What's Next for Software with Orlando Bravo

Thank you all. Thank you, Orlando. I appreciate you doing this.

Thanks for having me.

We were talking before we came on stage about how every time we sit down, it's like there's a moment in what you do—private equity, software, private credit—and this really feels like no exception to that. I figured we could start by level-setting with your views on software right now, because there have been so many existential questions about whether this is an industry that continues to exist. It's rebounded in the public markets over the last month. Where is your head at regarding the broader narrative versus what you're seeing on the ground at Thoma Bravo?

1. AI Becomes Enterprise Software

So, look, first, thanks for having me. One of the things that I believe people are overlooking is AI as software. To bring AI to the enterprise, AI is run by software and managed by software. So, you think about what groups can bring this agentic reality or promise to corporations, and the first group is the software companies in these domains that have been doing that for 20 to 30 years.

That's the first group you look at. They have evolved over time to automate more and more of their customers' businesses. That's what I'm seeing in our portfolio of 77 companies. We are incredibly detail-oriented, right? We care about buying companies, trying to improve companies, and trying to sell companies. We stay really, really true to our core—to some of the things we know how to do.

In the last year, the velocity that I'm seeing in their agentic innovation, what they're doing with their customers, is at a rate that I've never seen before. It's like a full-time job just to keep up and try to advise them. Even without us buying a company or selling a company, I've been busier than I've been before.

Now, there's this whole debate: Is it the incumbent or is it the startup? People call that the AI-native company. So, let's call that the software startup that now has an opening in the market because it can begin on the AI platform. The other companies need to re-platform their businesses, and of course, there are going to be winners there as well.

Given how much capital is being thrown at it, American competitiveness, and innovation, there are going to be a bunch of great AI-native companies created. We're buying a lot of those. We bought about 30 for our portfolios as add-ons, and as they mature, we hopefully will be buying them as platform companies.

So, it's not either-or. Both sides are going to be incredibly successful. This wave, as everybody knows, is going to be many, many, many multiples bigger than the cloud wave and the SaaS wave. What happened then? Salesforce was created, and Oracle did really well as well. Companies transitioned to the cloud. They're still doing that now. SAP is still transitioning to the cloud.

We'll have existing vendors do the same in areas of their core competency, and new ones will move up. Now, there's a third element, which is the LLMs and the hyperscalers. They will also participate in the upper layers of the stack to a certain extent.

But we don't operationally subscribe to the view that you can do it all. My operating mentor used to say, "If you try to do it all, you'll get to none." It's just human management. You need to have a set of priorities. You need to focus on certain things, because just winning at a certain game is tough enough without trying to win them all. So, I think there's going to be room for all of them, and that's what history has proven.

2. Domain Expertise Drives Software Survival

Is there a line, though, that you look at in terms of what's a software company versus what's an AI company, and how you think about investing in legacy companies to transform those businesses? Basically, what I'm hearing from you is there will be some dispersion. There are some software companies that are uniquely positioned for this future environment, and so I'm just curious how you think about that line, where you draw it, and how you think about devoting more resources to transform these businesses.

It's such a great question because it goes to the core of how we define software, which in many cases is very different from how somebody in Silicon Valley would define software. To give you a sense of the history, we started doing software buyouts in 2000. We didn't know anything about software except that it was really cheap.

Could you get that for software buyouts in 2000?

We went to Wells Fargo Foothill to see if they would do the maintenance revenue and things like that, and you couldn't get that. But we were small, and we could only do the small deal.

The thing that everybody told us in the venture community was, "You cannot touch those companies" for 2 reasons. First, the startups will put you out of business. Those companies are old because they were more viable. They had been in business for 15 years.

The second was that Microsoft was consolidating some elements of enterprise software. Microsoft was going to put these smaller players out of business. More R&D, excellent distribution—an unbelievable company. So, we were scared, but we looked deeply at it.

I remember my partners and I would spend nights with these companies. They would let us stay in the company, looking at their paper files of renewals and what they were doing. What we saw was that we started discovering, in many spaces, these incredible domain experts: companies that had spent 20 to 30 years getting to know all the problems of a given domain.

A complicated domain like flight operations that's owned by private equity in many areas, or different areas that are very nichey, had spent so much time on it. They had captured the entire knowledge of an industry—how to best do things in that domain—and put it in the product. You issue your next release or another release, and you made a mistake: "I thought this was going to work. Let's retract that." That collective experience over a long period of time, we thought, was worth a lot more than the customers that they were serving.

Mhm.

That kind of led us to start buying these companies, but once again, the risk was too much technology risk, with Microsoft as the gorilla in the space. We did really well during that time.

Then came SaaS, and the risk then was that AWS was going to capture most of the value. It was going to go to the hyperscaler. We doubled down on buying domain leaders because we were a bit bigger and understood the value of that by buying the number-one player.

That's when we got into cyber, and in cyber, for us, it's been very, very important that in these domains of identity or email or others, we buy the number-one player, not the number 3 or 4. It's a particular category, and we did better during that time than during the first time.

Now, what's happening is you're going to have an enormous wave of AI. AI is about being able to automate human judgment with software. These domain leaders may be automating 5% of a company, 7% of a function, or 10%, but with access to this infrastructure and these models, they can automate all of it.

What's going to make them succeed and make that transition? Leadership. We see that in our portfolio. When we back domain leaders—the founders, people who have worked in that domain for 20-plus years—we see that they're moving extremely fast. They're providing what the customer needs, they can absorb this, and they've done that forever. They've known how to do that.

So, I think in the markets, leadership and what really is quality leadership in an organization are being a bit undervalued. I know that there are some attributes that people consider moats in software.

"If you have the data." Yeah, that's helpful. If you're a system of record, maybe that's good, and maybe there's some risk to that, but maybe it's better than none if you're running the core transactions of a company. If you're deterministic, there are all these pieces of work that people are writing that are almost trying to get software investors and executives comfortable that they can sleep at night a little bit, but there really isn't that much of a moat.

There never was in software. You're either always producing the best product, providing a 5-to-1 ROI to the customer, implementing it correctly, making sure the customer is using it correctly, and serving them right. You have to do that. It's a very leadership- and people-intensive business, so that's the thing that we look at the most.

In our companies today, the ones that are run by the founders or by people who have done that for a long time are the ones that need less help from us.

So, as you look at your portfolio companies, how worried are you about AI disruption? Do you feel like all 80 of them can fully pivot at this point in time?

I'm extremely worried about it. We spend our days organized by vertical teams. In cyber, we have 3 teams: an identity team, a network team, and another team. In all our application sectors, we have everything from fintech to automotive to very nichey areas, so that our colleagues work deeply in each domain because we invest in software domains.

We don't invest behind a horizontal technology, because technology comes and goes. In private equity, I can't sell the stock. I may need to hold it for 10 years, so somebody has to give us a lot of money for it to make a return. Even if we take it public, we have to hold it for 7-plus years.

In each of those domains, we're anxiously looking for a new startup that's doing something interesting. Are we losing any customers to an LLM or somebody who just got started and is doing things differently? So far, we're not seeing it. Our retention rates are holding. We're not getting surprised.

Part of it is leadership. A great leader working with 10,000 customers in their domain cannot get surprised by that.

You need to hear that from your customer and do something about it if there's a good innovation.

So far, we're not seeing that. Now, how about upgrading our platform to a true agentic platform? Companies are in different stages of doing this. For example, Proofpoint is there. Ping Identity is almost there. Coupa in procurement is almost there. Anaplan is there. Dayforce is ripping, so they're there. Other ones are further behind.

What is going to be the ROI of those solutions? We don't know yet because they haven't been implemented and used. How can we get the uptick on the usage? It's very, very early, but we're just going for it because that's the future.

3. Medallia Exposes A Leadership Mistake

One of your companies, Medallia, has been in the news lately. There are reports out there that there is a restructuring plan on the table for the creditors to take over. It would mean wiping out the $5 billion in equity that Thoma Bravo and some co-investors put in. As you think about that one, what are some of the lessons learned with regard to Medallia? How do you employ that in the rest of your portfolio?

Well, you always learn from mistakes. It was a big mistake. That's one of our 2021 deals. We were moving really fast during that time. In hindsight, it's questionable how deep our domain expertise in that whole sector was, and our real competitive advantage is knowing, from 30 years of experience, what it means.

We underwrote really fast growth because the company was doing well then. In hindsight, we paid too much because our growth didn't materialize.

Now, I'll be very open about it. For many, many years, our whole model—since we buy domains and domain expertise—was that we always backed existing management. Because if you buy a domain, existing management and founders will nurture that domain and innovate, because that's something that we can replicate. Then we built an operating model around them that helped them become better operators.

In that 2020–2021 time frame, so many bad practices were happening in software operationally in order to fuel growth that, in some cases, we needed to go through management changes. It was too much of a lift to go from a negative 10% margin to 40%, which is what we try to do. The 40% is the end goal in most cases. So here, we changed leadership and put in a very, very good operator.

But we really lost the innovative capability of that company. We really didn't know that space and those customers, and that really hurt us as well in hindsight. So I think what we're doing now is we're much more humble about why we got lucky in the space and doubling down on those attributes, while also being very open that things are changing around us.

So, that domain expertise—in hindsight, you would have kept existing leadership in there, and in future buyouts, you'd have more of a bias toward keeping that existing leadership?

100%. We discuss it as a team. If these companies are about people, they're so leadership- and people-intensive. You buy them and say, "I'm going to get a great franchise, a great domain, cash flow. This is great." But who's going to do all this? You're going to have nobody there on the leadership team. You're going to find them all and upgrade them to people you don't know, who don't know anything about this business.

That's one of the things that I disagree with the conventional thinking of private equity, actually. It's a change agent: "Well, I'm going to bring in new management because they're making mistakes." You have to recognize the fact that the reason they got to 2 billion in ARR is that they did something right in the process. The hard job is making sure that you can adapt to them and them to you. That's where a lot of the heavy lifting happens.

Monthly operating reviews, 8:00 to noon, that we follow with these companies. It's much easier as an owner to say, "Oh, no, I'll just put in my people and I won't have to deal with that." But then they don't know the domain.

4. Software Capital Gets More Selective

Fascinating. In terms of capital deployment at this point in time, I can imagine the revaluation in software has created some opportunities. Are you seeing those opportunities? Are there management teams that want to sell?

It's so tricky because, as one of my partners says, who's just a great investor, this is exactly the wrong time to buy a mediocre software company at a bargain price. It's a very powerful statement.

It's tempting because if you cut some costs, maybe you own it at a 7% or 8% yield day 1, and if you can hold it together, you can try to make some financial money on it. So when you look at what we do, we double down on what we think we do well and what has served us well in the past. Buy the highest-quality domain with domain leadership. That really narrows the field.

Powerful statement.

Now you have the addition that the company needs to be showing really, really good progress in terms of this platform shift and adapting to this world. You need to see it in the numbers as well. So that narrows it even more.

Now, there are some great assets out there at very low prices that we have offers on, but nobody at these values is willing to really talk and have a conversation. That's the truth. It's very hard for us in private equity to make money out of the market being low. Let's call it insufferable contrarian.

Which ones?

I wish I could tell you.

This is good. I know, I know. Got to try. How about the financing markets for said buyouts? Are they open for software right now? There's a lot of consternation out there about private credit and whether it's overexposed to software, and there was a presentation earlier this morning about that. If one of those potential targets said, "Yeah, sure, let's do it," are the financing markets open for a software buyout?

Isn't it incredible in investing how quickly things change? People loved asset-light industries, return on capital, all that. What happened to that?

Now that that's over, let's go to CapEx. Of course, it's so attractive now because it's building the whole infrastructure of the future, and it seems to have no end in sight. Credit is very similar. All this private credit money gets raised, and they tell their investors, "These are recurring revenue streams. These are asset-light. Cash flow is much greater than EBITDA. Look at the debt paydown. This is fantastic."

Now it's like, "No, this is not software. These are health care and kind of this and that."

Is it open? We're refinancing a company now, which has about a $3 billion loan, and on a refinancing without equity going into the business, the market has dropped from roughly 7 or 7.5 times leverage to about 5. The rates are about 250 basis points wider, with some fees up front. So people unlevered can make 10%, call it, on a credit now, when it was closer to 6% before—yield to maturity. There's a lot less of it.

When you look at your portfolio, you've got to say, "I really have to pay a lot of debt down to make sure that in year 2 or 3, when the wave of refinancings comes, you're at a pretty low level, so you're not at risk."

Guest

In terms of when you're putting a lot of new money in, it hasn't really been tested yet. Is there any depth to that right now? What do you mean by putting a lot of new money in?

Well, in that deal, right—in those refinancings—you're not putting equity underneath it. But if you come to a company and say, "I'm going to buy it for $10 billion, I'm going to put $7 billion in, and then you need $3 billion in financing," that gives your partner a lot more comfort, and the market should be deeper than in a pure refinancing. A bit of a cushion with the equity that's going in, in addition to that, makes sense.

Would you see Thoma Bravo in, say, 2 or 3 years? Right now, on your website—and I think on CNBC earlier, we called it the largest software firm in the world—is it going to be the largest AI firm in the world? What are we going to call it?

I hope so, and I don't know yet. That's more of a marketing thing. I actually had breakfast with an LP that's just been with us for 25 years—a really great relationship. I love our partners because they're willing to look at everything in its totality, and they understand what we're doing now much better because they saw what we were doing 25 years ago and through that history.

They asked me the same thing: "If the companies are about automating industry processes and functions using software and AI, where do you go with this?"

Now, we believe we are, by far, in private equity, the AI-centric general partner. That's where we spend all of our time, most of our internal investments. The bookings from our companies are about 35% AI tech now. But what do we call it from a marketing perspective? I don't know yet. It's a good question.

Guest

Well, maybe we'll be back here in a couple of years and we'll be able to circle back to this conversation.

It's an interesting question because I think software leaders of public companies, some of the great ones—and there are a few out there that are too big for us to buy—that are really, really good and have really good leaders, are frustrated with that as well. They're also great at marketing, so I'm looking for them to come up with something, and they haven't been able to either.

Guest

Wow. Maybe they can ask the LLM for some help on that front.

They do a pretty good job on that, too.

5. Google Opens The AI Stack

Speaking of LLMs, Thoma Bravo recently partnered with Google. It's among the big consortiums that we've seen partnering with various LLMs to help bring more deployment and enablement to portfolio companies.

I'm curious how that deal came together: why Gemini, why Google, and why you felt like it was necessary for your portfolio.

We work with all the hyperscalers in terms of cloud hosting in our operations, and the commitments to each are in the high single-digit billions over time. Google is just such a great organization. They've been very aggressive and very dedicated to growing Google Cloud. Most of this group saw the numbers that they posted last quarter. They were just terrific on Google Cloud.

They've always been looking to do more business with the companies that our funds own. Now, with Gemini, Vertex, and their entire stack, that relationship got a lot more interesting to us. For example, a lot of our companies are building agents with the Vertex framework. Other ones are building their own framework, but Google has a lot to offer and a lot to add.

They've always been a good partner because they depend on that domain expert at the top to bring Google through to the customers that we have. We're not really in direct competition. We've never been with them. Sometimes they get to that upper layer, and it is what it is in cyber or in other areas.

Given that they're really the only ones that are fully integrated in terms of a stack, we thought that we should pay a lot of attention to that and partner more closely with them. In the short term, we really wanted our companies to have early access to their models, especially our cybersecurity companies. We thought that was important, and they're willing to do that.

So that's what it gives you: early access to the models. Then there's some sort of talent or engineering component to it, too, right? There's a scarcity of those engineers and the people who can help really deploy within the enterprise.

It's interesting. This community of—now, the term is FDE, forward-deployed engineer, right? Palantir coined that. If you look at the resumes when people are looking to hire FDEs, they're the same as a software developer: a junior software engineer or a senior software engineer. We're looking for this.

That was one of my worries early on, when ChatGPT was first released: Am I dealing with a different community, or are these the same people?

Yeah, they really are the same. What we want to make sure of for our companies is that we're not missing anything. Those forward-deployed engineers who exist in different places, including Google—which is one of the best innovators of all time—can be very helpful to our businesses.

Yeah, it's interesting, because when I heard about it, I was thinking: For a company like Thoma Bravo, you've got how many engineers at your various portfolio companies? Probably thousands, right?

Every company, on average, is about 1,000, but those are the flagship companies. We're concentrated in about 30 companies. It speaks to this idea of talent scarcity and whether there is actually talent scarcity, or whether it just depends on how you define it.

Right now, there's huge talent scarcity because you have a lot of engineers who haven't adopted—or haven't been as open-minded about adopting—this new world and really learning it and moving very quickly in it. Some have. So right now there's scarcity, but that scarcity won't last. These people get retrained really quickly, especially given the bill rates that they're charging and the pay rates that they're getting. That's going to change very, very quickly.

We talked about deployment, and we talked about financing. What about the exit side at this point in time? So much of the IPO discussion for 2026 and early 2027 is around AI-native companies. Is there a world where you see a vibrant exit environment for software and for your companies, or is this something that you expect to take some more time?

Right now, it's just so difficult to see that. We have a couple of large companies that are in late-stage discussions with financial services firms, and another one that's in late-stage discussion with healthcare or hardware firms that want access to that technology.

It's moving slower, of course. They know what's going on with valuations, and we're always of the mind that we've never been afraid to sell. Whenever we have interest from a big buyer, we always look to trade. Within reason, we're also not stupid enough to let a great asset go at too low a price at a bad time.

We've told our investors it's going to be a challenging year for exits. Last year was a very good year. Just in the flagship fund, we distributed about $15 billion of cash back, which was very good. It was a record year.

Hopefully, this buys us a little bit of time, but we're always trying to work these deals. It's so difficult for investors to see how that could change.

But today is today. That could change in 6 months. You just have to keep working on it. What changes that equation, other than obviously the revaluation of the upside in multiples and public comps?

So many things. The agentic opportunity becomes great, and these companies begin to realize it. The incumbents—which is most of the agents being deployed right now—are being deployed by these software companies. Something else slows down, and they start looking more attractive again.

They keep putting up good numbers—20% year-over-year numbers. Their margins hold steady. Their retention rates continue to hold steady. These are really, really good businesses.

We do see our job now—this is the first time in my career that I think we need more people at our firm. We have almost $200 billion under management and 200 people. We're kind of that group that maybe AI people say the world is going to become: very little middle management, small project teams, very little bureaucracy, large spans of control, and very few people doing the job.

But now our job has expanded, because we need to look at all the AI companies on top of the traditional businesses, all the add-ons that are AI, and new industry sectors that are going to be transformed with AI. So is that an opportunity for us to get into many other areas that are going to be AI-centric themselves?

What happens is, every time—and it's no different today—that we start looking at these other areas, they're not as good for us. The businesses are not as good. The consistency of the company, the cash-flow profile, and the ability to increase margins over time as you grow—nothing thus far that we've seen comes close to the model that we love.

So you wouldn't be doing a VC-type thing where you're looking at more of the newer companies?

We're just not good at that. We tried it once, doing a deal with 7 other great investors, and then going to a board meeting and saying a few things. If the company is losing money, and you're a little frustrated that it's losing a lot of money, or it's not an environment for getting deals because you're really close friends with somebody else, we don't spend our time that way, and we're not good at that.

It's domain expertise.

Our team is very, very good, I feel, at picking quality, at spending most of their time thinking about investing, but also in running the companies with management. If you look at how our team spends its time, it's 4 hours with every company every month, grinding through the disciplines, and people love it. That's what my mentor taught me how to do.

As you think about U.S. competitiveness, you talked about who is out there that could be a threat to the existing portfolio companies you have. How do you think about global competitiveness? Is the U.S. still the leader in this space, or how do you think about competition with China or elsewhere?

Well, I can't go to China too much with our cyber companies. It's another world, right? It's another tech stack, completely separate from the U.S., and that's becoming even more separate now. Could they come together and there be competition? I mean, sure. Geopolitics would have to change, but right now that's not one of our big concerns.

6. Cybersecurity Faces New Agent Threats

What about Mimecast? You mentioned cyber. Mimecast has been out there as a potential cybersecurity risk and as a potential cybersecurity savior. I'm curious how you see things.

Cyber is a big area for us, right? If you put our companies together, we're almost the size of Palo Alto, which is larger than CrowdStrike. We own the number-one player in many, many areas, with over $2 billion in ARR. These are companies that we're very excited about.

The area that AI is extremely, extremely good at is taking vulnerabilities out of code at the time it's written. We used to own a company 10 years ago, 8 years ago, called Veracode, that did that in a different way. Instead of checking for vulnerabilities after all this code is ready to go into production, you do it at the time that the developer is borrowing that code from open source or doing whatever.

For example, a company like the one we sold was really threatened by the capability of these models to discover vulnerabilities and check them at the first instance. But the big issue with all these new models is the human factor. How do they get into your enterprise to be able to exploit it? Call them bad actors, using the incredible capabilities of these models.

That's where many cyber solutions come in. In terms of customer identity, workforce identity, and email cybersecurity, all the threat vectors that enable someone to be a bad actor in those areas involve a human actor. Now there will be bad actors that are agents. So that's a whole new field of cyber where the identity companies are way ahead. I mean, they're going to own that field.

How do you tell the identity of an agent? What data can it use? What data can it see? What data can it change? All that stuff is completely new, and it's in the domain of those cyber companies. Fascinating. Orlando Bravo, thank you so much. Wide-ranging discussion. Really appreciate it.