Okta, Inc. (OKTA) Earnings Call Transcript & Summary

Well, at the risk of starting a little bit earlier and having a few people walking in while we're up and running, we're going to do a fireside chat with Okta this morning. Bill Losch, the CFO, is going to be here from Okta. We strongly believe the center of gravity of security is not only in the process, but has already moved out of the data center and into the cloud. We strongly believe that, over time, there'll be a number of cloud platforms that are integrated across what is industry calls the Zero Trust model. In that world, security is delivered by protecting users, data and applications. The connective tissue that centers all of those elements is identity, and we strongly believe that Okta is the de facto standard in the identity market and is the connective tissue that allows cloud security to happen. So we have a buy recommendation on the stock, and we continue to recommend it. My name is Alex Henderson, and I'm the security analyst at Needham. And we're going to get going on the Q&A.

Sounds good.

So I know that everybody here is probably familiar with Okta, but for anybody who might not be, and you want to give us just a quick rundown on what it is that Okta does and what the scale of the company looks like and so forth?

Sure. So we are an identity and management platform. And basically, what that means is if you think about where the world is evolving to, and I mean evolving to, because it's still happening, which is moving to the cloud, more and more enterprise figuring out how they can move to the cloud, how they can digitally transform themselves as it relates to their relationship with their customers. And to Alex's point, operating in that world of a Zero Trust security framework, it -- identity management has become more and more of a critical integral point of amalgamation of everything in that world. And as a result, what we have been able to do is basically establish ourselves as the leader in identity management for the cloud. We've done that through a number of products and features and functionality. We started out with basic single sign-on. We've now grown that to single sign-on, a universal directory, which in effect, is a way of thinking about it as active directory for the cloud. We've done multi-factor authentication for security, lifecycle management for deep workflows. And we've really focused on 2 markets. One is workforce, meaning for customers, for their employees, contractors and partners. And then there's another market that we focus on, which is what we call customer identity, which is more and more customers wanting to build applications for their customers, not just traditional technology companies, but all companies. All companies have to do this to be competitive, and so that's another opportunity for us from a market standpoint. Both are very big markets. Both are growing markets. Both are markets that we believe are still in the early stages mainly because cloud adoption and the movement to the cloud, despite the fact that we've all been talking about it for a few years now, is still very much early. We've had significant growth in the business. The current analyst estimates have us for the year a little below $600 million in revenues. And we've seen very, very strong growth year-over-year. And the reason we've seen that strong growth is because we were the first to do what we do. It's a cloud-based architecture. We have the integrations to thousands of cloud applications and other technologies. And so what we've been able to do is really build a very strong network effect with all these integrations because customers want to work with us or want to connect to our platform because, in effect, all those integrations provide them a way to seamlessly move themselves to the cloud, enable them to get to the cloud in a more efficient and productive way and also do it in a very secure way because, to Alex's point, in a world of Zero Trust, the reality is that when you think about what has to be a key part of your security, it really is the identity and the management of the identity to make sure that who the person says they are, you can authenticate that, that is who they are and that they really do have access to what they're trying to access. And having that centered around identity is essential. It's also essential to have it as a separate platform like we do because what we allow companies to do, as I said, is connect to any application or technology. So we're agnostic as to what you connect to. And because we're able to do that, customers are gravitating toward us -- or companies are gravitating to us to become customers because of the fact that, that independence that we have and the fact that we're agnostic as to what you connect to really allows them to make decisions in a fairly seamless and secure way about connecting to best-of-breed, which is really what companies want to do when they're moving to the cloud is focus on what are best-of-breed applications I should be connecting to as opposed to historically what has been more of a vendor-centric model in the on-prem world. So those are really, I think, the key things that are driving us and driving the success we've seen so far.

So we're talking about scale as being critical element to your first-to-market. I think you've given guidance of something in excess of 30% top line growth going forward. But on a calendar year basis, that would put you somewhere around $750 million in '20, and on '21 somewhere approaching $1 billion in revenue. What does the competitors look like comparatively? How much ahead of the competition are you, particularly the fact -- and the fact that you have multiple pieces of your business?

Yes. I mean I think that, from our perspective, what we've been able to do, as I said earlier, is establish a very strong competitive moat with these network effects that we've been able to build. And these network effects are really the depth and breadth of these integrations. We integrate to over 6,500 applications and technologies. We now have over 7,400 in customers. The reality is that the more technologies we connect to, the more customers are interested in connecting to us, that creates more users. The more users creates more data that flows through our platform that allows us to build better and better products. So that virtual life cycle is really what has differentiated us from the competitors. And I think the reality is that when you look at other companies that are pure identity management companies, we're significantly bigger, have grown significantly faster and, frankly, have that bigger competitive advantage, I talked about, these network effects than they do. And we're continuing to build on that all the time. I think that when you think about companies of larger size than us who do identity management, you specifically think about Microsoft, who has their Azure Active Directory, which is their version of Active Directory in the cloud for cloud management. But the reality is that our success against them continues to be very strong because of what I said earlier, which is CIOs, by and large, more and more want to be able to connect to best-of-breed applications and they want to have the ability to change that out. If they think there's an application that is doing more for them -- or will do more for them than they have currently, they want to be able to change that out, which is really kind of the beauty of the SaaS model or the cloud. And because we're independent, we can do that. We're agnostic as to what application you connect to. It can be a Microsoft application. It can be a non-Microsoft application. We're agnostic as to what public cloud you sit on. It can be AWS. It can be Azure. It can be Google, among others. And that is not something Microsoft has been willing or will be willing to do because, strategically, that doesn't make sense. They want to have you focused on their applications. So that is why we've been able to have a very strong differentiation from Microsoft and believe we will continue to do. And as we continue to improve our product and focus our road map on making our platform more and more integratable, and what I mean by that is allowing customers to make it more seamless to connect to us and technology is more seamless to connect to us, we believe those network effects will continue to grow.

So just on the core piece of your business, excluding the consumer for a second. You're at least, what, 2 to 3x the size of your nearest competitor.

Yes, I would say that's about right on the [ workforce side ].

And how important, when you're talking to customers, is it to have both the consumer side and the employee side?

I think it's becoming more important. And what I mean by that is, historically, like you said, and still the largest part of our business is what we call the workforce side, but it is the kind of the connecting the workforce to cloud applications to technologies. The customer identity or consumer side is becoming more important because more of these companies, as is not just technology companies, but all companies, are thinking about how do I interact with my customers in a more technology friendly way because they need to do that because their competitors are doing that or they need to do that because they want to take lead over their competitors. And the reason it's important is both the workforce and the customer identity come from the same platform. So it's one identity platform. And what is exciting, I think, to CIOs and CSOs is the notion that they can use one Okta platform to reach both of those big markets. So as a result, we become, in effect, their standard for identity management, irregardless of who their user is, whether that user is a worker or that user is an end consumer.

So none of your competitors have the ability to do both sides of that platform?

They do not do it to the extent that we're able to do it. So I would say most of the competitors out there will do workforce and not customer identity. There are some that will do customer identity and not workforce. There are some that have tried to do both. I think the challenge for them is one of the big attributes of us and one of the big draw of us from a customer standpoint is we can do it both securely, which is the most important, but securely at scale. And what we mean by that is when you think about some of these initiatives on the customer identity side, it's potentially where they could have millions of users that they want to have access to a particular application they're building or have already built. And to be able to secure that and manage the identity at scale is not something that anybody else can do to the depth and breadth that we can or if they tried to do it on that side and focus on that, not only can't they do it at scale, but in some cases, if that's what their real focus is, they don't do it on the workforce side.

So I don't remember the statistics you threw out at the last analyst event. But could you remind us how many people you can have processed in the consumer side first?

Yes. So in -- at our showcase, which is one of the events we do each year to announce new products and functionality, one of the things we talked about, what we call dynamic scale. And what that means is, I mean, we can process 500,000 users in a minute. So we have the scale to do that. And the reason we wanted to make sure we publicize that scale is because, as I said, we've seen traction with customers who wanted to come work with us on the customer identity side because we can do things at scale, but that typically is the question, can you do it at the scale I need it at? And the fact that we can do it that quick -- that much, that fast, puts us at a significant advantage over anybody else that's trying to compete with us.

So there's an example, Disney launches its online product, you could scale along with the additions of millions of customers in a very fairly short period of time.

Right, right. And that's -- that, I think, is an important feature from their perspective or any of those big customers.

So when I talk to a lot of investors about the company, one of the things that come back, "I mean, well you know it's just single sign-on, It's just multifactor authentication, so these things aren't that all that complicated." You've got a much richer feature set than, I think, people realize. Can you talk a little bit about your ability to customize the consumer experience and understand the iteration of data capture that you need as a customer comes on to a website, some of those types of technologies?

Yes, sure. So I think that the Okta of -- or they just do single sign-on and multi-factor, it was the Okta of 6 years ago. It's not the Okta today. I think what we've been able to do over time is take a lot of those basic products, add to that lifecycle management, which is our workflow automation, add to that more advanced multifactor authentication through the data that we run through the platform, which is millions and millions of users that access the platform every day. And in order to -- and what we've been able to do is really build very sophisticated and complicated -- would be complicated for folks to do it on their own, ways to manage workflow policies. So in other words, defining not just how you provision and deprovision people when they start work or end work, but actually defining in a very granular way, depending on function, the access this person has to certain applications, what -- how does that change if they change functions, how does that change if they change job levels, all those kind of things. We also -- on the consumer side, when you think about what they're trying to do in many cases, a lot of these customers are trying to take these large applications and basically be in a position where, 2 things. One is that they can be very assured that it's going to be secure at scale, so that millions of users can access it, but they're confident that we can secure it for them. So there's an element of trust that they have with us, which is really important as they think about what they should be focused on, which is how do I develop that application to be really unique to me, unique to what my customers need, unique to my UI, all those kind of things. And also when you think about, like in the case of a company like Albertsons, which is a grocery chain, where they have a number of different stores, Vons, Safeway, when they were trying to, in effect, consolidate at the back end all the information on those customers and understanding that, that -- you as a customer may go to those different stores, but you're the same person, really being able to manage that ID and that user information more effectively is what they're looking to do and do it at scale, where they know not only they can do that, but they can do it very securely. So it's things like that, that really are what we can do. And the reality is that as we continue to grow through these network effects and we continue to get more data, that we utilize that data to improve the products, those products become even more fine-tuned, fine-grained, better from the standpoint that we can do security better. We can move toward more and more when you're authenticating a consumer or a worker or whatever you're authenticating, you do it in a continuous authentication. You don't do -- just do it one time. It's continuous authentication, unbeknownst to them. They don't know -- it's not like they have to submit a password every time, unless there's a particular issue, in which case, if they're accessing something, it might signal that they have to do another multi-factor authentication. But being able to do that and what people I don't think really comprehend is trying to do that at scale, especially larger enterprises are trying to do this with thousands of employees or thousands of consumers, even millions of consumers, is a daunting task, and that's what we solve for them.

So one of the other things you've announced is the Hooks and the ability to allow programmers who are designing websites to do a better job and build your identity capabilities into it. Can you talk a little bit about how that has changed the consumer side of the business?

Yes, sure. So one of the things that we historically have done when we built the platform is we built the platform as a set of integrated products that are [ integrated ] very tightly to each other. And that's been very important from the standpoint that the value to a customer is the products in an integrated fashion together. What we've now focused on or are focusing on in the last year and continuing, is the notion of the way that platform was constituted is it puts us in a position where people want to integrate with us. So most of the heavy lifting is done by folks outside of Okta as far as whether it's software developers for software companies, technologies that want to connect to us or customers that want to connect to us. But what we're trying to do now is take the platform and make it so it can be more customizable to your specific needs as a developer developing for either the consumer side, if it's an application for your consumers -- for your companies' consumers or even on the workforce side. And so the Hooks and the identity engine, as we call it, is really the identity engine is really taking the platform and componentizing it, so you can use elements of the platform, and the Hooks in conjunction with that, allow you to use those elements and actually do more customizable things that are unique to what you want. A lot of that is relevant on the customer identity side. It's really this notion of, in effect, embedding Okta into your application really as a microservice. So that's why that's important. But it's also important on the workforce side because as we start to do more and more business, as we have been doing with larger and larger enterprises, you're getting more and more complexity in those environments. And so our kind of Okta platform may solve 70% to 80% of their use cases, but there might be some specific use cases that they want unique to them, that they want to be able to have their developers customize on top of. So having that customization, we believe, over time, will result in a couple of things. One, it will continue to enhance and even accelerate, we believe, those network effects we keep talking about, or I've talked about, as far as how many people want to integrate us because they want to build on top of us. And also, because of that, the fact that we're going to create the ability to solve more use cases because people will be able to customize things more, those use cases will create more users, net users kind of keeps that virtuous circle I keep talking about of more data and more data allows us to build better products. And therefore, better products, again, allows us to be -- attract more users and more customers.

So it's also pretty sticky. I would think very hard to see somebody spending time doing programming with your system and then shifting away from you.

Yes. I mean, what we've seen is -- certainly, already is that if we get into a particular customer, we get them successful, we are very sticky. We believe, to your point, that the more we can allow them to customize on top of us, that makes the platform and the ecosystem even stickier. And we think that is an important initiative and why we're focused on it.

So you announced that an on-prem product that you're 100% of the cloud today before this announcement. Can you talk about why you did that? Don't think that it's really a product for generating revenue on-prem as opposed to something to eliminate -- an impediment from people who are adopting you.

Right. So one of the things we've talked about over the last several quarters is the traction we're making with the world's largest enterprises. And we're making that traction in an environment where they're going to, probably forever to some extent, have a lot of on-prem. I mean they're going to operate in a [ hybrid ] environment. But by and large, they want to move to the cloud, I mean, as they are working with us because they want to move to the cloud. And historically, the way we've been able to accommodate, so to speak, them having us as that central directory or that central point of control, while still using a lot of stuff on-prem, is that we've partnered with companies to connect into on-prem, and we still do that. We still have partners that connect into us. But one of the things we realized was that if we could do a single sign-on on-prem ourselves from a technology standpoint, it would, in effect, put us in a position where companies that maybe were not -- they want to move to the cloud, but maybe they were being cautious about it, would be more willing to if they saw a solution that would basically solve, at least, basic SSO into their on prem that then, obviously, integrates with our platform because it's our product and our technology. And they saw that as, okay, if you can do that, that puts us in a position where maybe we don't have to invest as much on the legacy side anymore from an identity management standpoint, not to say that they're completely eliminated, but they can -- don't have to invest as much. And therefore, we can be able to and more comfortable about focusing on doing some of the stuff we want to do with new Okta on the cloud. So it's opened up some opportunities for us. It's just recently GA-ed in November, so it's fairly early, but it -- we've seen some good progress so far.

So as you start to do that and you're involved more with servers, are you getting into application identity?

I think that we've historically been focused on connecting identity or connecting users to applications, so the connection to. I think that, with servers, what we announced with Advanced Server Access last year, was really our first foray into connecting users to something besides application. So in this case, it was the servers. And the reason we did that is when you step back and you think about, as I said earlier, the fact that we're still early in cloud adoption, one of the areas that we're very early in is most workloads are still done on-prem, so that's something that's been happening. But what we're starting to see, especially in a world of DevOps and that type of environment, is companies wanting more and more to develop in the cloud. So as they develop with servers in the cloud and, therefore, want to give their developers more access to their servers, when you think about that, that's a pretty critical thing to give developers access to. So you want that to be very secure. And depending on how many developers you're going to give access to that, you want it to scale. And so Advanced Server Access was our solution to that for customers because, in many respects, if we're already doing the identity management for their user for connecting to cloud applications, it would make sense, we would do that as they connected to other things. And so we see identity for infrastructure, which is really what servers are a part of, as something that, over time, as more companies move more workloads into the cloud, that's an opportunity for us, and that's what we see with Advanced Server Access. Again, very early, companies are just starting to do that in, by and large, but we see that as a big opportunity.

So that kind of brings up the obvious question of you've got Privileged Access Management, you've got the identity access management product that you're doing, you've got the IGA segment. So there are multiple segments of identity, SailPoint, CyberArk, other people in some of those other areas. How do you view that overlap over time? And do you think those categories gradually merge or do you think that they stay fairly separate? How do you see that?

I mean I think we see them as distinct swim lanes, and I'll explain what I mean by that. I think that, for us, when you think about where we are today, again, not us, but the ecosystem of technology, again, most of -- like from a governance and compliance standpoint, most of the really critical governance, compliance, reporting, stocks reporting, those kind of things are still on-prem systems, and that's SailPoint's sweet spot. I think that, that will -- that center of gravity is going to shift, we believe, over time, to more and more of those applications being in the cloud. And that's what we're focused on is we have, in our lifecycle management product, reporting and governance capabilities, but we haven't really completely focused on it from the standpoint that what has been more important to our customers is helping them set the policies and operationalizing the policies through our lifecycle management, but we do have those capabilities. And over time, we think we're going to enhance those capabilities because more of that moves to the cloud. I think the same is true on Privileged Access Management. What I was just talking about with Advanced Server Access is, again, workloads moving into the cloud. And therefore, that's where we're focused on from an access management standpoint. I think the swim lanes are going to be, we focus our strategy -- we do, obviously, some things like we've done with on-prem, but, by and large, our strategy is focused on where we think the world is going, which is more and more to the cloud as opposed to doing more stuff on-prem, which -- there's going to be on-prem needs for a long, long, long time, and that's what CyberArk and SailPoint really focus on. So when we go into customers, there's a lot of times where either us directly with them or, in many cases, big system integrators who are trying to just bring us into the bigger customers, bring us in as those different swim lanes from the standpoint of how they sell to their customers.

On the other side of the coin, though, I mean, if you look at the announcement that SailPoint had about risk-adjusted identity and your products around risk-adjusted identity, they sound pretty similar and they're starting to overlap a lot more. How do you -- do you see a gradual kind of Venn diagram that out where those circles start to interact more over time?

I mean I do think that the swim lanes, there can be a little crossover of the swim lanes. That said, I think that we feel very comfortable with our position and not just today, but in the future, for really being that identity management provider for the cloud products. And whether it's, again, applications or as we move more and more into that governance and compliance is centered in the cloud, we think that's where we will continue to be most successful.

Let me ask you a question about your business strategy a little bit. So you have probably achieved de facto standard in the category. You're the dominant player. You're 2, 3x larger than your nearest competitor. You have both the consumer side and the enterprise side. Nobody else really does that. Yet you're still spending very aggressively. I think you've just talked about spending at a rate that would not produce much operating leverage, if any, in the forward year. Can you talk of why you feel that this is important at this stage of your life cycle?

Yes. I think it is predominantly because we think that we've had significant success, but we also believe that the market tailwinds we've talked about, and I've said this a few times today, of the push to the cloud, Zero Trust security, all of that is in its early stages. And when you think about the fact that, we believe, over time, all companies, by and large, have to become some element of a technology company and, therefore, some element of cloud, some element of making sure they have that security in a cloud environment that we want to make sure we go after that and that we put ourselves in an even stronger and stronger position going forward. And because we see so much of that opportunity, we're making those investments. And specifically, as we see those opportunities with the world's largest enterprise companies because they are starting to make that shift to realizing they're going to be in a hybrid world forever, but seeing us as both the company -- the identity management provider that can solve the most use cases today, but being that really strong on-ramp for them to move to the cloud, we want to invest and make sure that we're covering that as much as possible. And the other area, frankly, is we've had a lot of success internationally, but we think there's bigger opportunities even more [ international ]. So we want to make sure we're focused on that.

Let me stop there. So questions from the audience? Come on. No questions from the audience? Come on. Nobody? All right. Well, we'll continue. I've got a few more -- there we go.

Just to play the devil's advocate as you're looking for questions, but it sounds like the capability -- the type of capabilities that someone like the ServiceNow would [ drive an attack ]. I was wondering if you're the first [indiscernible] going on anywhere in the world [indiscernible].

So let me paraphrase the question for the webcast. So there are companies like ServiceNow that could be theoretically building out capabilities that would move into this arena. Do you see any of the large-scale players that are independent of the public clouds that might come in and go after this marketplace?

I mean I think that the reality is that there is always the possibility that one of them could try to do that. The major obstacle they're going to have is the fact that we have now gotten to a point where, to Alex's point, that we are, in effect, the identity standard for many companies. And the reality is that we have such depth and breadth of integrations already to all the technologies that companies will want to have potential access to, that puts us in such a position that even if you've got a lot of resources, that's going to be -- take a long time and hard to catch up to. And the reality is -- the beauty of that is it's something where we think we're just getting started. And we can continue to build that -- those integrations, those network effects through the reasons I said as far as making the platform more customizable, all the data that comes through it that allows us to build better and better products. And so I wouldn't say that we're obviously always cognizant of who might sneak up on us, so to speak, but I think that we're very confident that the position we've established, and we're not staying static, that we're continuing to improve that position. And it becomes the -- that virtuous cycle of more customers want to connect to us because of that. And if more customers are connecting to us, more users, more technologies are going to want to connect to us. We feel very strongly about that.

So isn't it also true, though, that those type of companies are generally partnering with you as well? So...

That's true. I mean as an example, ServiceNow does integrate with us and is a partner to us -- and is a good partner to us. So that's the other benefit is most of those companies that you might think of are already partnering with us. Now that doesn't mean partners don't turn [ on each ] other at some point. But it also -- they see the value of integrating with us as that identity standard, as does Workday, as does others. So I think that's another reason why we feel very comfortable with our position.

Question in the front.

Do you compete with Ping? And is that what you were referring to before maybe being 2 to 3x somebody -- your next competitor? And then do you also go -- extend into the mobile world like someone like a MobileIron?

Yes. So as it relates to Ping, where Ping has seen success is on-prem. So they've tried to compete with us for a long time in the cloud and that has not -- we've been very successful with that. Where they've seen success, I think, is in being an on-prem and taking potential share away from other on-prem providers. But we think of that in terms of that's kind of the old world, and we're focused on where the world is going. So that's how we think about with Ping. When we have head-to-head competition with them, we've always had very strong success rates, and we continue to. I think as it relates to MobileIron, we decided early on -- we had actually, at one point several years ago, thought about being a mobile management company in addition to what we're doing. And we decided to back away from that. So now we partner with the MobileIrons of the world. Well, we partner with AirWatch because what we're focused on is all the things that we do from an identity standpoint and not the management of the devices. So that's how we focus on it.

So the answer from my perspective is yes because it's definitely who I was referring to. So any other questions? If not, we'll probably have a break, so that people have the ability to switch rooms and get to where they need to go.

Thank you, everybody.

Thank you very much, Bill.

Yes, thanks.

It's good to see you.