Okta, Inc. (OKTA) Earnings Call Transcript & Summary

This presentation contains forward-looking statements. We reserve the right to change the information in this presentation. More information can be found in our security filings. [Presentation]

Please welcome Okta's CEO and Co-Founder Todd McKinnon.

Hello, and welcome to Oktane. We are thrilled to have you here. Everyone online, my wife is watching online. Hi, Roxanne, and everyone here in this jampacked room. My father is here. Welcome, George. We are going to tell you a story about a company that has gone through a major transformation. And this story starts with identity. Identity is who you are. It makes you, you. It's your reflection in the world, both personally and professionally. It's the entry point to the digital world. Determines what you can access and when you can access it. It's something that can make organizations more productive. It can make every single interaction with technology faster, smarter, and more secure. But there's something more important. There's something more important. While identity can be a powerful force for good, identity is also under attack. Over 80% of security breaches involve some kind of compromised identity, whether it's the initial compromise or how the threat moves laterally. So the stakes have never been higher for identity. And because identity is the foundation of technology, it's become the key to security. To get security right, you have to get identity right. A simple way to sum it up, identity is security. And the threat environment that we are all living in raises the bar for what an identity system has to be. It has to be agile and respond to threats. It has to be deeply integrated into every part of your ecosystem. It has to be independent and neutral, not part of some monolithic stack that's trying to lock you into one ecosystem. Now this is obvious to many of us today, but it wasn't always the case. If we rewind the clock back to 2009, when starting Okta, the world was in the early days of adopting cloud computing. And Okta's focus, our focus was on IT enablement. We were working hard to build a platform and a set of capabilities that would help companies adopt the cloud. Today, identity is still the entry point to the digital world, but it's become so much more than that. And with that change, so have the expectations of Okta changed. So we have a huge target on our back. We have a huge target on our back, and we are responding. Every month, Okta blocks over 3 billion identity attacks. These are credential stuffing, bot attacks on the Internet, broad-based attacks and very focused attacks. So this means that everything has to change. We aren't just powering the cloud. We are securing it, too. And this has resulted in a totally new risk model for Okta. We had to start treating every risk, no matter how small as something that would be found and would be exploited. We had to evolve how we build our products, how we protect our corporate infrastructure and how we manage risk. And maybe most importantly, we had to change our mindset. We had always thought of Okta as an identity company. And while that's still true, in a world where identity is security, Okta is a security company. And since last Oktane, we have had an all hands on deck approach to becoming one of the most secure companies in the world. Now we got a lot done in this period of time. And we have emerged a much stronger company because of it with a very clear vision and sense of purpose for our role in technology. This focus is captured in the Okta Secure Identity Commitment. The Okta Secure Identity Commitment is our long-term commitment to lead the industry in the fight against identity-based attacks. And it has 4 key focus areas. The first is building market-leading identity products that are secured by default; hardening our corporate infrastructure; championing customer best practices; and finally, elevated the entire industry to be more protected from attacks. Now since launching the Okta Secure Identity Commitment back in February, we have made a tremendous amount of progress. On the Workforce Identity Cloud, we've launched Identity Security Posture Management, Identity Threat Protection with Okta AI and Govern Okta admin roles. Customer Identity Cloud has seen the launch of the fourth generation of our bot detection technology, along with Fine Grained Authorization and Highly Regulated Identity. In the last year, we have invested over 1 million hours directly focused on security, 1 million hours. If I would have done this myself, it would have taken 110 years. Luckily, I didn't have to do it myself. I have an awesome team. Now it's a lot of progress on the screen, but it's just scratching the surface. The list goes on and on. This is a long-term commitment, and we will not stop until there are no more identity-based attacks, no more. It starts with helping ensure that customers are best protected. And that's why we created the secure identity assessment. Secure identity assessment builds on what we talked about last year with our Expert Assist offering. Expert Assist, as many of you know, since you've utilized it is where our experts make sure that your Okta installation is set up to the highest secure configuration and to make sure everything is locked down and up to your posture. Now secure identity assessment takes us a step further by doing the same thing, but not just for Okta, but for your entire ecosystem. See, our team, we've worked with some of the most secure organizations in the world, and we've learned a lot. And we want to share those best practices with you. And the best thing about it is that as you're identity security posture improves over time, we can reassess it and make sure you attain the level you want and you require and you're maintaining that level even as your technology, infrastructure and ecosystem evolves. Helping protect customers from attacks is a very important priority. But we also want to protect the broader communities that we all live and we all work in. In support of this goal, earlier this year, we launched -- or we announced a philanthropic commitment of $50 million to build a more secure world. And this future, as we all know, talent is critical. We have to have the right talent. Yet today, 4 million cyber jobs remain unfilled globally. So this is an issue for all of us. And the entire industry needs to move faster, building up and training the next generation of cyber talent. I want to spotlight an amazing organization that they're working hard to reshape the technology workforce of tomorrow. CodePath, it's an amazing organization and an amazing mission. They're all about meeting the needs of underrepresented computer science students, seeking careers in technology. Matching them with employers like all of us seeking strong, diverse job-ready talent. CodePath, they're on this mission to reprogram higher education, and we're taking actions to help them. We're partnering up. And along with we're going to build an open-source cybersecurity lab that will reach 3,000 students a year and ensure they're prepared to take on these key roles in the cybersecurity industry. We are so proud of this. Sometimes, these people that are early in their career just need a nudge, just need a little extra help, and they're off on their way, building a great career, helping the world in this important area. We couldn't be happier. So nice job. Nice job CodePath. So now learning and growth, continuous learning and growth are very, very important to us at Okta. And our transformation and our increased focus on security has taught us a lot. Becoming one of the world's most secure companies has required that we harden our own corporate infrastructure. And this means, of course, using our own products. It should be easy, right? We're a security company using our own products. And this was so critical, so critical. I got personally involved working directly with the product team, attending the daily meetings and adding my input. You can ask them what they think of this, but very important. And I learned some incredibly interesting things. Like, for example, do you know how many applications Okta has inside of our corporate infrastructure? Throw out some guesses. 5, someone said 5. No we have more than that. It's over 1,300, 1,300. Now many of you in this room, you have incredibly complex infrastructures at your companies. So this may not phase you, but I was surprised. I was surprised. And so what did we do? It was a tall task, but we do what Okta always does. We rolled up our sleeves and we got to work. Now getting a complete list of all these identities and all these applications, making sure we had end-to-end phishing resistant authentication for all of these things from the second the account was created or employee was onboarded. All through the resets and the job changes, et cetera, until when they're offboarded, doing this for machine accounts and human accounts, making sure it's all restricted to the access from the corporate VPN, making sure that it's only from allowed list of IP addresses, making sure that the privileged accounts are locked down, making sure the secrets are vaulted and rotated, making sure we have identity governance workflow across the whole thing. This was all very hard, very hard. Now, here's the other thing about it. It's way harder than it should be. And if it is hard for us, imagine what it's like for an organization where identity and security is not their main business. And why is this so hard? Why is this so hard? Well it's not -- we have great people, we have great products. But the reason it's so hard is because all the applications and all the technology is different. It's all different. They don't integrate well. And this yet led us to a simple but a profound realization to solve the identity security challenge that is afflicting the world, we need massive standardization, massive standardization. There's no identity security standard that ensures visibility and interoperability across all of technologies. Sure, we have SAML and SCIM that help. But as our own experience shows us, as our own experience shows us the industry, its far from where it needs to be. It isn't easy for a resource or a workload or an API or any other enterprise technology to make itself governable, discoverable, support SSO, support provisioning and continuous authentication. Now if we solve this, we are on our way to solving the issue behind 80% of all cyber breaches. And it doesn't matter if you have the best network security. It doesn't matter if you have the best endpoint security or cloud security, these things are necessary but not sufficient. If you don't have complete visibility into every touch point in your ecosystem, if you aren't listening to all the risk signals and able to take concrete action response, you are vulnerable and you are exposed. So this lack of standardization, it's the single biggest issue and the single biggest barrier to cybersecurity today. It's the problem of our generation. So the time is now to fundamentally reevaluate how we think about identity security. We need to move to a world where every app, every device, every workload, they all speak a common language. We need a way to standardize identity security. Think about some of the other standards that have impacted our world, like TCP/IP. If I have to explain to you what that is, you're at the wrong show or even something as simple as a screw. Now screws, they aren't just a story about standardization. They also represent the power of integration. Henry Phillips, yes, there was a guy named Henry Phillips. He didn't just come up with a strong x-shaped design that's made screws ubiquitous today. He also knew that for screws to have a big impact, he needed to license the technology broadly. So the importance of a screw can't be underestimated. It makes the modern where possible, the growth of the automobile industry, the space race and every household project, my dad and I have done together, possible with the crew. So our goal is to standardize identity security across the industry. And in doing this, we will help foster an ecosystem that is seamless and efficient to build enterprise technology and use it in an environment that will be secured by default. And we want this to be open so everyone can benefit. Now let's see what the scope of this would look like. You recognize in this picture on the right, something that looks like your corporate infrastructure. It is complex, cloud apps on-premise applications, AI agents. Now with the right kind of standardization, you'll have complete control over every part of this ecosystem. Identity does familiar things like SSO and MFA but also more advanced things like life cycle management and entitlements. It listens to risk signals and can take actions like Universal Logout. It can manage your security identity posture across your entire enterprise. Some of these areas, they have standards like OpenID Connect for single sign-on or SCIM for provisioning. But even there, it's not clear how those standards should interact with other parts of the picture. How do you make sure you bind an SSO session to a device, unclear. And then in some areas, there's no standard at all, like there's no standard for Universal Logout. We want this all to be simple, secure and open to everyone. So our solution is a new standard that covers this entire picture. The standard is called Interoperability Profile for Secure Identity in the Enterprise or IPSIE. Yes. So if you're still wondering if you're at the right conference, you know you are because we are an identity company, and we have never met an acronym we did not like. We've led the formation of a working group with inside the OpenID Foundation let's say aim of defining the standard, creating it and working with the whole ecosystem to evolve it into a unified identity security standard to solve all of these challenges. Now this is a key part. This is open and involves everyone, other identity providers, the biggest to the smallest, other technology companies. We're going broad and wide with this because it only works if it covers everything. An identity security standard that covers a couple of things, not super valuable. Today, the identity industry can't integrate deeply enough into technology and the people that are building technology, they don't have a simple and consistent way to allow these connections to happen. They're all reinventing the wheel. And IPSIE is meant to codify this connection. And in doing so, it will dramatically improve identity security. Imagine you're building technology. It will give you a clear identity security blueprint that will make your solution far more secure. And organizations that standardize on IPSIE-compliant technology they'll get complete visibility into their identity environment and the threat surface, and they can provide access to what we all want, the right applications at the right time and take real-time actions in response to threats. Now this part is important, all at a fraction of the time and cost it takes today because it's too hard, it's too expensive. We need to solve these problems as an industry and get back to the main businesses we're all in. So Okta is committed to this world and leading this world in the fight against identity-based attacks. This standard is the most transformative way we can move the entire industry to a more secure place. Now think about our own example of hardening our corporate infrastructure. In a world where each one of those 1,300 applications have been built to be IPSIE compliant, we would have been able to move much more quickly in securing our own and increasing our own security posture. We would have had faster, complete end-to-end visibility into every aspect of our ecosystem, every nook and cranny, every element of it. We want this to be available to everyone, more signal sharing, more SCIM, Universal Logout everywhere, all requiring fewer calories, fewer calories. Now we're turning the show into a diet seminar, has to be cheaper, has to be easier. We all know in security complexity kills makes everything brittle. We can solve these challenges. So in some ways, this is a big deal, huge and revolutionary. But in other ways, it's a continuation what we've done before. When we -- we've been kickstarting the adoption of standards like OpenID Connect and SAML and WS-Fed since Okta's earliest days. When we got started with SAML, it wasn't widely adopted. So we built the first version of the Okta Integration Network by hard coding, screen scraping to every application that didn't support SAML. And as more applications supported it, we updated the integrations, the ecosystem -- upgraded the integrations and authentications happened quickly and easily and seamlessly as a result. So we are no stranger to standards and how standards can move the entire industry. We've done this before, and we're doing it again. Launching IPSIE and starting the standardization process is just the beginning. We aren't waiting around for this. And just like in the early days, we're pouring resources into solving real customer problems today. And that starts with secure identity integrations. We're meeting you where you are today by building 125 new secure identity integrations across some of the biggest names in enterprise technology, Google, Office 365, Atlassian, Slack. Now the idea here is to make these integrations behave exactly like everything will behave when everything is IPSIE-compliant. So imagine this, think about this as a glimpse into the IPSIE future. Now this wasn't easy. We spent a lot of time taking an inventory and building all the integrations into the most critical applications manually doing this work. And in the future, as IPSIE is adopted everywhere, all of this will be easier and easier and faster and cheaper, but we wanted you to get the results sooner. So this is all very important. But another key to making this move forward and be effective broadly is that as many applications as possible, as quickly as possible, need to support Universal Logout. Now the Customer Identity Cloud is the identity layer for thousands of applications out there. So if we added support to the Customer Identity Cloud for Universal Logout, it would be supported by these thousands of applications immediately, and that's exactly what we've done, exactly what we've done. So this means as the IPSIE standard evolves, thousands of applications out there that use the Customer Identity Cloud all are well on their way to being compliant. Now Universal Logout is just to start. Over time, we'll add more capabilities to spur adoption even further. So this is a virtuous cycle. We are providing real value today with secure SaaS integrations. This makes customers more secure, so they'll start to demand it of all of their technology. We're working with everyone in the ecosystem to codify IPSIE. We're adding elements of IPSIE to the Customer Identity Cloud, which will lead to more IPSIE compliant technology, more secure SaaS integrations and most importantly, more secure customers. You can see we're putting all the pieces in place to eliminate identity-based attacks. And let's be clear, we will not stop until we get there. And what an amazing accomplishment that will be, what, a better future. So doing this is an important step in our overall vision, and that is to free everyone to safely use any technology. Are you excited about this? Hopefully, yes. I'm glad. I'm glad because like a lot of things in life, there's a catch. The catch is we're going to need your help. We're going to need your help. First of all, you have to believe this is possible and get aligned that we can build a better future. For those of you that saw the keynote, the intro keynote yesterday with Alex, how do you do something impossible? First thing you do is you tell yourself, it's not impossible. It's just really hard. And then you break it down and you do it. Second is dig in, understand the standard and give us feedback, collaborate on us. Now if you're building technology, make sure it adheres to these IPSIE principles. We're going to make that really easy, whether it's adding capabilities to the Customer Identity Cloud, publishing tools and documentation, make it all very clear and transparent, get everyone's input, make it open and accessible to all. And finally, if you're buying technology, make sure the vendors are IPSIE-compliant or headed that way. They need to be on board with us, all of us. And now we know that introducing new standards is hard. And to get them bootstrapped, they have to be open, and we've talked about that. It has to be easy and simple for every technology company, no matter how big or how small, to adopt them. Now the good news is we already have some of the biggest in the business on board to help us.

Thank you for the warm welcome, Todd and hello Oktane. I love that name, by the way. Unfortunately, I couldn't attend in-person, but I'm thrilled to represent Google and our partnership with Okta today. As many of you know, security and user experience drive all of our product decisions here at Google, and we see Okta as a class-leading identity provider with the exact same goal. Now like Okta, we believe in ecosystems over monoliths and an independence and neutrality, so we can strive to provide customers with the best available choice. Now throughout the journey, Google and Okta have done a lot together and have delivered a lot of value to our customers. We've added key identity security features directly into Chrome for our enterprise customers globally. We have extended that for popular desktops and Mobile OASIS so that we can embed threat detection and posture management, again, directly into Android and Chrome OS. And now with Google Workspace, a partnership that we launched last year, we are seeing great traction with prospects and customers. Now customers see security and user benefits of having communication collaboration apps, such as Gmail, drive, docs and meet that people know, love effortlessly and safely accessible with the leading identity provider Okta. And I'm really excited to see the latest ongoing effort with Google Cloud and our security offerings such as Google Security Operations so that we can fundamentally bolster security across the board for customers wherever they are. And so as industry leaders, we now have to set the bar and keep the bar high. And like Okta, Google is a huge proponent of identity standards. And to get security right, we all know we need to get identity right. Vendors and app developers cannot let their silos and proprietary approaches get in the way of securing our shared customers. So we all need to do more to ensure security before at and after the logging process so that right people can access the right resources at the right time. And at Google, our DNA has allowed us to lead in these areas over the last few decades. But overall, the industry needs this. And I think more importantly, the audience here, our customers need this and should be demanding this. So we look forward to our further collaboration and alignment with the new OpenID working group, which has already done some amazing work to get. So I'm really excited about the journey ahead. Thank you again for having me at your event. Enjoy the rest of the show, and back you, Todd.

It's great hearing from Sunil, and we love working with Google. When I talk to companies, software companies and technology companies, large and small about this mission of eliminating identity-based attacks. The conversation is never about the why. The why is incredibly clear. It's always about the how, how do we do this. So IPSIE is a collaborative effort across the whole industry to clarify the how and move forward rapidly toward solving these problems. So we've heard from one of the largest companies in the world from their perspective. Now next, we're very lucky to have someone to have a conversation with a customer of Okta, who is also a software company. So it's an interesting perspective into all these ideas we're talking about. So please welcome the Chief Information Officer of Workday, Rani Johnson.

Sorry, I didn't run out here.

No, worries, yes. Well, I got a little out of breath. So thanks for joining us. how does Workday think about application security? And how does this fit into the way you think about Workday and its opportunities and its internal infrastructure in?

Well, at Workday, we are simply obsessed with creating delightful user experiences for both our customers and our employees. And we understand that securing those user experiences are frankly, table stakes. We believe that security should be intuitive, slightly invisible and seamlessly integrated with how users interact with our applications. And this is why we're constantly evaluating security capabilities like identity governance, passwordless and privileged access management. We believe that security and user experience have to go hand-in-hand. And if security is cumbersome or in any way intrusive, people will find ways to circumvent it. Not you good people in IT and security, but everybody else. And this is why we're striving to make security so user-friendly that it becomes second nature. At Workday, we managed the sensitive data for over 10,000 customers and millions of workers. And security has to be at the foundation of trust in our platform. So security is a nonnegotiable.

Yes. Talk about someone that understands internal security and hardened corporate infrastructure. So the internal governance rollout, pretty easy. I like your term slightly invisible.

Slightly. Got to know it's there.

I heard Rani was telling backstage that their rollout of identity governance is going very well. So I'm excited about that. We don't want to comment until it's completely done. I understand.

Feeling good about it, though, Todd.

What do you -- I'm sure in technology world, you've heard about standardization and some standards work and take off. What do you think about this idea of trying to standardize identity security?

Well, as an IT professional, we know standardization is the right answer. But as a long-time customer, we are constantly impressed by Okta's ability to manage identity at scale. And so we're internally focusing our use of Okta to encompass more identity profiles. And so for us, we're trying to get off, frankly, active directory and security group.

Sorry about that. If we would worked harder, it would have happened already.

It's a lot of work that we're on the path. And we're focusing on automating onboarding and offboarding. You talked about that a little bit earlier for us. It's provisioning access just in time. We have also leveraged some insights from Okta to actually do license reclamations and we're also not over licensing our workers. And then most importantly, we're streamlining visibility, making sure that we've got identity analytics. And as you mentioned, I'm super proud of this. We only rolled out OIG recently around our user access reviews. But the folks in Workday security and IT teams will tell you, when we did that just a month ago, we included for the first time, applications that were under [ SOCs ] controls, so not just those with the security objective, but those with a compliance objective. And so this is around like literally like our sales force environments and our Workday environments and rolling out those UARs, we did that with significantly less manual intervention, less headache on our side, but we did, we were successful, and I'm going to just tell the truth on this too. We automated the escalation of frankly, telling your boss by a slack that you hadn't done your UAR, and we did the threat of, frankly, the reclamation, and we actually had significantly more success with much less, much less intervention...

That's amazing, I love it, yes. Yes. I'm laughing, I'm smiling up here because I'm smiling up here, when I listen to your talk because I'm just thinking of selling technology to another technology company, a company that has great products and great user experience. The bar is always very high. So I'm glad to hear that it's going well. What about for customers? What do you think this could cut the customers of Workday? Because you're the CIO of Workday, but obviously, Workday has a very strong presence in the market, delivering HR and financial management and the whole platform of products. What do you think this means for customers?

Well standardization, just frankly, it simplifies administration, but more importantly, it enhances security for our customers. It enables the authoritative source of identity for authentication and helps us to achieve and enforce our security and compliance objectives. We have been advocating for our customers' use of MFA for a really long time now. We are moving to the stage of enforcing MFA across our customer environments. We know that our customers should have stronger protection for employee data. It's our responsibility at Workday to ensure that only authorized individuals access this important and sensitive data and our reputation depends on it.

Yes. It's kind of like I was talking earlier about Expert Assist. If it's our -- I mean, we think about it as our fault, if Okta is not set up, right? I mean technically, customer has to help us, but we don't want to say like, oh, it's your problem. We want to help them.

Exactly.

So looking forward, when we're back here next year, we're already booking you for next year, you're so good up here. What are we going to be talking about? What's next for Identity Security at Workday?

So first of all, I'm a huge introvert and a big old nerd, so this is...

Yes, exactly. You're doing great.

I got coerced.

You're doing great.

I appreciate it.

You can't see anyone out there anyways. The lights are too bright. There's only a few rows deep.

It helps. It helps. So we're focused on enhancing our identity strategy in a few key areas. The first one is passwordless. We obviously want to make a better user experience and make security kind of seamless for our employees. But the more interesting one for us is really contextual access. We're moving beyond basic role-based access control to create more dynamic context aware approach. Considering factors like location, your device MAC address or, frankly, even the time of data to make sure that the access is appropriate when you're trying to gain it. You can't go to a user conference without saying AI, so check. We're also...

This is a record. We're like 35 minutes in, I said AI agent. So, yes.

If you're taking a shot every time you say AI, you'll be drunk by the end of the day. So we're deploying AI-powered identity analytics to proactively identify and mitigate threats and frankly, help stay aware of potential vulnerabilities. We're aiming to create truly frictionless, secure identity experiences that empower the employee and strengthen our overall security posture. And for what's next for Workday? We are continuing to define the future of work. And when it comes to AI, we are not new to this at Workday. We have been true to this for over a decade. Our next generation of AI, we're calling Workday Illuminate is taking us beyond task automation and to true transformation. Imagine that our AI will act as like a personal coach. It's accelerating the employees' performance. Freeing workers to focus on meaningful, to impactful tasks and reducing the kind of the burden of kind of redundant work, really elevating human potential. We're aiming to move business forever forward, and we're excited to partner with Okta on defining and shaping the future of Workday.

Yes. We're thrilled to have you. Thank you so much. The perspective is super valuable. Rani Johnson, everyone.

Thank you, Todd.

The issue of identity security standardization, it's a real problem, a problem impacting all of us today. Now let's learn about a customer that's taking this problem and turning it into opportunity. [Presentation]

That's right. Cigna, Fortune 15, 15 company using Okta to innovate across health care. To show you this in more detail please welcome 2 leaders from Okta's product marketing team, Harish Peri and Jen Vaccaro.

So Todd was sprinting. I figured I would hop and skip, but that didn't work out. How are we doing Oktane? Are we having fun yet? There we go. That's what I'm talking about. So as you saw in that video about our amazing customer Cigna, Open Enrollment is a critical time for them. They have millions and millions of customers accessing their system to conduct very sensitive transactions. And the security risk on that company is incredibly high. So for the next few minutes, we are going to take you on a journey. We're going to show you a demo of how Okta secures every part of Cigna, every app, every interaction, every touch point, everything. I'm going to show this to you from 4 perspectives. The first is that of an IT administrator. The second is that of a customer service rep, an employee. The third is a developer working on the myCigna application and the fourth is a health care customer actually using that app during Open Enrollment. So let's get going. Let's start with the IT admin. Cigna's admins have to manage thousands and thousands of applications, every single one of which has its own governance, its own entitlements, its own access policies. It's very complex. It's a lot of work for these admins. Let's take a look at their ecosystem. What's already great about this is that many of their apps already support the secure identity integrations that you heard Todd talk about, which means, of course, they're secure, but it also gives the admins visibility into what's going on. You have apps like Zscaler that support risk signal sharing and you have apps like Salesforce that support SSO, MFA, entitlements, life cycle management, signal sharing and Universal Logout, pretty powerful stuff. But beyond just making things secure these integrations also let their admins do their own jobs better and faster so they can focus their efforts on supporting Cigna during Open Enrollment. That's what counts. But that's only one part of this. To further protect Cigna, these integrations also give their admins unprecedented visibility into identity risks across their ecosystem. This is Identity Security Posture Management, or ISPM. This is a phenomenal capability that shows their admins identity risks from across their entire enterprise, risks like unused accounts, admin sprawl, bad password hygiene, just to name a few. But it gets better. The admins can click into a specific kind of risk and actually see the users that have that risk. But wait, it gets better. They can actually click into a specific user, and this is my favorite part. This is my favorite part. I'm biased, but is my favorite part. This shows the admins the access graph at a user level, what that user has access to and how they have access to it, very, very powerful stuff. But where it gets really, really good is the admins can actually take a remediation action directly from ISPM. This takes them to Governance Analyzer with Okta AI. What Governance Analyzer does is bring together vast amounts of data from the ecosystem to create a highly targeted recommendation of what to do with a specific entitlement problem. In this case, it's recommending that we revoke that users access. I want to remind everyone what we just saw. We saw a macro level view of identity and security and a micro-targeted, surgical recommendation of how to fix a specific user problem. That is identity security in one place, extremely powerful stuff. That's the admin side of things. Thank you. Yes, yes, yes. That's what I'm talking about. If you know you know, now that's the admin side. Now when we keep this journey moving. Let's see what this looks like for an employee who's onboarding themselves into Cigna to get productive securely on day 1. And for that, I'm going to pass it off to my friend, Jen.

Hi, everyone. It's my first day as a customer service representative, hired to help during Open Enrollment period. And because this is such a busy time for Cigna, it's imperative that I securely get access to all my apps so I can be productive on day 1. With this welcome e-mail, I can begin activating my account without waiting for IT approvals. Instead, I can use a seamless self-onboarding flow, using secure ID proofing. Now if we proceed here, it's already kicking off the ID verification process using [Clear], which is possible because of [Clear's] deep integrations with Okta. And as I proceed, I already have a [Clear] account. So all I have to do is type in some basic information like entering a code here and taking a selfie for face ID. Now let's hope they caught my good side. Now as we proceed, I can log into the Okta dashboard, where I already have access to all my essential applications to be productive day 1. But that's not all. I can request access to additional applications and privileged resources on behalf of myself and others, simply by inputting some basic information here, and we'll be able to get that up and running pretty quickly. Now what we've just seen here is the future of onboarding, and it's here today. From my initial onboarding flow to birthright access, to entitlements and Universal Login that the IT admins configured, Okta can help Cigna ensure that the right user gets the right access at the right time, fast and easy. Back to you, Harish.

Thank you so much, Jen. That was pretty cool. We saw an administrator securing their applications, and we saw an employee getting onboarded quickly. Let's keep this journey moving. Let's see what it's like for an actual developer securing the myCigna app. Now Cigna's developers during Open Enrollment are dealing with one of the most notorious kind of risks, bots. Bots are on the rise and they are on the hunt for sensitive data exactly like you would see in open enrollment. Well, with Auth0, Cigna's developer can embed bot detection directly into the myCigna app without having to write a lot of code, it's highly configurable and it uses a tremendous amount of collective intelligence to help determine what's a bot and what's not. So that's bot detection. But there's one more thing. Our developer here can also ensure that the users of the Cigna app actually have the right authorization to access the right kind of data. And this is where Fine Grained Authorization or FGA comes in. They can very easily model complex relationships like beneficiary independent, which is key to open enrollment and again, ensure that only the right users access the right kind of data. And just like that, our developer was able to secure their app against bots and also make sure that user access data is controlled in the right way. Now let's close out this journey. Let's see what it's like for an actual health care customer accessing the myCigna application during Open Enrollment. Let's see what their experience is like. For that, back to you, Jen.

Now I need to log in to finish my Open Enrollment. And as I do so, Auth0 is checking for bots in real time to make sure that my account doesn't get breached and that I am indeed a human being. And it looks like I have a new message. Let's see what it says. It's the Cigna AI chatbot, and it's asking if I want to update the address of one of my dependents because it noticed an address change in the app that we use to manage prescriptions. This is possible because I have previously authorized this chatbot to take this type of action on my behalf. And under the covers, this chatbot is powered by Auth for GenAI, which helped secure the identity of GenAI applications. And I'm able to view all this information of my dependent because of the Fine Grained Authorization model, we just saw the developer configure. And since it's a bot acting on my behalf, we can use async authentication to verify with a human. Now I'll go ahead and approve this flow, and I'll use my phone for that last verification here. I'll approve that. and use face ID. That was pretty easy. Now back to you, Harish.

Thank you so much, Jen. We covered a lot. So let's recap. We saw how administrators and developers can embed security deeply into every part of Cigna's ecosystem. And we saw how customers and employees can benefit from our security without sacrificing user experience. When you step back and when you bring all of this together, this is what it really means to free everyone to safely use any technology. Thank you. Back to you, Todd.

All right. Thanks, Harish. Thanks, Jen. It's great to see the power of Okta in action at Cigna. Cigna team here? Thank you. Thank you very much for being such a great partner. Now you can hear about all of these incredible products throughout our keynotes today. Our ability to build these innovative products is deeply dependent on our interactions and our feedback from you. And this has been one of Okta's core strength and value since our earliest days. In fact, when we first got into the customer identity business, it was because customers were asking us to use our workforce identity products for customer use cases. So we're always listening and adjusting and trying to make things better. Since 2022, after the acquisition of Auth0, we focused our customer identity innovation there. And many of you, including Workday and Cigna, use customer identity solution. And as you know, we're committed to supporting and maintaining this forever. In fact, it shares 80% of the code with the Workforce Identity Cloud. So you've seen a steady stream of updates just by the fact that it's on the same platform. We've also added critical enhancements based on customer demand as well. So in the past 2 years, I've had many, many conversations with customers about their visions and their requirements for innovation and customer identity. And it's been clear that they were pretty worried about having to migrate to Auth0 or the cost and complexity of that. So after hearing this feedback, I'm very happy to share that we are accelerating investment in the customer identity solution. And that means -- what does that mean? That means more innovation and more new capabilities. It means we're going to be sharing a road map with regular updates so you can plan accordingly. In fact, the first version of this or the first discussion of this will be in the Customer Identity Solution road map session later tomorrow afternoon. So both Customer Identity Solution and Auth0 are critical, critical parts of our future, and each will have their own specific road map with regular updates so you can have a very clear idea of where they're going and you can plan accordingly. We believe that customer identity is very broad and diverse, and we want you to be able to choose the right solution for you, and we're here to support you because everything we do comes down to making you successful from Wyndham to JetBlue to MLS to Siemens, to Zoom, to Mars to over 19,300 customers around the world, they rely on Okta every day to secure access for their workforce and their customers. We don't take that lightly. We're honored to serve you and working hard to do it. So wherever your business is headed, Okta makes that possible. And this shows up in our numbers. We're the largest independent and neutral identity company, which just blows me away every time I say it. Our customer base covers over 40% of the Global 2000 and 60% of the Fortune 500. We have the industry's broadest and deepest set of integrations with the Okta Integration Network with over 7,000. And you can see today, we're enhancing and innovating and driving the industry to make that even better. Every month, we have 1 billion unique users across our 2 clouds. Now let's hear from the leaders of those 2 clouds. First up, to talk more about the Unified Security Solution for the Workforce Identity Cloud is the Chief Product Officer of the Workforce Identity Cloud and also the best dressed man at Okta 7 years in a row, Arnab Bose.

Thank you, Todd. It's so inspirational to hear the success stories of customers like Cigna and Workday, businesses which are making identity the backbone of their security strategy. Every company must adopt a similar strategy because today, identity is the security perimeter. When engineering teams spin up new AI models, they're looking to unlock business outcomes like accelerating clinical trials for a new vaccine or automating customer engagements via support agents. But us, in this room, what we see is machine identity sprawling, over permissioning and chances for lateral movement. And when an employee gets a voice mail from an executive asking for help, they think they're earning browny points.

Hey, it's Todd. I left my phone in the car while going to this customer lunch, and I can't check my e-mail. One of our investors is forwarding you a document, I need ASAP. Can you download it and text some screenshots to this number? I'll owe you big time.

Now I've worked for Todd for over 5 years, and I know he doesn't need slides to get a customer meeting right, but that deepfake was pretty realistic, right. What we are seeing is bad actors getting savvier and savvier and securing our workforce getting harder and harder every day. We see more attacks than we did just a year ago, 180% more, in fact. And it's taking organizations over 290 days to recognize and contain a breach. That is why we need every layer of the tech stack to support an open standard like IPSIE. Imagine a world where your whole tech ecosystem conforms to the IPSIE standard. It will provide the strongest level of identity security before, during and after authentication. Before authentication, you can discover and remediate risky identity misconfigurations. During authentication, you can achieve outcomes like end-to-end phishing resistance, device found sessions and getting to 0 standing privileges for both humans and nonhuman accounts. And after authentication, you'll be able to continuously listen for risk signals across your entire enterprise and terminate sessions with Universal Logout. The future of identity security is powered by the IPSIE standard. And the good news is we are well on our way to achieving this vision today. Let's take a closer look at how we secure each of these 3 phases and how we are innovating to give you even more control. Before authentication, customers need to discover identity misconfigurations like partially offboarded users or inconsistent MFA. You saw this in the demo we showcased before. ISPM showing you that user access graph, where even though you might have that application behind SSO, that same user has direct access to the application through other means. ISPM integrates to major cloud vendors, IdPs and more to uncover risks fast. In this phase, you also need to discover and remediate excessive standing privileges and take actions to rightsize these entitlements. However, managers and approvers don't have all of the risk context. They're being asked to approve these access requests without all of the data to make the right decision at the right time. This is a problem you'll be able to address with Governance Analyzer with Okta AI. Customers will be able to leverage the full power of Okta's platform from device posture assessments to relationship data and past governance decisions as well to get real-time recommendations to get authorization right. And as apps adopt the IPSIE standard, Governance Analyzer will get even better because it'll get plugged in to every single application in your tech stack. Now our end-to-end use cases don't just stop with applications. You might think that setting up a single sign-on for an application is what you need to secure access to it. But every SaaS application or cloud-based product also has break glass accounts or admin accounts to set up the config in the first place. If we don't pay attention, these accounts can easily go unprotected and be a way to bypass your security checks. Meet Secure SaaS Service Accounts. Now you can discover, vault, automatically rotate and manage these service accounts with Okta. And as -- yes, there you go. It fired up. And again, as the IPSIE protocol becomes more widely adopted, discovering SaaS Service Accounts will be easier than ever. And again, your whole tech stack, every application in your tech stack will start supporting this awesome capability. Now let's take a look at how we're enhancing security at the point of authentication. Okta has long led the way by supporting phishing-resistant authentication with Okta FastPass across Mac, Windows, iOS and Android devices. And in early 2025, we'll start supporting Linux machines as well. But think about how you unlock your actual Windows or Mac computer. In most enterprises, this remains the final frontier where using a password is sufficient. Last year, we announced Okta Device Access to help customers secure their machines and ensure that security starts at power up. And over the summer, we took things even further by adding passwordless phishing-resistant authentication to Windows and Mac devices using FIDO2. And today, I'm excited to announce that we're taking this journey even further with a new capability called Extended Device single sign-on. Extended device -- so much excitement, haven't even told you guys what it does, but let's get into it. So what extended device single sign-on does is it improves outcomes in 2 major ways. First, from a security perspective, it ties the Okta session directly to the device using a hardware-protected key that's secured on a hardware chip on the device itself. This means that the Okta session is bound to that specific authorized device and cannot be replayed anywhere else. And from an end user's perspective, you'll simply sign into your machine. And from that point in time onwards, you're already signed into Okta. All your downstream applications will be automatically logged in. And at every login, we are constantly reassessing all your security risk signals. So in case something does change, we can step you up at that particular point in time. So not only is it faster and better for your end users, it is more secure end to end. Now speaking about active sessions, let's take a look at security post authentication. This is where Identity Threat Protection with Okta AI comes in. We announced it at Oktane last year. We made it generally available over the summer. And throughout the course of this year, we've been adding even more integrations. Leveraging real-time signals from Okta and the rest of your security stack, ITP continuously evaluates the risk of an end-user session and takes actions to contain threats. Leading security providers like CrowdStrike, Jamf, Palo Alto Networks and Zscaler already integrate with Okta using an open standard called Shared Signals Framework and trigger powerful in-line responses such as Universal Logout if a high-risk situation is detected. And now we've continued to expand our network of partners that shared risk signals. We've added Rubrik, we've added Workspace ONE and SURF Security, among others. We are also working with a number of applications that are highly adopted in the enterprise and have extended Universal Logout to PagerDuty, Zendesk and Dropbox. And any application built with Okta's Customer Identity Cloud will automatically support Universal Logout as well going forward. These are some examples of the deep integrations we've already built with the most prominent enterprise technologies. Todd talked about secure identity integrations. What we've done is it's not just for Universal Logout or shared signals across the entire identity security process before, during and after, we've been going ahead and hand cranking these integrations, working with tech partners to help make your businesses safe. In fact, over 125 deep integrations are available for our Workforce customers today. Applications like Google Workspace, Salesforce, Slack, Box, Microsoft 365, I could go on and on. But we've been like laser-focused trying to ensure that we can raise your security bar and support your entire stack. So let's bring this back to 3 key security outcomes from a Workforce customer perspective. First, we want you to take back control of your identity security posture. Second, implement the principle of Least Privilege with products like Governance and Privileged Access Management. And finally, continuously monitor and remediate identity threats in real time. All of this is made possible not just with the products, but with the deep integrations we've built throughout the tech ecosystem. And these integrations are only going to become easier to use and more widely adopted as the IPSIE standard takes off. This is just a preview of all the exciting innovation that we are introducing to make our customers even more secure. You are not going to want to miss the Workforce Identity Cloud Keynote at 2:00 p.m. this afternoon, where we'll go deeper into our Unified Identity Solution, share even more innovation, and you'll get to see it all in action. And now please welcome the President of Customer Identity Cloud, Shiv Ramji.

Hello, Oktane. Good morning. How is everybody doing? Good. Thank you, Arnab. Here at Okta, we are building for every identity use case and for every part of the business, from IT and security teams, to marketing and digital teams and of course, the product and engineering teams. That's because customer identity isn't just about user names and passwords. It's where security meets revenue, where your brand meets your bottom line and where trust fuels growth. Now think about that. Developers are not just building applications. With each line of code, they are shaping security, revenue and business growth. It's a tall order. It's a tall order considering customer identity impacts everyone in this room and most people on this planet. When done right, it powers convenient, secure experiences for billions. That's why embedding IPSIE into every application is so critical to help every single application builder, build faster, without compromises, with continuous authentication, automated provisioning and integrations all right out of the box. Now we know developers are under more pressure than ever to deliver more and deliver faster. And many of you in this room are building applications that power our businesses and our personal lives. And you face real challenges as application builders, integration complexities, scalability issues, and adoption hurdles. When you build an application with Customer Identity Cloud, you will get IPSIE out of the box. It starts with giving SaaS application builders, the tools to streamline onboarding and provisioning a key part of IPSIE. Today, each application uses different APIs for user management. And developers are forced to spend hours building custom solutions, increasing the risk of human error, orphaned accounts and unauthorized access. With IPSIE, every application will be built with the ability to automate the provisioning and deprovisioning of users. This will be powered by SCIM, also a key part of IPSIE. Now not only does SCIM boost application security, but it also frees up developers so they can get right back to building, and we aren't stopping there. Next year, we will launch self-service SCIM. [Audio Gap] Now over the next decade, we believe we will see the rise of a huge AI agent ecosystem. Large networks of interconnected AI programs that integrate into different applications, and act autonomously on our behalf. To realize a world where AI helps us daily, managing tasks and making decisions on our behalf we must empower builders to securely integrate Generative AI into their applications. This is where Okta can help. Auth for GenAI makes it easier for you to build generative AI applications securely. Thank you. It is a series of features to help ensure that AI agents have least privileged access to sensitive data, secure API access for AI agents and implement human in the loop processes for AI agents to take action on behalf of users. In the customer identity cloud and keynote later today, I'll be walking through a demo of Auth for GenAI to show you how all of these features work together. I hope to see you all there. You will also see more exciting product announcements and demos and hear from our customers Siemens and Major League Soccer. Make sure you are there. Thank you so much. Back to you, Todd.

All right. Thanks, Shiv and Arnab. To free everyone to safely use any technology, we have to solve the problem of identity-based attacks. It's the only way we can help the entire industry by working together. Tech companies, identity providers, all of us focus on this common goal that's going to have a huge impact on the world. As we wrap up, here are all the innovations we announced today, you can see it all in one place. Thank you so much to the R&D teams that have been working on all the stuff. I'm fired up about where we're going. It's going to be a lot of hard work. But at Okta, we love a challenge. We don't shy away, we lean in and we're going to get back to work. We have a great foundation to build on. It's a foundation we've built together, so give yourselves a round of applause. Thank you very, very much for being here today and being on this journey with us. Please enjoy Oktane.

Good morning. Welcome to Oktane in the Investor Summit at Oktane. I'm Dave Gennarelli. I think you guys know me from Investor Relations. You guys know, allow me some safe harbor. So we will probably be making some forward-looking statements today. Please refer to our SEC filings for further information. . So with us today we've got Todd McKinnon, our Co-Founder and CEO; Jon Addison, our CRO; Brett Tighe, our CFO; and Eugenio Pace, our President of Business Operations. This format would -- this is going to be an open Q&A format. So this next hour is for you. Reminder, there is an online audience, but the questions will be coming just from this room. So with that, I want to turn it over to Todd, who's going to make a couple of opening statements, and we'll go from there.

Yes. Thanks for joining us. It's an important session, and I look forward to the conversation. When I was reflecting on the keynote we just delivered really during rehearsals and thinking about the themes and the focus and the genesis of a lot of the products. It really is, I think, I'm really happy with how it went, first of all. And I think it's a good balance of a new twist and new emphasis in certain areas along a consistent theme we've had for many years. And that consistent theme we've had for many years is more integrations, deeper integrations, more capabilities across the entire technological ecosystem that identity connects to delivering more value out of the gate for customers, whether it was 10 years ago when we first had the Okta Integration Network and then we added different types of integrations, and we're working really hard to integrate Okta actually into the devices with things like FastPass over the years and on and on and on. And really, the big change here this year is, we've evolved from, I would say, the first 10 years of Okta was working with standards and around standards. And now we're really trying to lead the industry and define the next standard, and that's why this IPSIE standard is so important. But we're not going to turn into a company that waits around for standards. We're building the next generation of integrations and while at the same time, trying to put all the pieces in place to have the standards to be adopted with -- by supporting them in customer identity cloud and by doing the secure identity integrations we announced. And then around those integrations, obviously, is this what's become a very powerful set of capabilities with all the different products around governance, privileged access, Okta Privileged Access and the whole workforce suite. So it's -- I think it's -- you want a combination of new frontiers and new twists, but you want a consistent long-term strategy and that it's been very consistent and long term for us. And that is we're going to free everyone to safely use any technology, we have to do it by integrating better than everyone, particularly better than any one vendor that's trying to build the one-stop shop for everything security, the one-stop shop for everything. We're trying to focus on identity and have the best leading product in every category of identity and then really lead everyone to connect to the ecosystem, and that's going to solve this problem of identity-based attacks because when we go out to talk to customers and prospects, the security is the burning platform. And when we can be involved in that conversation, everyone has more value faster and more success factor. So that's faster. So that's an important part of the messaging as well. So yes, I think with that, we'll just open it up for questions and get the conversation started.

Joe Gallo, Jefferies. We've been hearing about tens of thousands of IGA customers come up for grabs as legacy vendors show end of life. Are you seeing the same opportunity in the next couple of years? Maybe talk about IGA product positioning and then how we should think about the capabilities of potential in fiscal '26?

So we're pleased with the progress on...

You have 10,000 customers in your commit. That's what I heard. It's out there. It's possible.

We're at 1,000 customers already on OIG. And I think that if you look at our 19,000 installed base, it feels as we're out there in the field talking to customers about their use of Okta. For many of them, it's a very natural progression to go from what's often the starting point with our customers around access management and then they'll start to look at some of the extended features around things like life cycle management and workflows. And for a lot of those customers is a very natural evolutionary step to talk to us about OIG. And so that's, I think, taken us quite quickly to 1,000 customers. I think that when you look at our installed base, customers right now are thinking about budget constraint, OpEx is the challenge, but they're very much leaning in with us and trying to understand about the full breadth of our portfolio. And so there's kind of a maturity that's playing out in terms of their leverage of our portfolio, that means governance and PAM are very natural progressions for them. And even when we're landing new logos now, we've got great examples of new logo wins who are coming to us, and they're actually going all in. We signed a very significant deal with the transportation company recently. And they came in and they bought the access management solutions, governance and PAM all first up. So I think I'm really pleased with how this looks in our installed base, but it's also very encouraging that when customers are coming to us to modernize their identity platforms, they are seeing the full portfolio as something they're willing to commit to straight off the bat. So I think it's encouraging in both those aspects.

I think the other part would be encouraging. Just yesterday, I was talking at the Expo with one of the GSIs and one of the first topics we talked about was how they can get more involved in governance because I think from a GSI perspective, they can add a lot of value, we can try to help them. And we -- obviously, we need to sell a lot more customers than what we've done. We've done 1,000, like Jon was saying, and we got a lot of left out there, but it's exciting to see the potential inside the customer base and also outside the customer base.

[indiscernible] from Truist Securities. Todd, you mentioned your $1 million-plus customers are your fastest-growing cohort. You've got around 40% penetration in G2K? What do you think investors are not appreciating about the significant expansion opportunity in the set? And do you still think there's a lot of runway for growth left in these larger enterprises as you go forward?

Yes, the 40% in the G2K is a little bit of a -- as currently used in those accounts, it's a little bit of a vanity metric, meaning that it's not like we have 40% of the Global 2000 that are wall-to-wall in Okta. So there's a tremendous amount of upside there. Many of those deals are -- there's a presence, but it's part of -- it's a subsidiary or it's a smaller deployment because once you get into a Global 2000 Customer, a mid-market customer or even a mid-enterprise customer, they're not going to do part of their employees on one thing and the rest on something else. But Global 2000 is much different. The projects to get fully implemented take a long time, multiple years, if not longer. And in our presence in the Global 2000 has a tremendous amount of upside. In my conversations with investors, I think we need to have a better way to quantify it, quantify the potential there. We use the $1 million deal cohort and we use the over $100,000, which doesn't really tell you much about the Global 2000 because it doesn't -- you don't have to be a very big company now to spend $100,000 on Okta a year. So we got to, I think, maybe do a better job quantifying that with external metrics.

Patrick Colville from Scotiabank. I want to ask about the 2 recent products in GA, posture management and threat detection. If I'm not mistaken, they're both 2Q GA. I mean, of those 2, how should we think about the directory for adoption? And then also, I guess, Brett, what's like the spend uplift as you go from an SSO MFA directory customer to add threat detection or posture management. Is it like a small uplift or pretty sizable for those 2 products?

Maybe we can maybe start with Jon and then I can chime in from the product.

I think with both of these products, it's very early days. I think with threat detection, there's clearly like some great synergy with existing Okta customers. And we've already had some immediate wins where we're looking at cross-sell and upsell, and customers are coming to us and looking at device access, threat protection and OIG. So again, it's just like rounding out the full breadth of the portfolio for our existing customer base. So I think that's a very clear upsell opportunity. With secure posture management, I think that also has relevance in our customer base. We had a great financial services win, quite a security aware financial services company moving fast into the cloud, their existing solutions to a lot of hand cranking and secure posture management. Like they got to value in days and not months, but we also see secure posture management as a bit of a beachhead opportunity for us to get into accounts, and it doesn't necessarily have to be an Okta installed-base customer for workforce for us to go in and show great time to value, specifically in that secure posture management environment. So very pleased about how the teams are getting enabled. There's a lot of excitement around both of these products. And looking forward to the future with them.

Yes. Identity Security Posture Management, it's a qualitatively different product for us because we've never had a product that just scans the environment and assesses risk and tells you what you need to remediate. Our products have always been proactive in the sense of, or maybe the right word, but they've actually been authenticating people and creating accounts and actually operationally executing things in the workflow and in the access management process. Posture management is different because it's more like a traditional security product and that it scans the environment, detecting potential threats, detecting potential issues, and then initiating workflows for those issues that can be remediated by Okta Privileged Access or Okta Identity Governance. So as Jon was mentioning, it really gives us a very compelling entry point for the security person in the account, the CISO or someone in the security group, which traditionally has been an influencer in the identity decision, but not necessarily the primary buyer of it or the driver of it. So it's a very important part of our strategy, and the early success there is really, really encouraging.

Yes, in terms of the uplift, we don't have enough data for you yet. Once we do, we'll give you some more information on that.

It's John Difucci from Guggenheim. Brett, I want to talk for 20 minutes on CRPO, I'm only kidding.

The CRPO keynote is later this afternoon.

Actually, I wanted to come back to what you started with Todd and bring in actually Joe's first question. So everything you were talking about, to me, sounds like a word that's often overused and I'm glad you didn't say it, but a platform. And it really seems like today, there is room for something, an identity platform where you bring together all the functionality of identity which you couldn't do 20 years ago or actually, was it 20 years ago, yes, it was actually that long ago. And I worked with one of your shareholders back here. He was my senior analyst, but when we were looking at things like this. So -- but when I think about what Joe asked, there is this opportunity for IGA to rip and replace, but that's because lot of the legacy solutions just failed. And they didn't fully meet their potential, but it's only been a large enterprise solution. And PAM has to, for the most part. So Jon, when you say you have 1,000 users on your governance product, is that -- are those like rip and replace because it just seems like your sweet spot, yes, you sell into a large enterprise and you want to sell more into it. But you also sell to the mid-market and you sell to the small enterprise and even the small business. And the IGA and PAM seems to me to be solutions that could be used in those areas, but the products just couldn't be up until now. And what your strength is, you brought identity to the masses from the start, the core IAM. And could you be doing that today? And the answer to the long-winded question is, out of those 1,000, are they rip and replace? Or are those greenfield opportunities?

Well, I think we're seeing opportunity in all segments. I think we are seeing with our approach to governance a lot of customers are just coming into governance for the first time in our product. And so obviously, companies that have grown up with us as their identity standard and their platform of choice. For them, it's a very natural progression to get into governance for the first time with us. In bigger customers, obviously, most of them have a legacy with on-premise solutions. And so for them, it's a question of, okay, how do we start? Is this just the cloud applications? Do we have a coexistence strategy for sometime and how do we kind of start to think about a longer-term strategy as we move more broadly to the cloud where we start to think about deprecating some of the legacy solutions that they've invested in and that they spend a lot of money on. And so I think the challenges around some of the budgets that we were talking about and was mentioning earlier, that's kind of driving some of that, which is in and around how do we reduce the cost of ownership for governance in our company, how do we use that to drive further cloud adoption. And I think for us, that's a really good opportunity going export with them.

Almost 0 of them are replacing Oracle or CA governance, almost 0. The next, I would say, maybe 20% are replacing something more modern like a SailPoint. But that's a relatively small number. And I would say, the majority of the remaining, they're putting it around something else. So they're keeping SailPoint and adding Okta to the apps that are easier to cover with Okta and then the rest is greenfield. . So the surprises there, if you would have asked me 2 or 3 years ago, I would have not thought that as many people would put Okta around SailPoint. Rather they would like to pick one and either Okta or SailPoint, but the coexistence seems to be more prevalent than I thought, which is kind of not surprising given that once these things get in, they're hard to change. So that's how we're seeing it.

Gray Powell with BTIG. So I'll have to admit, I'm a little intimidated. John's question is really hard to follow. But I'm going to do my best here, if that's okay. Okay. So Okta has had a lot of success in the past, helping customers connect to workers and applications and just winning on ease of use for lack of a better phrase. But today, some of the areas you're getting into like privileged account management, posture management, those are more security-centric buyers. So I guess like how does that change the conversation? How do you get customers over that hurdle? And just how is the conversation on security different today than it was like a year ago?

Yes, might be a good one for you to start with.

Well, I think what we're seeing with the breadth of the capability and the offerings that we've got is that we have to service quite a broad range of buying personas. And that's the reality of how we have to go to market right now. So whether that's the CISO org security operations, the CIO and obviously, with our SAM offerings, it's much more around VPs of engineering and digital. And so we've got to scale to the needs of a very broad number of constituents. And so as we've started to like really enable and educate the field organization with this broad range of capability, like it's going to take a bit of time for a lot of that to land. And so we're thinking as we go to market about what that means. We're considering aspects of focus in the future and specialization that might help address some of those challenges. And so I think that we have a very, very broad opportunity. But each of the buying personas and the business drivers around that capability set is quite diverse. And so we have to think about how we evolve to meet the needs all the time.

Madeline Brooks from Bank of America. Brett and Eugenio, this is going to be more for you guys and not to bring CRPO up again. But I think a lot of us are starting to think about more single-digit growth for next year, and I'm not going to ask for any type of guide. But if we think about that, how should we think about margin structure? And where could you get a little bit more expansion on the margin?

Yes. I mean, from a margin perspective, we've been working on it for a few years now. It's a lot of what we've done. It will be just that continued, right? So if you remember, a couple of years ago, I talked about real estate rationalization, talked about software rationalization, just being more cost conscious. And then the big one was around low-cost regions, right? We had very few people in low-cost regions. We've done a heck of a job across the entire company over the last 12 to 18 months on expanding that percentage, and we believe there's more opportunity as we go forward. And so that's really where we think margin can come into play is really from the low-cost region folks. And you can see that even in this year's margin guidance, that we're reinvesting that back into the business. So we talked a lot about security today at the keynote. You've heard a lot about the Okta Secure Identity commitment. You've heard about us really doubling down and becoming one of the most secured companies in the world. And so we've been taking some of that savings and investing it back into these key priorities even in FY '25, we're going to continue to do that in FY '26 because we believe this is a massive opportunity in front of us. And so we're going to continue to balance the growth and the margin profile just like we have done in the past.

Yes. Just -- I'm sorry to add on that. The existence of a centralized operations team has brought inefficiencies by itself because we don't have to traverse a complicated org charge anymore. It's all in one place. We have faster decision-making, we can ship things faster, et cetera. To the low-cost expansion, BT, which is part of my team, the technology team in our company has a big investment, so growth investments in India, as an example. And we're going to be doubling -- almost doubling the team there. It gives us access to amazing talent, which is primarily the first driver, it's like assembling teams that can execute more quickly and obviously with a different cost profile as well.

Maybe just to clarify what you said, Brett, I think this is one. How far into the security hardening do you think you are from an Okta perspective?

I'm going to let Todd answer that question. He is the expert. I mean, I could give it a shot, but go ahead, Todd.

I think the last -- it's been really a process of the last 3 or 4 years with a very concerted doubling down in the last year. And I think next year and beyond, you'll see more of a normalized long-term level of investment and focus there that will keep us at the level we are now.

Yes, on the infrastructure. Infrastructure is one of the pillars of OSIC. OSIC, I think has been really, really well received by our customers and the broader community. Internal infrastructure, which I'm responsible for, as I said before, has been a big focus. And I'm a big fan of ISPM as a user. We drink our own champagne at Okta and even though we run a pretty tight ship, it's amazing how good that product is. We made a lot of progress.

Brad Zelnick, Deutsche Bank. Thanks so much for hosting us today, and congrats on another great Oktane, which I know Difucci probably wanted to say too, he just forgot. But I wanted to talk about the international opportunity, it remains significant, roughly 20% of your mix today and obviously headroom to be much, much greater. And Jon, I believe, if I'm not mistaken, you just replaced your prior role with a really strong leader in EMEA that comes out of the GSI world, which makes me wonder, a, the strategy, how much does it depend on partners to really be effective for us to see international get to 30%? And I don't mean to leave out APAC, but EMEA is obviously the bulk of what international is today for Okta. And then even as we think about the strategy and how it's different and how you leverage partners, how should we also think about the economics of going into international markets and the cost of acquisition for these customers?

Well, I'll start maybe with a little bit about the expansion and maybe you can pick up on the economic piece. But so we've been investing in international through our own direct investments and obviously through establishing a partner strategy in the regions that we're focused in. And very pleased with the progress in both of those areas. I think we've got very strong and stable leadership now in our markets outside of the U.S. I think that where you see the progress, then it's clear that the progress is in the markets that are cloud forward and they're -- like no prizes for guessing which ones those are. And I think even now when we're starting to see kind of some of the real marquee customers that you expect to come through in those markets and the impact that just has on like local references and really starting to build strong penetration in multiple segments and in some of those marketplaces, we're leveraging hubs to allow us to do that, so we're building in Dublin, we have been building for some time now a hub that's really focused on the SMB bid market and the emerging markets outside of the core markets in Europe. You can start to see a kind of multilayered strategy of investments in markets for field, investments in markets for hubs and a partner strategy that leverages the work that we're doing in HQ in North America with some of the big international systems integrators. And that's really playing out well, not only in the core international markets but also in emerging markets, and we're starting to win like really great Tier 1 logos in places like the Middle East and Africa, as an example. And a lot of that is influenced by the impact of some of these GSI relationships out there in the peripheral international markets where we don't have a presence. So I think partners are going to be a very, very fundamental part of international expansion. In some markets, we're highly committed to our partner-first strategy. So fully loaded transactions through partners in Tier 2 markets, activating those markets indirect only, very clear priority for us as we look to grow our international ecosystem. So I think that the economics of that is a combination of those things, where we're investing directly. There are some markets where we haven't got current legal entities and direct investments, and we're looking to expand those through partner penetration.

Yes, I would just add to the unit economics of the countries, it definitely differs based upon which way we're going. Obviously, if you go direct, it takes time to get the 747 off the ground, if you will, right? You got to use some fuel to get it off the ground and the unit economics aren't as good. But in the long run, as each one of these countries mature, we find better unit economics over time. It's just a matter -- not everybody knows Okta in every country like they do in the U.S. We have to recognize that. And some of the things that Madeline was asking around margin doing low-cost regions helps us fund things like this to be able to make sure that we're investing in the right places at the right time.

I'll add just over the top of that more focus on partners and partner enablement and partnering in broader parts of our business from demand generation to closing the sale to servicing the customer to supporting the customer is a big focus for us. If we're going to get to our long-term goals, we're going to need across the whole company to improve and deepen and mature our partnering approach. We've made good progress, but we can do a lot more, and it's really a big important focus for us going forward.

Back here in the middle. This is Darren Baker from PRIMECAP. I wanted to follow up on Madeline's a little bit, and I'm going to be a little blunt here. So I hope you'll forgive me for that in advance. Look, I think for most of the investors in the room, the biggest concern that we have is really about the growth trajectory, right? And when we think about the possibility that Okta could be growing single digits, I mean, that's usually kind of a domain that we think of as afflicting much larger companies with legacy technology or just in much more mature markets. And as we listen to your presentation here, you see the energy and the number of attendance, people in the hallways and things like that, that doesn't feel like the environment that we're in here, right? At least, I'll speak for myself. It feels like there's a tremendous amount of initiative taking place at Okta. There's just a rapid pace of innovation, really trying to address what customers are looking for, pushing forward new standards, all kinds of things like that. So I will -- again, speaking for myself, like I'm just trying to square like where -- how do we line up kind of that growth trajectory with what feels like a much greater level of kind of confidence and momentum qualitatively that's coming out of an environment like this. So I'd love to just hear your kind of latest thinking on how those conversations with customers are going, what's holding them back if they are kind of slow walking the process of expanding the relationship with you? I know that new customer adds have been a little bit weaker in the recent past and so what might be slowing down customers who clearly have identity infrastructure from potentially making a move over to the Okta platform, anything like that, just to help us think about kind of the medium-term trajectory of growth here and what catalysts there could be that could kind of get things going again?

Yes, we appreciate the question. Don't be afraid to be blunt anyone. We love that. We are -- growth is very important to us, and we don't like the deceleration either. We are very focused on reversing that trend and trying to grow faster, while at the same time, making sure we continue to focus on profitability. We're at a scale now where we should be able to grow and be profitable. When I look at the -- I think right now, it's a timing thing, in a sense of when the growth initiatives are going to kick in. And I think, obviously, in the numbers, we're not seeing them kick in yet. But as you mentioned, we're very optimistic. And I would go in order of kind of things I'm most optimistic about for driving growth. Our -- number one is large enterprise. We talked a little bit about it with a Global 2000. Okta is really -- our success was built on, call it, mid enterprise. And the reason that the $1 million-plus cohort is the fastest growing is because there's still a ton of potential in the large enterprise. A lot of these companies have been reticent to adopt a cloud-based identity approach for a couple of reasons. One is just their own internal infrastructure has been -- they've done cloud, but in terms of the center of gravity, big enterprise has to have a lot of cloud for it to be like the default where they choose to put their security tools and something as sensitive as identity. So that's really starting to happen more and more now, and we're very optimistic about that in the future. It helps that we have this broader platform. So my -- the second thing I'm most excited about after large enterprise is the ability to sell these new products. Governance, we've talked about that, privileged access, the idea of the whole suite being something that we can sell. Identity security posture management, of course, don't forget about customer identity. That's a big growth driver. So we're really excited about that one as well. And then I think the third one also we just talked about. Internationally, I think we've made a ton of investments in these Tier 1 countries, we're partnering in others those investments. We're optimistic about those showing up. But talk is cheap, right? We have to continue to work hard and actually show the results. We're not satisfied until we can do both, grow and be profitable.

Adam Tindle with Raymond James. Todd, I'll ask a blunt strategic question. In your keynote, you talk a lot about wanting to basically stop identity attacks completely through sort of prevention. Another thought might be to accept that there's -- identity is going to be an attack factor. It's not possible to stop 100% and shift all of that investment to detection and response. We asked that because CrowdStrike, for example, has built a couple of hundred-million-dollar business in ITDR from 0 just over the past couple of years. So strategically, why such a focus on the prevention piece versus detection and response? And if you can wrap in your view on how you see ITDR evolving over time, particularly relative to players like a CrowdStrike who's built such a big business and how that might change going forward?

Yes, it's a really, really insightful question. I think the stop in the attacks is probably -- as you call out, it's maybe a little bit oversimplifying it. The deep dive is what you're saying. I mean -- and you know in Arnab section of the keynote, he talked about before authentication after -- during authentication and after authentication, then security posture management to assess the vulnerabilities that log in with things like phishing resistant, FastPass. And then after authentication actually continuously evaluating the threat landscape and having different layers of the security stack, the CrowdStrikes, the Palo Altos, the Zscalers, the Microsofts be able to share signals with us and the attack -- malware attack can happen, but you want to prevent it from moving around. So I think that is the right way to think about it. It's not -- I think it's really simplistic to think that you can literally stop all these attacks before they ever happen. It's a combination of all 3. Specifically, the CrowdStrike, I think that their business around identity security is interesting. And when we launched our identity threat detection product and later on the identity security posture management, we had really frank conversations with the team talking about should we really get into this, like CrowdStrike is a security company, they're awesome at that. They're going to take on identity. What do we -- how do we have differentiated value to add? And the answer is, what we're really good at is building integrations to thousands and thousands of different applications. And to have ITDR for the entire ecosystem, you have to have the integrations everything. You can't just say, it can't be super simplistic and happened just before log-in and has to be deeply embedded into the whole session of those accounts. And that has to be done through standardization like IPSIE. It also has to be done with our integration factory that we're really good at. So CrowdStrike's business is, they're evolving it now, of course, because they see some of the similar problems we see, but it's built on on-premise legacy active directory, which is, you can build that integration once, which the company that they bought built, this company called Preempt. And you kind of get it everywhere. But the world is changing. And there's a reason why Microsoft is not betting on on-premise architecture for the future because the future is SaaS and AI agents and cloud, and that's where we're going. And the one -- the key argument why strategically, we got into that business and how we can differentiate, it's coming back to this core differentiation of building these integrations at scale, which is a combination of hard work, a platform that can do it, standardization, culture in the company that's really good at this. How many companies have a culture that wakes up every day and says, "We're going to try to integrate to 7,000 things." Not many. So that's our differentiation there.

Eric Heath from KeyBanc Capital Markets. Maybe just to come back to the growth equation and focus on SIEM a little bit. Maybe if you could just help illuminate us a little bit more on just why it's been a little bit more of a pronounced slowdown and obviously getting back to the future here, but what you really feel like you can do to reinvigorate growth there? And feel free to tell me I'm wrong, but it feels like it's just been such a big point of friction to convince customers to say, hey, homegrown is not the right way. You need to switch off homegrown solutions to a commercial solution. So it seems like it's been a big point of friction to catalyze that change. So maybe you can just talk about if I'm perceiving that correctly and what you can do to catalyze that change?

Maybe from the go-to-market perspective, you can start and then all.

Well, I think you rightly identified that the conversation that we're in is the build versus buy conversation. And so it takes -- I think this is still a very early maturing market, right? This is a very big market, but I think it's still very early days. And so we spend a lot of time technically evangelizing, right, with companies of all sizes about the benefit of buying a platform of this nature for consumer apps, digital platforms. And we've acquired all 0, and we've spent a long time activating and enabling like the level of awareness that's required to govern and have that technical evangelism story really nailed down with customers across our sales organization and our presales organization. And if you look at the work we've done this year, like we really -- like for most of half one, we basically spent all enablement cycles on CIC enablement. And I think that when you look at what are the measures of the progress that we're making in terms of taking CIC to market at scale internationally and in the U.S., one of the things we track is AE participation rates. So we've made progress every quarter with that. And so we've vetted the capability to go and have those conversations into the field now and I think that we've reached a point of maturity with that. But I just think in this environment, a lot of customers and prospects are taking time to really weigh out their options, and they've built development teams, and they've been powered those development teams to build software. And a lot of the time, what we're trying to do is to get the platform into the hands of those developers either through our freemium motion and we've made some changes there, but it's really designed to fill the top of our funnel with a lot of pipeline that over time is going to build. And once we get the product into the hand developers, then we know they get to that [indiscernible] and they upgrade to the paid offering. So I think we've done a hell of a lot of foundational work this year to get that right, and I'm very excited as this market really matures that we start to see the fruits of that over the coming quarters.

The other thing that's -- just real quick, Brett, the other thing that's driving the numbers of that business is that a lot of customers overly optimistically bought seats or monthly active users. Just like on the workforce side, we've seen with companies downsizing their workforces that puts a little bit of pressure on the natural motion that used to happen when contracts came up for renewal, they just expanded seats and added employees. Customer identity side has the same phenomenon, meaning that 2 or 3 years ago, if you needed 1,000 monthly active users, you probably were going to buy 1,500 just because everything is great, everything is optimistic. Now if they need 1,000, they're probably going to look about how they could get away with 750. So that dynamic in that "rightsizing" for a more -- the new normal, not the 0 interest rate environment that we were in a couple of years ago, that's driving the growth rate that you see a little bit, but it doesn't change the fact that this is a big opportunity and that we have the leading products in this market by far.

Yes. I was actually going to say that, but I also add something as well, which is, in Q2, we saw the number of customer identity deals grow quite swiftly. But the problem what Todd was just talking about, is the number of monthly active users on average has gone down by a fairly significant amount as people are being more thoughtful with their contractual agreements. So you see that directly in the ACV results that we provide on a every other quarter basis. So we're adding them and just the unfortunate part is you're seeing that MAU headwind related to the macro because number of products is about the same. price is about the same. So your ASP is going down because you've got less units basically being purchased because people are just being more thoughtful at this point with their agreements.

Gabriela Borges, Goldman Sachs. Todd, I've heard you a handful of times now consistently respond to the question on how do you reaccelerate growth by saying large enterprise. It's the first thing you normally talk about. So maybe just to expand on your earlier comments, within the large enterprise, what's incrementally changing around the willingness to invest in cloud infrastructure? And why is Okta better qualified for that opportunity today versus maybe 2, 3 years ago? And perhaps Jon, you could comment as well.

Sure. I think one of the things that we're really striving to do is to surround our customers and prospects in enterprise and strategic in the G2K with partners who can consult with them about transformation to deliver incredible value through identity management in the cloud. And that's a long-term play because working with GSIs -- companies to build their levels of awareness and to really deeply understand how they can grow meaningful services practices around Okta, that's going to take time. But we really feel strongly that we're making great progress there. And so if you look at some of the feedback that we had from the GSIs, who came to Partner Summit this week, I mean, some of them have materially grown over the last year or 18 months, their business practices around Okta, whether that's in dollars or in terms of the number of partitioners that are now activated and able to do work. And so when we think about winning in the enterprise, a really big part of that is making sure that we are influencing the enterprise. And we've only got a certain amount of capability to do that at scale and that's a very big part of our strategy. So we're focused with our own resources, very strategic partners and that we have a long-term vision with those partners to understand how to consult with customers over these very generational decisions so that it's a win-win-win for all 3 of us.

I'm working with an early-stage prospect with -- it's a massive financial services company, and they have 500 SaaS applications, 1,500 applications they run on public cloud. So it's applications they built or they bought that they run them themselves on the public cloud and then 5,000 that they run in their own data centers. And they are talking to us about being the identity standard across all of them. Now when they look at that equation, that's 7,000 apps. And a cloud service that's most integrated to everything in the world is only going to be compelling when the 1,500 plus 500 gets big enough to where it's kind of some reasonable share of the whole total. And so sometimes it's as simple as that. It's like the center of gravity of their IT has shifted enough where they really say, hey, we can have one identity layer across all this, and it makes sense to do that in the cloud because now 2 out of 5 of their applications are in the cloud now. And it's a combination of just trust and maturity and scale that Okta has been able to deliver. They look at 300,000 users at FedEx. They look at all of our large enterprise customers across the board, and they just get more comfortable with it, and they see that it's flexible and can be deployed quickly and have a -- they aren't going to have to have multiple vendors for all the different areas we cover, and it's not -- I wish that would have happened 5 years ago or 10 years ago, but the second best time for it to be happening would be now.

Roger Boyd with UBS. Todd, in your keynote, you talked about reinvesting in customer identity solution, I think, separately from customer identity cloud. With that product having effectively lived within Workforce Cloud over the past few years, should we view this as a desire, maybe better define the CIS road map separately from workforce or customer? And if so, why now?

We have a lot of customers that need it and rely on it and they don't want to migrate. And we -- I think a couple of years ago, we thought that the enhancements they get because it's on the same platform, these are significant things. Like for example, one of the things we added to the Workforce Identity Cloud in the last couple of years is an overhaul of the framework that you grant administrator role access to the whole platform. And that's going to be super beneficial. You're going to like define the admin roles and do that scalably and manage the life cycle, whether it's a customer identity use case or workforce. These are significant enhancements. And I think we thought that, that would be enough for these customers. And I think what we're learning is that they want more specific customer identity integration. And I think the incremental investment there for us is well worth the path, if you see the size of the business and the importance -- the strategic importance of those customers.

Mike Cikos with Needham. I know we've gotten a couple of questions on the growth dynamic. And one of the things that I think all of us are trying to figure out, we're calling out see headwinds, could you help us think about where we are in the renewal base and how those seed headwinds are playing out? We're talking about them in Q2, but like are they still getting worse? And then any commentary on those seed headwinds as well if we try thinking about workforce identity versus customer identity?

Yes. Seed headwinds, we believe, last through the first half of next year. We're doing that based on when the contract started. So we -- our data suggests that the longer you're back into the COVID area, the more challenging it could be. So for example, if we had a deal that was signed in FY '24, we don't think that's part of that cohort. If it was signed in FY '21, there's more likelihood that there's been some overpurchasing like Todd was describing on the unit basis. That's based on the current macro economy. Obviously, if it gets worse, maybe that time frame extends out. If it gets better, maybe it gets a little bit shorter. But that's our assumption based on the cohorts as we see them today and how they've been performing based on the renewals we see. In terms of workforce versus customer identity, I would say, it's probably a little bit more on the customer identity side, but it exists on both sides. It's something we're seeing in both sides of the business.

Just to be clear on that, the first half comment for next year, like is that when you think it will be largely behind us? Like is most of that pain already behind us? Or is there like...

We think the majority of it will be behind us by the end of the first half of next year. But this is something that happens in every economic cycle, even in a good one, people go bankrupt or people overpurchase. It's just -- we think that the magnitude of it will be lessened and will be more normalized once we get into the back half of next fiscal year.

I think we don't see it getting worse. We just don't know when it's going to get better, that's how I would put it.

Peter Levine with Evercore. Todd, to your comment earlier on the growth initiatives, not yet kicking in. So maybe like what's underlining that remark? It sounds like macro is a piece of it, but is it the majority? So maybe help us understand, is it educating the market? Is it competitive landscape given how fragmented it's become? Or perhaps was it the biggest pack from last year? Did that derail your plans? And as we now anniversary what happened last year, can you give us an update on how those renewal cycles have played out given what your expectations would have been?