SailPoint’s quarterly results have become a useful barometer for the identity governance market. The company reported second quarter fiscal 2027 revenue of $309 million with annual recurring revenue of $1.231 billion, up 25% year over year, alongside adjusted earnings per share of $0.09. For CISOs and IAM practitioners, the numbers matter less as a financial story than as evidence of where enterprise identity spending is actually going, and specifically how much of it is being redirected toward governing non-human and AI agent identities.
The commercial problem the market is grappling with is straightforward. Identity governance and administration was designed around a population of employees whose access changed at human pace and whose lifecycle was anchored to an HR record. That population is no longer the majority of identities in most enterprises. Service accounts, workload identities, API credentials, CI/CD pipeline tokens and increasingly autonomous AI agents now outnumber human users by a substantial margin in many environments. Each of them is an identity. Each carries entitlements. Very few of them have a manager who can be asked to certify access at quarter end.
That mismatch creates a governance debt that compounds quietly. An agent granted read access to a data warehouse for a proof of concept does not submit a leaver ticket when the project ends. A service principal created to test an integration does not appear in an access review because no reviewer owns it. Over time the estate fills with entitlements that are technically valid but operationally unowned, and the organisation’s ability to answer the question of who can reach what degrades without any single system appearing to fail.
Growth is following the governance gap. The pattern in SailPoint’s results, and across the wider market, is that expansion is coming from customers extending identity security to identities that were previously out of scope. That includes agentic workloads, where the governance requirement is not just what an agent can access but what it attempted, what it did with delegated authority, and whether that behaviour stayed within policy. Runtime control and behavioural oversight are becoming part of the IGA conversation rather than adjacent to it, because a static entitlement model cannot describe an identity that makes thousands of decisions an hour.
Consolidation pressure is real. Platform vendors are responding by absorbing point capabilities. SailPoint’s completed acquisition of Entro Security, its partnerships around cloud and endpoint telemetry, and its expanded platform access programme all point in the same direction: buyers want fewer consoles and a single source of truth for identity risk. For practitioners, the practical implication is that evaluation criteria are shifting. Depth of connector coverage still matters, but so does the ability to ingest identity context from cloud infrastructure, endpoint security tooling and AI platform logs without bespoke integration work.
What security leaders should take from the quarter. First, budget conversations framed purely around human access certification are increasingly hard to win. Framing identity governance around the growth of non-human identities, and the specific risks they introduce, aligns with where spending is actually moving. Second, the identity lifecycle management model needs to be extended rather than replaced. The core disciplines of ownership, attestation and separation of duties remain valid; what changes is that they must be applied to identities that never appear in an HR feed. Third, agentic identity demands a policy enforcement point close to the workload. Governance that operates only on a monthly cadence cannot constrain an agent that acts continuously.
The revenue trajectory suggests enterprises are willing to pay for that extension. The outstanding question for most security teams is not whether to broaden identity governance beyond human users, but how to sequence it. The organisations making progress tend to start with discovery, establishing an accurate inventory of non-human identities and their owners, before attempting automated policy enforcement on a population they cannot yet describe.