Mark McClain, SailPoint | SailPoint Navigate 2026

Thank you.

It's a great pleasure to be with you both. So excited to be here.

I did have some help, as they say, but yeah, no, it's still kind of mind-boggling sometimes to be in rooms like this where not so long ago, you know, the whole company, much less our Navigate conference, fit in a single smaller room. So to see this, you know, kind of taking over a couple of Marriotts in downtown Austin is kind of mind-boggling, but it's just a credit to our amazing team that's done such great work for years. It's also a strong indicator of what's happening in this market and the excitement and somewhat concern both about what's happening in the market, and I think folks are just leaning in on this topic. So it's a fun time to be in identity right now.

Indeed, yes. We were joking about old-time references before we got on camera. So this is not your grandfather's SailPoint, I think was a reference made earlier. I think that's an old Oldsmobile ad or something. But yeah, we've really shifted gears pretty dramatically in the last few years. The heritage of the company was sort of what we would call the administrative side of identity, right? How do you set things up correctly? That became lifecycle management. How do you validate it or, you know, check on it on a periodic basis? That became the compliance side of our business. Important disciplines, useful disciplines, no one's ever felt like this wasn't something they needed. But what's happened with this rise of non-human and particularly agentic is just a complete shift to we do need those things. We need administrative, we need, you know, good compliance controls. But the real issue now in this space is effectively rebranded identity security now, right? What it's really about is how do you secure all these identities, especially this explosion of non-human identities. And so it took a very small amount of analysis for our technical team to go, you know, we can't do this effectively in admin time. We have to be in the real-time decision-making cycle of is this agent, with its context and its intent, doing what we expect or want it to do? And if not, we have to stop it right now. So you have to be kind of in the real-time loop to make those decisions and to be able to stop bad behavior. As we saw with the hacking face, I don't want to shift topics yet, I guess, but as we saw with the hacking face, things can go off the rails and go badly very fast in an agentic world. So the days of responding in days or weeks are not going to be relevant in this new world.

Apparently, the world's ending in a decade. I'm kind of sad about that.

The fate of humanity. And I thought we were just writing better blogs.

What happened here? What happened? Right.

Very big shift, I think, Rebecca, because at the end of the day, right, I've kind of been in the IT space a lot of decades now. Can't even say years, I have to say decades, so sad. But at the end of the day, right, I like to use this phraseology, which is we've been looking through various lenses at security for a long time. We've looked through the lens of the network for a very long time. We've looked through the lens of the device or the endpoint for a very long time. Through the lens of the cloud for 15 or 20 years at least. Looking through the lens of identity as a core construct for security is a pretty new thought, right? Like we would have arguably said, looking back, oh yeah, sure, this was about people accessing systems over networks using devices, right? All those things were part of it, but the security industry kind of grew up around some of these core domains. And the thought that identity in and of itself is a core domain to be controlled is a pretty new thought and is almost related to what happened in the other domains, because the days of we used to talk about the castle moat, right? You set up this strong perimeter defense and you sort of thought once you're inside the castle, you're good. Like I don't have to pay a lot of attention, right? Now that metaphor is broken, right? Like we don't think that way anymore. So I need to know who you are, should you be here, and if you're here, are you doing what you're supposed to be doing or not? That's where identity, I think, has risen to a prominence.

Yeah, I know. There's so many shifting parts of this landscape in some ways. It's just exciting and again, I won't say terrifying, but concerning, right? We all see the potential of what all this AI technology can do and I think the security crowd is very attuned to the risk. And to use the great phrase, just the old phrase, an insider threat. And we used to even back in the day with humans say, look, there's kind of two flavors of that, right? There's the actually fairly rare case that a good actor goes bad. Think the Snowden case of a number of years ago where this agent working for the government actually turned and sold secrets to the Russians. That's really bad. It also doesn't happen that often, right? What started to be more of a situation and obviously got a lot worse in the last few years was a compromised insider. So it wasn't actually that person doing the bad thing, but it looked like it was that person because they had been compromised. Their identity had been stolen or compromised or whatever. So what looked like insider threat was still sort of actually a bad actor having compromised identity. Well, what we just saw with Hugging Face is so fascinating because we still have the threat of an agent being compromised intentionally by a bad actor, like somebody taking over your account with a phishing attempt and they got your ID and password and off they go, right? But what we just saw with Hugging Face that was a little scary was these were good agents initially that actually started to do some bad things in pursuit of their goal. We've heard this term now in the industry, agents aren't immoral, but they're amoral, right? Like they don't have any morals. They don't know what a moral is. Like their mom didn't teach them what was good and bad when they were kids. Little kitty agents, is that a thing? I don't think that's a thing. So at the end of the day, right, these agents are just sort of in pursuit of a goal. That's how they have been programmed. Let's not forget these are programs, and they're going to go get that mission accomplished. Well, what we saw was the new insider threat is what if an agent in pursuit of its mission doesn't have appropriate guardrails or controls to protect all of us or the organization from going and doing bad things in pursuit of their mission. Like that was a big wake-up call for the industry, like, uh-oh, this is a problem. We're going to have to figure out how to put some guardrails around this.