Okta, Inc. (OKTA) Earnings Call Transcript & Summary

All right. So welcome, everybody. Thanks for joining our fireside chat here with Okta today. I'm Eric Heath, senior software analyst here at KeyBanc. So Monty, really appreciate you doing this, right?

Yes. Thanks for having me.

Look, so I mean, you might be a new face to some investors. So it would be great to just get the overview and your perspective on the business, what your role is, and we'll go from there.

Sure. So good morning, everybody. Monty Gray. I'm responsible for corporate development at Okta. I've been there a little just past 6 years, so it seems like a long time. What I cover is I am responsible for corporate strategy, M&A, technology partnerships, ecosystem, Okta ventures, our social impact ESG efforts and just a number of other cross-functional initiatives for the company.

Yes. That's great. Great perspective. So just given that purview at Okta, just give us your high -- or overarching view of the Okta corporate strategy and why you think that's the right strategy.

Yes, sure. So our ambition is really to enable anybody to use any technology securely, right? That's kind of the tagline vision as a company. Our ambition is to actually elevate and have identity itself be a major -- we use the term primary cloud internally, which could show up as think of a company or a business that's $5 billion, $10 billion in size. To do that, we participate in 2 related but distinct categories. One would be workforce identity, which I think was what a lot of people know Okta for. Workforce identity is when you interact with your employer or business partner interact with your applications within the organization. The other is the customer identity segment. Customer identity is if you're a consumer. So think of a B2C use case, a brand interacting with their users, right? That's customer identity. There's other -- another subcategory of that, which is how to power SaaS applications. So if you think of the SaaS applications, we have a part of our business will actually be embedded in those, empower that as well. And so ultimately, like those are the 2 categories. How we're going to be successful for those? There's a couple of key tenets. One of them is the tentative neutrality. So we believe in enabling best-of-breed and being a neutral vendor, not part of another stack, and we can get back to that part. Another one is security, having security focus. So we do this, and we have the number of inbound requests we're getting, the number of inbound threats we're getting. We have to do all this in secure fashion, security forward. And then finally, developer-centric. So particularly on the customer identity side, just like meeting the developers where they are early in the cycle because that tends to be a different top-of-funnel cohort. And we support all of that with just a multipronged go-to-market operating model, multisegment, multi-geo, multiproduct, direct, indirect. And for each of those, we have different nuances that we've been evolving over time.

Great. That's great. So you guys had a solid 4Q earnings results, and I know that must have took a lot of work to deliver those results in light of the security incidents. So can you talk about where the source of strength were? And how you guys were able to deliver such a solid report despite what, I imagine, was a lot going on in terms of Project Bedrock and a lot of customer communications? So how is the team able to execute on those results? And what are the sources for the upside?

Yes. So I think that team did an amazing job in light of Bedrock and the security incident. There was a lot of conversations, a lot of distraction during it, but we're fairly proud of how that showed up. I think the highlights of the quarter were really around overperformance in free cash flow, operating margin and on the top line, which is really -- the narrative there is really one of large deals, large customers, which when we think about large customers, it's with an ACV of over 100,000. And so we look at that cohort and that average is at an all-time high. And then you look at the over $1 million ACV cohort as well that's also all-time high for us. So those were some areas that we're super proud of that happened. I would say the team managed through the conversations. There's a natural maturity that happened there, right? First, it was what happened, what's -- customers wanting to understand, I was part of a number of these conversations myself with some of our largest customers, like what's really happening in the incident. Then next one was like, was I impacted. And then after that was -- the natural arc was, well, wait a second, you guys have done all this work around it. Tell us what you did and we can kind of walk them through, like everything that we've been doing ourselves and kind of the broader security health of the company. And then the national next step is like, great, we want to see that checklist so we can do that ourselves because we know if you're being attacked as much as you are, we also want to see that. And so I think it's just -- it's a high-calorie effort, honestly, with the customers there.

Yes. I mean I think the feedback we got is, look, you guys are a big company now, a lot of customers, and one of the most widely deployed identity solutions out there. So just not too dissimilar to Microsoft. Like if you're going to be the biggest girl in the room, you're going to have a big target on your back. And it seems to me that, that reassurance of how serious you're taking this incident from Project Bedrock to the secure identity initiative, et cetera, it seems to me, like the part that's resonating with customers.

Yes. And I think it goes back to a longer-term trend that's out there, the relationship between identity and security. And for those of you who have followed this space, like the early incarnation of identity is one of enabling technology, right? It's like companies would want to adopt a best-of-breed solution. And so you need identity stack to enable that to happen. And then that quickly started to evolve into, great, now that's perforated across large organizations out there. People sort of realize, well, that's actually an attack vector. So the posture of how you think about identity from -- also from how you manage it from the default settings, from the different categories around identity started to evolve some of our security focus. And we've been thinking about this actually long before the incident. We've been thinking this for multiple years. And I think just bringing our customers along that journey has really been helpful.

Yes. So let's talk about some of the products, and there's a lot of stuff to get excited about when it comes to the Okta portfolio. Look, I think identity is probably one of the last areas of security to consolidate. So I think you guys are well positioned to lead the charge there. And you had IGA come out last year. So let's start there. It sounds like it's been nothing but success above and beyond what you anticipated. So where are you finding success when it comes to the IGA product suite?

Sure. So I think if you look at the IGA market, we're seeing a couple of different categories of customers there, right? One customer would be somebody who doesn't have IGA at all. They're kind of probably a smaller company, probably new to the cloud, they're probably growing up, and they never realize they have to get into more governance. So that's kind of one category. Another category would be a customer is using some of our more advanced features, say, life cycle management, workflows. So they're doing IGA type of use cases in the organization, but without doing the full entitlements and the compliance aspects of it. Then you have another customer, which would be probably heavy sale point, somebody who has an embedded, very sophisticated governance solution in place. The first 2 are where we do really well with our products and where we're seeing early traction. And that makes sense, right? So obviously, these are probably cloud native companies, but they're also reacting to the convergence story that we tell. So when you think about what Okta historically has done on the workforce side, we have the users, we have the directory, we have all the app integrations. It's a natural launching point for where you can then do the next thing, which is like with the depth -- what's happening within the application, what are the entitlements, what are the access request? That's a natural upsell for us. And that's where we're seeing a lot of good momentum.

Yes. And you've had some success in the enterprise, if I'm not mistaken.

We have success in the enterprise. Where that tends to work is, is there's something episodic that happens around like moving your workload to the cloud or you're deploying Workday or something else and you want to actually have that part be governed as well in a cloud-native fashion. And that works well for us. So we're very excited about that.

And in an enterprise setting, would you coexist with a traditional adjacent solution that maybe addresses more of their on-prem environment and you guys are addressing more of the SaaS?

That's right. That's exactly right.

So -- well, that's great. And then on PAM, so it's newer and just recently released. There's not a ton of feedback, but maybe you can talk about some of the initial traction that you're seeing. And second, what are the learnings from IGA that you guys picked up? And how can you replicate this with PAM and see some of the success?

So PAM, as you mentioned, is probably about a year behind in terms of when we released it to market. The Converge platform story is resonating with PAM, the early PAM success we're seeing are customers that actually have -- again, if you look at that maturation of the platform where it's -- you have the users, you have entitlements, you have the connectivity, the privileged access story is just a natural extension of that. And another area of PAM where we're seeing some interesting results that relates back to security is we get to -- we can provide privileged access against the Okta admin dashboard. That's a unique thing that only we do. And that's a huge threat vector that we're seeing. People understand what's happening there through all the breaches. And it's like PAM is actually resonating in that whole area. To your question about what we learned from IGA. I think it's really just understanding our customers and understanding where they're on that journey so we can do the upsell part of it. And that's a big focus for us this year. We see a lot of upsell opportunity. The dynamic is very similar to IGA in terms of large enterprise. I think the type of workloads you cover with PAM might be more expansive. When you think about database, as you think about servers, right, servers meaning like if you have a cloud infrastructure, if you're a large enterprise with a build-out of AWS or GCP, like our PAM offering will do well in some server access there. And all that is related to the Converge story.

That's excellent. And both these products, right, were -- our understanding is it's at about a 30% uplift on both these relative to core access management?

That's right. Correct.

And given your perspective in corp dev, a couple of acquisitions in the past 12 months and Uno and Spera. So just curious to get your perspective on why these capabilities are important to plug into the platform.

Yes. So we're always -- those are very different types of acquisitions. We're always looking at innovation that can support a market trend or a road map. I think in the case of Uno, it's very small. We found a talented team to support small nascent innovation that we have, so we wanted to bring them in quickly. Uno represents -- we have something that we announced at Oktane last year. It's still pretty early, hasn't really been released to market. And then there's -- on Spera, that's a trend we've been looking at for a good 18 months. What Spera represents is a security offering to make our customers more secure, to provide more visibility into your customers' environments of your Okta and your non-Okta identity, kind of your landscape, right? So we looked at -- the approach we typically take for M&A is we look at a theme. We meet with all the different market participants in the theme, and we get to know the management team and see if there's a deal and a situation that makes sense for us. And so we're very excited about the Spera team. I just met with them yesterday. They're over here from Israel, and we're excited about what they can do for customers.

And it's a workforce product, correct?

Yes.

And is it a stand-alone kind of solution? Or does it plug into maybe PAM or...

It's a stand-alone solution. So Spera is a stand-alone solution. And what it does is it's -- think of it in the identity security posture management, so you can put it in your environment. It will tell you everything about what's happening in terms of users, what access they -- where they have access. Maybe if they're -- someone's over permissioned or under permissioned, if they're Okta, if they're non-Okta. So we can show you other IDPs. We can show you service account access they might have. So it's really just a full view of what a user has above and beyond what might be governed through IDP.

Yes. And one other thing that was new from the -- I think on the earnings call was the highly regulated identity. So it was new to me, and I'm curious to learn what gets you excited about this opportunity?

Yes. So highly regulated identity is on the customer identity side, right? Customer identity, again, if you're a large brand and you're engaging with your users, how do you regulate identity, really focuses on the financial institutions. So if you're a large bank and you want to have your customers. You think about the requirements that come from a solution like that around identity. Identity requirements could be knowing and having the right journeys for something to open a bank account. Like that's a highly sophisticated thing, and you have to understand who the user really is. Another part of it is understanding if they want to do something that's a high-value transaction within the environment. It's a little bit beyond identity. So you authenticate in to a bank, for example, and you want to do a big withdrawal, like what are the different configurations and policies around that. And so we're very excited about this. It opens up a good opportunity and it supports that vertical, which is important to us.

Great. So maybe switching gears a little bit to the go-to-market side of things. So I think Todd mentioned that sales productivity is probably the biggest source for upside that he sees in the business going forward. So I guess, give us a little bit more perspective on what he means by that. And what are some of the initiatives you guys are putting in place to drive that productivity?

Yes. I think productivity is -- there's a lot of different elements that go into productivity. I think there's tenure is one of the -- rep tenure is one of the forward leading indicators of that. And so we were -- I was at our sales kickoff the week before last in Las Vegas. And it's always a great opportunity to speak to the reps themselves, understand the ground truth of how they're feeling, what the sentiment is at the beginning of the year. And there's a couple of things that we did to keep them excited. I think one is just -- and you saw this in some of our announcements around just the executive stability in the field, where Jon Addison is the Chief Revenue Officer. And a lot of people were coming directly up to me and saying just how excited they were to see Jon in that role and some of the changes he's able to make as a result of them being in that role. Another is just looking at the territories themselves, right? Having territory consistency year-over-year makes the reps just have a lot of confidence in their ability to actually close the deals because the end of the day, like the reps are going to be here. They're going to stay longer if they can close deals, if they can make their quota, they'll ultimately be successful. And the other part of that is everything we've been talking about around the growth opportunity for customer identity. We spent a good part of the programming at our sales kickoff just enabling the field at a tactical level on how to sell customer identity. And they -- and that resonated with people. They realized the growth opportunity there, the large deal opportunity there. And so I see a lot of people were super excited about that. And so it's something we're going to be very deliberate on is introducing innovation to the field and at the right cadence. Enabling them at the right -- on the right windows, and putting the right incentives in place for them. And that seems to be resonating early on in the year.

Yes. So I mean, the salespeople have a lot to sell this year, right? They have their core business. They have SIEM, they have PAM, IGA, they have Spera that's coming down the line as well. How are these people spending their time? What's the incentives you put in place to make sure these sales people are going out to the right opportunities?

It's still -- so we still have a generous sales model. We give the priorities of what we want to enable the field. So we try to space out the innovation that we have, the new products, as you mentioned, whether it's IGA, PAM. Spera will be a little bit later. And then the customer identity is a whole thing. That's a priority for us as a company to get that out there. And so I think a lot of it is just having them understand and how to actually get the heuristics from their installed base so they can do those upsells. And in certain segments, for example, this is a new motion for us, in the commercial segment, we actually are transitioning over to from pure generalist to a hunter-farmer model. And we talked about that last week at our earnings. And that's just adding specialization to people that go after new business and people that go after installed base business. And that's a trend we've been looking at for a good part of a year, just to see how can we optimize that relationship with them. And the fields, they're very excited about that.

Yes. And in the enterprise space, are there certain incentives to sell SIEM or...

We have -- there's some incentives to sell SIEM. It's -- there's some more kickers on top.

Yes, makes sense. And then also, I know you guys, I think, were purposely calling out was, I guess, the channel momentum. So I forgot the exact numbers, but 6 of the top 10 deals, Dave can correct me if I'm wrong, that were -- 8 of the top 10 deals were influenced by the channel. So obviously, you guys -- my perspective is historically a little bit more of a direct model. So what might that have looked like a year or 2 ago in terms of these large deals being channel influence or channel source? And what's being done internally to drive that change?

Yes. So I think today, roughly 40% of our ACV was channel -- was from the channel. And last year, it would have been about 1/3. And that's -- to your point, there's a lot of opportunity for us to evolve the channel. When we think -- when we talk about channel, it impacts your business in different ways. We have -- when you think about the global SIs, right, the global SIs, and you think about the role an SI plays in a large company, in a large implementation and whether they're upfront implementing another SaaS application, we want them to think about how Okta can help enable that, right? And so we're seeing a lot of momentum in large deals with the global size you're doing. We're also seeing global SIs impact on the customer identity side, which is like they're building out full solutions with their customer and authentication is part of it. Now another area on the distribution side would be our relationship with AWS. I think we did $175 million this year, growing 130%. And that's a big one for us. We're very excited about that. We see a lot of opportunity in front of us on AWS. And another part on the partner side still, really when we announced this, it hasn't really been impacted was just what we're doing with MSPs and SoftBank in Japan. So MSP is a new way for us just to gain some distribution. We're looking at the SoftBank opportunity is something that can go after the Japanese market for us. And we're very excited about that one.

So I'm curious as part of like the identity and the GSIs and the customer that, I don't know, symbiotic relationship. Do customers just wake up 1 day and say, I want to swap out my identity stack, whether it's workforce? Or is there usually some sort of catalyst with a move to the cloud or application modernization? Does -- is it really part of a broader project, and that's where the GSI kind of influence relationship kind of comes into play?

It's definitely more of the latter part, right? There's something episodic that happens within the organization, whether it's deployment of a new HR system in the cloud where they realize wait, my users are moving to cloud, what else should go there? So like that's a good leading indicator. IT modernization. We talked about the build-out on the PAM side of like adopting public cloud in large enterprises. Like these are all catalysts where they realize, wait, we need identity. We need some security. We need some visibility to what's happening in those environments with our users going to those environments. And so GSIs can help there, help have that top of mind as we think about that and think of us as enabling technology for that.

Yes. And I did want to come back to the MSP partnership you talking about with SoftBank. I think it's interesting. So curious to hear how incremental that could be in the near term? And maybe I don't know, just more broadly, the MSP market, just how penetrated you are within that because I think a lot of -- we're seeing a lot more ISV security vendors sort of leaning to that channel a little bit more.

It's -- so we think there's a huge opportunity for MSPs. And there's different flavors of MSPs, like sometimes there's -- you could have an account-based MSP or could have a full-scale managed MSP. What we did with SoftBank is a new development for us. They actually required some product work. So think of it as a single pane glass to manage multiple Oktas, right? We developed that not just for MSP, but some of our larger customers. So we looked at some commonality that we're seeing with some of our more sophisticated environments. And so like this looks very similar to what MSP would like. So we built it as Project Aerial. We announced that at Oktane.

Project Aerial? It's like a multi-tenancy platform?

Yes. Exactly, exactly. It's a multi-tenancy, single pane of glass, you can manage and you can do it from delegating down, but also from a billing perspective. So we looked at what market makes sense for us. And again, Japan -- SoftBank has 16,000 customers in this program. And we think that's a huge opportunity for us to actually gain some reach. We're looking at it for other geos, but this year is really just about making SoftBank successful and making that multi-tenant successful. But we think that's a big lever for us going forward.

So any questions in the audience before we -- yes, one in the back? [ Alex ]?

Any comments on the [indiscernible]

Yes. So the question was about the breach, what we've learned. I think there's tactical things you learn internally, right? With every breach, there's some nuance there about what happened itself and there's a report and a blog post out there. So all the details I don't have to go over. I think what we've mostly learned is how we talk to our customers and how we engage with them early on. So there's a right balance about being early in the communication to your customers, but also being thorough in the communication to your customers. And you don't want to over-index on either of those. If you go too early, you might have incorrect information. If you wait to be too thorough, you might be too late and then you introduce uncertainty. So what we found is just activating our team to actually have this high-touch conversations with the customers really matters upfront. And yes, we are doing a lot. We've announced at earnings last week, the Okta secure identity commitment, which is really a manifestation of things we've been working on for a long time, but this is more like public facing, just about what -- some of the things that we're doing internally. I would say it has prioritized a number of things that, from a road map perspective internally over the past -- we talked about some 90-day sprints, some of those are ongoing about things that we are doing, both from our own internal security, but also as we add security to our products. Those have all been prioritized as a result of this. The other part of the question was around pipeline and how we feel about that going forward. We feel very comfortable about it. We have a great pipeline going into in Q1 this year. It's -- we don't see any quantifiable impact at this point from the security incident. And so we're pretty optimistic.

Great. Any others before we -- no? Okay. Look, so one area that I think still could you some improvement is probably on the new logo side of things. And I think part of it is being addressed with the hunter-farmer model. But what's happening from a go-to-market perspective or a macro perspective that's weighing on that number? And I know, obviously, the hunter-farmer model is partly addressing that, but are there any other things that you're doing to spark that?

Yes. I think it's hunter-farmer you covered it. So macro, from our point of view, has been fairly consistent in terms of the segments, right? So we've been looking at the small -- the commercial segment in the small business segment for some time now, which is why -- hunter-farmer didn't just show up. Like that's something -- it takes a lot of change and thought to go into it and adjustments. And so we've been look at that for a good part of the year. So we're super hopeful about that. We're reacting to what we're seeing in the market with that for new logo. The other part of new logo is really the large customers. And we think there's going to be more momentum on that one. And so those 2 combined, I think we're still -- we're cautious, and we see that as we plan for the year, but we're reacting to what we're seeing in the market.

Great. And again, coming back to kind of your purview at Okta, but just when you talk to Brett, how do you guys think about capital allocation going forward in terms of, I don't know, M&A from your perspective or buybacks, what have you?

Sure. We're going to be thoughtful about M&A going forward. We're in an opportunistic position where we don't have to do M&A. But there's a lot of good innovation that's happening out there and my team is -- we meet with hundreds of companies per year, and we really have a good idea of what's out there. We're trying to be as prescriptive as we can to what -- as we stagger our innovation. I think from the balance sheet perspective, there's a focus on just looking at the debt part of it right now. You saw some things we announced around the net settlement method we're doing. So those are all part of like the bigger picture. Brett and I meet quite regularly to figure out the best ROI there.

Okay. All right. Well, we're about time here. So Monty, I really appreciate you doing this and this is great.

Yes, likewise.