Okta, Inc. (OKTA) Earnings Call Transcript & Summary

Well, thanks, Nate. So my name is Alex Henderson. I'm the security analyst at Needham. It's a distinct pleasure to have Eugenio Pace, who is the CEO of Auth0 as well as now an Okta employee to talk about Okta and Auth0. For reference to people who are in the audience, if you want to ask a question, please do. There's a dialogue box, you can type it in and relay it to Eugenio. We prefer interactive, the more comes from the audience, the better. Makes my day a lot easier if I'm not making up questions as we go. So first off, welcome, Eugenio.

Thank you. Great to be here. Thank you, Alex.

So May 3, big day?

Yes.

That's when you guys closed the deal. How has it been to be an employee of Okta instead of the CEO of Auth0?

Well, it's been quite a ride. I look back, it's, yes, in a few months, but it feels like much longer. It's been so intense. I think the intensity of the transaction. The intensity of the business we are in, which is -- has not slowed down at all, thankfully. The intensity of the world that we live in at the moment, which is the screens and people all over the world, and I think all of that, the year has gone in seconds on one hand, but it feels like it's been like much longer, frankly.

So Auth0 has been reported somewhat separately from Okta for the last couple of quarters. My understanding is you've got one more quarter of that format before you guys really talk about it as an integrated company. How has the integration gone given we've only got one more quarter of separate financials being reported?

Yes. So we can look at integration in multiple aspects. So the first one is we decided to integrate our G&A capabilities earlier on and that went well. So people, finance, legal teams, facilities, workplace. Now we have collectively like 14 offices all over the world. That has gone -- it's a pretty advanced stage and has gone well and has served us well as well. The...

Well, you've always been a very distributed company, right? That was one of the advantages of the Auth0 architecture before you came into Okta?

Indeed, yes. So the 2 components of that is by virtue being like a very heavily distributed company, clearly, that puts us in an advantage when the world hit COVID-19 and -- but we were already practicing like being on a screen and communicating asynchronously. So it was a good practice. It wasn't -- it was tough anyway, like everybody else. But [ in fondness ] well prepared to that. But one of the side effects of that was also running a global company early on. So one of the things that we are complementary with Okta is that our composition of the business. It's much more heavily distributed in the world, not just the workforce. 50% of our business was outside the U.S. before the transaction. And so it continues to be the case just for Auth0, which tells us a little bit of the global nature of the problem that we are solving, right? And the fact that it's not exclusive to American markets.

So clearly, part of the question is the -- related to what degree you have distinctively different products within the consumer portion of the Okta product line? And obviously, you were heavily skewed towards the customer-oriented side. So actually, with over 100 people signed in, not surprisingly, we've already got a couple of questions coming in. The first one is what level of confidence that Okta will be able to maintain the product road maps for both Okta core and the Auth0 given that the 2 segments serve distinctive buyers and use cases? And what is the risk that one set of customers ultimately gets prioritized over the other?

Yes.

Thanks for the question, guys.

Yes, great question. Great question. So we came together with the hypothesis that we were different. There are products where like, yes, there were some touching points, but they were different. But of course, that was well informed but we didn't know indeed.

Let's stop for a second just for people who might not be as familiar, what's the differentiation between the employee piece and the customer-facing piece?

So I'm assuming that everybody knows what we do, right? We are in the identity and access management, which is logging in. If you wake up in the morning and you enter using in my password in a website, solving that problem, that's what we do. So these 2 big markets here. There's what we call workforce security when the person entering the user name and password normally. It's an employee of an organization. So if you're a -- I'm an employee of Okta, I log in, in the morning in my machine, I don't use a password thankfully. And I log in to my e-mail, into Zoom, into Salesforce, et cetera. So single sign-on across a broad range of apps, but as an employee. That's the core use case for Okta. That's where the company was born, where the company evolved and grew over a lot of all these years.

And that was 2/3 of their revenue before the acquisition?

Yes. That buyer is primarily an IT buyer. So it's the CIO of a company. It's a CSO of a company. It's making sure that employees are logging into what they should be logging in and not to some other thing. And when somebody is not an employee anymore, that they don't have access to anything that they shouldn't have access to. That's the workforce use case. And you're right, that's roughly, give or take, 2/3 of or a bigger chunk of the Okta business.

It was about -- I think it was 70% of Okta before the acquisition, it's 2/3 now? Is that right?

No, no, no. I don't want to use a number. I think you're right. That's...

You guys reported still. So it is public.

So -- the second market is what we call CIAM, and it stands for Customer Identity and Access Management. That's when the user that is entering credentials or logging in into a system is not your employee but it's an external entity. It's your customer, typically. So that's why it's called CIAM. It's somebody that is not your employee. Now on that one, which is -- the Okta had a business before the acquisition, we will come back to that in a minute, but that was 95% of Auth0's business, give or take. So the vast majority of the -- of our -- the customers that we had Auth0 were customers that were building applications for their customers. But the keyword there is building because we actually did not create Auth0 with that use case in mind. We created that Auth0 with the developer in mind, so with that -- thinking about builders of applications. It just happens that there's a very high correlation between developers and CIAM. So the vast majority of the developers in the world are building up for others, not for employees. There's some, but in volume, in importance, in size, it's about the applications that you're building for others. And that market -- that segment, it's further divided into 3 categories. So if you look at CIAM, there is actually 3 different types of use cases. It's consumer apps, so B2C use case. If you're a user of, let's say, Dow Jones or Wall Street Journal or The Economist, any like media and you are an individual logging in into those sites. If you are -- if you like to meditate and you use head space, your [ asset ] user. If you are buying tickets for planes or buying tickets for a train, so you're a consumer-facing app, mobile website, that's that category. That's a big important segment on Auth0. The second category is what we call B2B SaaS. So if you're building applications, whose users are not individuals, are employees of somebody else. So if you're Zoom, if you are Atlassian, if you are -- any software company, any software company that is selling to the enterprise, that's the second strongest use case for Auth0. Those 2 are the 2 subsegments in CIAM that we are going to lead on with Auth0 moving forward, and what we are doing. There is a third subsegment, which we call it external collaboration, which, in retrospect, it's technically CIAM because it's not necessarily your own employees. But if you think about like the manufacturing company with a big supply chain use cases or vendors, contractors, like extended workforce use cases. That's where we are going to lead with Okta CIAM. It's for that specific use case, which based on what I'm describing, hopefully, the audience will understand it's really like an extension of workforce that we are an extension, probably more on the customer side.

So going back to the point of the question that was asked now that we've put some context in front of it, to what extent do you see risk that core Okta use cases will use resources and that the CIAM piece would be less so?

Well, given the size of the opportunity and given the growth rates and the ability -- how much progress we have done in both markets, frankly, and how much we can grow, I would be really, really surprised to see like one win on the other because it's 2 big markets on the run. And now with Auth0, we have the capacity to deliver on that, and I think the proof is in the results. Whenever a company is acquired, there's always a question of what's going to happen with the platform. And it's going to be replaced or decommissioned or -- but based on what I described before, hopefully, all of you understand that we actually need both platforms to serve this big, big market. CIAM is $30 billion estimated. And workforce is another $30 billion. So each one is massive. And if -- even if you look at the combined companies today, it's a single-digit penetration into those 2 markets. So -- and it's not that it's a problem that it's going to go away or it's becoming irrelevant or the conditions of the world have changed, so there's not a pain anymore. On the opposite, if anything, the last 2 years have been -- have accelerated the momentum for us. And look, I look at 2 data points in the last 9 months of being together. What is the vote of our customers and our customers vote with their wallets. It's like a very skinning the game. And our business has not decelerated. Auth0 itself has not decelerated. Okta has not decelerated. In fact, it has been beneficial for Auth0 because now we are a public company, not on our own, but we are a public company by association with Okta. We are Okta. And now we are reaching customers that in the past, perhaps were somewhat concerned and say, well, you're not big enough. This is a big, big problem, I'm betting on you for a big aspect of my business. So now they perceive us as lower risk, sure bet, more secure. And the second is the market kind of like the industry, community vouch of -- and vote of confidence. This is the first year where we, Auth0, got named as a leader in Gartner's Magic Quadrant and it's not the first year for Okta for sure. But now Okta has 2 dots in the Magic Quadrant, one is Auth0 and the other one, it's Okta. So...

I can believe you just set me up for that. I was about to put it up.

Yes.

So I'm actually disappointed to see Auth0 as low as it is represented there because, frankly, in the CIAM space, you are way ahead of everybody else. I mean, I think, they're comparing you to the entire identity management space as opposed to the CIAM space. If you're just the CIAM space, you'd be above Okta and above everybody else. So clearly, Okta and Auth0 combined are really powerhouse players.

Yes. So now to the previous question, will we compete for resources and we want the priorities of the other? I think we recognize these 2 markets are so big markets with so much more to grow, that is really -- it's not the market that will constrain our growth. It's not demand or lack of demand that will constrain our growth. It's just our ability to continue to innovate and our ability to scale our go-to-market teams to reach -- expand globally, reach new markets and just reach more customers. [indiscernible]

So one of the elements of this story is that you actually are a much higher growth rate and the CIAM space is a higher growth rate category, you're actually accelerating the growth of Okta net-net. If I look at the most recent print that you guys had, the combined company, even after adjusting for the reported print or the aggregation of the company really produced some spectacular numbers. The idea that Okta was slowing before certainly wasn't evidenced in the 39% growth rate of core Okta and 43% RPO growth and 47% calculated billings. And similarly, Auth0 posted, what, 63% growth in ACV. So those numbers suggest that there was a considerable amount of flywheel benefit to this, those faster the growth for both companies stand-alone, then no merger or not organic in those numbers. Those are excellent numbers.

Yes.

So one of the things about Auth0 that I love is the coder-centric capabilities. We've long felt that, that was something that Okta core needed to build out, as we look at the world, and I think I'd like to use the comment from the CEO of Cloudflare, those who get the coders win. You guys really bring a lot in. How deep is your penetration of the coding community? How many people are programming, utilizing microservices based on Auth0's technologies?

So today, it's roughly -- it's 150,000 active developers in the world that are using -- actively using Auth0. That's still -- it's like -- it's a big number on its own, but it's still small compared to drawing the analogy of the TAM and our business, same vein for the total addressable audience in our case, which is depending on who you read is between $20 million and $30 million. And this includes, of course, all kinds of developers, not necessarily what we would call like professional developers. I think developers are come in all different flavors. But -- so we still need to do a lot of work despite the fact that we have -- I think, we have done a pretty good job in creating a brand that is recognized in the segment. And it's funny to see sometimes developers using interchangeably our name and the name of the standard, which is [ olaf ]. So they say, yes, I'm using the standard, Auth0 as if it was the -- like the [indiscernible] which is also we are going to see. But we still need to do more work in...

So how rapidly are you adding coders to the base?

Well, we will -- our plan is to add like another 100,000 in the next year or so and continue to grow at the same rate.

That's a very impressive target. As the coders look at utilizing the product, obviously, there are a lot of different features and capabilities. Are you seeing a broadening of the various elements that you can offer, the coder to develop the product with that is expanding the revenue generated on a per-coder basis?

Yes. One, for sure, there's more things we can do within the realm of authentication because it's always something new. There's biometrics. There's the attack protection. There's things that we can tie to the core transaction of knowing if a user is a legitimate user or not. There's also evolution in types of apps, right? So the way apps are being built is some new framework every day. There's new stacks that are being developed and optimized for mobile experiences, for devices to -- pretty much everything, nowadays, has a computer in it. And everything with a computer has potentially a user, even your fridge has a computer. And I need to know that it's you and not somebody else. So that's an expansion in its own, but we are also expanding in other capabilities. So just before the end of the calendar year, we announced the developer preview of fine-grained authorization, that's a service that we shipped in early access which solves the problem not of whether you are or not who you say you are, but solves another big problem which is the -- once you are who you say you are, what is it that you can do? And there's an explosion of complexity there because it goes into the details of the app, right? So if you think about like Google Apps and Google Docs. So can I view this document? Can I read this document? Can I share this document? Can I delete this document? Can I move this document in this folder. Can I have access to all documents in this particular folder? Who can I share these documents to? Those are all questions that are all related to access control, but it's not the coarse-grain access control. It's are you in or you out? Are you anonymous or are you authenticated? This is like this specific document, can you join this Zoom call in this specific time of the day for this particular conference, who can do that, who cannot do it. So we delivered -- we are shipping a service that provides the building block for answering those final great questions, and we're obviously very excited about it.

So when I think about Okta as a company and as a stock, I think, to some extent, people became, how to say it, almost bored with it. I mean I'd say that's probably not the best term to describe it, but they understood that identity was important. They understood that Okta was the kingpin. They understood that the company was dominant. And there really wasn't a lot of challenge to that viewpoint. And then over time, the company started to mature a little bit and their growth rate started to decelerate towards that kind of 30% growth rate. Now with Auth0 in there and with the shift in emphasis broadly towards a more distributed workforce. It seems like the growth has reaccelerated, and you're producing growth rates that are well above the 30% threshold. But the streak doesn't seem to be as enamored with it anymore. But I think that, to some extent, is a misread because identity is the core to anything in the cloud and Zero Trust as we move more and more towards a cloud-direct model clearly is the core of any security platform. So how are we taking advantage of those aspects to put sizzle back into the story and to articulate how big a deal that, that is?

We completely agree with you in terms of how important this is. The -- whether -- I don't take it wrong. Like the judgment of whether it's boring or -- there are things that are boring for some people who are like the passion of others. And it just happens -- this is our passion. This is certainly my passion. And everybody in Okta is 100% dedicated to this specific problem. And in the big scheme of things in the world, it's a -- it's one of the many, many other challenges that the world faces. And yes, there's an argument to be made, it is who cares it's boring. But this is what we do. This is our passion. We are not bored by it. In fact, we are really, really -- if anything, I mentioned to some other people before, I want to be part of the company that killed the password in the world. So we don't have to deal with passwords anymore in our lives. They've been in our lives for too long already. And I don't know you, but I don't like -- I don't enjoy having 100 passwords for different things. And the future is here not evenly distributed. So we have all the components to do that. And to secure...

It's more than just getting rid of passwords, though, it's providing a true understanding of who the person is. It's understanding the risk profile of that character. It's applications because applications need to be authenticated as well. How do we think about that broader theme in the context of a cloud-direct world that is tying users directly into applications and across the WAN?

I'd see identity and perhaps people were not seeing this way. But -- when you think about like what are the fundamental building blocks of applications, there's compute, there's storage and persistence, where you store information. And then there's a mechanism of communication, sending information in and out. And there is identity and security. You cannot like...

The basic building blocks of the Internet.

These are the building blocks of the Internet. So that's why -- like with all due respect of what other companies do, like look at great developer companies, too, like Stripe and Twilio, which -- we modeled Auth0 after them. So -- but not every application necessarily needs to take payments with a credit card, right? And not every application sense SMS, a lot of them do, of course, but every application on every level of maturity, every company needs us. This like a true horizontal or reversal ubiquitous requirement.

Ubiquitous.

And so that piece, the piece of universality. And then the -- clearly, the world will rely more and more on technology, not less on technology for all aspects of our lives. And -- so we're going to need more applications, not less applications.

So I understand that the number of applications are growing at about a 30% clip on a base of around $750 million. Would you -- do those numbers jive with your view of the world?

I -- look, there's 2 sides of that. It's the applications that were built. And we do a lot of business in modernization use cases, which is -- The Wall Street Journal, it's a customer of ours. And clearly, it existed before Auth0 existed. And so we help them modernize their user experience and their authentication posture with our system. So brownfield for us is a very important component of...

Are you the guys I can blame for not letting me through their vault-guarded app?

Yes, indeed. And many others, too. I suffer that. But -- and in some cases, I'm not happy.

So it's an interesting point, though, because there's a perception that if it's a legacy application that it's monolithic and monolithic applications inherently, are going to be displaced by modern applications where, in fact, I think, most monolithic legacy applications are becoming microservice elemented, so they take the kernel and they take a lot of the stuff around it, and they turn those into microservices so that you end up with a hybrid partially legacy, partially microservice, and that allows you to start to transition into the more modern world.

Very, very few organizations can afford the greenfield scenario. Only start-ups -- or clearly start-ups are those we can say, okay, we'll start with a blank slate, here is a white canvas. We don't have to worry about legacy or this thing that we inherited from a previous acquisition or from a merger like this thing that somebody wrote 20 years ago that still works, but nobody maintains or nobody knows how to touch it, very few can do that. The vast majority of the world is already using something. And that's important. I can tell you how we built Auth0 precisely to make that transition easier. We designed Auth0 with that in mind out of necessity, frankly, because clearly, for a start-up to expect people to like throw away everything they have, where they invested millions of dollars and thousands of man hours, of brain power and bring this shiny new thing, it's completely realistic. And so brownfield exceeds...

So let's come back to the market for a second because I want to make sure that we keep this kind of punchy to what investors really care about. And it seems to me that, a, adding 100,000 developers over annually would certainly drive some pretty robust growth. But on top of that, I would think that there's a very significant broadening of the need for microservice-based consumer-oriented environments, given the work from home, given the COVID environment, has this caused an acceleration, an explosion of interest in your technology?

Absolutely. Absolutely. There's...

A quick answer. Let's move to the next question, actually.

Yes. No. I mean it's a fact of life. We were seeing it, but it's what -- it's already well known that COVID, working from home, remote, but even in less well-known aspects like self-care and consumer apps that are directed to health and mental health and other things...

It just brings up an interesting question that investors are very concerned about, which is if you're a COVID beneficiary, does that create a situation where you have the big boom and then the bust on the back side of it because now people are going back to work, now they're going out to dinner and they're not doing as much from home and they're not as software and remote-oriented anymore. I don't think that's the case here. But DocuSign didn't argue that it was the case before, and they had a big correction. Any risk to your business decelerating because people go back to work and COVID goes away?

Well, if you -- the reason I don't think so, it's because -- there were things that were already happening before COVID like remote work was maybe something that some companies were more comfortable experimenting with. We were one of them. So we were a company, we'd embraced that model.

Me too. I'm moved out of New York City in '19.

Yes. And now I could tell you, well, I was such a visionary, but in our case, it was out of necessity, right? Because it was difficult to compete for talent in Seattle or in San Francisco, and we say, hey, let's -- talent is everywhere. Just -- and we have the technology.

That actually brings me to an interesting question. One of the questions we're trying to get to ask every company we talk to is what's going on with the turnover rate, not so much against 2020, but rather this period of the great resignation? Are we seeing turnover accelerate versus where you were in, say, 2019?

The numbers are higher than in 2019. I don't recall exactly, but they're not as low as we were in 2019. However, we remain like an attractive play...

Destination.

Destination. Yes, and that's our intent. We look at the business -- this business, certainly, I look at this business. But I share this view with other leaders in the company and is a long journey, long-term growth and a place where people can grow and there's so much to be, there's so many things to do, so many subsidiaries to open that there's plenty, plenty of opportunities for talent. But yes, it is...

What about on the wage inflation side? Are you seeing a meaningful pick up in the cost of per employee, particularly in the software coding space?

There is increased competition, there's inflation, as you probably know. And so there's not just the wages inflation, there's inflation in the nation. But there's increased competition all over the world. So some companies adopted remote as a mechanism for tapping into talent at lower cost, which is somewhat disappearing over time because the fact that you live in a city that it's -- where things are less expensive, it doesn't matter. People can hire you anyway. And so the advantage that we have is that we have done that for -- we do this with a conscious effort, with deliberate effort. And we know...

You've got a long history of experience with it. And you know how to do it, right?

Yes. And it's one of those things that it's very obvious and sounds like...

So we're kind of running out of time here, Eugenio, unfortunately, I could go on for hours with you, and I would love to do that with a beer sometime. But we've got 3 minutes left. Can you give us the 3 key points that you want investors to take away? We've got over 100 people zoomed in here listening. So what are the 3 key things that you want them to walk away with out of this meeting in general on Okta?

Well, the first thing I wanted to highlight is the opportunity for us. And so I mentioned $30 billion, $30 billion, that's $60 billion on combined workforce and CIAM. Combined companies today, we have single digits into that, tapping into that opportunity. There's no other company in the planet with the platform breadth, the vision and the execution history of our combined history. So we believe we are really, really well positioned to tap into the opportunity. And it's not an opportunity that is going to go away anytime soon. And this is not taking into account further adjacencies into each of these 2 worlds. Like I haven't really talked too much about governance or privileged access, which are adjacencies to workforce or I've mentioned fine-grain authorization, even like the more avant garde use cases like being able to leverage more like the crypto technologies for authentication purposes, which is a good proof of concept that we shipped also...

The new many scale -- high and large scale adjacencies.

Many, many points. Not to mention that the entire -- yes, Auth0 was a globally -- heavily global company, but Okta was more U.S.-centric and now want to expand there. So yet another dimension of expansion and growth. So I like a Freddy phrase, the Okta's Co-founder phrase, is this, the future is bright. It's certainly right for us for sure.

That's a good summary. I would add to that point, which is the valuation has come down a lot. If you look at the valuation of Okta, it's down in the 14 to 15x EBITDA sales on '23 numbers. That's a valuation that the SaaS subscription companies were posting 5 and 6 years ago, which were growing in the 20% to 30% range. This is a company that's growing well in excess of 30% combined and selling at a, I think, a very discounted valuation. And with plenty of opportunity to drive margin expansion from here and get leverage. So investors should be taking a hard look at Okta here and Eugenio, I really appreciate you coming in and doing a call with us. And for the triple-digit clients that zoomed in. Thanks for joining us. And Nate, thank you so much for hosting the webcast.

Thank you for having me.