Okta, Inc. (OKTA) Earnings Call Transcript & Summary

All right. Thanks for joining us again for another software session. I'm Walter Pritchard, Software Analyst here at Citi. And I have Todd McKinnon, who's the Founder -- Co-Founder and CEO of Okta on with us. Todd, thanks for joining us this morning.

Yes, it's good to be here.

So maybe we could start out just -- we're in a -- probably one of the strangest, most unpredictable, in many ways, unfortunate environments that we've seen in a long time. Can you just talk about what you're seeing from a business perspective? What this work-from-home and shelter-in-place dynamic has done to drive Okta's business? And on the other hand, what you've seen from a macro perspective and how that's been a headwind in the business.

Yes. It's been amazingly interesting to say the least. I think that -- first of all is, I think as a CEO, it's been -- I've never really had to make decisions that were really kind of health and safety of the employees was on the line. So that's been kind of an interesting experience. So I think one of the things we did well is very early on in the process is we got it really clear with the company, the priorities, like #1 priority was to make sure the employees are, and then by extension, the customers and so forth were safe. And then after that, it was really all about being agile and flexible. And because like a lot of people, we didn't know what was going to happen. So I feel like we've done a good job with that. Going into it when we all went to shelter-in-place, I think that -- I was -- we were mostly a remote -- or sorry, an office culture. And I was honestly a little bit just culturally -- and the dynamic of the company, I was a little bit -- I wasn't sure that how effective we could be remotely. And thankfully, the company has been very effective remotely in terms of like getting products out and innovating and shipping things and closing deals and so forth. So that's a super pleasant surprise. So there's a lot of learnings there. I think we can talk maybe about that. It will inform the future of our workforce. But on the market side, I think in -- and we've been doing this for like 5.5 months now. I think the first couple of months, there was definitely a rush of people just deploying Okta to be effective remotely, employees' workforces. We had some really good tailwinds there. I think there was also some just general, especially in impacted industries, there were some general -- also some headwinds, just some slowdown in projects and some companies not doing too well. But I think that's largely behind us. And I think what we see now is people kind of getting on with the business of transforming their technology and doing more cloud and adopting Okta for both workforce and customer identity as they have the last few years, right, because they need to get closer to their customers on the customer identity side. They need to be more flexible and secure on the employee -- the workforce identity side. And it's -- we're in a very fortunate position.

Got it. How do you think about as we move through the year, I think Q4 is usually a big sort of projects quarter, budget flush and so forth. You obviously have guidance out there for the year that gives -- has some assumptions in it and so forth. But just talk us through sort of qualitatively how you think the rest of the year will play out as we move into next year, given the environment we're in.

The -- so if you look at all the historical numbers, Q4 is -- we're ramping and growing through the year, so Q4 is always our biggest quarter. And if you look at the numbers, the quantitative numbers this year, the pipeline and momentum in the business, it looks very good, like we should be able to do what we've done in the past. I think that we're -- there is a -- in our guidance and in our planning, there is a measured approach. We want to make sure that we're -- we preserve that optionality to be agile and flexible, given the uncertainty in the environment just from a macroeconomic perspective and from a -- with the general situation of COVID-19 companies and countries and people are dealing with. We're trying to be measured, but we're also optimistic, especially in the long term. We think that a lot of the -- COVID-19 has fast forwarded a lot of the trends that were inevitable anyways, whether it's remote work or digital transformation. So we're very optimistic in the long term.

Got it. And how have you seen -- I think we've seen some of the bigger cloud players talk about, for example, Microsoft, talking about customers, even putting more scrutiny around cloud and making sure their utilization of paid instances and so forth is high. And that there really is a sharp business case around some of the cloud migrations, even if the view is that things inevitably go there. What nuances have you seen around, especially the macro factors as it relates to cloud adoption?

It seems like companies are -- from what we see, companies are embracing it aggressively. I mean even in -- through our lens, it's like even in industries that were traditionally maybe had big IT budgets, things like financial services, right? Financial services companies have big IT budgets, and they have a lot of people that do identity internally. And we've seen even companies like that really be aggressive about adopting cloud. I think that the usage, especially also on the identity for their customers, 24% of our business is customer identity, so a company's urgency to really figure out their website and their mobile app and how they can get a direct connection to their customers. I've probably talked to 3 or 4 CIOs, CTOs in the last month, where it's all about we're going direct to our customers. We're using the web and using mobile apps to like maybe disintermediate people and get around the traditional supply chain and go direct to our customers. So that's a big trend and that inevitably involves -- that does not involve legacy technology. That involves AWS or Google Cloud or kind of modern cloud technologies from a development perspective and from an infrastructure perspective, and it's really happening.

Got it. And stepping back, how do you think about -- as you've worked on getting larger enterprise customers on board and the $1 million customer count has gone up quite a bit. When you look at the opportunity within these big customers, sort of trying to get to market size here, but how do you think about the employee opportunities, sort of various aspects of that, you have MFA, you have the core directory, you have SSO, you've got your workflow product that's sort of in the IGA space, and then you've got customers. Sort of how do you look at the ultimate spend that a large customer could be to Okta as you sort of fully get adoption across this product portfolio?

Well, I think that the -- I think that first of all, the workforce versus customer identity, as I mentioned, workforce is about -- customer identity is about 24% of our business from revenue and the balance is workforce identity. Over time, we think they both are very large markets. We think that they both could be $25 billion-plus markets over time. So I think that we're very bullish about both. If you look at where we're investing across the product portfolio, I think that's an interesting lens and kind of tease out how we think about the opportunities going forward. Where a lot of the product work is going into making Okta a componentizable platform. So we have these platform services that -- things like Okta Workflows, Okta devices, things that can be used across both of those use cases, workforce and customer. So that's where we're investing because companies want -- they want one platform, they want to be able to use that platform across multiple use cases, and they wanted to connect everything. So that's how we're investing from a product perspective. I think that in terms of the company's size, we're -- we've had, for the last few years, a very explicit focus on the Global 2000. So we've kind of been -- Okta traditionally, it was really like a mid-enterprise company. We never really did really small business. We started -- our sweet spot, traditionally, was 5,000 employees and so forth. So we have a big opportunity in the Global 2000, and it's -- we're making a lot of progress, but probably the most optimistic thing about the company is it's still relatively early for us in the Global 2000. We think that we land these deals that are -- that seem big, they are $1 million-plus ARR deals, as you mentioned. But for these companies, they're just really small starter deals for these big companies. And these companies have multiple divisions and hundreds of thousands of employees and cases, millions and millions of customers. And the value we can provide to them is massive, which is why we have such a focus there.

Got it. And so as you think about the sort of playbook of rolling out your technology within the Global 2000 customers and some paying you $1 million upfront for the initial rollout, what does that typical rollout look like? Where do they start? And what do they usually add next? And how long does that process take in terms of them able to get enabled?

It's kind of -- it's interesting. Traditionally, what we would see is that a company would start with the single sign-on product and then maybe add multifactor authentication or life cycle management on the workforce side. Or on the customer identity side, they might start just with the directory. They might use Okta as a central directory to maybe consolidate some customer databases and then have a good log in experience on their website. And then they would, of course, maybe add other products in the portfolio on each side and then cross-sell workforce to customer and customer to workforce. One of the interesting things about the largest Global 2000 companies is sometimes they'll adopt a bigger part of the suite, multiple products like single sign-on, multifactor authentication, life cycle management, but they'll do it just for maybe a sub-company or a part of the company. And then so the upsell is then Okta into multiple divisions, right? We -- I'm thinking, one example, a big -- a global insurance company that the first -- the "land" was the full products suite in one kind of subsidiary. And then over a couple of years, the $6 million, $7 million of ARR, what it grew into was really other units and then finally, the global parent. So that's one interesting difference. And that's -- and because of that, we've -- over the last couple of years, have gone to more of a named account, global account coverage model, which gives us better sales capacity and service capacity and support capacity to turn that one department or that -- not really a department, it's a company, a subordinate -- or a subsidiary company and turn that into a global standard across the [indiscernible].

And what do you attribute that to? So the sort of landing with all products as opposed to maybe landing at a larger scale vis-à-vis the employee base, but only with one product? Is that maturity of the products? Is there some other force at work, do you think?

Mostly, it's kind of the IT organization, I think. Some IT organizations are -- they're centralized for just central things like HR apps or things like directory services or identity. But then there's IT teams and the other subordinate parts of the company that do other things. So I think if a company has, let's say, really decentralized IT and not a strong central IT function at all, we tend to get deep and broad product deployment in one subsidiary versus if there is -- I think of another -- I can think of another example, like it's a global like technology services company. That deployment started at the central IT group just for directory, right? So it was a very one product to all employees. But then it took us longer to go down into all the subsidiary companies because each of those IT groups had more beyond the directory in central HR and some central security things. They had more autonomies decentralized. So it took us a little bit of selling across the entire organization to get into those subsidiaries. So kind of it can work both ways.

Got it. And just...

And by the way, I've noticed that there's no like -- it goes back and forth. People want central IT. They want -- then they want to decentralize IT, and then they put it back together in the middle. There's no standard across the world, across how that works.

Yes. No, that makes sense. So I guess one of the -- another question I get pretty frequently is how much of what you're selling, especially on the employee side, is replacement technology for sort of the prior generations of identity management infrastructure versus how much of it is sort of replacing either manual processes or just a new need that's arise as these customers have gone more fully in the cloud?

I think -- so it depends by -- it's different based on size of company, and then it's also different based on the products. I think that if you look at something like multifactor authentication, surprisingly, that they had a solution in the past, but it was mostly tied to a local network. So it's like -- I guess, it's "replacing something", but it's replacing it in a way that's far more flexible and for more adaptable and far more useful, which is a little bit different than single sign-on product. The single sign-on product is actually, surprisingly, in a lot of companies, it's not replacing anything. It's just they have so many cloud apps, and there's so much security risk with the things being outside the data center, along with the benefits of that, there are some security risks that they put in a single sign-on solution to make it easier to use, make it more -- easier to get their hands around and to make it more secure. The last thing I will say is, I would say, in the large enterprise, it's -- there's -- I would say, more identity technology has been adopted. So there's more replacing legacy in the large enterprise than in the medium-sized enterprise.

And how do you look at the road map there going forward? I mean you have products or technologies you have like Advanced Server and the reverse proxy implementation or newer type offerings for you, and it seems like some of those lend themselves better to replacement. Do you expect replacement to become a bigger part of the business on the employee side or not necessarily?

I think it's -- with the focus on large enterprise, it's a bigger part of the business, especially with taking out these legacy identity suites, taking out an Oracle Identity or a Computer Associates identity stack. They had, of course, SiteMinder and then a bunch of technologies they put around that. So I think large enterprise, it's more replacement. I think interestingly enough, Advanced Server Access is -- that's actually not replacing things that often. It's more -- these people are building in the cloud, they have this DevOps in this flexible DevOps environment and they want -- they're using shared accounts and bad security practices. So we replace bad security practices. And that's -- and there's new kind of dev shops which is powerful and that product is perfectly architected for that.

Got it. Can you talk about the role of a CISO as a buyer for you? I mean identity management has sort of been thought of as letting the good guys in, not necessarily kind of keeping the bad guys out where CISOs have been focused in the past. Can you talk about that person as a buyer or advocate or their influence on Okta adoption within customers?

It's really, really grown. I think if you had asked me this question 3 or 4 years ago, I would have said, yes, usually an IT person or maybe a CTO or a product officer is into the customer identity side. But in the last -- especially the last couple of years, the CISO has become a pretty important buyer for us. I don't -- I should probably -- we should probably get some more exact numbers. But I would say that over half of the deals, the CISO is an important, if not a direct buyer, a very important influencer, and -- both on the customer side and the employee side. Traditionally, CISOs have focused more on the employee side, but you're seeing in customer identity, especially when a lot of times, Okta for the customer identity side is to make things more secure with multifactor authentication and so forth. So the CISO has become an important factor in our world, and we have a great story for the CISO, which is one of the reasons why we're doing so well.

Yes. And then shifting a bit over on the consumer side, I think you highlighted this, to some degree, just the basic functionality of just having a better -- a directory and a better website log on experience for customers. I think there's a few things going on in that market. You have the very high end of the market where they probably have built around. Then you have the low end of the market, where they may not be ready for your solution. What is the sweet spot at this point for these customer identity customers? And where do you see that evolving over the next year or 2?

It's very broad. We see in the large enterprise, I think it's -- a great kind of target customer is a customer that's maybe had some customer-facing and partner-facing systems, but they've been -- they're dated, and they're trying to modernize those. So maybe they're upgrading their ERP system and they get some kind of web customer view or they're upgrading their legacy CRM system and they get some kind of web customer view. And along with that, they want to supplement that with a newly developed experience that kind of encapsulates that legacy system. And so we can play 2 roles. One is we can be the front door, but we can also help integrate the data from that legacy system into this new customer directory. So it's like legacy application upgrade plus new initiative to build the modern stack is a very compelling use case for us in large enterprise. We have a -- I mean a great example of that is our customer, Albertsons, the grocery store. They had some kind of legacy customer systems and they wanted to build a great new customer portal for coupons and get that channel online, and we helped them there. So the other surprising thing about customer identity is that it's doing very well actually in the mid-market segment. And I think that's because you see -- first of all, you see more mid-market companies that are digital companies, whether they're building a product or a service or -- we're great for that. And also, I think you're seeing that market segment, maybe sometimes a little more agile, a little bit able to quickly get online with some of the larger enterprises. So surprisingly, we've done very well with customer identity even in the corporate segment or the mid-enterprise segment for us.

And in that market, I mean, traditionally, you've sold in the -- you started out in the enterprise, selling to employee -- or corporate markets on to -- into the employee deployments. On the customer side, sometimes, developers are important advocates, users of the product. How have you had to change your sales process? And who you're going after there? And I know -- I think you even have some competitors that really focus in the customer identity segment on developers specifically. I'm curious how the competitive landscape there and what you've done to optimize the sales motion has gone.

Well, it has to -- that's -- I think when you're talking about developers, I think it's less about -- it's not a sales motion, it's a product, right? So our sales motion is great. We sell high. We sell broad. We sell a pretty compelling value proposition to the senior leaders in the company. And the way we sell to developers, we don't sell to developers. We just have our product do the selling for us. And that's an area we've been -- I talked a little bit about earlier about this focus on platform components. That's really important for developers because you can have great APIs and great documentation and so forth for developers, but the guts and the bones of the platform need to be consumable in a way that solves their problem and gives them what they need and not too much. So we've done a good job of that with these platform services, which is one of the reasons why this business has taken off.

Got it. Got it. And then as it relates to integration into other developer services, which have been the most important services to integrate with on the customer identity side to make sure that your product is just thought of as another building block as they're putting together a consumer service?

It's -- so there's a bunch of them. I mean there's all the -- just the tool chain that developers want to use. They want -- and one of the -- I guess, it's -- you can -- it depends on how you look at it, it's positive or it's a negative, but there's really no -- it's really no standard developer toolkit. There's Java, there's JavaScript, there's Python and there's .NET, and there's a lot of different developer tools. And so one of the things that we've done in our customer identity business is we work with all of them. We have SDKs in all the top 10 major languages and toolkits. And so we're kind of -- we kind of meet the developers where they are, which is really important. We've also done -- we've also done a lot of work to integrate with the cloud providers, whether it's Google or Amazon, to make sure that the command line tools and the -- not only from an API perspective, but also from an advanced server access perspective, we can integrate with their -- after they create their apps, we can integrate with how they deploy and run their apps as well. So it's just integrating that whole tool chain is important. And like I said, like a lot -- and our -- Okta is good at heterogeneity, right? So I guess the heterogeneity of developer tools is good for us because it plays to our culture of supporting everything. We believe that a developer that uses a tool that's flexible and can span clouds and span programming languages and span environments is ultimately the best choice for the company and the developer. And so that's our approach there.