Okta, Inc. (OKTA) Earnings Call Transcript & Summary

I'm Joe Gallo. I lead Cyber Research at Jefferies. Thank you all for attending. Today, we're delighted to have Brett Tighe, CFO at Okta. He's been there for almost a decade. Before that, he was also at Salesforce.com for, I believe, 11 years in various finance roles. And then we also have Dave Gennarelli, who runs IR at Okta. Okta, I'll let Brett describe in more detail, but Okta is actually what secures all of you in this audience. So at Jefferies, we really care about our clients. And so for customer identity, we actually use Okta. We care less about our employees. We use another vendor, I won't talk about that, but just wanted to give that background. But Brett, really appreciate you joining us here today. Maybe the room is certainly filled with some generalists, maybe just give a background on what Okta does and why it's so mission-critical for security?

Yes, absolutely. Thank you, Joe. So happy to hear that you're happy Jefferies customer. We do need to get that other side. So I'll talk about both sides of the business real quick. So there's -- Okta is 2 main businesses; one is Workforce Identity, and that is where we secure our customers', employees' and partners' identities. And then what Joe was just talking about is there's a second side of the business, which is customer identity where we secure our customers' customers' identities. If you look at the business in total this year, we're guiding a little north of $2.5 billion of revenue, growing around 12% for fiscal year '25. If you look at that, it's just in the very early innings of what we think the total addressable market is. The total addressable market, we believe, in total, is about $80 billion. That is broken down between workforce being about $50 billion and customer identity being about $30 billion of that. So you can see that we're very early on in this opportunity. The way we deliver the product is via cloud infrastructure. So it's a multi-tenant offering. In most cases, there are some situations where we do offer a single tenant or a hybrid on-prem connector for those who are making that transition from on-prem over to the cloud. In terms of a couple of other financials, I talked to you about the revenue side of the house in terms of margin. This year, we're guiding about 19% to 20% non-GAAP operating margin and about 22% free cash flow margin. So at scale, generating a good amount of margin. So that's just a quick overview.

Awesome. That's helpful context. Maybe to start super high level on macro and the environment before we drill into Okta, there's been a wide dispersion of results so far, right, in cyber and broader software. I think the cyber has hung in better, but what are you seeing out there when you look at budgets? Is AI cannibalizing budgets? Where is cyber in the prioritization? And then maybe if you can talk about enterprise versus SMB as well?

Yes. So macro is definitely a headwind to us. We've talked about it for several quarters now. We don't see it getting worse or getting better at this point. When you look at our guidance for the balance of the year, we're assuming really the macro as it is today, which is a headwind. And it's a headwind in a variety of ways, but the main one that we see it on is on new logo acquisition. It is harder to do business with new customers at this point. If you look at the last several quarters for us, most of the business or most of the net new ACV is coming from an upsell side of the house, upsell being either seats or from cross-sell. And when you dial in and you dive deeper into that, it's really more cross-sell than it is more seats. People are much more thoughtful about their budgets at this point and their contractual spend. So when we look at it from a segment perspective, what, Joe, you're just saying, enterprise seems to be holding up a little bit better than SMB. So it's been a challenge a little bit more from the small and medium-sized business, I think, just with the assumption they don't have quite the balance sheets that the enterprise and strategic customers do. Also, we do service public sector and have done quite well there recently as well. So think of that being very much like enterprise and strategic. The balance sheet is much stronger for those government agencies. In terms of AI versus security, we haven't seen any difference, to be honest with you. It feels like we're still high priority -- identity or security is still a very high priority for, not only our current customers, but also any prospects out there.

That makes sense. And we would expect cyber to continue to be resilient. So despite those macro challenges, you still grew cRPO 15%. You guided 2Q to 10% to 11% growth. And historically, you've been very prudent. I won't ask you the degree of prudence, but maybe as we think through upside drivers or top drivers of growth, what are the 3 or 4 things that could maybe eventually reaccelerate growth?

Yes. So if you look at the top 3 strategic initiatives we have this year as a company, first one is security, second one is reigniting growth, and the third one is scaling the organization to continue to improve the leverage of the business. So I'll dive into the second one, which is reigniting growth. So we have come up and driven a lot of new products lately, so you can look at governance, you can look at PAM, customer identity is obviously a massive opportunity that we continue to expand in with fine-grained authorization. So improving the product set so our sellers have more to sell to our customer base. The other one is expanding our partner ecosystem. So historically, Okta has been a reseller-focused or traditional reseller focused, think SHI, CDW. And the last time we spoke about it, about 40% of the total revenue stream came through the partner channel, with the vast majority of that being the reseller organization. Now there are 2 areas that we want to get more deeply ingrain in, which is the cloud service providers like AWS, which we announced last quarter at the end of Q4. It was about $175 million of ACV or annualized contract value, growing about 130% year-over-year. The other area that we need to invest more into is the GSI community. We have historically not had as much attention from them primarily because Okta is easy to turn on. That's one of the benefits of Okta. A lot of times, you just -- you go and purchase it. It turns on pretty easily. There is a very light amount of implementation work. You can see that through our professional services as a percentage of revenue. It's only about 2% of total revenue, at least in Q1, and it's been about 2% to 3% for the last couple of years. So we need to be able to improve our relationship with the GSIs and focus on them and show them how identity can play into one of their practices and make them a lot of money. So those are the areas that we're -- from a partner perspective, we're focused on. And then the third area is something we just implemented in early February, which is a hunter-farmer model in our America's SMB business. So I talked about earlier that new logos are harder to attract right now. So what we saw in our quant that we felt that best decision for us is to split our lower-end SMB, being small and medium-sized businesses, our lower end customer sizes into a hunter model, which is a rep who only gets paid money when they bring in a new logo versus a farmer who is farming the current customer base. So we think that those 3 areas, the new products, the partner ecosystem and hunter-farmer should help us reignite growth over the medium term. I'm not saying it's over the near term. I mean, in a SaaS revenue model, it's hard to accelerate that in such a short time frame. So it will take us some time.

That AWS number is super eye-popping. Is that the only marketplace you're on? Are you investing in other marketplaces? And then how do you think about what inning we are in, in that AWS? Is that a long runway? Is that helping you move further down market? Maybe just give us a little more details there.

Yes. It's a -- we have, I think, a special relationship with AWS. We're one of the largest users of their service just from a pure AWS perspective. So we've got a very close partnership. Yes, I mean we're excited about the partnership. I think there's still a lot of room to run. And I think it will get us both SMBs and enterprise strategic. So I think it's definitely a good opportunity for us. In terms of the other marketplaces out there, we are in early days with GCP, and Azure, not so much given they are a competitor to us. So we're looking to continue to build out the GCP side, not just from a go-to-market partnership, but also from a product perspective, having a diversity of platform because we are actually on all 3 platforms at this point, but the vast, vast majority of it is AWS.

So $2 billion of business, $80 billion TAM. You've had a fantastic improvement in margins the last year.

Thank you, Joe.

How do you think of a -- we're credits too, we really have. How do you think high level -- if you follow us. How do you think high level about the growth versus profitability? Because you obviously [ the investors ] in the room on profitability, but you also want to make sure you're not underinvesting to capture that TAM.

Yes. So we're going to do the same thing that we've done for years, which is manage the business through the lens of the Rule of 40. We're balancing growth with profitability. If there's opportunity to grow faster, we're going to take it. If there's an opportunity to create leverage, we will do that. I think we've done a really nice job of increasing leverage over the last couple of years. It's taken a lot of work by a lot of people across the company. And I think we've built the pillars to be able to, not only invest in the business, but also create leverage. So it's something that's paying off specifically actually in FY '25 to be able to deliver these types of margins while also investing a lot of money in areas like security or reigniting growth or scaling the business. So I think I'm really proud of the team, but there's still a long ways to go.

And then how do you think about the sales and marketing side of the investment? Where are we on capacity? Are we still hiring? How do we think about efficiency going forward? And then you guys have made a ton of structural changes the last few years. Is there anything left to do on the go-to-market side?

Yes. I mean, from a capacity perspective, we feel like we have the right amount of capacity for the balance of the year. Right now, what we're looking for is -- I kind of look at it as capacity is the glass and the water level is -- in the glass is the productivity, and we still are not overflowing the glass. When we see productivity get to a certain point, we'll start adding more in. But at this point, we feel happy where we are. In terms of potential changes in the field, we're always looking at new things and making sure that we're getting the best ROI out of the things we're doing today. So for example, with the hunter-farmer, that's only been in place for a quarter now. We're optimistic that it will be accretive to both logo count and growth in the future, but it's only in a smaller segment in a larger geo. There's a potential that we could expand beyond that, but we want to make sure that it's successful first before doing something like that.

And then how do you think through the sales force's capacity to sell everything? Because I mean really, in your tenure as CFO, you've gone from largely 1 product, then adding a major SIEM customer identity market as well as IGA and PAM in the last couple of years. And so is that an easy sale, a complex sale? How do we think about the sales force's ability to sell?

I think we are getting better. I would say that there is areas like customer identity, which is a massive market in its own right. We have definitely gotten better. We actually track participation in the field of which deals you participate by product. So for example, if you look back 2 years ago, the vast majority -- vast, vast majority of the field was in the workforce identity deal because that's our -- that's where we came from. That's where we started. If you looked 2 years ago, the delta between the workforce participation and the customer identity participation in the field was, I mean, not super scientific, but like this, let's just imagine that. If you flashforward 2 years, this number has basically stayed the same, but they're getting closer together. So we are getting better. There is still improvement in the field to get better on customer identity. In terms of the newer products like governance, PAM, posture management, threat protection fine-grained authorization, I think those are still a ways off in terms of maturity, in terms of the field being able to sell them. Some of them are easier sells. The governance tool is basically an extension of our life cycle management and workflows tool, which is under the Workforce Identity Cloud. That is an easier sell for a lot of our sellers because it's tangential to what we've done for years and had a lot of success in. Things that are a little further afoot like a PAM offering will take longer for us to be able to sell because it's something, frankly, not exactly what we've sold in the past. So it's something new, and it will take some time. So we need to be patient. We need to enable the field. We need to make sure the products are good enough to be able to compete. I mean there's a lot of things and a lot of steps to releasing a product, not just you come out, "Hey, there's a new product here." You got to actually do a lot of steps to make the field successful because you want to show the field that they can make a lot of money, and then they'll get out there and they'll sell it so...

Let's double-click on the customer identity side of the business. I think a lot of people in the room are probably familiar with the workforce side. You compete with Microsoft, Ping, and we'll talk about that later. But what is the competitive landscape on the customer side? And how do you think about the durability of growth in that business? I know your aspirations are to kind of get to a 50-50 business.

Yes, those are our aspirations. And to be clear, I should have said this earlier in my intro, which is about 60% of the business is workforce and about 40% is customer identity. Look, the competitive environment there is really a buy versus build. We need to convince the market they need to buy it from us than build it themselves. One of the key metrics we have internally is number of developers on the platform, right? Because that's one of the key personas that we need to go after. Customer identity is an interesting market in the sense that the developer is very important because they could be starting as a hobbyist, starting with a very low dollar or even free self-service subscription. I'll give you an example, OpenAI, 1 of our largest customers now, is -- started out paying us, I think it was like $100 a month. And then they -- it was a monthly credit card thing. It was nothing because the OpenAI Dev team was starting to experiment with our product. Over time, they realized how valuable it was and then upgraded into an enterprise contract, and have been doing upsells over a variety of quarters over the last couple of years. So it's -- that developer upmotion is very important for us. So we need to be able to continue to make inroads there. Another stat that we've talked about in terms of the developer upmotion is about 45% of the new logos that come into the customer identity business come from that self-service subscription, either the free or the paid. So think of it as another area of pipeline for us. Then there's also a top end sale that we do from a Head of Product, Head of R&D, Head of Marketing, even a CIO, very rarely a CISO, but -- so it's an interesting market to work in, and there's a lot of opportunity. The thing is it's not like workforce. There's some dynamics about workforce, not just the developer upmotion, but also the fact that customer identity is fairly new. Historically, this has been kludged together with a bunch of different simple technologies and is not really scalable for the people who are trying to build it themselves. And so we need to teach that market they need to buy it from us as opposed to trying to figure it out on their own. So a lot of work to do there. There's a lot of opportunity there. We hope to continue to make a lot of inroads there.

Earlier, you said one of the growth drivers is leaning more into the channel. Historically, the channel is always coin-operated, right? They do what's in the best interest for the channel as most people do. You being a super easy to deploy and use solution doesn't necessarily help them build up a services portfolio around you. Now that you have customer identity in full force, now that you have IGA and PAM, is that helping you make inroads with the channel? And then, as the CFO, are there any other levers you can pull to help drive the channel motion?

Yes. I mean, that's definitely the products are an important -- those new products are important areas for us to be able to explore with the partners, the GSI specifically. Yes, I mean, if you think about customer identity, if you're going to -- if you're a GSI, you can build an application business, identity being one of those pieces. There's tons of new applications being built on a regular basis. Governance, our tool does work out of the box and is very flexible. We think it's a lot better than the legacy products out there, but there's a lot of work before you actually turn the product on in a governance tool. You got to figure out who has access to what, when, right? And so that work, it's not coding, right? It's basically just figuring out, "Oh, Joe should have access to this system at this time and make sure he doesn't have too much access." So those are definitely the -- the main area is product focused. But frankly, as an organization, we need to be better about being partner friendly. In fact, at our executive staff meeting a few weeks ago, with 40 top people in the company, we brainstormed for a couple of hours as a team and then in individual groups and functions like G&A, sales and marketing, R&D, of how we can operate as a more partner-friendly organization. Because not just developing the products, we have to be open to it, to ourselves and how we operate the business. So there's a variety of things that we're working on to try to push that forward. And this is not something that's going to result in numbers being produced overnight, this is a multiyear journey and long-term relationships that we want to have with a handful of these GSIs.

Maybe going back to the workforce side, you guys recently launched last year, IGA and then this year, I guess, in December, PAM. How are those businesses going? And then as financial analysts or investors, how should we track the traction of those businesses?

Yes. Governance is off to a start that definitely beat our expectations. We're up to hundreds of customers at this point. But frankly, if you think about that, compared to the 19,100-plus customers we have, it's just a rounding on the upsell opportunity just on that front. So we're doing well. And like I said earlier, it's an easier transition for that sale for our field than probably some of the other things like PAM. I mean, privileged access just came out in basically a quarter ago. So it's very early on. But the bottom line is what we're trying to drive here is as a workforce platform that has 3 major pillars to it. One is access management, something we've always done historically. I think single sign-on, multifactor, universal directory. That's the core access management that we started with early on in the company's history, Then you've got the pillar of governance and you've got the pillar of PAM. We do have dozens of customers now who've purchased all 3, even though the PAM product has only been out for like about one quarter at this point. So we -- that is our long-term strategic bet into the market is these 3 pillars that people want to buy all 3 of them because, frankly, each individual product is very powerful, but together, they're more powerful and add more value to our customers and, frankly, improve their ROI, which is what we want to be able to drive from a customer success perspective.

Obviously, you, as everybody else has seen seat-based pressures, but is there a world where PAM and IGA can help reaccelerate your NRR going forward?

Yes. I think in the long term, yes. Right now, to be able to move that NRR, it's a very large number. We have to sell a lot of IGA and a lot of PAM to be able to get that number to move because remember, it's a $2.5 billion business at this point. So it's definitely -- it will be helpful over the long term. I wouldn't expect it in the short term given the size of the businesses at this point.

At RSA, you guys made a ton of product announcements. What were the top 2 or 3 that you think were most important?

Yes. For us, it's really the security-based products. So we had talked about threat protection before, but threat protection is something we continue to talk about, which is continuous authentication. So a lot of situations are stolen sessions right now when you think about security incidents. So what continuous authentication can do is say, okay, Joe is still Joe, doing what Joe should be doing on the laptop or computer and what system he's going after instead of, okay, Joe has gotten in and we just forget about it. Continuous auth is there to be able to improve the security footprint of our customers. That was one of them. And then the other one is really around posture management. It's also a workforce identity tool, which is how to look at your current setup and say, do you have problems? I think we've all heard about service accounts, and that's been a challenge for a lot of companies. One of the things that posture management does is it takes a look at your infrastructure and says, how many service accounts are sitting there open basically. And so that's one of the many tools that it can do, but that's one of the ones that I think everybody is aware of given the challenges that folks have had across the world with service accounts lately. So excited about the security offerings because it's -- we believe it's -- it underscores the importance of security and -- the importance of identity and security, but also adds a security layer. And then, frankly, we can land new customers just with like posture management, for example. So it's, once again, trying to add the bag for our sellers to be able to make [ the quote ].

And then given you're the CFO, what are the financial implications of these announcements? Are they top line drivers? Are they more gross retention rate stabilizers? How should we think about...

I'd say a little bit of all of it, right? I mean, in the long run, it should be able to help with NRR, or net retention rate, should be able to help, in theory, with gross retention, should be able to help with growth. I mean it's all across the board, frankly. So yes.

And then earlier, you mentioned an increased focus on security. You obviously had a cyber incident a while back. Maybe just describe that briefly, and then update us on how customers are thinking about that incident?

Yes. So actually -- so I just talked about service accounts, and so that was the core of the issue that we had in October. And if -- hopefully, all of you had a chance to see [indiscernible]. We published the Okta Secure Identity Commitment, which is a blog. You can go look at it. It's on the investor website, and it's on our own website, you can have a look at it, but it's really got 4 main pillars to it, which is making our infrastructure as a company better, making our product even more secure, leading with best practices with our customer base and then leading the market. Those are the 4 main pillars. There's like 15, 16 pages you can go through and see everything we've already accomplished and everything that we're planning to do out in the future because we want to be one of the world's most secure companies. Identity is security, and we want to be able to get there over the years. So that's a key part of the commitment to our customers is to really be better when, frankly, we weren't at our best last October.

Have you seen any changes in pricing, any changes in gross retention rate, contract duration, anything from the...

No, we haven't seen any like really quantifiable evidence of the impact to the financials from this security incident. But look, there's a potential we're just not picking it up in our financial data, right? Think about someone who was thinking about Okta, but never actually looked at Okta after the incident. We'd never find them in our data anymore because they're not in Salesforce. They're not a lead. They're not a contact. And so there's a potential that's out there. We just can't seem to find it from a material perspective in the financials and, frankly, when speaking with parts of the field.

And your biggest competitor also had an incident. Like has that helped you with the federal business? Like I guess, how would you describe federal traction? And like where is the U.S. government in identity adoption? And where can it be?

Yes. I mean it's very early on in our public sector business. I mean we've been having some really nice deals. The team has done a great job. We've got great leadership in that part of the organization. We've got great products. We spent a lot of time on U.S. FedRAMP certification, which is -- not only helps you with U.S. federal business, it helps you with SLED business, it also helps you learn how to get these certifications in other countries around the world. And so we believe we're very early in that opportunity. In terms of your question around Microsoft, maybe it's helped us. I haven't heard anything one way or the other. But look, we believe we can win with or without those, and we want to be able to solve as many use cases as we possibly can to be able to address and solve as many problems that our customers have.

Maybe for the final question. If you had a magic wand to remove 1 constraint from your business, is there 1 thing that you would remove to help turbocharge growth or whatever it may be?

Macro. Macro. I think it's still a heavy headwind for us. And I think I'd love for that to go away. But we're not going to sit here and wait for the macro to turn around to try to reignite our growth profile. That's what we talked about earlier with these products, the partnerships and then the hunter-farmer model. We're not going to just let the macro control us. We want to be able to be better than we are today. So yes. I'd take macro out of it all day long.

Awesome. Brett, really appreciate the time today. Thank you.

Thanks, Joe.