Okta, Inc. (OKTA) Earnings Call Transcript & Summary

Well, great. Good morning, everybody. I'm Rob Owens with Piper Sandler, and I manage our security and infrastructure software research practice. Really pleased to welcome our next fireside chatting. I don't know if we can call it presenting, Freddy, but company here with Okta. Joining me is its Co-Founder, Executive Vice Chairman and COO, Frederic Kerrest. Freddy, welcome. Good to see you.

Rob, thanks a lot for having me. Great to be here with you. I really appreciate you turning down the fire. It is still summer time in California. So we need to be careful, but thanks for having me.

Absolutely. So let's just start at 30,000 feet around identity. And it's such a highly competitive category, how are you differentiated from competitors? And why do customers choose Okta for identity?

Yes. Rob, well, very excited to chat a little bit about the business and how we're doing. Obviously, things are going well for us. We've been very, very fortunate. If you look at last quarter, the last year, the last number of years, these mega trends that we're working on, cloud and hybrid IT, digital transformation, Zero Trust security. These are early, and these are going to be very large. And I think what's happened over the last 12 years since we started the company, frankly, is identity has come out of all of these individual stacks of technology and become its own primary cloud. So everyone has historically been a Microsoft shop or an SAP shop or an Oracle shop. And they always had identity 20 years ago, but it was buried inside those platforms. And what you've seen is with this diversity of technology that people are adopting inside their workforces, this identity has come out and become such an important part of how people are building out their enterprise infrastructure. I think that's the first thing. And then the second thing is, obviously, what's happened with the unfortunate pandemic is it's really accelerated everyone's need to move to a more digital world. Look, digital transformation, most of you use the term in the industry, what it really means is people just need to have a better interaction with their customers, their partners, their vendors, their suppliers. They need to have much easier to use interfaces on their web apps. They need to have brand-new mobile apps on their phones. And building all that is very complicated, very hard and tricky. And certainly, you don't want to get that wrong. And then finally, when it comes to security, the bad guys are not taking any days off. And as everyone got shipped home and all of a sudden, phishing incidents went up, and the needs for multi-factor authentication, 2-factor authentication to securely get in an e-mail, those needs all went up. And then finally, what you see is happening in the government, right? I mean you even have the Biden administration mandating that all federal agencies really up their game. When they think about security, they think about protection of information and of data. You bring all these things together and identity has really come to the forefront as this really important piece of technology and frankly, of strategy, when you think about the largest organizations in the world. And I think one of the things that really works for us is we're independent. We're neutral. Our whole vision and mission in life is to help organizations adopt modern technology in the way that makes sense for them. We don't have an agenda to push. We're not trying to push a suite of applications. Of course, I think my MFA product is very, very good, but we also integrate to the top 18 next MFA products. So whatever technology people are using, we help them take advantage of that and then think about what's going to happen in the future. It's not just about what you have today, but how fast technology is transforming and really innovating. There's going to be new solutions that people are going to want to use next year. And we make it very easy for people to think about modernizing their infrastructure and future-proofing it for what's about to come.

So Freddy, what was the problem that you set out to solve at the beginning? I mean, obviously, the abstraction of identity from everything makes a lot of sense nowadays, and the Switzerland position of Okta puts you in a very unique position. But what did you try to solve to begin this journey?

Yes. So the background for the company is my Co-Founder, Todd McKinnon, and I had an opportunity, the front-row seat, really, of the early stages of software as a service, what we now call enterprise cloud. I joined Salesforce almost 20 years ago. You can imagine how much taller and better looking I was then, Rob. And Todd and I worked with a lot of our larger customers at the time. Salesforce became a public company. It started having a little sway in the market. And large organizations would say, "Well, look, we love Salesforce. We want to adopt more of these software as a service technologies, but we're running into basic problems." The problems that you and I still have at home today, too many usernames, too many passwords. It's a much bigger problem, obviously, in the enterprise. You want to let someone go, you have to make sure that you take them out of all these publicly available Internet services with this mission-critical data in it. So it really was a very simple problem that we're trying to solve because we took a step back as technologists had said, "Hang on. We think that software as a service or enterprise cloud is a much better way for most companies to adopt most technology." Whether it's TCO, total cost of ownership, whether it's ROI, the return or whether it's time to value that they're getting, just getting these solutions up and running much more efficiently and effectively, just a better way to go. No one is going to get extra brownie points for running an exchange server that much better. But for all these large organizations to adopt this new way of thinking, we said to ourselves that it's going to have to be a bunch of new integration stacks that are going to be delivered into the market because enterprise IT doesn't throw anything away. What they do is they buy new things, they kind of gloom on the front. And so we thought, well, what are some of the big integration layers going to be? And one of them, we took a bet, obviously, was going to be identity as we thought about how all these technologies were going to spread. And knock on wood, so far, so good.

Yes. And clearly, the last 18 months has played into that. As you're fixing the identity problem -- there you are. You popped up. As you're fixing the identity problem, maybe you could fix my least favorite acronym at all of security, CIAM. First of all, talk about the consumer identity in the access market, why it's going through this massive transformation and what makes Okta very well positioned to address the opportunity.

CIAM, your least favorite acronym. I learned something today. Hang on. I'm going to write that one down, Rob.

I think it should be CIAM or something of that nature.

Yes. CIAM. I agree with you. I didn't come up with it. CIAM, obviously, refers to Customer Identity and Access Management. So when we started, as you mentioned, it was really all around workforce. That's what we knew. That's what we understood from our time at Salesforce. If you think about what we sold, it was SFA systems. Now they have all sorts of clouds. At the time, it was really SFA systems internally to companies as they were trying to move to the cloud. So if you looked at our products, actually, the first 1,000 customers, that's all they could buy was a bunch of workforce solutions. And then in like the mid-teens, I'd say, 2014, 2015, a bunch of our larger customers said to us, "Hey, you know what, you have this awesome user store. It runs in the public cloud. It's got a bunch of great functionality. I want to put customer information in it." And we said, "Well, that's fine, but that's not actually what it's designed for. We don't have pricing. We don't have packaging. We don't have any of these ideas for." So we want to do it anyway. And so we kind of got pulled into this market. Now, obviously, it's become a very big market for us. It's gone from about what we estimate to be $0 of TAM when we went public in 2017 to $30 billion of TAM today. And why that is, is because people and the market landscape is very different here. Here, the whole thing is about build versus buy. Most companies have been putting up websites with username, password, registration flows for a long time. You and I have had amazon.com accounts for 20 years. But what's really happened over the last 5, 7 years, as people said, first of all, the Internet is becoming stable, and the infrastructure is becoming good enough that I can really do business on that. Second of all, it's much more efficient and effective for me to actually interact digitally with my customers, my vendors, my suppliers and all the rest of it. And then third of all, what's really happened over the last few years is we have an extreme dearth of software engineers. In North America, I think we're short 300,000 alone, and we're only printing 30,000 a year in our universities, which means if there was no growth in software, which I believe you and I and probably the other folks on this phone call believe there will be, it would take 10 years to catch up. Now what does that mean? That means that Okta and Google and Amazon will probably get the software developers they want. But large Fortune 500 organizations in the middle of the country, great places to go work, they might have 500 or 1,000 job openings today for software developers, they're not going to get them all. So the ones that they do get these precious resources, they really need to focus them on the things that are mission-critical business advantages for them, things that are sustainable, competitive differentiators. For FedEx, that's their supply chains. For John Deere, it's putting technology inside their tractors. Identity, very important. But the easier we can make it to take it off the shelf and put it inside your application, the better off all these organizations are going to be. Look, you think about the analogy of Twilio. They're doing very well. It's a $60 billion market company. Messaging, a lot of people need that in their app. You look at Stripe, $100 billion payments company, still private, but $100 billion. Well, a lot of people need payments. I would argue everyone needs identity inside their applications. So the easier that we can make it for people to take it off-the-shelf and just use it as a function, as a service, the better off we're going to be and obviously, all of our customers are going to be as they can really accelerate their digital innovation strategies.

So obviously, you're pursuing something there towards the path of least resistance makes a lot of sense. You acquire Auth0, which had more of a development focus versus Okta, which I think probably sold a broader value proposition at the C-suite. So maybe talk about how the acquisition expands your value proposition and what it means for the long-term competitive positioning of Okta in the CIAM market?

You didn't want to say CIAM.

It doesn't flow for me.

I know you really want.

I really did.

I know. So yes, so absolutely. Happy to talk about that. We're thrilled about the acquisition you mentioned, Auth0. We closed that in early May right before -- right at the beginning of Q2. Look, combined Okta and Auth0 is a very powerful combination. I mean, first of all, it strengthens our position as the world's leading independent identity cloud; extremely powerful network effects, which I'll talk about; driving platform innovation; better serving our customers, as you mentioned, with a broader range of use cases and audiences. And frankly, it's just going to allow us to capture the $80 billion identity market even faster. So what does that mean, and why we do it? First of all, we've known the Auth0 folks for a long, long time. It's not like we did it over the weekend, and thought it might be a good idea to get married. The first pictures I have of my Co-Founder, Todd and Eugenio Pace, the CEO of Auth0, having dinner was in 2015. So we've been talking about this with them for a long time. And then we've been talking to them specifically about putting our 2 companies together for quite some time. It didn't happen last year. They did a private round earlier this year. It turned out to be the right time, and we're thrilled about it. I think in the long run, it's going to be phenomenal. Look, we had about a $200 million, $250 million business, growing very fast. They had a $200 million Customer Identity and Access Management business growing very fast. We basically just doubled the size of our business, which is going to be awesome. But as you said, they are very complementary. And that's one of the things I'm most excited about. Here's a very simple analogy. If you want to buy a new car, you can go down in the dealership, you can order a [ Ford or ] a sedan. You can pick the color, you can pick the sunroof. Maybe if you're someone special like you, Rob, you can even pick whether you get the JBL or the standard audio system. And then it's going to show up at your house next week, the week after, and it's going to kind of be all done. It might look a little bit like the neighbor's, but it will be a little bit customed to you, especially when you get the vanity license plates I know you like. Now another way of getting a car is building every specific part from a magazine. One of my next-door neighbors has a machine shop in his garage. He gets his carburetor, he gets his drum brakes, he gets every specific piece the way he wants it. Now that car is also going to ride down the road, and it's going to be super customed, exactly the way he wants it, exactly the speed, exactly the dynamics, 2 different ways of getting a car. And those are the analogies for us and for Auth0. Okta is really more of a low-code or configuration system. It runs out of the box. You can tweak it. If you think about News Corp, they're a customer of both ours and Auth0. They use us for things like fantasy football. Well, everyone uses fantasy football, but it's going to be once a week. It's a pretty standard interface. You can just tweak little things. They're also a customer of Auth0's, and they're making all sorts of new, very, very custom applications for the phone so that when you're watching the Super Bowl, they can have ads at halftime. You can vote on them in real-time, and they can give awards at the end of the Super Bowl. That's a very different approach and a very different need. 2 different use cases, but they still fall into your favorite category, CIAM.

Absolutely. Maybe more so on a tactical level, what should investors think about over the next year as it's integrated in? And I think you recently announced sales integration building in some cushion relative to how you're bringing the sales force together. So help us understand just what to look for and potential benchmarks as you move forward with this integration?

Yes, absolutely. So the integration has gone very well. We're about 4 months in. We're pretty good at execution. So we had some pretty good goals for ourselves, but I think we've been beating even those, which is great. And as you mentioned, we've already announced some of the integrations of the back office are already in place. We're actually moving forward. We're accelerating the go-to-market integration because we're making that a top priority for the beginning of the fiscal year, which for us is Feb 1 in 5 short months here. But if you think about what's happened, Auth0 has brought to our base thousands and thousands of net new customers. We thought there would be some overlap. It turns out there was less than 300 common customers in a base of 13,000 enterprises, so less than 2%, which really shows you how big the opportunity is and how vast that market is and what an opportunity it is for us to go seize it. Customer Identity and Access Management has gone from $0 TAM to $30 billion. It's now 36% of our revenue, growing 54% last quarter. Both sides of the business are growing very, very fast. So we're accelerating the time line for integrating the sales organizations under Susan St. Ledger at the beginning of the fiscal year, as you said. We are already looking at how we're going to do some of the tight integrations on the product side, so that we can really get innovation best-of-breed on both sides. I'll give you a couple of quick examples. Workflows, which is a great product that we've had for a couple of years now, it sold very well on the workforce side last year. We brought it on to the Customer Identity and Access Management side. It turns out it's something that can also augment the Auth0 product and platform, number one. And then number 2, we've got these 2 great products, Advanced Server Access and Okta Access Gateway that have sold very, very well for us, along with CIAM. Day 1, the sales force over at Auth0 said, "Hey, we need those products. They sell very well. It's kind of like can I have fries with that. Can we sell those?" And so we're finding ways to integrate those very quickly. We've got a lot of other really good ideas, no shortage of those. You'll hear more about that when we talk about Okta and Auth0 at our showcase event in October, so in just a month here, where we're really going to highlight some of the awesome product integrations that we already have in place and what's going to come, which I think customers are going to get very excited about.

So just to add to the alphabet soup overall, I did have a question come in from someone online here relative to IGA and PAM, so governance and privilege, effectively. And as you've talked about planning to move into these markets more formally, explain where you are from a competitive position because it does feel like those specialist companies that are out there have more of an enterprise focus. Is the opportunity really in the mid-market? Or do you think you can compete up market with some of those traditional competitors?

Yes, absolutely. So the alphabet soup continues. IGA, identity governance and administration, and PAM, privileged access management...

And I like that one, too. I like IGA. It makes more sense, and so does PAM for me. It's just CIAM. I don't know.

No. I understand. I understand.

Strange fetish, I know.

My job is actually to unpack all of these things and make it easy to understand for your investment world. That's what I'm working on here, Rob. So yes, you mentioned these are -- they're both great categories. Again, going back to our total TAMs, total addressable markets for those of you who are following at home. When we went public, the total TAM for the business is about $18 billion, and that was all basically core workforce. If you roll the clock forward to earlier this year, we've kind of reevaluated these things as we've gone. Core workforce has doubled in size from 18 to about 35. We've added 0 to 30 of your favorite CIAM. And now we've added 15 more of IGA and PAM, which we just talked about. And that's kind of how we get to that $80 billion number. Big market is growing very fast. Look, I think we have a lot of good work to do. Our business is going to wrap up the year at $1.25 billion, give or take, which is a far cry from the $80 billion. So we've got a lot of work to do, but we're on our way. So talk a little bit more about IGA, PAM. It's not as though we sit here at home and look at all these Gartner Magic Quadrants in trying to figure out which ones we play in. We spend a lot of our time with our customers. Love our customers is our #1 corporate value. I think it served us very well, especially as we brought the concepts of enterprise IT into this subscription and enterprise cloud world. And certainly, the proof's in the pudding, right? We're very fortunate to work with a lot of great organizations. And basically, if you think about what's happened with identity, core identity and access management is it's gone from on-prem to people are putting their identity information in the cloud, both their workforces, so their employees and what they're doing, but also their customer information. And obviously, as we said, it's getting complicated. But people are getting more and more comfortable saying, "Hey, this is a mission-critical resource, but it's not my core competency. I have a limited set of developers and time and resource. I want to find the right partner, and Okta is the right partner." Now what is IGA? Let's start with IGA. First of all, IGA is derivative information. And what I mean by that is there's -- today, there is this event, Rob, this amazing event where you and I are having this scintillating conversation. Tomorrow, there might be some reports written about this event. Well, this event right here, that is the identity and access management. And then IGA is the governance, it's the reporting on this event that's going to happen tomorrow. You print out the reports. You say that Rob and Frederic had this great conversation. You give it to your auditors. They make sure that all the information they're looking for is correct, and you move on with life. So if you've moved all of your core identity information into the cloud, it makes a lot of sense that people are not going to want to take that core information and bring it back on-premises to run those reports. So it's really a second order, a derivative piece of information off of core identity. And frankly, a lot of customers have been asking us for a long time now, hey, I've gotten comfortable putting all my core identity information in the cloud. Can I now run these reports? Can I do the auditing? Can I do the logging? Can I do the reporting straight next to that cloud platform? Help me with that. Now as you said, we've kind of started to get into these categories. With IGA, we've got a first set of products there, life cycle management and advanced life cycle management. They solve the joiner, mover, leaver problem with access for employees, entitlement management on your CIAM side. That is the beginning of the IGA suite, but IGA will be a full set of products. There'll be upsell SKUs. There'll be completely different in terms of revenue lines and so forth. But as you can see, we've kind of already started to go that way. And when we think about what customers want, as you said, there are some legacy vendors out there that are on-premises that have 1,000 or 2,000 customers. And that's fine, and we have very good integrations with them today. They manage the on-prem infrastructure for some of our Fortune 500 and Global 2000 customers, and we do all the cloud stuff. But the real point here is the next 25,000 and 50,000 companies who want that same functionality, who are not going to do the on-prem implementation, who want it running in the cloud next to their access management, that's the first group that's going to come. And then as we build the product over the years and as slowly the larger enterprise really realize they're going to push more and more of their enterprise IT out to the cloud, that's going to be a natural for us. Just the same motion we've had in access management, right? Over the last 5, 7, 10 years, we started with the small and medium business, the mid-market was very excited about it. And then as our product got more and more mature, the market came our way in large enterprise said, you know what, I want to put this in the cloud. Same story, pretty similar for privileged access management. First of all, I would argue that in a cloud world, all access is privileged access management, right, because of what you can do and how quickly you can get across in places, number one. Number two, if you think about what the PAM world is, it's a pretty staid world. We talked a little bit about IGA. I would argue that PAM is even more staid because it's really about back in the day when it was the 4 walls of the firewall, the VPN token, and it's basically managing SSH keys on-prem, which have all sorts of problems for developers. First of all, they're shared resource. So if someone does something bad, internal actors, right? Internal actors are a big problem for companies today. If you and I are developers, we're actually going to share that key. So it's not clear which one of us did that bad act on the box, number one. Number two, they accidentally get checked in the source code all the time, which means if you go into the source code, you can find the key. And number three, if you say, okay, we're going to fire Frederic, you have to rotate all the keys, and that creates huge disruption. So just thinking about modern ways that people want to use these kinds of technologies in these new hyper cloud platforms, whether they're developing in AWS or a GCP or an Azure or in something else, we're just thinking about very simple, short-lived, token-based, session-based. Again, we have an advanced server access product. It's the beginning of PAM. PAM is going to be upsell, PAM is going to be new SKUs, but it really starts to get us into that. And it's what people want. Our customers are saying, "Please give me a modern solution to manage my developer access, especially as developers become more and more important to what I'm doing in my production environment because software is eating the world." And so these are things that I think are natural adjacencies to what we're going to do. And I think they can be very, very well received by the market.

How should we think about nonhuman or machine identities and Okta's ability, potentially, to play in that market as it grows?

Yes, absolutely. So I think if you roll the clock -- these are my favorite parts of my conversation, I get to talk about the future. I get to talk about the vision. I get to talk about where we're going, Rob. Yes, absolutely. I think that there's a few different components to identity down the road. Certainly, we talked about workforce, so the enterprise side of things. We've talked about CIAM, the Customer Identity and Access Management part of things. I think consumer is going to end up being a thing. It's not like we have a product here today. It's not like I'm telling you to put it in your revenue stream tomorrow when you guys are putting together your models out there. But it is something that we're thinking about because it is an important third leg of the stool. How we're going to solve the problem that we all have at home? Also, if, for some reason, the Board of Directors at Okta decides that I'm not working out anymore, and then I'm going to have to go find another job, I want to be able to take some of that core identity information that's mine. My LinkedIn, my personal Gmail, maybe my payroll, my financial statements with me over to my next company. How can we kind of manage that and make it easier for enterprises, where a new employee shows up, and they just plug-in their Okta? There's something we're going to have to do there. And then a fourth part of that is just what you said, which is machine to machine. I think that we've been looking at that for quite some time. We've been working with a number of our forward-thinking customers when they think about IoT. If you think about what that is, first of all, there's always core descriptors for any of these objects, whether it's your refrigerator or whether it's your microwave or anything else that you want to plug in, there's a unique identifier. And if you think about what our database is and obviously, keys off of a unique identifier, I say that's rowens or rob.owens or whatever the case may be, very easy to swap that in for an identity of a machine out there that you want to manage as well. And you can do a lot of the same things. People are using them in easy to use ways. You think about oil, natural gas is a great one. They have pipelines they're managing. And actually, the valves on all those pipelines are something that, historically, they've had someone walk down the pipeline and check all the valves and see how they are. Much better to actually have a sensor and then just be able to turn it on and off centrally and actually manage who did that and then have log reports of all that in case there's an accident or an incident. Those are the kinds of early things that we're starting to see, but I think it is going to take off, obviously, the number of machines that are being connected to the Internet are going through the roof. All you have to do is actually go home to your own network, which I was messing around with last night because my wife said there wasn't good WiFi in our home. I pulled up my eero, I pulled out my Comcast. And if you look at actually the number of machines that are already connected to your network, whether that's your audio system, whether that's the iPads or the phones and all the laptops that we have, whether or not it's your smart TV, and you go down the list, I was really shocked. And actually I had to figure out what a whole bunch of those IP addresses were. And then all of a sudden, as a security guy, I said to myself, are these things secure? But that's a separate conversation for another day. Bottom line is, yes, I think it will be a big market. We're trying to find the right ways to help customers with it, but we're certainly heading in the right direction.

And is there a different technology that would lend to that? Or is it within Okta's portfolio right now?

There's nothing that we would go out and start with. I think when we think about where our business is going, we've laid out some of those long-term models. We've reiterated us growing the revenue base to achieve $4 billion in FY '26, growth of at least 35% each year, targeting FCF margins of 20% in FY '26 and being uniquely positioned to capitalize on this $80 billion identity TAM. We've been very clear that's going to be done with the existing product set suite and organic development that we have today, including obviously Auth0. There will always be some tuck-ins. We talked at the last earnings call a couple of weeks ago about atSpoke, which was a very good adjacent technology, great team, great technology, about to go into that go-to-market ramp. So it was a great piece to add on the IGA. We'll find a little piece of technology like that. But we're not going to go out and buy any businesses to get there. And certainly, I think that the core of identity and access management, whether it's for the workforce, whether it's for customers, whether it's for consumers or for machines is already in with the stack that we have and the team that we have. So we're going to be building that from the inside out.

Perfect. Freddy, thank you very much for your time today, and best of luck to you.

Thanks for having me, Rob. Pleasure to be here.

All right.