Okta, Inc. (OKTA) Earnings Call Transcript & Summary

Well, good morning, everybody. Thank you for joining. For those of you who may not be familiar with me, my name is Hamza Fodderwala. I'm the cybersecurity analyst here at Morgan Stanley. And this morning, we have the privilege of having Todd McKinnon, Co-Founder and CEO of Okta. And just before I begin, for important disclosures, please see the Morgan Stanley research disclosure website at www.morganstanley.com/researchdisclosures. With that, Todd, thank you so much for joining us.

Thanks for having me.

All right.

Great to be here.

Yes. So I kind of wanted to start off with like a basic question. Maybe you've been asked this in the past, but you started Okta in 2009. Prior to that, you were at Salesforce, where you really were instrumental in building out Force.com and the AppExchange. What made you want to start an identity security company? And in particular, what did you see the opportunity back then? And how has that opportunity evolved today?

So my perspective from Salesforce is important to understand the story. So I ran engineering at Salesforce. So I would -- when I did work with customers, it was all about their challenges adopting SaaS at the time. So especially at the time, we were trying to sell to larger enterprises, and I saw SaaS coming into these IT departments. And the IT departments were frustrated because they didn't have the control and the visibility they did in the previous generation, where they own the network and they own the data center. And so the reason I got excited about -- the opportunity I got excited about was, it was pretty clear that there was going to be a cloud version of everything. Amazon had just launched, EC2 and S3 had been out for a few years. And infrastructure was going to the cloud. And then Google Apps moved from consumer Google Apps to being Google Apps for businesses. And you could -- it was not a big leap to say, "Hey, collaboration and e-mail is going to be in the cloud too, and of course, business app." So what I got excited about was what were the platform opportunities when fast forward 5, 10 years, that everyone in IT is thinking about how they can take all these cloud services and stitch them together. And so the first idea we had at Okta was not identity, it was -- we were going to be systems management for SaaS. So it's like if you had a bunch of SaaS apps, you could take Okta and apply it, and it would tell you the reliability. So that's actually what we started about. And it's relevant because the company has always been about enablement. How can we enable companies to adopt technology? And then as we worked -- kept working on the product and iterated and pivoted on the idea, we really hit on this vein of value, which is identity and how important identity was, which was -- at the time, it was not clear. It wasn't clear that identity was going to be important enough to build a big company. And it definitely wasn't clear that you should do security in the cloud. So those were the 2 -- every company, I think, has to make some bets and get a little fortunate with the bets and those 2 bets for us really paid off fast forward to today. And like we thought there's -- the center of gravity is really in cloud and identity is a big part of that.

Yes. And speaking on the strategic performance, when you started the company in the early days, how often were you talking to the C-suite, the CIO, CISO? And how those conversations look like today?

Well, in the early days, you would talk to anyone that would listen; the janitor, the maintenance crew, anyone. And the first traction was really through -- it was very tactical. It was like, "Hey, we're trying to roll out this SaaS app." And when everything was running on the network, it was pretty easy, but this new SaaS world has come in, just help me do something very tactical, which is let my employees log in and in a very easy way, so they don't have to type in a password and -- or it's the same password and then get me going. And then over time, the big steps of the evolution were, I would say like tactical 1 or 2 app enablement to like we were being picked for broad as like venue, it was important to adopt cloud and identity was going to be an important part of that. So that was a broader strategic adoption for the workforce identity. And then the other big shift is probably 5 or 6 years in, which is the CISO community really started to be an advocate for identity, and they realized that they couldn't control things with the firewall anymore. And they couldn't -- it wasn't enough to just do endpoint and firewall and in that security posture, you had to control identity, and you had needed something like Okta to do it, and that was a big change there, I would say, about 5 years in.

Yes. So you guys talk a lot about the Identity Cloud. Basically, Okta as an Identity Cloud becoming another pillar within the organization. Maybe just explain what you mean by that? And how -- what's the strategy to really help you become that center of gravity?

Well, I realized that I didn't really answer your -- completely answer your previous question, and so I'll answer them both, which is -- so today, we -- there's really, I'd say, 3 main people we talk to in terms of value and deliver value to in terms of the sales cycle in the market today. One is, call it, CIO. So it's really kind of an IT enablement conversation. How can you give me choice? How can you give me flexibility? How can you enable me to adopt all the technology I want? Whether it's devices, whether it's types of networks, whether it's applications. And how can you keep -- how can you make it really great end-user experience, get rid of passwords? So it's like IT enablement. The second person we talk to is the security -- Chief Security Officer. And that's very much a compliance, risk mitigation, help me have the robust posture against threat to traditional security. And then the third type of person is person building a digital initiative or a product. Think of it as a -- probably in a -- and it used to be -- kind of even most companies, this was in IT, but more and more now, it's not even an IT. It's someone in the business unit or some Chief Digital Officer. Their imperative is get online, beat the upstarts in my industry with a digital alternative or maybe we are an upstart, and you want to win the market in terms of building a new product. So those are the constituencies we talk to. And it's roughly -- I think it's about like 33% each one, roughly speaking. It might vary quarter-to-quarter, but that's kind of the split. It's pretty balanced. And back to the most recent question you asked, the -- what's -- the strategic imperative for Okta is that everyone -- we build the platform in the company and everyone understands that when they think about their technology strategy, and that's -- most times these days, that's indistinguishable from the business strategy, identity has to be a critical part of that. You have to have your identity story in line. If you want to give your workforce the best technology, if you want to have the right foundation for these digital transformation projects, and if you want to make it all secure, you have to get identity right. And not -- it's not -- I'd still say it's like probably 3 out of 10 people just get that off the top of the -- off the bat. 3 out of 10 in the market say what are your top 3 technology initiatives? Only -- they probably say -- 3 out of 10 say identity. And there are probably a couple of those who are probably our customers. And so the big opportunity for us over the next 5, 10 years is we want to get 10 out of 10. So everyone knows that when I think about my technology strategy, identity needs to be one of the first things I think of. And I need to invest in that platform, and I need to partner with a vendor that's going to enable my identity use cases across all of these scenarios, whether it's workforce identity, customer identity and every nuance in detail of those 2 big markets. And we're trying to build that platform and that company.

Got it. Maybe just bringing it back to the current demand environment, both during and, I guess, post COVID, if we can say that. It did seem like ...

We're here. That's a pretty good start for me.

Yes. So it seems like from our perspective, 2 things happened during COVID was you saw an expansion within your existing customer base. So the net retention rate went up. And there was perhaps a bit of an elongating in the sales cycle for some of those net new digital transformation deals, which Okta is often tied to. Can you talk about now are you seeing those larger initiatives come back as people start to shift from maybe my more tactical needs during COVID to the more strategic priorities?

Yes. I think there was a lot of moving parts in the last couple of years. And I think the -- there's definitely some tailwinds. Oh, we have to get people working remotely. We need a solution now. We definitely benefited from that, I'd say, in the last couple of years. There were also headwinds that impacted industries, people are not sure about their business. I think probably the -- I think the biggest impact for us is that early in the pandemic, we were a little cautious about investment just internally. We're growing quickly, and we were cautious about investment. And I think that slowed us down more than the pandemic did. But I think we've long since changed that, and we're investing aggressively again for growth, which is the right thing to do given the TAM. I did -- I also think that there was naturally, over that couple of years, as you mentioned, Hamza, the return to things that were more longer-term investments. If you're going to transform your company digitally by launching a new product or having a new app or maybe changing the way your distribution channel works, you're going to go direct versus use some distribution channel. Those are longer-term things. And I think during the pandemic, you saw a shift from reaction right out of the gate to getting people working remotely to some of these longer-term transitions, and that's benefiting us today.

Got it. So I want to shift into the 2 main components of the business. So the SIEM business, the customer identity business, which I think is now about a little over 1/3 of the overall ACV growing in the 60% range. You talked about a big opportunity here, $30 billion when you think about all the users that you can potentially address. Just beyond security, why is SIEM such an important component of digital transformation initiatives? And when customers are coming to you, is it -- are they buying it for security or compliance purposes? Are they buying it more for customer enablement? Like how does that sort of break out?

So the -- I think it's really important to -- when you think about what I've outlined, the prevalence of identity needs to be -- we need to make sure everyone understands how prevalent it is across all these use cases; customer identity, workforce identity. And our strategy is we're going to build the leader in identity that seamlessly and in a powerful way solves these identity use cases across the whole spectrum. And then beyond that, it's the best and most deeply integrated platform to everything else. Because the thing about identity is it's not only just -- it has to be connected to everything. It has to get you into the app. It has to give you a choice of different technology. It has to give you integration to the security tools, to the ecosystems of all these different -- all these things that impact your technology strategy. So that's -- that -- and that -- being the leader in identity and being the leader of the ecosystem around identity, that's why it's so strategically imperative to own both the workforce and customers. So it's driven a lot of our strategic moves over the last couple of years in our investment. And now when you think about the transition that Okta is going through, it's really transitioning from what started as a workforce company to be a 2-market company. That's -- we really think a lot about that. How can we be in both of these markets in a meaningful way? You mentioned the split of business traditionally has been slanted towards the workforce side as that's where Okta started. But over the next few years, we're trying to get it as close to 50-50 as possible. Well, they're both growing very fast. So it's like a 2-horse race. We want both to be -- both are going to continue to grow very quickly, and we think it's -- the markets are very large on both sides. So why do people -- what is this about customer identity? There's a few different value props. Probably the -- off the bat, the biggest value prop is just productivity of developers. They're just trying to get these digital initiatives to market, and they could build a user database and they could build a registration page and they could build a password reset and they cloud build all these things that our service has out of the box, but it's just time to market. This developer cost, it's time to market. And then what they learn over time is that these things are -- especially when it comes to at scale, getting good visibility about users registering, attributes of the users, analytics on what the users are doing and security outcomes is the password reset done in a way that's not fishable, not hackable. Can you seamlessly do 2-factor authentication in a way that's not totally annoying to the user? The security outcomes become -- the customers see how hard it is, not only to build these things, but build them with good security outcomes. So I would say the security value prop is there, resonated as well.

Yes. And your point about developer segues nicely into the next question around Auth0. So one of the main reasons it seems that you bought Auth0 was to get more traction with that developer ecosystem. And I think Auth0 had hundreds of thousand developers using their solutions.

Yes. It's a big expansion of the TAM.

Yes. Is the developer going to become the primary buyer in this market over time? And now that you have that captive audience with the developer and you have this more product-led growth model, what other areas could you expand into within developer security?

I think the buyer is the 3 -- the buyer is still the 3 folks I talked about earlier. So IT, security or head of product/engineering. Now if you mean by developer, you mean the third persona, I would say yes. But traditionally, person on the keyboard, person managing a small team that finds Auth0, tries it, learns about it, builds it into their product from the ground up. That's not -- like monetizing through that departmental thing is not the priority. The priority is using that as an entrée to these deals that are done by the Head of Product or Head of Engineering. So maybe a little bit of semantics detail there. But the goal is that we get this groundswell of developers using Auth0 and they're having success with it. And there's some revenue that comes from that, just the self-service business, and that's a nice business. But the big payoff for us strategically is whether it's a product the company is building a digital initiative, whether it's a security sale, whether it's an IT sale. We can cover across that whole spectrum. And then -- so -- and as more and more people are realizing identity is the key to all these things, and we're the identity platform that's going to solve all their needs.

Yes. So one of the things you recently did is you unified the go-to-market between Auth0 and Okta after your recent sales kickoff. I think before salespeople were agnostic about selling either Auth0 or Okta, if I'm not mistaken. So what does that unified go-to-market entail? And what are some of the benefits that you see?

Yes. The acquisition closed 3 quarters ago. So right at the end of Q1, so May of 2021, calendar 2021. And the first 3 quarters, the sales teams were -- there was the Auth0 sales team and there was Okta sales team, they are separate. They collaborated and communicated, but they had their separate management chains. They kept their quota plans, they kept everything, they sold -- they sold -- the Okta reps sold Okta SIEM. Okta workforce and Auth0 reps sold Auth0. So on Feb 1, after sales kickoff, a bunch of enablement, tons of immersion training. Now you have all of the -- every rep in the companies can sell Auth0 or Okta. They can sell the whole portfolio of products. So that's much more sales capacity. So the opportunity there is, with the sales capacity, you have to enable everyone to sell everything, and that's what we've been working hard on. And yes, I'm really optimistic about this year with this awesome sales team selling everything.

Do you see any risk around that at all? Like how do you think about managing that?

I think that -- absolutely. I'm paranoid. I think there's risk in everything. I think that the -- I think the risk is -- like the worst downside risk is that everyone is so confused, no one sells anything. I think that's not going to happen. I think the more realistic risk is that you kind of just get -- people that were Auth0 reps kind of keep selling Auth0 and you get people that are Okta reps keep selling Okta. That's probably really the -- that's really the risk we're working on avoiding. So tons of enablement and the high-level enablement is really not a -- there's definitely product technical specialization in the go-to-market team. So there's product and platform experts that cover each of the platforms. But I think the enablement is really about the business level because if you think about the company, Okta, we're transitioning from a 1-market company into the 2-market company. One market was workforce, the majority was, and now we're going really into 2 markets, workforce and customer identity. And this is like educating people on the business value, the strategic imperative for the customers, making sure that they can speak that language and they know how our value prop maps to that and making sure we nail that. And then the product technical specialists bolstering that. I think we're set up for a lot of success here.

Got it. So shifting to the workforce side. So you talked about how you're in 30% of G2K, I think, for both workforce and SIEM. But just within workforce, when you look at the G2K base that you have currently, how penetrated would you say you are in that?

Just scratching the surface. Very early, yes. we have like some kind of foothold in 30%, but compared to the potential of spend there, it's very tiny. The G2K has -- they have the most legacy. They're the -- they're the -- I think the -- averaged across the entirety of their portfolio, they're the slowest to change. It's -- sometimes it's [ a seating ] because there's always parts of them that could move faster. They have a subsidiary or they have a division. And those are the -- a lot of the things we've had success with in the G2K, but what you're seeing for us and for identity is, over the next few years, you're going to see a big move in the G2K. And it correlates a lot with a broad adoption of cloud services like it's happening to the rest of the industry for 5, 10 years. It's like, I think, a lot of companies talk about it. There's this continuous cycle of reinvention and more technology investment, particularly on the customer-facing side, how they -- products they're offering, the services they're offering around their products, that's an unabated trend that we're going to benefit from as well. So I'm really excited about it. We're -- our success in the G2K is largely -- it's largely been departments and subsidiaries and things like that. And more and more, you're seeing those roll up into massive deals across the parent. But we're going to see more and more of those going forward, which when you think about building this identity platform that can cover all these use cases from workforce to customer, from the developers using it to the employees using everything in between. That's why I'm very optimistic about this happening more and more.

Got it. And then last year, you talked about formerly entering the identity governance and the privileged access security market. Most recently, you mentioned -- and I know you want to get the product right here, but you're going to delay the privileged access security launch. It doesn't seem like there's a launch date yet. Maybe just explain your thought process around delaying that and what you're doing in the interim with some of your existing offerings?

The core of what Okta is, it's a -- identity management is a -- sometimes I wish it started like an expense management company. Very simple to explain. What we do is expense management. You submit your receipts and we pay you back. Identity management is important, but it's complicated. It's -- sometimes it can be tricky to explain. So one way to think about the core Okta workforce product is it's -- real-time, it's the traffic cop. So it has all the records of what -- where people can go, from which device to which application, it says yes or no. You can go here. You can't go here, stop this, do an extra check here. So it's the traffic cop. So it's -- and it's largely the traffic cop for business applications, SaaS applications. And so when customers look at that platform and what they've trusted in that and how integrated it is to all the devices and all the employees and all the applications, now -- they own now and they're going to own in the future and the technology choice it gives them, it's a very, very natural extension for them to want 2 more things from that. One of them is they want to get reports for their auditors about where the traffic cop said people could go. And that's identity governance. It's like, okay, we've had all these access rules in place. Now report to me who went where, who had access to what and make -- assure to me that it's in line with our compliance requirements and our auditors would approve it. That's identity governance. So you can see it's a very natural extension because the traffic cop has the data. So it's like give me the reports. And so -- and that's identity governance. Privileged access is the same thing you're doing for the business apps, do that for servers, databases, containers, all of the things that my engineers and my operations people need to run my service. So that's -- it's -- so you can see how related it is. It's like -- it's still a traffic cop. It's just a separate resource. So it's a lot of the same infrastructure, a lot of the same logging, a lot of the same access checking, just apply to different resources. In fact, we're kind of halfway in these markets right now. On the identity governance side, we actually have a product called Lifecycle Management that actually not only routes people for their access control, but it actually creates the rules. So it creates the accounts and creates the groups and puts the policy in place. It just doesn't do the reports for your auditor. And on the privileged access side, we do access checking for servers. We have a product called Advanced Server Access. So last year, it was really important for us to tell our customers clearly -- because -- and our customers are coming to us, they're like, we want you to do the reports. We want you to do governance. We want you to cover more resources into servers. We already love your product for server access. We love your product for Advanced Lifecycle Management. Give us more, rounded out. What are you going to do? Should I invest in something else? Should I invest in you? So last year, we communicated to them clearly that we -- our direction is to do the reports, to do full governance and do resources beyond servers. So that's what we announced last year. We're in this market, identity governance, privileged access. And so over the last year, we gave a time line of Q1 of this year, we would have -- we would have these offerings in the market. And so we've worked on these things for the last year. And identity governance, we have it in market. It's being beta tested and it's going to be released in phases over the next couple of quarters. Generally available completely around the whole world by the end of the year. Beta is going really well. Customers love it. They're -- it's appealing to customers of all sizes in all industries. It's relatively early in the beta. I think a couple of hundred customers are using it. So I'm really excited about that one. Privileged access. As we went through the year, we decided to put actually more features in Advanced Server Access. We did a bunch of work to make Advanced Server Access work really, really well with Windows networks on-premise. That's one thing customers wanted. So we put that in there. And then we decided that the PAM product, we should actually put a little bit more in it than we originally thought we were going to. So cover more resources, do a little bit more functionality, and that's pushed the beta out probably a quarter or 2. And yes, that's the status there. Still they're both going very well, and both markets are really important to us and both existing products, Advanced Server Access and Lifecycle Management are doing very well, and the customers are happy. And it's -- we're really progressing well towards this integrated suite that covers all these use cases across the board.

And when you think about some of your longer-term targets, you're targeting $4 billion in revenue by FY '26. Is that a big component of that target? Or is it more or less upside if you do get some incremental traction here?

I think the way to think about it is the workforce business is a suite. And the broader the suite is, the more compelling it is and the more differentiated it is and the more -- the faster and the bigger it grows. So that's how I think about it versus like a specific contribution from any one of those products, whether it's multifactor or whether it's PAM or IGA or Advanced Lifecycle Management.

Got it.

So I think that means it's important. It's pretty important. And it's kind of such a logical extension. I think that's where the market is going.

Yes. So I wanted to just ask a competitive question. I know Microsoft gets brought up a lot. Microsoft competes in a lot of different software markets. And if I just draw on your experience, at Salesforce, for example, I mean Microsoft has dynamics, right? And to me, it seems like why Salesforce was able to really solidify its leadership position was, they had this great front office platform, but they also built a great ecosystem around it with Force and with AppExchange where they brought in third-party apps and developers. Was that the similar mindset that you had when you started Okta to really solidify your leadership position in the identity space?

The ecosystem in the set of integrations, the power -- I definitely saw the power of that at Salesforce. A lot of it was customer driven. Customers wanted these integrations and it unlocked a lot of value. And then for us, customers and partners wanted to extend and enhance our network of integrations for us. We were the -- we had the most customers. They wanted to build integrations that could connect to those customers. So that's really how that flywheel got spinning. And -- so in a lot of ways, it's -- when someone competes with Okta, they don't just compete with Okta, they're competing with everyone because they're competing with every SaaS vendor that wants a great integration with Okta because we have the customers. They're competing with every ecosystem partner that wants to integrate with us in a deep way. So -- but definitely, it was inspired by Salesforce. But I think in our business, it's -- the ecosystem is even more important. It's even more important because what identity is about, it's about technology choice and giving the customer the flexibility to use whatever they want to use. Even -- and even if -- you got to remember, people think about apps. They think about collaboration apps or business apps, but I'm talking about technology. So choosing Okta, you get freedom of devices. You can use MAX or Android or Windows. You get freedom of what kind of network you're going to use, whether it's an on-premise network, whether it's a Zscaler or cloud flare. You get freedom of every layer of technology between device and app and infrastructure and monitoring tool and SIEM. And so it's -- Microsoft, as broad as they're trying to be, they're a small fraction of the technology that customers need to use. And when you are -- so there's the ecosystem and competed against everyone. But also remember that what we're building is hard and takes a lot of focus. And it's very hard to be inside a company that has another platform to sell and another set of apps to sell to truly enable people outside of your ecosystem. Like imagine being the product manager working for Microsoft, and you come up with this great idea to let your customers connect to AWS. So "Oh, I'm going to make it so easy. You can go on to AWS and securely connect users there, and it's really going to drive a lot more consumption of AWS." You'd be fired. I mean either explicitly or you'd be like your career would be -- I mean can you imagine? What are you talking about? But you could say that for a thousand other things from the apps into the devices, and it's like you're really the person in Microsoft that really, really, really want everyone to get on Android and iOS.

All right.

It's a tough thing. And so I think -- Yes, I think that, that neutrality in choice is a big deal.

All right. Well, unfortunately, we're just about out of time. Thank you so much, Todd, for joining us and pleasure having you.

Thanks for having me.