Okta, Inc. (OKTA) Earnings Call Transcript & Summary

[Audio Gap] run the software equity research franchise here at Citi. Very excited to have Okta on stage with me. And actually very thrilled to have Monty Gray, Head of -- EVP of Corp Dev, Head of Corp Dev at Okta. And it's exciting times in cyber, very exciting times in identity security. So very serendipitous for you to join us here.

I know maybe not many investors are familiar with you. So I'd love to kind of level set with the audience here in terms of your background and the 7 years that you've spent heading up the corp dev effort at Okta, and then we can take it from there.

Sure. So thanks for having us over here.

Dave Gennarelli, a man of legend running the IR effort.

Yes. Thanks for having us.

Man, that needs no introduction.

I'm responsible -- I've been at Okta for 7 years, responsible for corporate development, which includes company strategy, M&A, technology partnerships. We have some investments in just broader ecosystem engagement for the company. So glad to be here.

Excellent. I want to very much start out with the M&A philosophy, the M&A process. You've done a deal in the privileged access space this year. You've had one of your principal peers/competitors in this space now get acquired or at least in talks of being acquired by Palo Alto Networks. So at the very highest level, can you talk to us about how your M&A process in terms of asset selection, asset quality, asset size have changed and how the Palo Alto CyberArk tie-up is going to potentially add further change or influence or impact further change in this process and for?

Yes. So I'll say, as long as I've been doing this, even before I joined Okta, this is one of the busiest times that we're seeing in terms of just M&A activity out in the market, right? And from a security standpoint, it's very active. We're very busy. We tend to be extremely proactive and diligent when we think about spaces that we acquire. We announced an acquisition last week at our earnings in the privileged access space, a small acquisition. I would say the profile that tends to work well for us as a company are things that accelerate our road map, right? With the exception of Auth0 about 4 years ago, that was more of like getting into a different market category and a scaled market category. The thing we look at now is like how do we accelerate our road map, how do we understand the ecosystem? And again, given the purview of what I have, I have a lot of different ways to touch the ecosystem through partnerships and integrations. And that's the benefit of having -- being a company like ours, we're an identity-related company where you just have integrations to everybody in the company in the ecosystem. So I get a chance to really meet a lot of different companies there. I'll say the security part is dynamic. There's a lot of companies that are trying or a lot of different aspects, especially with security trends, agent trends that are happening now in Agentic AI. And so we're constantly looking at ways that we can accelerate inform our road map with that as well, and there's just a lot of good talent out there.

I think that's a great jumping-off point to talk about AI and Agentic AI and what that portends for the business in the next 3 to 5 years. So can you walk us through some of the main bets that Okta is making on the organic side and the asset profile and the intellectual property that you're seeing out there to help accelerate that road map. So walk us through kind of some of that industrial logic.

So I think to answer that, let me just paint a picture of kind of like what our philosophy and strategy is here. We think of identity as a pretty broad -- pretty broad platform. And we call this identity security fabric. What does that mean? It means we have -- at one end, at the top end of it is like all the different types of users within the organization. So it could be an employee, it could be a business partner, it could be a contingent labor and now it could be an Agentic AI, right? And imagine all those just having access to all the different resources available within an organization. Resources can be SaaS application, it could be a database, it could be cloud infrastructure, Kubernetes, even down to on-prem. And once we have -- once we're supporting that whole paradigm, we're then able to have different use cases that hang off that. There's an access use case, there's a governance use case, privileged access use cases, posture management. So we think of that kind of from a holistic perspective. And to your question, in that world, that's what do we have to do to actually extend that into, as I mentioned, Agentic AI, right? All the basic principles still exist of an Agentic AI has access on behalf of a person. How do you do this in a secure, compliant manner? And how do we enable our customers to be able to adopt these technologies? What happens today, by and large, is a lot of customers will adopt Agentic AI. They'll basically just give them overprivileged service account or something. And that creates a bunch ton of risk. We're trying to narrow that down to basically what are the policies and entitlements that a person would have, we extend that to what an agent would have. To do that effectively, you need to actually have visibility into what the agent is doing. You need to grant them privileged access and then have all the reporting that comes along with it. And so we view that as just another -- our road map is something that's aligned with kind of that strategy that we have right there. Obviously, there's a lot of different deployment modalities and different ways that you can integrate with agents, and those are things that we're looking at. We're starting to see some innovation happen there from the early startups, but those are very early. Those are still really small companies.

I have this debate with investors around, hey, in the nonhuman identity sphere and slapping guardrails around how that is going to be managed from an architectural standpoint in an organization. Is it more of a governance problem? Or is it more of a privileged problem? You used the term overprivileged earlier. So bearing in mind that you have both sets of intellectual property in the form of what you're selling to customers in OIG and what you've been selling to customers from a PAM -- privileged access perspective. But I'd love to get your feedback on what you're seeing, but also what customer reaction has been to, hey, is the agent problem more of a governance and a role-based access authorization issue? Or is it a pure privilege curtailment dynamic?

We actually think of it -- there's even a visibility problem ahead of that, which is posture, right? So we think of it is actually cutting across all those different aspects. So for example, like what agents exist within the organization, what do they have access to? Let's just baseline what's happening within an organization. That's really just a visibility and posture question. And then from there, it's like how do you provide the right level of privilege to actually narrow the scope of what these agents have access to within the organization? And then from there, it becomes a governance one, which is, is this really happening the way we think it's going to happen and kind of report on that. So we're starting to actually find that this cohesive platform is where it really starts to light up because the identity complexity is something that's much more than there was before with just humans in there. So it kind of cuts across all 3. It's not just one or the other, but we do see historically, what people do without having an identity sitting in there, is we're just kind of overprivileged. So the word privileged does jump out.

And even from a technology perspective, I'm wondering if you can opine on how much of this new pain point can be solved by repurposing existing capabilities that you have for a net new use case or if it fundamentally requires a fresh new approach. Can you retrofit OIG or Okta PAM?

Sure. I think it goes down to -- there's 2 different ways agents will actually interact with systems within an organization. One way is they will mimic the human behavior. In that world, you still have sessions, you still have tokens, you still have the interaction paradigms, which are very similar to what a person would do. And that's where you can actually repurpose some of these -- some of the tooling to support that. There's some nuance to it, right? Can you actually have a disconnected session where someone can go off and do some work, come back and have human in the loop, things like that, and we support those. Can you have a directory? For example, our directory today is primarily humans in there. Can we extend that to actually support nonhumans into our directory? So there is some additional road map. The other interaction paradigms tend to be more, I'll say, below the line, which is more API-centric. So are these agents actually going to a native API? Are they calling an MCP server, for example? And in that world, we spend a lot of time working with standard bodies to actually support the open ID standard, things that are adjacent to -- so the open ID standard enables us to actually use an IDP to actually give access to things that actually happen at the system level. And that's where we -- there's still some road map around those, and that's where we're spending a lot of time and energy right now.

And then just tying this back into sort of some of the commercial implications. So as I alluded to kind of in my opening remarks that the Palo Alto CyberArk tie-up, initial impressions on the transaction implications as one of your peers just sort of get swooped away. I know there's an ethos at the company about being independent and being a standard bearer of independence how are you internalizing that just from a go-to-market and competitor and competitive perspective?

Yes. I think there's -- you nailed one of them, which is our philosophy. There tends to be 2 philosophies that kind of exist in the market today. One is, is there a kind of a full suite or platform approach? And then the other is what we do, which is supporting best-of-breed and enabling best-of-breed. And in that world, we have -- we play -- we integrate with the ecosystem. We have commercial relationships with different parties in the ecosystem. When you think about the control plane for security, there's endpoint providers, network providers, there's cloud infrastructure providers in addition to an identity provider. And that's the world we operate in, which is like the breadth and depth of integrations and those use cases that cut across, we do well, we focus there. So that's kind of one area. The second, I would say there's a big coexist. I get this question quite a bit around competition, like how do we -- how are we versus Microsoft or versus CyberArk from a PAM perspective, we tend to coexist, right, with these areas because they tend to support a different type of the environment, whether it's on-prem part of the environment. And where we do well, it is more on the cloud-native side of the environment. And so there tends to be kind of a coexistence there. I would say specific to the transaction, it's early. They haven't closed yet. It's going to take a while to close. We have good relationships with both companies. And so I think it's still very early from that standpoint.

Before we shift gears, I want to talk about Auth0. That was a pretty transformational move for the company. So a lot of lessons learned, a lot of perspectives gained. 4 years later, where are we with respect to Auth0's core capabilities being infused and/or borrowed from and cross-pollinated across the portfolio? And then relatedly, we talked a lot about the enterprise aura of privilege and governance. But how does Auth0 and those capabilities, how do those play into the Agentic AI opportunity, especially from a consumer-facing application standpoint? That's a mouthful.

There's a lot there. So for benefit of the room, Auth0 is -- participates in the market is customer identity, right? And traditional Okta, which everyone knows is more on the workforce identity side. There is an interaction between those 2 properties. So on the customer identity side, there tends to be, I would say, 2 major use cases that exist there. One would be if you're a brand and you're a B2C brand and you want to engage with your customers, Auth0 plays well there. Auth0 is a developer-focused product, a lot of developer adoption there. And so if you're a B2C, you're probably CTO, Head of product is probably interacting with it. The other part of Auth0, and this is relevant to the conversation is a B2B SaaS. So if you're a B2B SaaS vendor and you're looking to figure how to do authentication and have your directory and your user store, Auth0 can provide that for you so you can focus on your SaaS application. In that world, there's a nice interaction between what Okta has, right? Okta is the workforce IDP of a given customer, but then the B2B SaaS that the customer is adopting can also be powered by Auth0. So we see on both sides of it in that world. And in that world, you can get some unique interactions that happen between both of those systems. So we spend a lot of time and effort just evangelizing the benefits of actually to an ISV, if you're an independent software vendor, not only do we -- does Auth0 take care of your directory and authentication, single sign-on and all things that make you enterprise ready, but you get some benefit by going into the Okta ecosystem, which your customers will be adopting. So there's a standards approach we've taken there. We announced that at our conference a little -- almost a year ago, which is we're going to do this in a standardized manner. So it's not proprietary. We just think we have the best reference implementation of those standards to make these systems talk to each other.

And related to that, before we move on, we generally have this working thesis that generative AI is going to have an explosive impact from a consumer and consumerized end-user perspective. So Auth0 clearly has historically had a play there, right? How does that dynamic get turbocharged as a brand-new voluminous body of consumer-focused generative AI applications burst on the scene? Where does Auth0 play in that? Is that a pipe dream? Is that me being Pollyannaish? Or is that something that is a very tangible opportunity that you can chase?

Yes. So Auth0, I answer the second part of your question, has an offering that we announced Auth for Agentic AI. So what is that? That's basically if you're building an AI agent as part of your SaaS application, there's some unique aspects to authentication that matter there, right? We talked about MCP being part of it, how you can interact with MCP, which is how you get access to a data. But also, if you think about the disconnected nature, if you're an agent is going to go on behalf of a person, you want to have a disconnected session, then come back and do a human loop. If you want to do RAG retrieval for a different data source, Auth0's offering helps support all these different use cases that are specific for generative AI. And so that's something that we feel is -- we announced that about a year ago.

Right.

About a year ago, and that's been something we've seen a lot of good early adoption from developers. So we think there's going to be a lot of tailwinds on that part of it.

Yes. I think one of the big debates for investors coming into the conference and inquiring minds are really trying to understand and appreciate is how AI in the enterprise -- the operationalization of AI gets monetized in the organization and for enterprise software vendors. So from your perspective, historically, you've been conventionally a seat-based model, right? How does that change? How does that evolve? How does that get disruptive? And what are some of the mitigating forces that you're thinking about in terms of infusing some of these new pricing models and modalities in the business to mitigate that?

So I'll say it's still early, right? And our approach on this one is when I describe the identity security fabric, and we're talking about how we extend the value proposition and use cases to Agentic AI in addition to people, that's part of this, right? We view the identity complexity becoming more important today as a result of this than it was prior. We already discussed the privilege and governance complexities there. So we're positioning ourselves to support both of those. I think it's still very early on the pricing front of like how do we price Agentic AI, something that we're listening to our customers right now, and we're working some early adopters on, but it's still pretty early, but we like how we're positioned on both sides of it. I'll say even as Okta, like as a company, as we adopt AI on our side, we're still squinting at is it a force multiplier of productivity? Or is it something that's going to be a replacement? And we're still early in that cycle of understanding kind of what's really going to happen in terms of the seat pressure actually happen versus moving that over to more software-based and usage-based. But right now, we're still seat-based. There's a lot of durability in that model, but it's something that we're -- from a product offering, we're positioning ourselves to support both.

Because you brought it up, I'm very curious, how is Okta AI-ing itself?

Yes. We spend a lot of time as kind of like in the C-suite, talking, discussing and understanding where the value is going to come from. The early value is customer success. We're making our customer support reps more productive with it. We've made -- obviously, we've unlocked a lot of the different capabilities for all the employees to use the tools to become more productive themselves, whether it's through the different LLMs that are available. We're looking at different use cases to support in the marketing organization, for example, and to make people more -- but this is all under the umbrella of like how do you get people more productive and more effective versus like it's replacing the work today. But it's something that's a constant conversation. It's rapidly evolving. And we're also looking at how do we do this in a secure manner. So we have 2 conflicting kind of philosophies that hit within the organization. For the past couple of years, it's been -- everything has been around security and hardening our securities organization. Now how do we actually still maintain that, but also go adopt AI to become more productive? And so we're learning as we go through this. We're actually learning ourselves as we build up our own stack internally for doing AI tooling and doing it with security and privilege and governance and visibility at the forefront of it, and then we can take that and talk to our customers.