Okta, Inc. (OKTA) Earnings Call Transcript & Summary

Thanks for joining us today at the Berenberg Cybersecurity and DevOps Conference. Today, we're very fortunate to have with us Okta's CMO, Ryan Carlson. Ryan, thanks for joining us today.

Happy to be here.

I'm going to kick it off with Q&A. [Operator Instructions]

So with that, let's kind of just kick it off. If we think about it, last year was kind of crazy. I'm still working here in front of a green screen in my apartment. Cybercrime is incredibly on the rise, and then you have the SolarWinds breach sort of at the end of the year that I would call kind of the icing on this cake. From your perspective, how have you seen the threat landscape evolve over the last year? And kind of what are your expectations as we head into 2021?

Yes. I mean 2020 was a year like no other and hopefully remains a year like no other because we don't want another one like that. As context, before I answer your question about the threat landscape, just for those who might be new to the Okta story, we're an identity company broadly. And you can think of us as using identity as a technology to help 2 different but somewhat related problems. Well, the first thing we got, workforce identity, is every employee or a member of an organization needing to access their apps and their information, they need to do that easily and securely and we help them with workforce identity. But anybody building software needs to connect that software to a person, to a user. So we call that customer identity, and we build into software the way for companies to connect to the users of their software. And both of those things experienced significant change over the last year. And initially, after the uncertainty of what was happening in the world settled, we saw a huge change in the conversations about -- well, what Okta does in general is important, and now it's even more important. And you mentioned the threat landscape and security. Imagine taking a workforce with several hundred thousand people and, in the course of a couple of weeks, having to make it all remote and then having to both get that workforce up and running completely remotely themselves but also having to secure and manage it while you can't be physically present in an office with any of your users. And the threat landscape is not -- that's not like hackers are going away. It's not like cybercrime is slowing things down. So you had to really be proficient in using cloud services to do this and spinning things up quickly, things that you can manage remotely. And we were built and born in the cloud. Our service covers cloud apps but also on-premise systems and on-premise applications. It covers everything any organization would need, but we're delivered from the cloud. And that really helped us serve customers. And then the customer identity landscape that I mentioned with -- if you're going to connect with your customers virtually -- and right now, you have no choice but to do that, you can't -- you have to do it quickly. You can't compromise security in order to accomplish speed. And so for us, authentication built into software is really hard if you're going to do it yourself -- and we'll talk more about this, I'm sure, us providing a service that does it quickly but also keeps it secure was huge in this threat landscape.

So you did mention the 2 halves of the identity story, workforce and customer. On the workforce side, it does make sense that single sign-on and MFA, they're kind of crucial components of securing this remote workforce. So let's say we saw a big demand increase for these products as a result of the pandemic. Everyone went to work from home. How do you see -- how sustainable is that demand environment? How is the demand for those solutions change as we sort of exit 2020 and go into 2021 where the world might return to the office? Or we just all see more prepared to kind of support this remote workforce than we were last year?

Yes. For sure. I think at a high level, some things happened during the pandemic that were net new and necessary that might go away when things return to normal. Other things were going to happen eventually and the pandemic just accelerated them. And I think that the things that we do on the workforce side, single sign-on, eliminating usernames and passwords for all the apps that you use, putting two-factor and multifactor authentication in front of those things, those were always going to happen for every organization. They had to get there. This just accelerated it. So once, knock on wood, we return back to normal, are people going to not need single sign-on and multifactor authentication? No. They just got there sooner than they otherwise would have. And it's kind of like we -- imagine taking away -- we're very much a security solution. We keep users safe. We help organizations secure their entire group of constituents in a remote way. But the people who use our products love using our product. We solve a real problem for users. It's a kind of a unique solution in all of security. Most of the time, security intrudes upon or weakens the customer experience or the user experience. In our case, when you start using Okta, imagine taking that away from your workforce. They just wouldn't have it, going back to trying to manage multiple usernames and passwords or -- our multifactor authentication solutions are very seamless. I'll get a push notification on my watch that I just have to tap, and that lets me into everything. Imagine taking that away and putting something else, and it's not going to happen. So we feel like these weren't -- this wasn't onetime demand. This was just pulling things forward and accelerating things that a lot of companies were going to have to do anyways.

And understanding that the demand environment was sort of accelerated because of the pandemic, we also have to address the fact that the macro environment kind of did get a little bit weaker, right? So did you see any unusual pushback on pricing given that, I believe, you guys tend to be the premium-priced asset in the space?

Yes. This -- the macro part really tend to be vertical or industry-specific. For many companies who kept going and for a lot of our customers, even their businesses could accelerate during the pandemic. And so obviously, we didn't see any pressure there. But others, hospitality and travel, who were really hit hard from a macro standpoint, you certainly saw that there. We actually -- during the first couple of months of the pandemic, it's very clear to us that our product could help organizations. And we took the long view, and we actually introduced a version of our product that was free for as many users as you want, for as long as you want. We didn't feel like -- for some companies who were really -- who needed to find a way to reimagine how they're getting work done, we didn't want to capitalize upon that in the short term. We felt like if we could help them and service them and make their jobs easier, then that would work out for us in the long run. And we actually had -- I think the number is close to 200 different organizations who use that free product from us. And we felt like that will help in the long term. Now like I mentioned, hospitality and travel, those things were hit hard. But we had a cruise line, a major cruise line, become a customer of ours in the pandemic. We had a major airline recently become a big customer of ours as well. And so we certainly see that happening in part because we're foundational. You can't use IT and technology inside your company without something like Okta. You can't connect with your customers via software without something like Okta. And so we -- certainly, there's some industry or vertical-specific macro trends, but at a high level, we think that was offset by the increase in demand for all the reasons I've mentioned.

And when you talk about certain verticals being pressured but still landing customers within those verticals, would you consider those customers anomalies? Are the vast majority of the customers in those verticals still not spending? And if not, do you expect those -- that spend to sort of improve going into this year as maybe things start to normalize in 2021?

Yes. For sure. The ones that were hit specifically that -- their businesses were affected because of the pandemic, as things return to normal, they -- if they get through this, and the big companies will, their spend, I'm sure, will increase at a macro level. What that means for us is hard to tell because like I said, we're very -- we're near the top of the list of things that you want to spend money on. Conversely, we're near the bottom of the list of things that you would cut spending on given the mission-critical nature of what we do.

And then aside from pricing, you have other dynamics where you see some of your competitors, like Ping has a new cloud offering. We have CyberArk purchased Idaptive, which has pretty strong functionality. And then you just have Microsoft that continues to build out their overall functionality in general. So with all these developments, have you seen any changes to the overall competitive environment in the last year? And more importantly, how do you think about competition going forward?

Yes. I mean in general, you can't -- if you're close to this market at all, you can't help but notice how big it is, how fast-growing it is and how important it is. So of course, it's going to attract attention and investment from others. The 2 that you mentioned, Ping actually -- Ping is a much older company than we are. You can argue they started the space. Their initial technology platform was an on-premises-based product. And it's really hard, just in general, to be the on-prem product and then migrate and be the leading cloud product. It's often said PeopleSoft wasn't able to become Workday. Siebel wasn't able to become Salesforce. The -- it's really hard to be the leader in on-prem and the leader in cloud. And for us, we've kind of seen that with us versus Ping. We're -- I think roughly, we're 4x their size, growing roughly twice as fast as they are. So you just kind of see that it's clear that we're the leader in the cloud. And of course, they're going to try to introduce cloud products. But for us, there's a lot of network effects involved in our business. The more customers we serve -- and we're now across the 10,000-customer mark. I think we're probably 4 or 5x bigger than they in terms of customers. The more customers we serve, the more things we connect to. And the more things we connect to, the more value we add, which means we get more customers. And that is like a very simple but powerful network effect that's part of our business and part of just our platform. And that is -- that has certainly helped create a lead for us because it helps us create the best product, but that network effect is also, we think, accelerating. So it's really hard to -- you can -- if you're somebody like a Ping or somebody like a CyberArk, you can add cloud components to it, but it's hard to catch up. And I think our growth rates really reflect that.

And before I get into the Integration Network, when you do compete with Ping, how important is Access Gateway to that story? Are you seeing customers actually leverage you for full cloud-to-ground coverage? Or are you still more like supplementation, whereas Ping might stay in the background, on-prem, and you guys will more supplement and be focused on the cloud stuff? How is that dynamic playing?

That's a great point, yes. You mentioned this product that we call Okta Access Gateway. If you look at -- since Ping started on-prem, back when they first introduced their product, all of the Fortune 500 companies were using Ping's on-prem products to protect on-prem applications and resources. But then as those companies started to move to the cloud, that's really where we were strong. We were the leaders in -- we're a cloud-based service, but we really started covering cloud-based applications. So then companies were in this choice -- this is years back. But they were in this choice of, "Well, what's the future of my application infrastructure? Is it on-prem or is it the cloud?" And most people would say the future is the cloud. So they would look at Okta to protect their cloud apps, but then they'd say, "Maybe I still need something like an on-prem Ping to connect to my on-prem apps." So we introduced a product called Okta Access Gateway, which eliminated that trade-off. It's still -- it's integrated in our platform. It's a very lightweight on-prem thing from us, but it covers legacy on-prem apps for the world's largest organizations. So now they can use Okta with Okta Access Gateway to cover everything they have, and there's no trade-off for them to be made. And we really feel like the center of gravity for most organizations has certainly shifted to the cloud. And so you would naturally expect them to choose the cloud-based service like us to cover their cloud apps but now also their on-prem apps. So it's -- that Okta Access Gateway has seen a ton of traction, but it's especially opened up strategic conversations for the world's largest organizations. When our -- in our quarterly earnings announcements, we always talk about a subset of our customers, the ones paying us more than $100,000 of ARR, and that is a very fast-growing segment of our customers. That's a proxy for the world's largest organizations in part because we've added things like Okta Access Gateway to do exactly what you mentioned.

And when we think specifically to Idaptive, on the other side of that question, how do we think about some changes to the go-to-market? You used to talk a lot about strong partnerships where you would partner your access management with CyberArk privileged access management. How do you see that progress moving forward after -- on those partnerships moving forward now that CyberArk has purchased a competitor in the access management space?

Yes. It's interesting. Like there's always -- this is true in general but especially true in investing. It's pattern matching. What's this category? Who's the leader in this category? Was there an on-prem version in this category? And will there be a cloud-based version of this category? But I -- and identity certainly lends itself to that because you'll have -- many people would say Okta is the leader in access management, but then you have privileged access management with CyberArk or IGA with a company like SailPoint. But we really think that those lines in those categories are blurring and are going to continue to blur. We look at -- strategically, we'll touch every user inside an organization for workforce identity, where these categories I just mentioned would be applied. And they use us every single day. And we're -- in often cases, we're the directory. We connect with this thing called Active Directory but we're also a directory ourselves. So we become this source of truth or this center of gravity or however you want to describe it. And so for us, we can then use that and, we think, our unique approach to building software to go and solve problems that some people might say is a PAM problem or some people might say is an IGA problem. And we just look at that as we can solve that problem for customers. And so I think those lines are definitely going to blur. We partner with CyberArk, and we partner with SailPoint. And yes, we see the Idaptive stuff, but we were really laser-focused on customers. And we feel like we're in a really strong position to solve problems for them better than anybody else, and many people will, in the future, look at those as PAM or IGA solutions from us, for sure.

And when you talk about this convergence story with customers, right, I think most customers today are buying a separate tool from the separate, respective vendors within their leading markets. Do the customers understand the story of convergence? And are you hearing any feedback in terms of ongoing investment in your, what you'd call, IGA or PAM modules that need to be done in order for you to really take on this convergence story?

Oh, yes. The customers, especially the leading edge, forward-facing C-levels, CIOs and CISOs and CTOs, they understand this clearly. Like we interact and engage with our customers closely in a bunch of different formats obviously. But one of them is we get a small group of C-level executives together a couple of times a year just to really think strategically. What -- we're looking for feedback from them often, and we're looking to make sure we understand the trends that are happening in their business. And then literally, every one of those -- and I'm in those often. Every one of them, they say, "Okta, when are you going to take on PAM? When are you going to take on IGA," in part because they like our approach. I kind of mentioned it briefly before. Our unique approach to building cloud services is that we're taking things that are inherently complex, inherently difficult. And through our design approach, we abstract that complexity away and we make them simple. We make them easily accessible but still retaining the power and the impact. That's really hard to do. It's really valuable. And we hear all the time, "We want you to solve these other areas for us in the way that you solve what you already do for us." So yes, customers see that clearly and they ask us for it all the time. And for us, it's just a matter of -- we have to prioritize. There are so many things we can do from the position we're in. We want to do them in the right order. And I realize, Josh -- sorry to interrupt. I haven't yet answered your Microsoft question. I will get to that one but keep going.

All right. We'll ask a little bit more about Microsoft. I wanted to touch on the Integration Network, right? So I've lost count already, but I think the stat is north of 7,500 prebuilt integrations or somewhere around there. When you look at your competitors, like Microsoft, the last time I checked, had 1,800. Idaptive is at 2,200. I would assume that after the first 500 integrations, you're likely covering most needs of the average enterprise. So I understood that this used to be a big competitive moat for you guys. Do you still view it as a competitive moat? Is that moat shrinking as other companies build out their library of integrations? And how do you see that moat standing in the future?

Yes. For sure. I think it's the clearest manifestation of this moat that we would call the network effect. Because there are these vanity metrics, where you can say, "Oh, we have these many integrations." And so you decided numbers. We're still bigger than anybody else, but I think your point is that after a certain number, do you really need that many? The short answer is yes because you got to cover everything. You can't leave a hole. But it's not just the number of integrations. It's also the type and depth of these integrations. So there's -- to get into our workforce identity products, you can do single sign-on or authentication or federation into an app. That just signs you into it. But we also have provisioning and de-provisioning integrations, setting up and deactivating accounts when somebody joins or leaves. And we've added capability into those products that we call Workflows, which puts the power into the hands of the customers or into system-integrator-type partners the ability to build unique integrations between these apps. So here's one example. Let's say you have a workforce that -- or sales force that's using Salesforce.com as your CRM. And you want them -- your salespeople to be able to see their full forecast when they're using a company-managed device that you know is secure. But you also want to enable them to use their personal devices but you want to restrict the access to maybe just the things that is specific to them. That's a pretty complex scenario. You can set that up with Okta so that when a person joins their organization, it's automatically configured inside Salesforce for them, those permissions based on that scenario. And that's a different type of integration. That's not one that you just throw into the 6,000 or 7,000 integrations. That's one that's powerful. And that's one that -- and increasingly not being built by us. That's being built by customers. It's being built by ecosystem partners. And so the Okta Integration Network is extremely valuable, but it shouldn't just be measured by the number of integrations. It should be measured by the depth and type of those integrations. And we feel like that's a flywheel/network effect that's very much spinning for us in that area. Does that make sense?

Yes, yes.

And it is related to the Microsoft question, for sure.

I'd love to move on to the exciting things going on in customer identities. If you want to address the Microsoft question, you're more than welcome to. If not, we -- I have plenty to ask on customers.

Yes. The short version is those integrations, the things we connect to and how deeply we do so, we feel like that's why customers view identity as this. It's no longer something it's part of another platform. It's its own platform. You have an HR cloud. You have a CRM cloud. You'll use Office 365 for email and collaboration, but identity is on par with those because it gives you this flexibility to connect deeply to anything. And that really ultimately sets us apart from somebody like Microsoft. But yes, let's talk about customer identity for sure.

Okay. So you did give a little brief introduction of what it is, how it differs from the workforce side of the business. I guess the #1 question off the bat is why now in terms of the Auth0 acquisition, maybe some investors are questioning, why not purchase an asset like Ping, maybe stay in the workforce market, buy some enterprise customers especially since we just spent the last 20 minutes talking about massive drivers in that space. So just any view on why now in terms of the acquisition would be great.

Yes. For sure. I mean buying somebody like Ping -- like I said, we're 4x their size, growing twice as fast that -- we feel like we can just extrapolate out that trend. In customer identity, it's very much a newer market. We put the size on workforce identity, the market size, the TAM, at $30 billion for workforce. And we have said that customer identity is $25 billion. We've been saying that for a couple of years now. But that market is new and it's dynamic, and it's ever-changing. And the dynamic in that market is very much not a -- the primary competition there is somebody is building something themselves. It's a software developer or a team of software developers who are building a website or an app or a SaaS platform, and they also would build themselves the authentication or identity components. And so the primary competition for us is build versus another vendor. And we've long admired Auth0. They are very focused on this. That's all they do. It's customer identity. And they've done an incredible job of looking at it from a developer standpoint. And I don't mean developer like independent developer in a garage. I mean -- no matter what type of company you are, you have software developers and they're increasingly important in how you choose software, choose tools and build your digital transformation strategy. Auth0 has done an amazing job of building their company and their products and just everything they do with the developers in mind. We've tried that. We're very good at thinking about what a CIO needs and a CISO needs and reliability and scalability. And in customer identity, there's so much variation and so much variety in the use cases that people are trying to solve. We have just found -- and I'm getting to your point about why now that -- we can together -- Auth0 plus Okta together can give more value to customers, can give more choice, can solve more use cases for them. And we look at this $25 billion market as one that together, we could go at it faster than we could alone primarily by doing more for customers solving more problems for them together than we could alone. And that's kind of -- that's a high level. Why now? We also have gotten -- as we got to know them, they're very similar to us from a culture standpoint, from a vision standpoint. And we really feel like that will be complementary and additive. We feel like we're a stronger organization as combined with them for the customer identity market, again, because we're doing more for customers than we could alone.

And when we think about the demand drivers on that side of the business, workforce saw a bump from pandemic. Is the view that the pandemic will also accelerate the demand in customer identity because you basically have all these large enterprises that are prioritizing applications as the platform of choice for servicing their customers going forward?

Yes.

And this too should benefit from the pandemic-related drivers?

Potentially even more so. I mean when you think about it, you have -- you cannot connect with your customers physically right now. You have to do it virtually. So this term digital transformation, which is broadly used by everybody just to talk about companies moving themselves forward using technology, that has been accelerated. I forget who said this. 5 years of digital transformation has been compressed into 5 months. And you have no choice but to connect with your customers with software now. And if you're going to connect your customers with software, you need an identity solution that is that connection point to those people. And so we feel like it certainly pulled things forward. And also, it's not like when things go back, people are going to say, "Oh, I no longer want to use a food delivery service." The -- these digital connections that are being accelerated are not going away anytime soon. It's kind of -- the pandemic has accelerated a lot of things that would have otherwise happened and that, we think, customer identity is in that category for sure.

And you have the demand side of it benefiting. How do we think about the barriers to adoption, right? So you talked about it being traditionally in-house. Is the view just that there are now these, I would call, maybe aggressively accelerated digital transformation time lines, people are rushing to modernize applications, but there's a big resource gap from developers? And now maybe just there's an inflection point in terms of it's just going to be easier to sell a customer identity going forward because organizations don't really have a choice if they want to keep up.

I wouldn't say they don't have a choice, but it's clearer than ever before where they should spend their development resources. If you think about customer identity, it's an odd part of a website or an app that it's not really going to differentiate your app. You're not going to win because you have a better authentication flow but your -- you might kill your company if you don't protect your customers' information and you get breached. So it has to be done right. It has to be done really well, but it's also not where your -- as an organization, your developer should be spending their time. They should be working on your core application, the software that you're using for your business. And so we think developers, when they prioritize, will say, "Okta and Auth0 can do it better than I could build myself." And so it's incumbent upon us to make them aware of that. One way in which we're really complementary with Auth0 is they did -- like I said, they have done an excellent job of focusing on developers of an -- organizations of all size, and they have that reputation. We've kind of expect that there will be a boost. "Oh, Auth0 is now part of Okta. I know of Okta as this trusted, leading, fast-growth category-defining company, and now Auth0 is part of that." That makes me even more confident in choosing something like Auth0, that we feel like the awareness amongst developers will be heightened. And that is a big -- if it's a build-versus-buy market, a big part of the marketing is just making sure that they're aware that we exist.

Yes. So I was kind of hoping you could expand on that last point. On -- when you announced the acquisition on the earnings call back, you guys drove home the point of the developer community. Can you maybe just expand on how important it is to have the trust in the developer if you're trying to break that build-versus-buy scenario? And how do you believe that Auth0 will help you land more customer identity business going forward?

Yes. So what -- the phrase back in the day that everybody knows, "Nobody gets fired for buying IBM." That's because it's the safe choice. And you -- I think Okta, we are very much a trusted company and a trusted partner. And people feel like this is such identity in general, whether it's for your workforce or for customer identity. It's an important choice. It's not something you can swap out easy. And it's not something that if you mess it up, it's not going to have a huge impact on your company. So we have -- over the 12 years we've been doing this, a core part of the Okta brand is trust. We give people confidence in our technology but also in the way we conduct ourselves, how we prioritize their success. We've done a great job on that. Developers look at it slightly differently though. Sometimes, they look at the big company as like the not-fast-moving company. And they -- developers want to go and use a product without talking to a salesperson. They want to get it up and running. And if they have a small app, put in a credit card. And Auth0 has done a great job of that. And so we feel like developers may have had somewhat of an allergic reaction to Okta, but they certainly didn't to Auth0. And now there's no trade-off they need to make. They get the best of both worlds. Whether you're a CIO or a CTO and you're caring about your development team or your independent developer inside that, you get the best of both worlds now.

And can you just help -- especially from your perspective, I think the language was in the near term, they're going to be run as separate businesses. Can you kind of just help us understand like what's the integration time line there? And then how complementary really are the product offerings? Like is there any overlap? What's it going to look like in the near term when they're separate businesses? I know you don't really compete, but can you compete against each other? Like what's that dynamic going to look like? And when should investors kind of expect one customer identity offering from Okta, whether it does or doesn't incorporate both of your offerings today?

Yes. I mean we've been very clear we're going to keep both platforms. We're going to keep investing in both platforms, and we expect both platforms to get better, faster now because the integrations that we ultimately will make eventually will be on the back end, and they'll be able to take advantage of each other in a way that both platforms will improve at a faster rate. Now like acquisitions, when you buy a company that was working, Auth0 was doing very well. I think the numbers were -- looking forward, $200 million plus of ARR, growing north of 50%. You don't want to mess that up. It's working. And again, we're not doing this to go find synergies that you see in some acquisitions. It's -- the synergies we're talking about here are revenue-accelerating and value and choice and flexibility for customers. That's -- and so it doesn't make sense to try to smash them together earlier than you otherwise would. It makes sense to keep doing what they're doing, which is working, and keep doing what we're doing, which is working, and then find ways for that -- these 2 platforms to take advantage of each other to get better faster than they could alone. And we also don't want customers thinking, "I have to migrate from one to the other," because we're -- again, this is about going faster and about going after what is the real choice that companies are facing, which is building this yourself or buying it from an Auth0 or now an Okta plus Auth0.

Okay. And I guess the next thing I want to touch on is, if I remember correctly, I believe Auth0 has a pretty meaningful international presence relative to Okta today. So how does that acquisition kind of accelerate Okta's plans to capture the international opportunity? And then maybe just more broadly, how are you thinking about this international opportunity? How does it differ from the U.S.? Who are you competing with there? And then maybe where the customers fall in the adoption curve relative to your buyers in the States.

Yes, yes, yes. I mean Okta's international -- the percentage of our revenue on the Okta side that's international, it's hard to grow it meaningfully because we're growing so fast in North America at the same time. It's hard to change that mix. But we certainly expect Auth0 to help us with that. They do have a strong international presence in part because they're an international company. They have their headquarters in Latin America in addition to the North American headquarters. They have a fully distributed team from the beginning, and they've just done a really good job even in the Asia Pacific and ANZ region. They've done really well there. So we think that will help in part because as people keep moving toward customer identity solutions and the way we talked about, they're already there. But there's also a synergy on the growth side, which is every company that was using Auth0 for customer identity should be thinking about using Okta for workforce identity. And that's very complementary for us to look at those types of conversations now that we'll be in eventually. That can help and that -- we expect that to help internationally for sure.

I'd like to talk about that not -- more broadly, not just internationally, but I think Auth0 has about 10,000 customers. So there should be -- I mean I know it's early in terms of what's the exact customer overlap. But I'm assuming from your perspective, there should be some low-hanging fruit in terms of, well, we have 10,000 customer identity customers that we can now sell at least Okta's workforce to -- or try to sell it to. So are there any plans in place? Anything you guys are strategizing, bundled packaging, just face the target Auth0 customers and kind of capture some of that low-hanging fruit and sell them on the workforce tools?

Yes. I mean this is -- we haven't yet closed the transaction. So a lot of those plans, we would look at when it makes sense to do so. But at a high level, we sometimes say Okta's vision -- our vision as a company is to enable everyone to safely use any technology. And we chose the word everyone there. It used to say anyone. We want -- but we now believe we can cover everyone. And that means like getting reach to every person. Whether they're inside an organization, whether you're a customer, we want to help them safely use any technology. And so anybody who's using identity should be using it for their employees and for their customers. And that's something that we'll -- we can make that more clear that we have the most choice and the most options to let organizations do that, for sure.

And then I guess, not from a selling perspective but from a technology perspective, is there anything that we've sort of missed that the workforce side of the business can kind of take and leverage from acquiring Auth0 technology?

Yes. This is a great point, something that when we talk about -- you were mentioning Ping and CyberArk even Microsoft. We're the only company -- and this is even without Auth0. This is now stronger with Auth0. But even before Auth0, we're the only company that is really good at both of these things at the same time, workforce and customer identity. Some -- all of those other ones are focused more on workforce. They have customer identity offerings but they're not really -- they're not meaningful. Or a company like Auth0 is really focused on customer identity but didn't really have workforce. We're the only ones that were really strong in both. Remember, before Auth0, customer identity for us was 1/4 of our business, growing faster than the rest of -- it's a meaningful business that's close to close to $250 million for us. So we're the only ones that are strong in both, and the key reason for that is the way we've built our platform. It's not like we have 2 separate platforms. It's one integrated platform. And so when we add a feature to a workforce product like multifactor authentication that's a push to your watch or a password-less option, you can then make that available to developers on the customer identity side. And then to get to your question, one of the things that we do on the customer identity side, you're serving organizations that have tens of millions or hundreds of millions of customers. You have to be able to scale. And when we can scale in that way, that reliability and that scalability goes over to the workforce identity side. And one integrated platform that does both of these things benefits from the uniqueness -- the unique aspects of workforce and customer identity. If we had broken it apart and we had different platforms for it, that might be -- that's not as possible. And then to the point about Auth0, we're going to be able to leverage their technology to make our customer identity products better. And of course, that stuff should go over to the workforce side in the way that I just mentioned.

And when you think about over the last year and then how you think about going into next year, has the mix in terms of your customer conversations, like "I meet a customer, they're interested in workforce," or "I meet a customer, they're in customer identity?" Like does that mix change? Has the mix led to more customers talking about customer identity? Like how should we think about that over the last year and looking ahead?

At the high level -- and yes, for sure. But at the -- at the top of the funnel, the initial conversations were really -- we actually just are launching an ad campaign. We call it People Protected. And the whole -- it's a very high-level campaign. It's around you need to protect ideas. You need to protect the brilliance. You need to protect your business. And to do that, you need to protect your people. And your people are your employees but they're also your customers. And so at a high level, we're trying to convey that identity can help you in all these ways. And no matter what the initial conversation that we have with the customer is, whether it be about workforce or customer identity, we then broaden it. But yes, for sure, we're seeing more interest in customer identity in part because many people thought they had to build it before. It's an awareness thing that's changing and in part because of the acceleration of digital transformation like we talked about.

Okay. If we kind of switch gears a little bit, I think we talked a lot about workforce and customer identity. I wanted to kind of touch on the SolarWinds attack a little bit. If you look at a lot of the different attack vectors, right, it kind of seems that on-premise Active Directory Federation Services is kind of the feeling everything that sort of went wrong. Are you seeing or hearing from customers that they want to look to move away from relying on ADFS? Is this an immediate benefit to Okta? Or is this more about like a long-term flight to Zero Trust? And then you even mentioned earlier, you are a directory. Does this benefit products like Universal Directory. Just how do you guys think about this opportunity over the long term?

Well, I mean it is so important to workforce identity in this case that you mentioned because ADFS is -- Active Directory is the -- it was bundled in with Exchange. And every company, to a first approximation over the last 20 years before G Suite, was using Exchange for email. So they all have Active Directory. And then ADFS was a way to connect that to a cloud app, and ADFS is rife with security vulnerabilities. And the problem with it -- and you know this and then probably many people listening know this, is if there's a security vulnerability in that, it's your responsibility as the customer to patch it. Sure, Microsoft will be posting, but you have to go patch it. And that is just -- you're always going to lose there. You're always behind the curve in terms of catching up and patching these things that have vulnerabilities. It's true of on-premise software in general, but it's especially true of identity-related on-premise software. And the center point of that has long been Active Directory, and it's attacked for a reason because so many organizations use it. And it's just an arms race of trying to keep up to speed with vulnerabilities and people trying to attack it. And what you should be using is a cloud service where we do nothing but keep that secure and keep that -- keep and maintain it and also keep it updated. You don't have to patch Okta. There's nothing like -- stating the obvious, you never have to go and update your version of Gmail. You're just always using the latest version. And we released -- we have functional releases every single week to our service. It gets better every single week. And that compounded over years is going to win. And so to get to your point about SolarWinds and in general, it's not a new issue, these things I talked about, on-premise software having vulnerability, maybe patched. But it significantly raises the awareness and just drives the point home across every level of the organization. And so now if you're a CIO, you're at the Board meeting every quarter explaining your cybersecurity strategy, and now you're having to answer, "What does SolarWinds mean for us?" And if the answer is, "I have a lot of on-premise software that I need to somehow patch," that's not a good answer. You have to go to cloud services in general, and cloud services like Okta in particular if you want to have a chance.

Okay. And then I know we're kind of coming up on time. So I'm going to just kind of sneak one more in here. Net revenue retention rate was very strong last year. And I'm not looking for an indication of what it's going to be headed into 2022 but if -- fiscal 2022. But if we look, I'm assuming a lot of that was driven by customers rushing to adopt MFA, SSO and really enable that remote workforce. So now that we head into this year and everyone seems to have kind of figured that out, what would you point to as being the products that are the real drivers? Or is it just a seats-related thing? What would be the real drivers of keeping that NRR metric strong going into this year?

Yes. It's a good point. It's not just that people went to MFA from SSO. We have multiple land and expand. So an organization will start with us in one case, whether that be with a workforce and then they'll add more workforce products or, like you said, they'll add more seats so they can grow in a number of products in workforce or their -- just their workforce gets larger. Companies buy other companies. Companies grow inorganically through M&A. Well, any time they do that, that's thousands and more employees that need to be covered by the workforce products that we sell them. But it's also -- you start with workforce and you go over to customer identity and you start to use Okta to manage all of your customer-facing properties. And then we've talked about this in the past. You see people starting with customer identity and going back over to workforce. So there's lots of land-and-expand opportunities for us in new products, new seats or new use cases. But one of the things I would do, and I would be remiss in not ending with not -- getting close to the end without a plug for our customer conference, it's called Oktane. It's our annual customer conference. It's April 2 through 6. You'll see a bunch of product announcements there, which -- as we have become the category leader and we've created this new space and we're the leader in it, it's incumbent upon us to continue to add new products to that mostly and primarily because we'll add more value to customers, but it also helps us with things like our net retention rate. I'm very excited about the products that we're going to announce in just a couple of weeks at Oktane. We do have an Investor Day there as well, where we'll expand upon those after the products are announced, and that will be a big driver for things like NRR.

Okay. Well, I think there's no better place to leave it here than with the plug for the business. So everyone on the call, thank you very much for joining us. Ryan, it was a pleasure. Thanks for giving us the time. And I hope everyone is well, doing well. Bye.

Thanks, Josh. Appreciate it.