Thoma Bravo’s Investor Meeting Sends a Warning RiskTech Cannot Ignore
Source: CNBC
Orlando Bravo did not mince words at Thoma Bravo’s annual investor meeting in Miami yesterday. Speaking exclusively with CNBC’s Leslie Picker on the floor of the event, the firm’s founder and managing partner addressed the AI disruption narrative head-on – and drew a sharp line between the software companies his firm owns and the ones it would not touch.
“There are many, many software companies in the public markets that will be disrupted from AI,” Bravo told Picker. “Those companies were going to be disrupted anyway. AI will create that disruption a lot faster, and some of the decreases in their valuations are very warranted.”
Thoma Bravo manages over $183 billion in assets across roughly 80 enterprise software companies, making it the largest investment firm with concentrated exposure to the software sector. That portfolio visibility – into customer contracts, renewal rates, and the operating fundamentals of dozens of companies – gives Bravo’s assessment unusual weight. This was not a market prediction. It was a practitioner’s observation.
The RiskTech industry should take it seriously.
A Different Story Inside the Portfolio
Bravo was equally direct about what he is seeing inside Thoma Bravo’s own holdings. “For the most part, our companies are crushing it,” he said. “Our companies are incredibly positioned to be winners in the agentic era, and our companies are well on their way toward becoming AI-centric companies.”
He also pushed back firmly on suggestions that Thoma Bravo should be marking down its portfolio in line with public market declines. The S&P software and services index has lost roughly a quarter of its value since October. Bravo said his firm’s markdowns are not close to that magnitude, and that Thoma Bravo marks its companies on EBITDA, free cash flow, and net income rather than revenue multiples. “These are still very healthy levels,” he said, “and we can earn excellent returns at those exits or at those levels.”
Responding directly to comments by Apollo co-president John Zito – who reportedly told a closed-door meeting that private equity marks on software are broadly wrong – Bravo declined to comment on other firms but defended Thoma Bravo’s transparency with its LP base. “We have here with us literally 100% of the largest state pension plans in the US, and literally all of the sovereign wealth funds of size in the world. Many of those have been our partners for 25 years. They have seen our marks, they have seen our exits, they have seen our progression, and everybody is extremely comfortable.”
Proofpoint Launches Agent Integrity Framework
“The need for cybersecurity in the world of AI goes up. It’s not just humans and other traditional systems you have to protect.”
Also at the meeting, Proofpoint CEO Sumit Dhawan announced Proofpoint AI Security, a new product built around what the company calls an Agent Integrity Framework. The product addresses a specific problem created by the proliferation of autonomous AI agents inside enterprises: traditional security tools cannot determine whether an agent’s actions align with its intended purpose. Proofpoint is positioning to govern that gap.
“The need for cybersecurity in the world of AI goes up,” Dhawan told CNBC. “It’s not just humans and other traditional systems you have to protect.”
The product is a cybersecurity solution, not a risk management one. But the problem it identifies – that autonomous agents create risk at the same time they execute work – points to something the risk management community has not yet fully confronted. As AI becomes embedded in business functions, governing the integrity of those agents is not solely a security problem. It is a risk management problem as well.
CalPERS Frames AI Disruption as a Portfolio Variable
Anton Orlich, head of private equity for CalPERS, added a dimension that should concern every RiskTech vendor with institutional investors in its LP base. Orlich acknowledged that some prior software underwriting did not fully anticipate the pace of AI-driven change, and described CalPERS’ venture AI holdings as a “natural hedge” against disruption in its legacy software positions.
That framing is significant. It means large capital allocators are already pricing AI disruption risk into enterprise software holdings – not as a future scenario but as a current portfolio management reality. For RiskTech vendors still operating as though their market is insulated from that repricing, the signal from Miami could not be clearer.
“There are many, many software companies in the public markets that will be disrupted from AI. Those companies were going to be disrupted anyway. AI will create that disruption a lot faster, and some of the decreases in their valuations are very warranted.”
Why Legacy RiskTech Is Structurally Exposed
The GRC and risk technology market has largely treated AI disruption as a problem for generic enterprise software, not domain-specialized risk platforms. That assumption is wrong – and the reason goes deeper than most vendors are prepared to acknowledge.
Legacy RiskTech was built around Assurance and Compliance objectives – defining controls, testing them, and producing evidence for audit and regulatory consumers. While the three lines of defense model assigns first-line control ownership to the business, in practice the exercise has been driven almost entirely by risk practitioners serving assurance purposes. The architecture is sequential: identify risk, document it, test the controls, report the results.
Integrated Risk Management operates differently. Risk governance extends into Performance and Resilience – into business functions, operational decisions, and strategic execution – running concurrently alongside the work itself rather than reviewing it after the fact. In that model, both humans and machines manage risk and create risk simultaneously. An AI agent executing a business process is exercising risk-relevant judgment whether the organization recognizes it that way or not.
That is a governance problem legacy GRC platforms were never designed to address. The question facing every enterprise is not whether its current risk technology vendor has added AI features. It is whether the platform was architected for concurrent, enterprise-wide risk governance – or for the sequential, assurance-driven world that AI is now bypassing.
Not All RiskTech Faces the Same Exposure
Bravo drew a clear distinction between software companies that deserve their valuation cuts and those that have been “severely punished when they shouldn’t have been.” That distinction is precisely what the IRM50 – Wheelhouse Advisors’ classification of the fifty vendors defining the GRC and risk technology market – is designed to make.
The IRM50 AI Disruption Risk Index, or ADRI, ranks vendors by structural vulnerability to AI disruption across two dimensions: compliance-artifact dependency and architectural positioning for autonomous risk management. The results are not uniform.
“Two of Thoma Bravo’s RiskTech portfolio companies rank in Tier 2 of the ADRI – the second-highest durability classification in the index”
Two of Thoma Bravo’s RiskTech portfolio companies rank in Tier 2 of the ADRI – the second-highest durability classification in the index, behind only ServiceNow at Tier 1. Everbridge and Riskonnect sit alongside Microsoft in that group, a placement that reflects strong architectural positioning for autonomous risk management and lower dependency on compliance-artifact workflows. Coupa, also a Thoma Bravo holding, sits at Tier 3, reflecting moderate disruption exposure.
The broader market narrative paints all software with the same brush. The ADRI does not. While Bravo’s remarks are a legitimate warning for much of the RiskTech landscape, they are not a uniform verdict – and the differentiation within the IRM50 has direct implications for how enterprises and investors should be evaluating their risk technology portfolios right now.
Wheelhouse Advisors has published two research notes through The RTJ Bridge that provide the full analytical foundation: “The IRM50 AI Disruption Risk Index: Which Vendors Are More Durable in the Age of Autonomous IRM?” and “Not All SaaS Is Equal: IRM50 AI Disruption Risk Index.” Both are available at wheelhouseadvisors.com/rtj-bridge.
The capital markets are already having this conversation. The RiskTech industry needs to catch up.
