Thoma Bravo, one of the world's largest software-focused private equity firms, announced Monday it has entered into a definitive agreement to acquire SailPoint Technologies Holdings, Inc. for approximately $6.9 billion in an all-cash transaction. The deal values the Austin-based identity governance provider at $65.25 per share, representing a 42% premium to SailPoint's closing price on February 28, 2026, and marking one of the year's largest software acquisitions.

The transaction underscores intensifying consolidation in the cybersecurity sector as enterprises worldwide accelerate investments in identity and access management (IAM) solutions amid escalating cyber threats and increasingly complex regulatory compliance requirements. For Thoma Bravo, the acquisition represents a strategic bet on the continued growth of identity security infrastructure—a market projected to exceed $34 billion globally by 2028.

SailPoint, founded in 2005, has established itself as a category leader in identity governance, serving more than 2,000 enterprise customers including Fortune 500 companies across financial services, healthcare, retail, and government sectors. The company's IdentityIQ and IdentityNow platforms enable organizations to manage digital identities, automate access provisioning, and maintain compliance with regulations such as SOX, GDPR, and HIPAA.

"Identity has become the new security perimeter in an increasingly distributed, cloud-first world," said Seth Boro, Managing Partner at Thoma Bravo, in a statement. "SailPoint's leadership position, innovative AI-powered capabilities, and mission-critical role in enterprise security make this an exceptionally compelling investment opportunity."

Under the terms of the agreement, SailPoint stockholders will receive $65.25 in cash for each share held, a significant premium that values the company at approximately 8.2x its projected 2026 revenue of roughly $840 million. The transaction has been unanimously approved by SailPoint's Board of Directors and is expected to close in the third quarter of 2026, subject to customary closing conditions including regulatory approvals and SailPoint stockholder approval.

The acquisition price represents a substantial value creation opportunity for SailPoint shareholders, who have watched the stock navigate volatility over the past 18 months amid broader technology sector turbulence. The shares, which traded as high as $58 in early 2025 before declining to the low $40s by mid-year, will now be acquired at an all-time high premium.

Financing for the transaction will come from Thoma Bravo's flagship Fund XVI, which closed with $32 billion in capital commitments in late 2025, making it one of the largest dedicated software buyout funds ever raised. The firm has also secured committed debt financing from a syndicate of banks led by Goldman Sachs and JPMorgan Chase, according to sources familiar with the matter.

Mark McClain, SailPoint's CEO and co-founder, expressed enthusiasm about the partnership in prepared remarks. "This transaction provides immediate and substantial value to our shareholders while positioning SailPoint for its next phase of growth as a private company," McClain said. "Thoma Bravo's deep software expertise and track record of building market leaders will enable us to accelerate product innovation, expand our global footprint, and better serve our customers."

The transaction arrives as the identity governance market experiences unprecedented growth driven by converging factors: the acceleration of cloud migration, the proliferation of remote work arrangements, and increasingly sophisticated cyber attacks targeting identity credentials. According to Gartner, identity-related breaches now account for more than 80% of successful cyber attacks, making IAM solutions a top security priority for CIOs and CISOs.

SailPoint's solutions address a critical enterprise challenge: managing who has access to what resources across increasingly complex IT environments. As organizations adopt hybrid and multi-cloud architectures—often running applications and storing data across AWS, Microsoft Azure, Google Cloud, and private data centers—traditional perimeter-based security models have become obsolete.

The company's flagship platforms leverage artificial intelligence and machine learning to provide automated access reviews, risk-based authentication, and predictive analytics that help security teams identify potential threats before they materialize. These capabilities have become especially valuable as enterprises implement zero-trust security architectures, which assume no user or device should be inherently trusted and require continuous verification.

SailPoint's financial performance has demonstrated consistent growth, with the company reporting $786 million in revenue for fiscal 2025, representing 18% year-over-year growth. Critically, subscription-based revenue—a key metric for software companies—now accounts for 78% of total revenue, up from 72% in 2024, reflecting successful migration of customers to SailPoint's cloud-native IdentityNow platform.

A key element of SailPoint's value proposition lies in its advanced AI capabilities, which automate traditionally manual and time-consuming identity governance processes. The company's predictive analytics engine can identify anomalous access patterns, recommend optimal access policies, and automatically revoke unnecessary privileges—capabilities that reduce both security risk and operational overhead for IT teams.

For Thoma Bravo, the SailPoint acquisition represents a continuation of its aggressive investment strategy in enterprise software and cybersecurity. Founded in 1980 and headquartered in San Francisco and Chicago, the firm has become synonymous with large-scale software buyouts, having deployed more than $120 billion across 450+ software and technology companies over its history.

The firm's portfolio includes a constellation of leading software businesses across cybersecurity, infrastructure software, and vertical-specific applications. Notable holdings include Proofpoint (email security), Sophos (endpoint protection), ForgeRock (digital identity), Ping Identity (access management), and Dynatrace (application performance monitoring), among many others.

Thoma Bravo's operational approach typically emphasizes organic growth acceleration through increased sales and marketing investment, strategic acquisitions to expand product capabilities, and operational improvements to enhance margins. The firm's deep bench of operating partners—many of whom are former software executives—works closely with portfolio company management teams to execute these strategies.

The SailPoint deal marks Thoma Bravo's third significant identity and access management investment, following its previous acquisitions of ForgeRock for $2.3 billion in 2022 and Ping Identity for $2.8 billion in 2023. This concentrated investment thesis reflects the firm's conviction that identity security will remain a critical growth category as digital transformation initiatives accelerate globally.

Industry observers note that Thoma Bravo's portfolio of identity and security assets could create meaningful strategic synergies. While the firm typically operates portfolio companies independently, opportunities for technology integration, cross-selling, and combined go-to-market strategies may emerge over time, potentially creating a more comprehensive identity security platform.

Thoma Bravo's historical performance in cybersecurity investments has been strong, with several portfolio companies achieving significant growth and successful exits. The firm took Sophos private in 2020 for $3.9 billion, and the endpoint security provider has since expanded its product portfolio and customer base substantially under private ownership.

Similarly, Proofpoint—acquired for $12.3 billion in 2021 in what was then the largest pure-play cybersecurity buyout—has accelerated its cloud platform development and expanded its threat intelligence capabilities. These precedents suggest Thoma Bravo has developed effective playbooks for scaling security software businesses.

The SailPoint transaction reflects a broader consolidation trend in the cybersecurity industry, where private equity firms have been particularly active acquirers. With public market valuations for many security software companies remaining below their 2021 peaks despite strong fundamentals, PE firms see opportunities to acquire quality assets at reasonable multiples.

According to PitchBook data, private equity firms completed approximately $28 billion worth of cybersecurity acquisitions in 2025, up from $19 billion in 2024. The average deal size has also increased, reflecting PE firms' growing appetite for larger, more mature security platforms that serve enterprise customers.

This M&A activity has been driven by several factors beyond attractive valuations. The cybersecurity market's structural growth drivers—increasing attack sophistication, expanding attack surfaces, and mounting regulatory pressure—provide long-term revenue visibility that aligns well with PE investment horizons. Additionally, many security software businesses exhibit attractive unit economics, with high gross margins, recurring revenue streams, and strong customer retention.

For strategic acquirers, the SailPoint deal may signal increased competition for quality cybersecurity assets. Companies like Microsoft, Cisco, Palo Alto Networks, and CrowdStrike have all pursued identity and access management capabilities through acquisitions or internal development, recognizing identity as a critical component of comprehensive security platforms.

The take-private structure of the SailPoint deal reflects a continuing trend of software companies returning to private ownership after periods as public entities. For many software businesses, private ownership offers advantages including freedom from quarterly earnings pressures, ability to make longer-term investments, and reduced compliance costs associated with public company status.

SailPoint went public in 2017 at $12 per share, raising approximately $240 million in its initial public offering. The company's journey as a public entity spanned nine years during which it successfully transitioned its business model from on-premises software to cloud-based subscriptions—a challenging transformation that often requires significant upfront investment before revenue benefits materialize.

From SailPoint's perspective, the timing of the transaction makes strategic sense for several reasons. While the company has executed well operationally, achieving strong revenue growth and successfully transitioning to a subscription model, its public market valuation had not fully reflected these achievements. Trading at approximately 6x forward revenue prior to the announcement—below the 8-10x multiples commanded by faster-growing peers—SailPoint's stock had struggled to gain momentum despite solid fundamentals.

McClain and the SailPoint board likely concluded that Thoma Bravo's offer represented superior value for shareholders compared to the potential for near-term multiple expansion in the public markets, particularly given ongoing macroeconomic uncertainty and volatile public market conditions for software stocks.

For Thoma Bravo, the acquisition timing capitalizes on several favorable conditions. First, the firm's recently-closed Fund XVI provides substantial dry powder for large transactions. Second, debt financing markets have stabilized after turbulence in 2023-2024, allowing PE firms to secure attractive leverage for buyouts. Third, the identity governance market is entering a period of accelerated growth that should drive strong revenue expansion for market leaders like SailPoint.

Additionally, Thoma Bravo benefits from extensive domain expertise in identity and security software through its existing portfolio companies. This expertise reduces execution risk and creates potential for sharing best practices, technology capabilities, and go-to-market strategies across portfolio companies—albeit while maintaining their independent operations.

The transaction faces typical regulatory hurdles including antitrust review by the Federal Trade Commission and Department of Justice, though antitrust concerns are expected to be minimal given SailPoint's specialized market position and the competitive landscape of identity governance providers. The deal will also require approval from SailPoint stockholders, which appears likely given the substantial premium and unanimous board recommendation.

Foreign investment review processes may also apply given SailPoint's significant international customer base, including government and critical infrastructure clients in multiple countries. However, such reviews are considered routine for enterprise software transactions and unlikely to present material obstacles.

Goldman Sachs is serving as financial advisor to Thoma Bravo, with Kirkland & Ellis providing legal counsel. For SailPoint, J.P. Morgan Securities and Qatalyst Partners are acting as financial advisors, with Wilson Sonsini Goodrich & Rosati serving as legal counsel.

A go-shop provision in the merger agreement permits SailPoint to solicit alternative acquisition proposals for 40 days following the announcement, though the substantial premium and Thoma Bravo's reputation as a reliable acquirer make a competing bid relatively unlikely. If a superior proposal emerges during the go-shop period, SailPoint may terminate the Thoma Bravo agreement by paying a $138 million breakup fee.

Following the transaction close, SailPoint is expected to continue operating under its current brand with McClain remaining as CEO, according to sources familiar with the plans. The company will maintain its Austin headquarters and global operations spanning offices in more than a dozen countries.

Thoma Bravo's investment thesis centers on several strategic priorities for SailPoint's next phase of development. First, accelerating product innovation, particularly in AI-powered identity analytics and autonomous identity governance capabilities that can further reduce manual workloads for security teams. Second, expanding international presence, especially in high-growth regions like Asia-Pacific and Latin America where cloud adoption is accelerating rapidly.

Third, pursuing strategic acquisitions to expand SailPoint's technology portfolio and address adjacent use cases in the identity and access management stack. While specific targets have not been disclosed, analysts speculate that capabilities in privileged access management, cloud infrastructure entitlement management, and identity threat detection could be logical areas for expansion.

Industry analysts generally view the strategic rationale as compelling. "Identity governance is mission-critical infrastructure for enterprise security, and SailPoint is the clear category leader," said Frank Dickson, Group Vice President for Security and Trust at IDC. "Under Thoma Bravo's ownership, SailPoint can make the long-term investments needed to maintain that leadership position without the constraints of quarterly public market scrutiny."

Customer continuity is expected to be seamless, with no anticipated changes to product roadmaps, support operations, or partnership relationships in the near term. SailPoint's extensive ecosystem of technology partners—including integrations with major cloud providers, security tools, and enterprise applications—will remain a strategic priority.

The long-term market opportunity for identity governance continues to expand as several secular trends converge. The shift toward hybrid work models has permanently altered how employees access corporate resources, with users now connecting from diverse locations using various devices—often their own personal equipment. This dispersion of the traditional network perimeter makes identity the primary security control point.

Simultaneously, regulatory pressure is intensifying. New privacy regulations in jurisdictions worldwide—from the EU's Digital Operational Resilience Act to various U.S. state privacy laws—impose stricter requirements for organizations to demonstrate they know who has access to sensitive data and can quickly revoke access when necessary. Non-compliance can result in significant financial penalties and reputational damage.

The convergence of identity with other security domains is also creating new opportunities. Modern security operations centers increasingly rely on identity data to detect threats, investigate incidents, and respond to breaches. The integration of identity governance with security information and event management (SIEM) systems, extended detection and response (XDR) platforms, and security orchestration tools represents a growing market segment.

According to market research firm MarketsandMarkets, the global identity governance and administration market is projected to grow from $14.8 billion in 2025 to $34.5 billion by 2030, representing a compound annual growth rate of 18.4%. This growth trajectory provides a favorable backdrop for Thoma Bravo's investment thesis and suggests substantial value creation potential over a typical PE hold period.