Snapshot

Identity & access management (IAM) platforms control who and what can access an organization's systems, data, and applications. "Who" means employees, contractors, and partners. "What" — increasingly important — means AI agents, service accounts, API keys, and automated bots (collectively called "non-human identities" or "machine identities"). The two remaining publicly traded pure-play IAM companies are Okta (workforce and customer identity) and SailPoint (identity governance and administration). CyberArk (privileged access management) was acquired by Palo Alto Networks in Feb 2026 for ~$25B. Microsoft Entra ID is the dominant IAM platform by installed base (~20% market share by deployment count est.) but is bundled into Microsoft 365 and not separately investable.

The product & how money is made

IAM platforms sell three core capabilities, each priced per seat, per identity, or per protected resource:

• Authentication & single sign-on (SSO): Verify a user's identity (passwords, multi-factor authentication, biometrics), then grant access to multiple applications with one login. Okta's core product.
• Privileged access management (PAM): Restrict and monitor access to the most sensitive systems — admin consoles, databases, cloud infrastructure. CyberArk's specialty (now inside Palo Alto Networks).
• Identity governance & administration (IGA): Automate who should have access to what, certify access periodically, and revoke it when people change roles or leave. SailPoint's core product.

Money flow: Customers pay annual or multi-year subscriptions, almost always per-seat or per-identity. Okta's FY2026 subscription revenue was $2.86B out of $2.92B total (98% subscription). SailPoint's FY2026 subscription revenue was $1.01B out of $1.07B total (94% subscription). Okta's GAAP subscription gross margin runs ~78%, SailPoint's ~65%. Okta generated $863M in free cash flow on $2.92B revenue (30% FCF margin) in FY2026.

Expansion mechanism: Customers start with one module (e.g., SSO), then add PAM, IGA, or machine-identity modules over time. Okta's dollar-based net retention rate was 107% in Q4 FY2025. SailPoint does not disclose net retention, but customers with >$1M ARR grew 62% year-over-year in Q1 FY2026.

Demand

Contracted (filed, signed, in backlog)

• Okta RPO: $4.72B as of April 30, 2026 (Q1 FY2027), up 16% YoY. Current RPO (recognized within 12 months): $2.50B, up 12% YoY. contracted

  Source: Okta Q1 FY2027 earnings release, May 28, 2026.

• Okta FY2027 revenue guidance: $3.185B–$3.205B, implying ~9–10% growth. contracted

  Source: Okta Q1 FY2027 earnings release.

• SailPoint ARR: $1.125B as of Jan 31, 2026, up 28% YoY. SaaS ARR (cloud-delivered): $746M, up 38% YoY. contracted

  Source: SailPoint FY2026 earnings release.

• SailPoint FY2027 revenue guidance: $1.260B–$1.270B, implying 18–19% growth. ARR guidance: $1.356B–$1.366B, implying ~21% growth. contracted

  Source: SailPoint FY2026 earnings release.

Forecast / structural drivers

• Human identity growth: Every new employee, contractor, or external partner needs an IAM seat. The bigger driver is new-logo adoption: many mid-market and international enterprises still use legacy on-prem directory services (Active Directory, LDAP) without a modern cloud IAM layer. est.
• Non-human identity explosion: Machine identities (API keys, service accounts, AI agent credentials) outnumber human identities by an estimated 45:1 in large enterprises est., and the ratio is growing as AI agents proliferate. NHI management sub-market was ~$9.5B in 2024, projected to reach ~$18.7B by 2030 (11.9% CAGR). est.

  Source: MarketsandMarkets NHI Access Management report, 2025.

• AI agent identity: Okta's CEO stated in the Q1 FY2027 earnings call that AI agents are "a new workforce inside every organization, creating a wave of identities that must be secured." Every enterprise deploying AI agents needs to govern what those agents can access, creating a per-agent billing vector distinct from existing human seats.
• Zero-trust mandates: US federal Executive Order 14028 (May 2021) required federal agencies to adopt zero-trust architectures, which require IAM as a foundation. Many enterprises follow federal cybersecurity guidance, creating a compliance-driven floor under demand.
• Overall IAM market: $26.0B in 2025, projected $42.6B by 2030 (10.4% CAGR). US portion: $7.3B → $11.1B (8.6% CAGR). Asia-Pacific growing fastest at 12.5% CAGR. est.

  Source: MarketsandMarkets IAM Market Report, Nov 2025.

Supply

Capacity

IAM is pure software with no physical capacity constraint. Marginal cost of an additional seat approaches zero. Supply does not bottleneck the way semiconductor fab capacity or data center power does.

Competitive supply

• Microsoft Entra ID (formerly Azure Active Directory): Bundled with Microsoft 365 and Azure. Estimated ~20% market share by deployment count est.. For any customer already paying for Microsoft 365, Entra ID is included at no additional cost, creating a permanent pricing ceiling for standalone IAM vendors. Historically weaker in advanced governance and non-Microsoft environments.
• Palo Alto Networks (PANW): Acquired CyberArk for ~$25B in Feb 2026, adding privileged access management and machine identity to its Cortex security platform. CyberArk had $1.44B ARR growing 23% at acquisition. PANW is a $130B+ market-cap cybersecurity platform.
• Open-source: Keycloak (Red Hat) is free, used by ~1.6% of the market by deployment count est.. Lacks managed-service convenience.
• Other enterprise vendors: Ping Identity (Thoma Bravo, private), ForgeRock (acquired by Thales, 2023), IBM Security Verify, Google Cloud Identity, AWS IAM (AWS resources only), Saviynt (private, IGA competitor to SailPoint).

Bottleneck

The constraint is switching costs, not capacity. IAM touches every application, provisioning workflow, and audit process. Replacing an IAM platform takes 6–18 months for a large enterprise est.. Okta's gross retention is estimated above 95% est., but new-logo enterprise sales cycles run 6–12 months est.. Growth is gated by sales execution and competitive displacement.

The gap

The IAM market is expanding at ~10% CAGR overall est., with non-human identity management at ~12% CAGR est.. Okta is growing revenue at 11% (decelerating from 15% two years ago). SailPoint is growing revenue at 24% (smaller base, taking share in identity governance). Neither company is supply-constrained.

Pricing direction: Microsoft Entra ID's bundling creates persistent downward pressure on per-seat pricing for basic SSO and authentication. Okta has responded by expanding into adjacent products (privileged access, governance, machine identity) where Microsoft is weaker, and by pushing multi-year contracts (RPO growing 16% vs. revenue at 11% suggests longer deal terms). SailPoint faces less Microsoft pressure because identity governance is not bundled into Microsoft 365. AI agent identity is too nascent to have established pricing but represents a new demand vector without legacy contracts anchoring expectations.

The players

Sources: Okta FY2026 & Q1 FY2027 earnings releases; SailPoint FY2026 earnings release; CyberArk FY2025 earnings release; StockAnalysis.com for market cap/price data; 6sense for SailPoint customer estimate.

The price of exposure

Okta (OKTA) — $124.65 / share, $21.7B market cap

GAAP profitable. Net cash ~$2.2B ($2.59B cash minus $350M convertible notes due within 12 months, coverable from cash). Revenue growth decelerating (15% → 12% → guided 9%). FCF margin expanded from 28% to 30%; material buybacks initiated. Goodwill of $5.49B (primarily from the $6.5B Auth0 acquisition in 2021) is ~57% of total assets. Tangible book value is negative.

SailPoint (SAIL) — $18.38 / share, $10.4B market cap

Re-IPO'd in early 2025 at $23/share after Thoma Bravo took it private in Aug 2022 for $6.9B. IPO raised $1.38B (used to pay down $1.04B in debt; now debt-free). Trades at $18.38, 20% below IPO price. Goodwill of $5.15B (~68% of total assets) is from the Thoma Bravo LBO. GAAP loss of $270M is driven almost entirely by $310M in stock-based compensation. Adjusted operating margin is 18%. FCF inflecting positive: $52M full-year FY2026, $57M in Q4 alone. Revenue growing 24%, ARR growing 28%.

CyberArk exposure (via PANW)

CyberArk was acquired by Palo Alto Networks for ~$25B in Feb 2026 ($45 cash + 2.2005 PANW shares per CyberArk share). No longer separately investable. CyberArk's pre-acquisition ARR of $1.44B represents roughly 10–15% of PANW's combined revenue base est..

What to deep-dive next

• Microsoft Entra ID pricing dynamics: What share of Okta's customer base uses Okta alongside Microsoft vs. instead of Microsoft? This determines the pricing ceiling for standalone IAM.
• Machine identity monetization: Neither Okta nor SailPoint has disclosed separate revenue from non-human identities. Will AI agent identity be priced per-agent (revenue uplift proportional to AI adoption) or bundled into existing per-seat pricing?
• SailPoint's GAAP path to profitability: $310M in stock-based compensation on $1.07B revenue (29%) is the gap between GAAP loss and adjusted profitability. How fast does SBC decline as post-LBO equity grants vest?
• Okta's Auth0 goodwill: $5.49B in goodwill has never been impaired. Auth0 (customer-facing identity for apps) competes with free alternatives like Firebase Auth. Is Auth0 generating returns that justify the $6.5B acquisition price?
• PANW post-CyberArk integration: If PANW bundles CyberArk capabilities into platform deals, it could pressure Okta's expansion into privileged access.
• SailPoint IPO lockup and insider selling: Post-IPO lockup expirations for Thoma Bravo's stake. Stock is 20% below IPO price.

Sources & confidence