remain committed to driving top-line growth through investments in our partner ecosystem and product innovations to extend our position as a market leader, all while delivering results in a responsible manner. In the third quarter, we delivered adjusted operating income of $56 million, or 19.8% margin, well above our guidance driven by higher term subscription revenue and disciplined expense management. We generated cash flow from operating activities of $54 million and free cash flow of $49 million, or 17.4% free cash flow margin, which reflects our robust growth profile. Turning now to guidance. For simplicity, I will refer to the midpoint of our guidance ranges where applicable. Full details can be found in this morning's press release and supplemental earnings deck. For the fiscal fourth quarter and full year 2026, we are increasing our ARR guidance by $12 million to $1.122 billion, up 28% year-over-year. From a net new ARR perspective, this implies $82 million, or 30% growth for the fiscal fourth quarter, and $245 million, or 26% growth for the fiscal year 2026. As it relates to our revenue guidance, we expect to deliver $292 million in fiscal Q4 2026, an increase of 22% year-over-year, with adjusted operating margin of 20.2% and adjusted EPS of $0.09. For fiscal year 2026, this translates to revenue of $1.069 billion, an increase of 24% year-over-year, with adjusted operating margin of 18% and adjusted EPS of $0.23. We expect our diluted share count to be approximately 565 million shares. In summary, we are confident in our strategic direction and our team's demonstrated ability to execute. Our strong quarterly results, underscored by our increased guidance, reflect the inherent strength of our market position and continued product innovation. We remain committed to driving durable, profitable growth, and we are optimistic about our ability to deliver significant long-term value to our shareholders. With a well-defined roadmap, an exceptionally talented team, and an expanding market opportunity with multiple growth drivers, we believe we are well-positioned for continued success. With that, let's invite Matt Mills, our president, to join us and open the call for questions. Operator?

Thank you. As a reminder, to ask a question, you will need to press 11 on your telephone. To remove yourself from the queue, you may press 11 again. Please limit yourself to one question and one follow-up to allow everyone the opportunity to participate. Our first question comes from the line of Joseph Anthony Gallo of Jefferies. Your line is open, Joseph.

Hey, guys. Thanks for the question, and congrats on the $1 billion ARR milestone. That's a huge achievement. Yeah. Obviously, AgenTeq security will benefit your existing customers first. But can you just talk about the top of funnel pipeline with new logos? I mean, IGA has been around for a while, but there's a huge opportunity there. Is AgenTeq forcing people to examine their human identities as well?

Thanks, Joe. This is Mark. And I just as we got into question and answer time, did want to thank everybody for joining us today and also look forward to seeing many of you tomorrow at the Barclays conference out in San Francisco. But with that, I'll probably pass that one straight to Matt because in terms of what we're seeing out in the demand landscape out in the customer, both new customers that are in the process of looking at our broader IGA offering as well as existing customers who are pretty excited about what's happening with JEDx. So, Matt?

Yeah. Thanks, Mark. Hi, Joe. Look. I think you're thinking about it the right way, that install base and then the greenfield. And I think there's a consistent thread in all of that as folks are starting to move into this. And that is how much? How much do I need to get started? There's a certain amount of still, you know, people really don't know. And so that's one of the reasons. I don't know if you saw it yet. Yesterday, we announced our flex pricing, the Navigator flex pricing models. And one of them is actually called the digital identity flex. And it allows companies to get into this at a really nominal rate. Right, and then start growing into it from there. I think that's going to help accelerate a ton of interest because that's been one of the long poles in the tent, if you will. When you look at our greenfield proposals and things that are going out, look, I know that one's going out that doesn't have AI in it. And so again, I think this is going to accelerate all of that because, with these flex models now, no longer do we have to spend a ton of time trying to figure out exactly how many people need to be able to get started. So we remain hugely upbeat. I think the field is hugely excited about this announcement we made yesterday with these Flex Navigators.

Awesome. Thank you. And then just as a follow-up, you know, Brian, you've done a tremendous job with ARR beating raises. I just wanted to double click on 4Q. I mean, you beat the first two quarters of the year by 2% approximately, 1% this past quarter. 4Q appears to be a modest acceleration in new business for ARR. I know there are moving parts, but just anything that we should think about whether it was slip deals, FX, or anything else just to gain comfort in the ramp into April? Thank you.

Yes. Thanks, Joe. Yes, I think you're right. I mean, I think we feel really good about the overall health of the business. We've been public for three quarters now. We have met or exceeded all guided metrics heading into Q4. We have a lot of confidence. I wouldn't read anything into slip deals whatsoever. I think this is a typical fourth quarter for us. We feel really good about where we stand right now with the pipeline. If you step back and look at the linearity of the fiscal year, Q4 will represent about a third of our total year net new ARR. So very consistent with prior two fiscal years. And I would say that, again, we feel really good heading into it.

Great to hear. Thank you.

Star one one. Again, we remind you to limit yourself to one and one follow-up. Our next question comes from the line of Robbie David Owens of Piper. Your question, please, Rob.

Great. Good morning, guys, and thank you for taking my question. Mark, you talked a little bit in your prepared remarks about this is a market defined by consolidation of point solutions. I'd just like to hit on the consolidation theme, especially as we've seen a lot of adjacent vendors now starting to look at the IGA market. So I realize this has been relatively recent, but any market confusion from your sense, number one? And number two, maybe rewind us why SailPoint has such a differentiated and defensible solution over the long run. Some of these other larger tech bellwethers start to play in IGA? Thanks.

Thanks, Rob. Good to hear from you. Yeah. A couple of comments. And fortunately for us, this is a consistent message. If you even go back to our IPO roadshow messaging, we talked quite a bit at that time about what we thought was a pretty defensible moat around breadth and depth. And just to define those terms a little bit, right, breadth being the range and scale of identity types. You know, obviously, we've evolved through the years from employees to nonemployees to now two big flavors of nonhuman kind of machines, you know, bots and service accounts, etcetera, and now agents. And that breadth is certainly something that we've proven that we can handle at scale, but probably what gets lost sometimes is the importance of the depth of what we can do for that breadth of identities, and that gets into these detailed entitlements. And what we're finding is that others are jumping into this game as you say, Rob, there's a lot of movement either building and or buying into the IGA space from folks who have been near us and even folks that have been a little further away in the security landscape. What they're all, I think, going to struggle with is handling those two things together. There are people coming from the access landscape that have tons of breadth of volume, but typically solutions built on that base have very little depth. They're basically login-focused and very rarely can get into the detailed entitlement structure, particularly of older bespoke applications, which are very prevalent in large enterprises today. And on the other side of people coming from, say, the privileged landscape that certainly have demonstrated an ability to go deep, their challenge is going broad because, typically, they are managing a very limited number of identities in any given part of an enterprise. Those kind of permanently privileged static privileges like database admins and sys admins. So taken together, it's that ability to start from a very rich base of breadth and depth and then rapidly expand on both vectors, you know, expanding into this rapidly exploding landscape of machines and nonhumans and agents. While continuing to invest and we think a fairly defensible moat. We know of startups that are out in the market with sub 100 deep complex integrations into applications, and we are in the tens of thousands now. So that is a fairly significant gap from some of those companies' current offerings to our offerings. So I think we feel quite good that while people are making a lot of noise and it's easy to make a lot of claims about entering this marketplace, doing the hard work of really digging into these landscapes or these complex enterprises is very challenging. I think we're starting to see some acknowledgment of that from some of the folks around us.

Great. Thanks for the color.

Thank you. And again, ladies and gentlemen, in the interest of time, we ask that you limit yourself to one question. Our next question comes from the line of Gray Wilson Powell with BTIG. Your question, please, Gray.

Great. Thanks for taking the question. Yeah. So can you talk about the Savvy acquisition that you announced back in August? And I think that underpins the accelerated application management products. So just, like, how does that impact a customer's time to get up and running on SailPoint? Are there any, like, finer points you can give there? And then to the extent that it's easing friction, is that something that can help you move down market?

Hi, Gray. It's Mark. I'll take the beginning of that. I'll probably pass it for a little more depth to Matt because he dug in now with some of the customers that are looking closer at that. But, yeah, we are really pleased to find Savvy out there. We've known of them in the market. And what they had is some pretty slick—I think that's not a technical term, but—pretty slick technology for discovering applications as they're coming through the front end to the browsers. And as a result, you know, we've had confidence now to stand up and say to customers, Chandra made this point at our Navigate conference, that we believe confidently we can discover effectively all of their applications in a relatively short time frame. But that's what we call tier one. In other words, understanding those applications are out there and exist. And when others have been claiming, oh, we're faster and better than SailPoint, it's like, well, they're just claiming they can get visibility. We then define tier two as the ability to kind of rich compliance and understanding how to, you know, authenticate who has, you know, access and then make sure that's audited and compliant. And then most deep and challenging level, we call tier three applications where we can get into automated provisioning life cycle management where changes are made automatically by SailPoint based on changes in the environment. But when you get into those tier two and tier three applications, it's much, again, much bigger moat technically for what it means to get into that realm. But where Savvy and now our SAM's, accelerated application management, SailPoint accelerated application management solution comes in is to help us get that broad coverage very rapidly and then go from there into the depth as customers require in their environment. You know, Matt, what are you seeing kind of in the demand out there in the customers?

Well, look, I think this has been something that our competitors have, you know, effectively used against us for some time. And so now we have this savvy tool, as Mark said, we market it as SAM. It is now available. And I think there's a couple of things. When you look at these tier ones, right, these typically, it's like, just want to be aware. And you can get a little bit of detail around it, like users and maybe a basic level of entitlement. But with our savvy, SAM solution, you can also categorize. So now these companies will be able to say, how many of these applications are actually using agents? And I think that's a really, really big thing. Because all of a sudden now when you realize that of your thousand applications, 900 of them are actually using these agents that maybe you're getting from a self-serve service, ServiceNow or Salesforce.com. Right? Now you're going to have to do something other than just be aware. You're probably going to want to go up to this tier two level that Mark was talking about. And all of a sudden, the stakes just got really significantly bigger. Everybody trying to get there. So we think our tool here is going to continue to allow us to get to this security around and governance around these applications much quicker than anybody else. So, I think you're going to see this basically on every deal we do, to be fair, Gray. We priced it very reasonably so that everybody can actually use it. Because we think it's a big differentiator. Just one last comment I'd add there, Gray. That is that, you know, this is part of this fundamental evolution of this space from kind of a compliance audit focus, which came out of Sarbanes-Oxley and where big companies would really only govern deeply a small handful of applications because those are the ones they had to audit. As we move toward truly securing these applications, that's why we have to get visibility and control over basically the majority, if not effectively all apps, and then go deep into deep governance and deep compliance on the ones where the customer says, that's really important to me. I want to maintain much more strict controls over those. And it's that flexibility to understand the breadth of the landscape and then go deep into various apps again, I think others are going to have a lot of struggles to catch up to where we are today after a couple of decades of going deep in many, many of these complex applications.

Got it. That was really helpful. Thanks for the detail, and congratulations on the strong results.

Thanks, Gray.

Thank you. Our next question comes from the line of Shaul Eyal of TD Cowen. Please go ahead, Shaul.

Thank you. Good morning, everybody. Congrats on the set of results. My question is about operating expenses. You guys are doing a great job. Talk to us about the internal usage of AI to also take advantage of some of these opportunities and curb cost? Thank you.

Yeah. Hi, Shaul. It's Brian here. Thanks for the question. So we are embracing AI internally. You know, we use this as an existential competitive advantage as well in terms of the tools that we're exploring across all aspects of the business, you know, from product development to go-to-market to internal G&A functions. Really exciting stuff. I think that, you know, we're still, as with many companies, in the early stages of it. But we are really excited about the use case possibilities, and we're starting to see some payback on that.

Many thanks.

Thank you. Our next question comes from the line of Peter Marc Levine of Evercore. Your line is open, Peter.

Great. Thank you, guys, and congrats on the quarter. Maybe one for Mark or Matt. As you look at traditional PAM vendors, they emphasize bolting, session recording. How do you articulate SailPoint's competitive moat as you kind of move towards this, like, new-gen PAM? How do customers still view privileging through that kind of legacy lens? And then what's kind of what's your pitch to them? And then one for Brian. Brian, on the new kind of call it, not the pricing model, but if you think about the flexing model, maybe walk us through, like, the margin impact, the pricing model, how does that work, and should we expect any kind of variations or seasonality in the model going forward as this starts to ramp up? Thank you.

I guess I'll start with the privilege, and Matt may make a comment or two. Then I'll flip to Brian for flex pricing. Peter, I guess on the first point, yeah, the things we like to say is, like, it's not that that use case, that traditional PAM use case is going away. It's not. It's just going to represent an increasingly smaller part of the challenge that customers are wrestling with. Because even the folks at Palo who obviously did the cyber acquisition are making pretty public comments now about the challenge of now taking what they've done traditionally across that limited set of permanently static privileged users and making privilege—I think they've used the word dynamic or something like that. We've used the word democratizing privilege. The concepts are the same. The idea that over time, every identity, human or nonhuman, may have reasons to be treated as a privileged account and that can basically be flexed up and flexed down—not flexed pricing. Sorry. Don't want to confuse you with that term. But the level of privilege might flex up or flex down. And as a result, it's that challenge, again, of having that broad understanding of that deep entitlement landscape so you can make choices. Based on context is going to start to become a big word here. Not just the who/what is accessing what information, but from where, at what time, with what intent. That's going to be another concept we'll be talking more about, particularly with agents. What is the intent an agent has in accessing information, and does that seem typical or expected? And if so, great. If not, I'm going to escalate the privilege required to get to that in very real time. In a dynamic just-in-time kind of notion there. So this idea that privilege will become ubiquitous and flexible is quite different from the technology that was required to build static privilege—a kind of a permanent safe vault of these credentials that were kind of checked out and checked in for very important use cases like database administrators and such. So it's not that that isn't an important part of securing the environment. It still is. Right? But we believe that the next wave is going to be far more about this broad-based ubiquitous dynamic privilege. With all due respect, the folks that have come from PAM don't have any particular advantage at solving this problem versus folks like SailPoint who come from a broad and deep understanding of the entitlement landscape. So that's why we think we're well-positioned to handle that.

And then I'll just comment on just the new flex licensing model. Flex navigators is what we call it. Again, we're really excited about this. We think it's going to help customers buy and consume the way they want to and really optimize their investment, deploying what they need, when they need it, recognized ratably over time. This will be SaaS. It'll be The flex licensing pool is tied to our rate cards, list prices, so I wouldn't read into anything in terms of an overall to see how margin degradation. So I think we're going to be really excited customers utilize this in the best way for their environment. It's also going to help accelerate migrations or what we call platform modernization. So helping our on-prem customers adopt and grow into an ISC identity security cloud platform, faster and easier. In a much more economical way.

Great. Thank you, gentlemen. Congrats again on the great quarter.

Thank you. Our next question comes from the line of Meta Marshall of Morgan Stanley. Your line is open, Meta.

Hey, everyone. This is Ryan Lances on for Meta Marshall, and thanks for taking the question. Guess just from a go-to-market standpoint, you've announced multiple new product offerings and a new flex pricing model. So I'm just curious if you could provide some additional color around how ramping sales personnel on these new products and initiatives more broadly has trended thus far and maybe just kind of how you're thinking about sales hiring going forward? Thanks.

Hi, Ryan. This is Matt. Look. I think this is something we certainly pay attention to. I think if you look at our go-to-market model, we have a lot of specialization that's built up historically in our solution engineering organization, and that's where a lot of that comes from. I think one of the things you'll see from us, we started this last year adding a bit of these specialty sellers that are specific to an area might so take into consideration data. We think that's a little bit of a different selling motion, and it warrants at least initially some expertise to come in and, you know, alongside the field team. So I think you can see us looking at things like that as we go forward, and that's one example of where we moved.

Thank you. Our next question comes from the line of Jonathan Rakover of Cantor. Your line is open, Jonathan.

Yes. Good morning, and thank you. I'm wondering if you could touch a little bit more on the success you called out with data security. But, you know, I would assume that the attach rate could be quite high on agent identity, but I realized it's still early in that journey. So maybe just touch on the use case that's driving that success. And just, you know, from a big picture viewpoint, we hear a lot of identity companies talk about the importance to data as it relates to identity security. Can you just, you know, touch on that strategy at SailPoint as well? Thanks.

Hi, Jonathan. It's Brian here. I'll start, and I'm going to hand it over to Matt for a little bit more color. So, I mean, we're really excited about just kind of the, I'll say, the market basket of all of our cross-sell motions that contribute to our NRR number of 114%. They've more than doubled year over year, and that's a composition of things like nonemployee risk management, machine identity security, data access security, and then more recently, we're starting to see some green shoots from AgenTeq identity security and many of the other products that we launched at Navigate. So there's a lot of interest at showing up in the pipeline. I would say it's still early on some of the navigate launches, but very exciting from our perspective, and we're starting to see a strong attach rate of the new cross-selling motion. In fact, out of our new SaaS customers, this past quarter, we had a little bit more than a 40% attach rate of some of these new cross-sell motions. So, again, they we are landing with some of them right out of the gate. And that's only going to allow for some more expansion as we have more and more product out there that we just launched. It's the only point we can make. I'll jump in and probably pass to Matt again on this, Jonathan. We've had a product out in that data landscape for quite some time because we were pretty early on in identifying the fact that while the history of this space has largely been about application protection, you know, who or what are these identities and what apps can they access, and within the apps, what entitlements. Quite a while ago, we said, well, at some point, this space is going to need to incorporate direct access of those identities to data, both structured and unstructured. And things like, you know, the family of Microsoft apps, PowerPoint, Word, etcetera. But now as well as deep data access and the things like Snowflake and Databricks. Right? Well, there's going to be, we think, a continued need for that human direct access to data, which is, again, we'll be building on the heritage we've got with what we've called our data access security product. But importantly, in this new realm of AgenTeq, it's that full connection thread from the human or business function that has authorized an agent to take access directly to data, whether that data is in, again, Snowflake, Databricks, out in an LLM somewhere, understanding that full thread that's going to be extremely challenging for folks who don't have that breadth and depth already defined. And our data offering will actually be a part of our advanced AgenTeq coming in the future. We kind of pointed toward that at Navigate, but it's not yet available. I think, Matt, we can talk about kind of where that's headed.

Yeah. No, Jonathan. If you're intuitively, you're right on. Right? We believe the same thing that it's going to be awful hard to secure the work of an agent without data. So I think we talked a little bit about that at Navigate. I think you look at us historically, our data access security product has been unstructured. It's now moving over to structured data as well. And so I think you're going to see as we roll out that product, DAS will it'll drag DAS with it. So it's, we're pretty excited about it.

Yep. Very helpful. Thank you.

Thank you. Our next question comes from the line of Shrenik Kothari of Baird. Line is open, Shrenik.

Hey. Yeah. Congrats, and thanks for taking my question. So you did address the newly launched product traction, which is very impressive. I would like to double click into the observability insights you described as fabric. Of course, that's it is a telemetry across systems. Can you just walk us through how customers are using or looking to use that in practice? What's the monetization model there? And structurally, does this give you leverage to embed into broader SOC workflows and capture that wallet share as well? Thanks a lot.

Well, I'll start with we'll do a lot of these. We'll probably start and hand up to Matt. Right? I think on this one, yes, you got it exactly right. There's going to be a number of different things we think will be pretty powerful coming out of that O and I product. One is just the visualization of this connectivity, again, of that thread I talked about. When I can look in identity and understand the path all the way through an application or not through an application directly to the data and understand whether that's appropriate and, you know, being used as expected. And tying that as you observe into the SOC, whether that means kind of from our product line to other product lines from folks like Zscaler or CrowdStrike or Palo, or possibly embedding that into some other people's workflows in their SOC directly. And so we're having both kinds of conversations today, kind of I call it, higher level integration and perhaps even deeper kind OEM level integration that we think could be interesting over time. It's that visualization and understanding of that full value chain, if you will, that that product's going to be focused on. And then the insights part of it is to expose to the security teams and the identity teams whether there's current risk or potentially latent risk that needs to be identified and dealt with before something negative happens. So it's this idea of visibility into the true risk profile of a lot of these things is very, very difficult today. You will hear if you talk to I'll call them honest people that work in the SOC that one of their biggest challenges is when they see a vulnerability or a threat emerging, coming through any one of those landscapes out in the cloud, through a device, on the network, you know, all the places we look for threats, the great majority of those things, those tools are identity blind. They don't understand the identity that's either creating that access or could be negatively impacted. And so it's bringing together this rich identity context we believe SailPoint is uniquely positioned to provide tied into that deep security and threat landscape from the SOC and all those kinds of tools we mentioned. That's going to be a new era, we think, of much better defense against the bad and the threats merging. So that's you're right on in terms of where we're headed with that product and what we think will be kind of a breakthrough the landscape of really giving true security tools to the SOC relative to identity.

Great. Very helpful color. Thanks a lot.

Thank you. Our next question comes from the line of Matt Hedberg of RBC. Your line is open, Matt.

Hey, guys. Good morning. Thanks for taking my question. Congrats on the results from me as well. Brian, I realize you're not giving any sort of perspective on fiscal '27 yet. You got it so close off 4Q. But any sort of, like, high-level thoughts or guide rails on kind of how you're kind of approaching the new year, whether it be growth or margins or anything like that that would help us?

Yeah. Sure. Hi, Matt. I would say that we're really pleased with our margin performance this past year. I think we've demonstrated our ability to expand margins, you know, in a nice healthy basis while, you know, driving high top-line growth. I would say that this year, we benefited to a certain extent by strong term-based revenue through strong, you know, Fed renewals, some slightly longer durations. Not so sure I expect that to continue FY '27. So that was a little bit of a tailwind for us this past year. We're still going to invest for growth. I think, you know, we're going to favor, you know, point of growth over profitability because we know we can deliver profitability. But we're in a rare universe here in terms of companies that can deliver into the high twenties almost touching 30 of ARR growth while delivering significant margin expansion. So we feel like we're really uniquely positioned. We're going to continue to take advantage of our competitive opportunity.

Thanks.

Our next question comes from the line of Junaid Siddiqui of Truist Securities. Your line is open, Junaid.

You've talked about significant customer interest in your agent identity security solution. And my question is, what hurdles do you potentially anticipate in customer adoption of AgenTeq AI for identity security? And how are you preparing organizations to trust AI-driven identity decisions at scale?

Well, Junaid, I'll unpack that if I can. I think I heard two different questions in there. And one is, what are we going to do to help customers manage their agent environment? And as we've often said, there's basically two large flavors of that. Right? There's going to be all the agents that are proliferating from the big vendors, Salesforce, ServiceNow, Workday, etcetera, etcetera, etcetera. And mid to large organizations are clearly going to build a set of bespoke agents with kind of a genetic frameworks that they think are unique to their environment. So both flavors of agents, we think, are absolutely coming and coming at volume and scale. There's a lot there's a little bit of noise out there about bubbles and all that. And our view is, look. What companies are doing is trying a lot of things and experimenting and trying to figure out what works. But our belief is, certainly, as we get into the next year, there's going to be pretty widespread adoption. So there's the AgenTeq adoption of our customers and what they need help in managing those identities just like they manage all other flavors of identities. A different but also important question is, are they going to trust that we in the security landscape are using AI effectively to provide the value we provide? And I think on that front, again, we're doing a lot of work internally for everything from how we see patterns that might indicate there is a risk out there, how quickly we address concerns when they arise from customers by using LLMs ourselves to rip through lots of information and find out kind of root cause analysis of what might be going on. So both are really important threads. They're just kind of different. Is all the technology we're building to help customers manage this agentic explosion in their environments. The other is all the ways we're leveraging AI and various technologies inside our product line, including our own, you know, bespoke agentic technology for customers, Harbor Pilot, that's called. It's going to be a growing family of AgenTeq capabilities within SailPoint to address these problems. So I just wanted to tease apart. I think there's both in there. I don't know if you wanted to probe anymore in one or the other, but they're both very important to us.

Great. Thank you so much. That's very helpful.

Okay. You bet. Thanks.

Thank you. As a reminder, to ask a question, please press 11 on your telephone. Our next question comes from the line of Todd Weller of Stephens. Your line is open, Todd.

Thanks. I'll echo the congratulations. Good morning, and thanks for the question. Look. You robust set of new capabilities were launched at Navigate. Could you also talk about the potential for those to be a catalyst to drive more SaaS migrations? Then second question would be, last quarter, you talked about seeing an acceleration in legacy displacements. Just wanted to see if there was an update on what you're seeing there.

Hi, Todd. It's Brian here. I'll start and then maybe hand it over to Matt for any additional color. So we actually had a very strong platform modernization quarter. When I say platform modernizations, these are customers that are migrating from our on-prem solution to ISC or Identity Security Cloud. All of our new offerings, they are SaaS, so they will be on the identity security cloud platform. So I think that's really kind of the innovation carrot that we say in terms of customer see our vision and they see where we're going to help them with their needs not only today, but also into the future. And we've actually seen when we migrate more than half of these migrations include emerging cross-sell modules. And that's what drives really kind of the two to three uplift that we often talk about of the ARR that our on-prem customers are spending with us today in the form of typical annual maintenance. We see a two to three x multiplier on that when they do migrate to Identity Security Cloud. The good news that, you know, there's a strong amount of interest, and it's still early. So we've only migrated about 15% of our historical maintenance base. And there's still 85% to go. So we view that as actually nice tailwinds, you know, for the next two, three years at least. And I think that's only going to compound with all these new product offerings and when customers need to, you know, meet the challenges of AgenTeq and observability and insights that we talked about earlier that Mark alluded to. So, again, we're really excited about the possibility.

Our next question comes from the line of Ben Bollin of Cleveland Research. Your line is open, Ben.

Good morning, everyone. Thank you for taking the question. You touched a little bit on some pieces, but when you look at nonemployee risk management data access and machine identity, you mentioned that that doubled year over year. Can you talk about the contribution to ARR? Where does that stand today? And how do you think about that progression looking forward? And then a follow-up on Flex. What did duration of those contracts look like versus traditional deals? And how do the unit economics differ for the customer? Thank you.

Hi, Ben. It's Brian here. So while we won't talk specifically about the ARR number, it is doubling year over year. We also talked about how it contributes to our net revenue retention rate. It's probably in the low single digits if you combine the full basket of all those modules combined. Which, again, it's a high-growing, fast-growing basket of modules that's getting strong adoption and attach rate. With respect to the flex model, the navigator model, this is going to be no different from any other SaaS arrangement for us. It's typically an average of three years in length. And I think I mentioned earlier, this will be SaaS, and it will be ratably recognized.

Thank you. Our next question comes from the line of Joshua Tilton of Wolfe Research.

Hey, guys. Thanks for sneaking me in here. Kinda wanna go back to the first question that was asked. And my question is, I'm trying to reconcile what is an incredibly positive earnings call and a customer base that is increasingly embracing, like, your new vision of identity with the lighter beat in the quarter. So my question really is, like, was there anything around fed? Or you keep emphasizing that it was a huge quarter for these platform migrations. Is there anything we need to understand about how term ARR becomes SaaS ARR as these migrations happen? Or is there anything around Fed or any other verticals you can kinda help us bridge, you know, what is an incredibly positively toned call. Kind of the lighter performance in the quarter, that would be very helpful. Thank you.

Josh, it's Brian here. I think you need to step back and look at, you know, we're guiding to an annual number. This number is greater than a billion dollars, and we're beating on that. I think, you know, when you look at an beating on an annual number, you know, that's like four x of quarterly guide. So 1% beat on, you know, an annual ARR number is like a 4% beat on a quarterly. That aside, I think you have to look at also the net new ARR performance. It was $58 million. That's up 24% year over year. And the quality, which, by the way, that's 20% above the guidance. I think you need to also look at the underlying quality of the beat, which, SaaS net new ARR grew 52% year over year. So we feel really good about the overall health of the business, surpassing a billion dollars. Plus or minus 30% growth over the last eight quarters. While expanding margins nicely, and we're flowing through the full beat. On ARR. So I would not interpret anything. We had a very strong quarter on a variety of fronts across all verticals. You know, Fed was strong. We did have, you know, some strong term revenue out of Fed. Some slightly longer durations. That aside, SaaS also performed extremely. Again, I mentioned the net new ARR being up 52%. With a very strong attach rate. So I think we sit here today in Q4, and we feel really good about the business.

Appreciate the color. Loud and clear. Thank you so much.

Thank you. Our next question comes from the line of Gregg Moskowitz of Mizuho. Please go ahead, Gregg.

All right. Thank you for taking the question. Mark, I wanted to ask about your Just in time capabilities and how additive you think they will be going forward to your customers and to SailPoint's business more broadly? Also, how valuable will JIT be when it comes to agentic protection?

Yeah. Thanks, Gregg. I think it's too early for us to kind of give you any sense of what that looks like in a financial impact. As Brian commented, even some of these other market basket of newer things we've introduced are—we're on such a large overall base now, even if they're going quite well, they're going to take a little while to have a financial impact. But that said, I think this trend is critical, and I'm really happy with a lot of the questions y'all are asking today because I think everybody's tuning into it more and more that the world of kind of a static, we sometimes call admin time approach to identity governance is shifting to a real-time, just-in-time identity security posture. And that is no more important than in the realm of agentic because it hit machine speed, as it's sometimes said, an agent that either goes rogue or has the potential to go rogue can do an awful lot of damage far faster than a human ever could. We're going to have to get very fine-tuned into understanding both the setup these things have, right, that configuration administration setup that what is this agent? Where did it come from? Even if it's being created relatively transiently, where did it come from? What's it designed to do? What's its intent? Again, that's a word I think we're going to be talking more and more about. And then is anything going awry as that thing is working? And so our ability to sense changes, to detect potential anomalies, to look for patterns, is going to have to be increasingly real-time. And as we said on the earlier question, richly tied into the SOC. We aren't going to have all those signals and patterns coming from the SOC just like they don't have all the patterns and signals about the identity landscape. But when we bring those together, in real-time, I think that's where we're going to really start to change the game for these customers that are trying to deploy this incredible new technology of LLMs and AI and agents but are still quite concerned about the risks that come along with that without good control. So I think it is kind of an inflection point shift in our landscape for the next few years. And you've heard it, but I'll say it one last time. We don't think there's anybody better positioned than SailPoint to help customers navigate that journey and take advantage of these new technologies.

Great. Thanks, Mark.

Thank you. I would now like to turn the conference back to Mark D. McClain for closing remarks. Sir?

My closing remarks will be brief. Thank you all for joining us. We really appreciate all the interest and the questions. And as Brian said, we are very pleased with these results, and you're getting a strong sense of our confidence heading into the end of the year. And look forward to, again, going deeper on some of these and follow-on calls with some of you and or at the conference tomorrow in San Francisco. So thanks for joining us. Appreciate everybody's questions. Have a great rest of your day.

And this concludes today's conference call. Thank you for participating. You may now disconnect.