Empowering Exceptional with Mark McClain

Austin’s “Best CEO” and longtime V&E client Mark McClain joins us to talk about the importance of values and culture at his company, SailPoint, and his path from big tech to serial entrepreneur.

Listen on Apple Podcast

Listen on Google Play Music




You treat your employees right and ultimately they treat your customers right. And also, you end up with the right thing from shareholders.

Sean Becker:
Welcome back to Empowering Exceptional, the V&E plus podcast series, where we focus on fascinating people doing innovative things in their fields. I’m your host and head of Vinson & Elkin’s labor and employment practice, Sean Becker.
We’re honored to be joined today by Mark McClain. He’s an innovator and a leader in the technology community and the founder and CEO of Sailpoint.
Welcome, Mark.
Mark McClain:
Thanks, Sean, it’s a real pleasure to be here.
Sean Becker:
Also in the V&E podcast studio today, is Wes Jones, a partner in the MNA and capital market’s practice at V&E, based on our Austin office, and Wes has worked with Mark for many years.
Wes Jones:
Thanks Sean, that’s right. Mark and I have worked together for a number of years now, actually through two different companies that Mark’s been involved with, SailPoint and Waveset.
Both of those companies solve different problems and what’s known generally as the identity management market. Mark can you explain to us exactly what that is?
Mark McClain:
Yeah sure Wes, I think it is simplest, we’re part of security landscape for large enterprise organizations that have “quote” security issues, which is a hot topic as we all know today, and identity is the particular issue of basically ensuring that the right people have access to the right information, that the enterprise cares about.
So, it used to be mostly about employees, and of course overtime we have contractors, we have business partners, we have lots of flavors of people that are accessing our corporate-relevant information, and of course another shift that’s happened over time that’s made this problem complicated, is that, that information doesn’t always live safely secured in our data centers anymore, right we have cloud applications, we have software as a service that most companies utilizing, like Salesforce and Workday, so that the data is all spread out, the people are less centralized and less clearly owned by our organization. So, the challenge now is ensuring that the right people have access to the right information, it is quite substantial, and that’s our area of focus, we help mid-sized to large enterprise organizations around the globe, make sure that the right people have access to the right stuff. At all times.
Sean Becker:
Great. Mark I know that a big part of your success is driven by what’s called Market-Driven-Thinking. Explain to us what you mean by that.
Mark McClain:
Yeah, I think that, that this is probably more true in the tech world than a lot of other entrepreneurial areas, but I think so often you find people who kind of get enamored with technology and they develop something and we call that a solution running around looking for a problem. I’ve built this really cool, thing, gosh I hope I can find somebody who wants to use it for something interesting. And that’s in our minds, pretty unsuccessful way to generally build a company.
We start from a very, serious focus, on where is there an unmet or underserved needs in the market, and how do we then, build the best mousetraps so to speak. How do we deliver value in a way that’s unique for a very clearly articulated and well defined pinpoint in the market place.
So, the analogy sometimes that people use here is that of vitamins vs. aspirin or painkillers. When you have some level of pain, headache or something else, you’re anxiously looking for some sort of pain medication. I would like to something right now to take away my pain. Conversely, we all know we should take our vitamins every day, everybody tells us it’s a good idea, we outta healthy things and we generally try to do that, but if we miss a day or we cheat a little with a scoop of ice cream, we don’t lose too much sleep over it.
So quite often people have products that are fundamentally vitamins. That’s nice, I probably should have that, but I’ve gotta deal with this pain over here first, and so they naturally gravitate as buyers to the places where they real significant pain, and I think that it’s important when you’re starting a new enterprise of any sort, to make sure you can clearly articulate the issues you are solving for some set of buyers. Then go off to build the products that will solve that problem.
Sean Becker:
Gotcha. Now let’s go back in time before you started founding companies, you started your career at a giant company, IBM, right?
Mark McClain:
I did. It was, I liked to tell some of my younger friends. It was shockingly to them, the Google or Facebook of its day. In the mid 80’s, if you were going to the coolest tech company, it was IBM. I know it’s hard to believe that for some of the youngsters now, but it was gonna be the first ever hundred billion dollar company, it been growing successfully for years, it dominated the landscapes of IT, Information Technology, at that time.
Yeah, it was a great place to get going.
Sean Becker:
So how did you know you wanted to make the entrepreneurial job?
Mark McClain:
Well, to be fair I didn’t, if you had asked me at 22 if I thought I was gonna be an entrepreneur, I would’ve laughed at you, I would’ve said that’s just not me, I’m more risk-averse, I’m gonna work for big companies, I’m gonna climb that corporate ladder thing.
Actually spent a little time at HP, I did about seven years at IBM, HP, three at HP, excuse me. And then at that point I was ready for something different, I got picked up my MBA at UCLA at the time, and was thinking about making a transition, in fact I even considered going to Warehouser, with no offense to Warehouser, I don’t think I was called to make paper my whole life, so glad I didn’t make that change. But I kinda decided maybe I’m just not meant to be in these large organizations, where there’s a lot of challenges, political challenges, other things, and so decided to make the “Entrepreneurial jump” initially by joining an early staged company.
Turns out, Wes you know this well, Tivoli was a very hot high-growth startup in the 90s, in Austin, before Austin was at all frankly on the technology map, in the US. And I came because of a recommendation of a friend, and they went public right as I got there. Then found themselves, funny enough, sold IBM within a year, so I got my serial number back, I found myself back at the mothership in a way that I wasn’t expecting.
It was a great place to learn, both IBM and HP were great places to learn a lot of really good business discipline. Tivoli was a great place to learn, how you have to start a company. It was five years old when I got there, but it was still pretty small. Kinda what’re the issues? And then after that run as we got to the late 90s, by the Internet bubble headed burst jet, thanks for going great, so a group of us thought that we would make the entrepreneur jump to actually start one ourselves.
Sean Becker:
So through all that you end up back at IBM for the second time?
Mark McClain:
Yeah I did. It was more fun the second time, little history lesson for some folks, that’s when Lou Gerstner had come in and taken over IBM, which, it was a very different IBM to be fair, in that era. It was a lot of fun, but I think at some point we all kinda get into 30s or 40s and start to go “Do I like this kind of thing?” or “that kind of thing?” I think at that point I had concluded I was more suited to smaller, faster moving nimble companies.
A group of friends and I decided to, yup, let’s go ahead and get something started. Took advantage of some folks we knew in town, here, didn’t take advantage of them, excuse me, we took advantage of the fact that we knew some folks here in town, they might’ve thought we took advantage of them, I don’t think so. And got a little of what we today would call Seed Capital to get something started. So four of us left what was then, the IBM Tivoli division and decided we would take a run at a startup.
Put you back in time, this was late ’99, the bubble headed burst jet, everybody was starting companies, things were going great, so we quit our high paying jobs, we jump out to start this company and “kablooey” The market blows up a few months later. So there were four wives, having interesting sessions with four husbands about “Why did you just do this? This was a bad idea.” It turned out it was a great run, we did our aspirin test, we found a market need that was unmet and we solved it pretty well. The company grew rapidly for a few years and all of a sudden acquired by a big tech company called Sun. Which later on, itself was acquired by Oracle.
Sean Becker:
We’ve heard of that one.
Mark McClain:
Yeah, you’ve heard of both of those, I’m guessing.
Sean Becker:
What was the market need at Waveset that you identified?
Mark McClain:
It really was back to the Internet bubble, all of us on this little podcast or all of us when the Internet was exploding and webpages were exploding everywhere, and what started to happen was, this idea, we didn’t even call it identity management back then, but this idea that there was a lot of people that needed access to a lot of new things. Applications, webpages, whatever.
It was very difficult, for them to get that access quickly and efficiently, and so the first pinpoint we came after was the industry calls “Life Cycled Management” or “Provisioning” How do you, the industry parlance joiner-mover-leaver. If you think about it, what happens in organizations? People join, they may just as employee or contractor, they move around over time, their role changes, the applications they need access change, and ultimately they leave, well that’s a lifecycle.
Keeping track of who needed what at any point in time in that life cycle, is pretty painful and manual for most big organizations. And often I joke with people, that sometimes your first two weeks at work, you’re handed a stack of books and articles to read because nobody set you up for everything you need to do your job, so you kinda kill time. That’s a massive waste of productivity. You’re sitting around reading while some IT guy is supposedly setting up your access privileges so you can login to systems.
At the end of the day, it was how do we help make customers far more efficient, far more effective with that process. That was the focus of Waveset.
Sean Becker:
Sounds like this is one of those areas where you helped identify a problem and in some ways create an industry.
Mark McClain:
There were five or six of us that did that kind of technology. We found ourselves kinda quickly acquired interesting enough.
Back to IBM, IBM bought one of our competitors. We were acquired by Sun. Oracle bought a different competitor, six or seven little startups, immediately kind of disappeared into the big tech giants, and we stayed there for a bit. Then decided, there’s some other unmet problems in this market space, that’s what led to the founding of SailPoint a couple years later.
Sean Becker:
And at SailPoint, you’ve had a great run and it’s worth noting, that you’ve gotten a lot of accolades as you’ve been personally called the best CEO to work for in Austin, by Glassdoor.
The Austin Business Journal for several years running has named SailPoint as the best place to work in, in town.
It strikes me that you’ve innovated in some ways in the workplace culture, as well and created an environment in which people want to join you and want to stay. So, how’ve you done that?
Mark McClain:
Sometimes in this part of our conversation this goes back to that book that was around when we were young called “Everything I needed to know I learned in Kindergarten” It was a great book by the way, you should all read it.
The point there is, what we’ve done is not hard to understand, I think it’s hard to execute.
The values we’ve lived by as an organization, how we’ve built the culture the company, it’s not like it’s difficult to explain these concepts to people. What you just find is in organizations, people ignore these values and roll over them all the time.
Culture I think today sometimes gets misconstrued as things like beer in the fridge, ping pong and pool tables, an onsite massage, crazy. I think more and more people are beginning to understand, you can have all those things and have a really bad culture, because culture is really about how people are treated. How do you respect and work with each other in the environment, how do you treat your customers? How do you treat your partners?
I often reflect back to a great quote from Herb Kelleher, the founder, actually technically not the founder it turns out, but the guy who built Southwest Airlines. Just passed away recently, and he said this: “You treat your employees right and ultimately they treat your customers right.” And also you end up with the right thing from shareholders.
He never focused on pleasing Wall Street, he focused on making sure his employees felt empowered and enabled to do what they needed to do to serve customers, that created loyal customers that created an awesome business. He always looked at it through that lens, and I think we have a similar view that if we focus on the values we use inside our company, how we treat people, how we do work, how we operate as a team, we will get the right things happening in the products we build, help customers, and even work with partners, and then ultimately now as a public company, hopefully a good result in the stock market as well.
Sean Becker:
It sounds like you devote a significant amount of your time to having conversations with your key employees, key stakeholders.
Mark McClain:
Yeah I think at the end of the day, tech companies, particularly software, maybe all tech companies, particularly software. At the end of the day, they are people-companies. You have to hire people that come in and do work, create products and those products can get stale quickly, so you’re always having to stay fresh and innovative.
I think a lot of it is, is having conversations with people about where we’re trying to go, matter of fact, I’ve actually learned how to actually describe this as a set of guardrails. I’ve never worked in non-professional/white-collar environment, so maybe it’s different in a factory? I don’t know, but in the environments I’ve always worked in, I feel like professionals want to live between two guardrails. They wanna live between give me enough clarity that I sorta know what’s expected. What’re we trying to do here? What is success look like? Then give me enough freedom so that I can use my skills, experience, creativity, to solve those problems.
The opposite of those things is either, let’s go back in reverse order, on the less side as I drew it out, you’ve got people who’re micro-managed and I always contend that really capable, smart people will not tolerate that for very long. They will just say, you might as well hire a chain monkey to do this, because I’ve got a degree, I’ve got experience and you just keep telling me exactly what you want me to do.
Now if you’re flipping burgers, maybe you should told exactly what to do, but in a professional educated work environment, people don’t want to be told to exactly what to do, but they also don’t want to be left with so much freedom “white space” they don’t even know what you’re supposed to accomplish. What does success look like? What do you need me to get done to succeed?
I think that if you keep professionals between here’s enough clarity of what you need to get done with here’s enough freedom to bring your skills and creativity to get the work done. That tends to create this thing called job satisfaction. People love working where they can solve problems with teams and do so in a way that leverages all of their experience and skills.
I think when you give those environments to people, put those people in those environments, they’re generally pretty satisfied.
Sean Becker:

That mindset of using your skills and creativity to solve problems–that motivates most people.

Mark, being ultimately familiar with SailPoint, I’ve heard you describe before your company’s core values as the four I’s. Tell us what those are.
Mark McClain:
Yeah I always joke that we have four “I”s because when you get old like me you, you can remember four words that all start with I. Alliteration, I think was the concept for high school English.
We did, we captured our values in simple words and put short phrases even full paragraphs with all those, but the first I is innovation. I think again as we were talking earlier on the vitamin/aspirin conversation, obviously look if you’re going to start a deck company, if you don’t fundamentally more valuable product then they can get from a big company, why would they ever talk to you?
If they can deal with a safe-known vendor, to get something that looks a lot like your product, they will. They’re not going to take the risk on a new company that’s unknown.
You have to have an innovative approach, and again, as we were talking earlier about the painkiller, we described innovation as we develop creative solutions to real customer challenges. So it starts with understanding those real customer challenges then hiring really talented engineers who can build the best solution.
Most engineers will build you much better products, the more clearly you can articulate what the problem is that you’re asking them to solve.
I’d say what’s happened over time with that “I” value, is that we’ve learned it’s really far beyond products. No matter who you are in our company, you have some customer. It may be an internal customer, if you’re in accounting, you probably serve the internal organization, primarily, but they’re a customer. So you want to understand their issues, you want to creatively solve their problems. Everybody serves some customer.
That mindset of being innovative and creative, back to our guardrails, using your skills and creativity to solve problems. That motivates most people.
The second “I” is integrity and I joke that, I don’t know of any company that doesn’t have integrity as one of its values. The challenge for most companies is, it’s the plaque on the wall, not the reality of the way the organization actually seems to operate. We sort of talk about integrity as underpinned by honesty. Honesty is tables stakes.
If I can’t fundamentally trust you, very difficult for us to have any sort of relationship, much less a working relationship. You don’t have personal relationships of any kinds with people that you don’t trust, generally. Spouses, friends, those are difficult when trust is broken. Trust or honesty is fundamental. We define integrity as delivering on the commitments we make. So in our minds, takes that a step further.
It’s not just about honesty, it’s about, I’m gonna be careful with what I promised you that I’m going to do, so you can count on me to deliver that. The corollary, we learned over time is, guess what, despise all your best intents, sometimes you aren’t able to follow through on what you intended to do. Then the secret is quite simple. You just convey that to the involved party as soon as you know that.
What people hate is last minute surprises. When they’ve been expecting A and you show up with X. “Wow, when did you know you weren’t going to be able to give me A?” “Oh, months ago. Why didn’t you tell me then?” I think integrity gets lived out with, it’s not just about being careful to make commitments, kind of under promise and overdeliver. Don’t overpromise and underdeliver, which so many people do. Then it’s also take responsibility to communicate when you’re not able to follow through to communicate when you’re not able to follow through with what you said you were going to do. Explain why and it turns out, most people, not all, are actually quite fair and rational, and they will work with you toward a new solution. But if you shock them, or surprise them, they react negatively as you would expect them to. That’s a big part of what’s broken in the technology landscape.
Third “I” value, I’m sorry I’ll go through these quickly as you can tell, I have a lot of things to say about them.
Impact, and we describe that as we measure and reward results, not activity. To be a little harsh on the places I used to work, back in my early days, I do feel like in a lot of larger organizations, there’s a danger that evolves over time of people creating clouds of dust and activity that don’t actually make progress toward anything.
You can spin in a circle and appear to be very busy, but not actually get a lot done. In smaller companies, that is self-managing for the most part. When we had 10, 20, 50, even 100 people, I kind of knew what everybody was doing, and it was pretty apparent to everyone if one member of the team was just not getting it done, and again, with our overall culture we didn’t shoot them the first time we determined they were getting the things done they needed to do. We would sit and say “Hey, this isn’t great. What’s going on here? Why can’t we achieve what we’re trying to achieve?” But that accountability to follow through and deliver real progress, differentiates a lot of early staged companies from their large competitors, often where people are just, again, creating busy work and lots of noise and activity, but very little progress.
Again, another corollary that’s emerged over time in this value is, again, sometimes you try experiments or you try to stretch the limit, and then you actually don’t deliver the result you were hoping to deliver. I always tell, particularly our younger people, the good news, we got a lot of folks with gray hair and leadership, we can tell the difference. We can tell when you tried really hard and you were striving toward a difficult goal and almost got there from, that should’ve been something you slammed dunk and you just didn’t get it done ’cause I think didn’t apply yourself that hard.
We generally can tell the difference. Not always, but we’re pretty good at that, at this stage.
And the last “I” value I always say is should be a P, should’ve been three I’s and a P, for people, but, four I’s are easier to remember. So it’s individuals. We just describe that as we value every person in the organization, and I think what’s come so important about that is how technology has changed our lives. And what I mean there is, when I was young, when you were young, all of us were young, we actually left work at the end of the work day and we couldn’t do as much at home because we didn’t have anything to work on it.
We probably had things we could read, especially in the legal profession, but in the day that a lot of your work was done on a computer or a system, when you left work, that’s when you left the ability to work because the system was at work. There was no personal computer at home. This idea that there was a harder line, has so dramatically changed, in the lifespan that I’ve been on the planet. Now we have these functional devices that let us do work and play all day, every day, quite seamlessly.
You’re gonna take personal calls at work, you’re gonna take work calls at home, you’re gonna work on personal issues in the office, you’re gonna answer emails at night. Because we’re so much more fluid, I think our need to treat people as whole people has gone up. People expect you to understand that they have a whole life and it’s more fluid and integrated than it was 30 years ago.
I tell people, if you think you can hide when something major has gone wrong in your personal life, you probably can’t. People around you are aware that you were operating at a certain level and now you’re not. Something is going on. Is somebody sick at home? Marital problems? There’s just all kinds of stuff that could be happening.
We as leaders and managers of the organization have to recognize that affects work, and again, first response isn’t shoot someone when they’re going through a hard time, it’s like hey we need to talk about this, ’cause you’re clearly not in a place where you’re productive or as valuable as you’ve been, but how can we help you through this?
I think that idea of treating people as the whole people they are, not expecting them to be some sort of separate entity called an employee, from eight to five, then a person once they go home. It’s just a value that’s fairly common now, I think, but still not as well understood as people would like to believe.
Sean Becker:
These days the identity and access management business is now front of mind, we think of the Equifax data breach, Target’s, Sony, it’s something that public-private companies are more aware of it seems more than ever. In this era, how does an access management company stay one step ahead and innovate to out-think or avoid the next data breach?
Mark McClain:
It’s a great question.
We focus …there are different aspects of this market than when you kind of delve into it Sean.
We focus on this idea of getting fundamentally making sure that the right people have access to the right stuff and only the right stuff.
It turns out if you dig into some of these breaches that’ve made the headlines, quite often, it was not …so much poor security defenses, it was literally just sloppy identity management; meaning, someone had access to something that they no longer needed or never should’ve had, or perhaps they were, there was an imposter. Someone who appeared to be you, but was not you.
Well, a lot of this is just to use the phrase “good hygiene”, to make a quick metaphor here. A whole lot of the world of health got much better when people figured out you should wash your hands. Just taking the germs off your hands when you interact with other humans actually did a lot to reduce the spread of disease in humans.
Turns out, good hygiene in the world of technology is often, hey if Wes does this job, he needs access to these systems. He used to do a different job, that access he used to have, he really shouldn’t have anymore, because if Wes was to have a really bad day and go rogue and decide to screw up the company, he might go back to that system and do some really bad stuff.
Now, these are extreme examples obviously, Wes would never do this.
Wes Jones:
Mark McClain:
Matter of fact Wes is the most exemplary employee, probably at Vinson’s and Elkin’s, can I point that out?
But I think at the end of the day, this idea that, that hygiene isn’t sexy or as fun as fighting the bad guys from hackers from Russia, or the political operatives in China. Turns out, an awful lot of problems get resolved by just ensuring the right people have access to the right stuff.
I’m gonna give you another quick metaphor that a lot of people don’t know have shifted in the world of hacking. In the early days of hacking, think of a jewelry store, the metaphor was you broke the glass, grabbed the jewels in the front window and ran. That was how people thought. I’m gonna get in, grab what I can and run.
Now the metaphor that hackers use, and there’s data to back this up, they sneak in the back of the store and try to pose as an employee, and if they get away with it for a while, they’ll hang out for six months. They’ll case the joint, they’ll understand exactly where all the good stuff is. And one very bad night, when everybody goes home, they come in the back of the store and clean it out. We’ve seen that story a lot of times in tech, and so the trick is, on day 2, figure out that’s actually not a legitimate employee, because there’s stats now in the world of hacking, that when there’s a breach, when someone has infiltrated an organization, they generally go undetected for …I think the latest stat is 270 days.
Sean Becker:
Mark McClain:
They are inside, roaming around, looking for what they can steal and then they get ready and on again …one very well-swoop, try to grab as much as they can and run. That’s what a lot of our values to help people …hey look there’s operational efficiency to doing this better, back to the employee sitting at their desk for two weeks with nothing to do, when they show up, but there’s a lot of true security and protection here and I think that companies are beginning to try to understand, if I just do better hygiene, if I just make sure the right people have access to the right stuff, then I will prevent a lot of bad behavior.
Sean Becker:
SailPoint’s track record in this space is pretty impressive. You have built identity platforms for 11 of the 15 largest federal agencies, eight of the top 15 banks, four of the top six healthcare manage care providers. Where do you go from here?
Mark McClain:
We get the one set that aren’t on that list. A lot of what we’re doing now is continuing to try to propagate our success globally. We’ve had a global company for quite some time, about 1/3rd of our business gets done outside of North America. We’ve got a lot more fortune 5000 companies around the globe that we haven’t yet sold to. A few years ago, we decided we would kind of target more of what we call the middle enterprise market. We don’t typically sell to really small companies, meaning sub 1000.
A couple thousand employees and up, they tend to have some or all of these problems, particularly if they’re in regulated industries or if they’re public, and so we’re attacking that part of the market with some different products and some different routes to market, but in general, we think they’re literally something on the order of 50 to 60 thousand enterprises around the globe for whom our product should help them solve their problems and today we have a few bit of over a thousand customers. Lots of white space to go after.
Sean Becker:
Now this is the V&E podcast, so we do have to ask you about lawyers and in fact, I have heard you even flirted with going to law school at one point.
Mark McClain:
Even more than flirted, I actually got waitlisted at two law schools coming out of undergraduate, and thankfully, I didn’t get in, because I’ve learned since that I love and respect lawyers; I should not have been one. ‘Cause I thought it was just the Perry Mason part. You get on TV and you argue, that looked fun.
That whole research part, man, that’s not as fun for me. I think I’ve learned …the value of corporate law once I certainly got into the entrepreneurial realm was quite clear of how do you set the organization up with the right structure, how do you financially risk management, all the things that Wes and his team have done for us, as he said across two companies for almost 20 years. It’s a key partnership for a company that wants to make a dent in the marketplace, you have to have a great partner as your legal team, because you’re gonna likely screw something up if you don’t because most of us aren’t intuitively that smart at …about the law. I think we’d mess a lot of stuff up with our great partner.
Sean Becker:
Well thanks for allowing us to work with you, and thank you for spending time with us today, and sharing your wisdom and experiences.
Wes Jones:
Thanks, Mark.
Mark McClain:
My pleasure gentlemen. Thanks for allowing me on the show.
Sean Becker:
Thank you for joining us for this edition of Empowering Exceptional. Now I’m Sean Becker and please join us again next time for another episode.