CrowdStrike just posted the best quarter in its history and dropped 7%. CRWD shares fell about 7% despite CEO George Kurtz calling Q2 the best quarter in CrowdStrike’s history, with revenue of $1.47 billion growing 26% year over year and ARR reaching $5.84 billion with $332.8 million in net new ARR added, a 51% jump from a year ago. If a record quarter earns a 7% selloff in this software market, you need a very specific reason to own any security name going into earnings right now. SailPoint, reporting Wednesday morning before the open, provides one.
The Business
SailPoint governs identity: who has access to what, when, and under which conditions, across every human employee and increasingly every AI agent inside an enterprise. That second category is where the company’s growth story is accelerating fastest. SailPoint launched Agentic Fabric in May 2026 to help enterprises secure AI agents and other nonhuman identities at scale, designed to discover agents, govern access, and protect activity through a single identity-centered model. In Q1, nonhuman identities accounted for 40% of identity growth and represented 14% of all identities managed in the company’s cloud offering, while the agentic pipeline doubled in the quarter.
The pitch is structural, not cyclical. As organizations deploy autonomous AI agents across cloud environments, applications, and endpoints, they face a growing governance gap. Unlike traditional users, AI agents can act at machine speed, often without clear ownership, oversight, or consistent controls. As these nonhuman identities multiply, enterprises need a way to extend identity security beyond human users to the agents and applications now accessing critical systems.
Why Wall Street Is Paying Attention
OpenAI shipped GPT-6 Astra on September 3, 2026, four days ago. OpenAI says GPT-6 Astra is its first model to reach the “Critical” cybersecurity threshold under its Preparedness Framework, based on capabilities including autonomous vulnerability discovery and exploit development. More specifically, OpenAI defines the Critical threshold as a model that can either identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high-level desired goal.
The model launched in phases, with access initially limited for cybersecurity work through a trusted-access program for qualified security researchers and defenders before broader availability across OpenAI products. The implications for every enterprise security team are immediate. One analyst framed it precisely: the governance unit moves off the model itself, because the relevant question is no longer which model is approved for use, but how much damage a given identity can do before a control intervenes. That framing describes SailPoint’s core product.
What’s Driving the Opportunity
SailPoint heads into Wednesday with guidance calling for Q2 ARR of $1.218 to $1.222 billion, revenue of $308 to $312 million, and adjusted EPS of $0.07 to $0.08. The prior quarter beat consensus on both lines and management raised full-year targets for ARR, revenue, and adjusted operating margin. The full-year outlook now stands at ARR of $1.364 to $1.374 billion and revenue of $1.265 to $1.275 billion.
The number to watch Wednesday is not just revenue. Customers that adopted advanced nonhuman identity capabilities increased annual recurring revenue by more than 50%, giving the AI-agent theme direct revenue relevance rather than just a pipeline story. Buying centers are expanding beyond the CISO to include dedicated AI and architecture teams, often with budgets residing on the AI side of the house. That expands SailPoint’s addressable deal pool in a way its peers cannot easily replicate.
What Could Go Wrong
The software complex is de-rating. IGV has experienced heightened volatility in recent market cycles, mirroring broader software sector pressures as AI shifts investor focus toward hardware and specialized infrastructure. SailPoint is not immune to that rotation. The stock has already given back ground recently, and a beat-and-raise that fails to show nonhuman identity converting meaningfully into revenue this quarter could be met with the same indifference CrowdStrike received.
Valuation also requires faith in a growth rate that has yet to fully materialize. Management expects 90% to 95% of net new ARR from SaaS, a mix that compresses near-term revenue recognition. Agentic Fabric adoption is real but still early, with roughly 10% of customers having adopted AI solutions heading into Wednesday’s call.
The Bottom Line
The case for SailPoint on Wednesday is not that it will escape the software selloff entirely. It is that the OpenAI Astra disclosure just raised the urgency of the problem SailPoint is solving. An AI model that can autonomously find and exploit zero-day vulnerabilities across hardened systems is, at its core, an identity and access problem before it is a detection problem. Endpoint security matters. Identity governance determines the blast radius. With nonhuman identity growth already accounting for 40% of SailPoint’s Q1 expansion and the agentic pipeline doubling, there is a plausible path where Wednesday’s numbers confirm the thesis rather than just the beat. In a sector that is punishing good results indiscriminately, that specificity of catalyst is worth paying for.
