Okta, Inc. (OKTA) Earnings Call Transcript & Summary

All right. Welcome, everybody. We are at the anchor spot of the conference and delighted to have Okta here with us today. I'm Meta Marshall. I cover networking and cybersecurity here at Morgan Stanley. We're delighted to have Todd McKinnon, CEO and Co-Founder here with us after a great quarter last night. So...

Thanks for having me. Nice to see everyone.

So Todd, it's great to have you here, not only after earnings that you reported last night, but just this is a critical time for the identity market, particularly as identity moves front and center in the AI enablement discussion. Just how are you thinking about what type of holistic identity solution the market needs in order to better secure agents? And just how are you designing towards that?

So first of all, when we talk about agents, I think some people I talk to think about them as a discrete thing that's going to be delivered in a certain way. When I think of agents, everything is going to be agents. I think every piece of what we think of SaaS now will be -- take agentic features, reinvented as agents, replaced by agents maybe. I think every piece of software built will have some agentic capabilities. So really -- we're really talking about the future of all of technology. Devices will have agentic capabilities, autonomous SQLs. And so when we think about the potential of what we're doing with Okta for AI agents and Auth0 for AI agents, it's -- that's the long-term ambition. We want to be the identity layer, the identity infrastructure for everything. So what that means is simply put, it's -- a company would have use Okta as a system of record of how many agents they had, what they could do, how they're governed, how they perform. Right now, the product has a list of -- it's the key features that are resonating with customers is it has the ability -- it knows about what agents have been delivered by which platform. So it can download agents and synchronize agents from Salesforce and Amazon and Microsoft, and it can give you a central view of all those agents. And then it can control what they can connect to and they can do that connection in a secure way, so you don't leak session tokens or leak API tokens. And the connections of these agents is really important because that's how they get all the context to make them super valuable. So that's -- it's a big opportunity. And we're really -- I'm blown away by the interest. And then in Q4, the actual sizable deals on the board was -- it was super interesting. Still early, a $3 billion run rate, product is still in early access. The Okta for AI agents is early access. Auth0 for AI agents is GA for about a quarter, but it's very exciting.

Yes. The identity market, maybe as we think of it more traditionally has been this best-of-breed market with distinct swim lanes. Does AI finally push us more towards the platform? And why do you guys think that you guys are in the best position to lead?

I think it does. I think -- but I think the linchpin of that is the, call it, the system of record or the registry. And that has -- if you can give that value to customers to give them this platform-agnostic independent neutral view of all their agents and let them control the connections, that's a very powerful position to deliver value. But that probably leads to more ability to cross-sell governance for people and agents and privilege for people and agents and core human identity probably makes it even having more. We're already seeing platform gravity with the multiple solutions we have with our identity products and this being a system of record for agents probably makes them more platform gravity. It's very early now. I mean I think there's a lot of -- when I talk to hundreds of -- I've talked to hundreds of customers specifically about agentic and what their requirements are and what we're doing, big companies. And there is some spectrum of maturity from the most mature ones are -- have really thought through deeply how they can build an internal enterprise platform for agentic, including where it's going to run, how it's going to access models, how they're going to incorporate a system of record for identity into that, and they've really thought through strategically how that's going to all fit together. But the other extreme is they're really -- it's really early and they're thinking about how can we control which prompts our employees are giving to the chatbot. So there's quite a spectrum of maturity. The early deals we've had with our agentic products have been with the companies in the former category. They've thought through the platform and they said, "Hey, we want to really holistically do this. We're going to do big time automation across our business. The future is agentic. What pieces do we have to invest internally to make this all work. And our approach really resonates there. So yes, it's -- we feel like it's early, but the signals are pretty compelling and clear that this could be a big deal.

Yes. And we had this discussion earlier in the year. But in the market, there's been kind of a lot of identity start-ups or acquisitions of kind of start-ups within the space. Just what do you think that people are missing about kind of what is necessary and what kind of others are doing with these smaller identity acquisitions?

You're talking about like CrowdStrike?

Or just...

CyberArk? CyberArk is not a small company. ServiceNow. Well, I think it's -- I think when you -- I think what's driving a lot of this is it's a big problem for customers. I think people don't -- Okta has a unique view of how messed up the identity world is out there for customers. So we've been living it for a long time. We see it. But I think people don't -- people underestimate how fragmented and confusing and the jargon, the vernacular and the acronyms, it's very complex for customers. And it's -- by its definition as an industry, it's in the middle of everything. And so it's got this other dynamic of -- it's just -- it's very complex. And a lot of our success -- forget about AI for a second, a lot of our success is just bringing some simplicity and some sanity to that, which we've done a very good job of, which is like -- there's never been a company like Okta. There's never been an at-scale independent neutral identity company. They all got to a certain size and then some big platform scooped them up, happened back in client server days, happened in the web days, Oracle bought a bunch of them and then kind of killed them all. We're the only one ever. And it's because we've been able to make it simple and rational. And now we have multiple products across different categories, that's never existed before. So that's a powerful position. So I think -- I'm sorry, it's a long-winded answer, but I think what -- I think people from these big companies, whether it's ServiceNow or Palo Alto or CrowdStrike, they talk to customers and they're getting a firsthand look into how messy it is. And then they're seeing all these breaches caused by identity. And so they're trying to react to customer demand and -- which is rational. But I think what they don't realize is that it's -- if you don't own and you don't operate the identity infrastructure, the directory, the connections, the core of what it is, it's much harder to do security around it. If you own the infrastructure, you can make the infrastructure itself secure and you can build the detections and the monitoring and the posture management tightly coupled to that identity infrastructure, make it better versus if you're trying to do what some of the other folks are doing, which is trying to do identity security tooling across a broad range of complexity. I think we're in a better position to deliver that value.

Got it. It's great having you here just as a voice as a founder. We've seen kind of concerns of late of what AI can do to cyber. Just how do you see that discussion evolving? And how do you talk to your ongoing moats? And just do you think that the market is missing anything about that kind of AI eating software eating cyber?

Yes, everyone thinks about it. I think it's super interesting. I think there's so much -- I think that there's a lot of zero-sum thinking there, meaning that if someone builds something with cloud code or someone vibe code something, there's a zero-sum. It's going to replace something and that's -- companies are going to be cost cutting because they're going to take out some workflow tool or some infrastructure tool. I think in general, there's so much we can do with technology and so much power and automation and cost efficiencies and revenue -- I mean, the industry, technology industry. I mean the technology industry, you all know this, you're conversant in the numbers, but the IT services, so the people doing IT work, implementing systems, designing systems, coding, it's $1.8 trillion. And so I think the zero-sum nature of it is people are getting that wrong. And then I think you get to -- when you're figuring out, there is definitely going to be -- like you heard me say it, I think everything is going to be a agentic. It's going to be what we think of as a SaaS app now will have to get agentic or it will get disrupted. Now -- but I think they will get agentic. Some will, some won't. Some will get more -- have the religion and get agentic faster. There'll be more or less disruption. But I think what companies are going to have to do is figure out, okay, what am I going to try to build? What am I going to try to augment? What am I going to replace? And I think when you get down to this infrastructure layer that has to work, like identity infrastructure has to work. Like it's not optional. If it doesn't work, you can't log in, you can't go where you don't know your people, your agents are going to connect to. And then it has to be secure. And so I think we're fortunate that we're at this -- we're in this infrastructure category that has a pretty high bar for -- I think the build your own bar has to be pretty high to cross over. But it's incumbent upon us to make sure that we make sure our R&D teams are using all the latest tools to build way more capabilities than we have in the past and get leverage from that and make it not only our reliability and our security top notch, but the capabilities we deliver is so good. It would really be hard to get to the decision that you would want to build it yourself.

Got it. You just mentioned Auth0 for AI agents, which has been out for a quarter. Okta for AI agents still kind of in testing. Can you just walk through...

It's dozens of customers. Yes. So when we say early access, it just -- it means it's still paid for so customers in production. It's just -- we haven't totally opened the floodgates on it yet.

Just what are kind of some early learnings just that have kind of helped inform either further developments as you look to roll it out to the broader suite?

I think it's -- I have -- the way we're organized is that we have a go-to-market tiger team that is working closely with customers to iterate the cycle of iteration and the feedback loops into the product team is very fast. This is a fast-evolving environment. So that's -- so stepping back, we set it up to learn a lot and learn a lot fast. And I think one of the most valuable things we're learning is that we can provide this central system of record I'm talking about, which is valuable. But we can also help in this category of agents that's broad across systems. So what we see is that the companies that are building agents in their app, they tend to be more siloed. They tend to work on HR data or customer data or we can really help those flows spread across different silos, go to the data warehouse to different custom systems, different SaaS systems. And that's -- and I think the industry probably will start talking about that as a new kind of agent. It's broader, it's more capable. It can automate more things versus a stovepipe agent. And because we're so good at spanning different stacks, it's been an area that's really resonated with customers.

And then just how does what you learned from Auth0 for AI agents kind of inform what you've put into Okta for AI agents?

Well, I think the link -- so Auth0 is for people building agents, like if you're building a custom agent, whether you're a SaaS company that's trying to build agents into your product or you're a company that's building some of your own agentic software internally, you can use Auth0 for AI agents to do a bunch of things that are common that agents need to do. It handles the interchange between the system and the back-end systems that needs to talk to in a way that makes it really easy for developers. And the connection is that Okta for AI agents helps security and enterprise team have this authoritative system of record of what agents the customer has and what they can connect to. So if you build an agent with Auth0 for -- Auth0 for AI agents seamlessly plugs in and goes into the registry and manage the life cycle. But Okta for AI agents also works with Salesforce agents and the agent core from Amazon and Microsoft Fabric and Google and the 50 other agent platforms that are coming up. And in this dynamic market, that's really valuable to be -- have the central registry and the source of truth of everything in your environment.

Got it.

I mean there's no way for these customers to even keep track of what all the stuff coming at them. It's probably another learning coming at them so fast, especially companies that aren't very far along on the maturity curve of thinking about what this means, just the visibility into like who has agents is valuable.

Yes. I mean we spoke earlier in the year and you talked about kind of the system of record. You are also talking about some of the protocols that you were going to have out there to get different stakeholders to ease the standardization. Just where are we on that? And how should we measure whether we're seeing traction there?

It's -- I feel like I keep saying it's early a lot, but it's early.

It's a common theme this week. Don't worry about it.

Yes. Yes, yes, which is -- I mean, it's very exciting, right? But I feel like there's a lot of work to do, which is invigorating. The -- this agentic world, whether -- and I've said a few times now, it's like everything is going to be agentic. There's no good standard way for how it plugs into a company and so the company can make sure it's secure, they have visibility in what it's doing. It's -- they can stop it if it starts doing things that they don't want to do. That whole interface needs to be defined. And it's going to be defined as some kind of technical standard. There'll be de facto standards. There'll be people will get a bunch of traction and kind of set the default and other people will follow, but it needs to have some technical standards there. The best standard so far in agentic world is MCP. But MCP is not -- it is really how the models talk to the tools and the tools can share their data in a standard way -- discoverable way with the agents and models. But it's not -- there's not a technical standard of how the agents are -- get visibility and are monitored and controlled. So we've done some things working with the folks on the MCP standard to add capabilities to MCP to make it more compatible with enterprises. I'm sure there'll be more of that. I'm sure there'll be more just technical standards in the industry to make it all plugged together, and we're going to be right in the middle of next year deployment.

Got it. So I want to turn to results from last night. You reported 12% cRPO growth, 11% overall growth. You noted 30% of bookings -- of Q4 bookings were from new products and that you were seeing 40% average uplift when they were part of deals. Just where are you seeing -- those are great stats. Where are you seeing the most traction with those new products?

Strength of our business has been larger enterprises. That's been consistent over the last few years. And which kind of makes sense because they have -- there's a lot of complexity. There's a lot of security. There's a potential to upgrade security with a great identity system. There's a lot of -- like I mentioned before, there's a lot of complexity. There's a lot of -- these companies have 20, 30, 40 identity systems, and it's just -- it's hard to manage and it's expensive, and they don't get a lot of the security outcomes that could be available to them if they standardize in something modern like Okta. So large enterprise is a highlight. And our message with multiple products and our identity suite. And by the way, a lot of people say they have a suite. Ours is different in that's an identity suite. And you can -- you have to standardize on something and we'll save you costs and all your identity products. And then we also have the added benefit is you can choose the best cyber stack around that. You can use CrowdStrike, you can use Palo Alto, you can use any app you want, you can use any agentic world, you can use any agentic development platform, any model you want. So this neutrality, it's like pick something to standardize on. Our pitch is like, hey, pick identity, we'll handle all the identity use cases. We'll consolidate all the vendors. And then we'll give you the choice. We're not going to say, hey, it's any model you want as long as it's our model.

And then just on the new products, I think you mentioned that OIG was kind of where you had seen kind of the most strength in the new products.

2,000 customers now. It's awesome.

Okay. Perfect. In the outlook, there was a small step back on operating margins as you invest more in go-to-market and agentic solutions. Just what is giving you the thought that this is where you want to invest right now?

Well, the 2 -- I think the 2 areas of investment are -- incremental investment are go-to-market and then R&D. And I think there's the -- in terms of the go-to-market investment, I think there's -- we're seeing productivity. We're very comfortable where the productivity is now after it accelerated last year. And we feel like there's more market share to be gained with that investment. R&D side is mostly about making sure we're -- we continue to innovate, have this comprehensive set of products. The Agent investments are a good part of that. We're also -- I think maybe something else that's maybe not obvious -- well, maybe it is obvious looking at the numbers, but we're -- I think is an advantage for us is the company is in a good spot in terms of being able to invest more at an efficient rate. So we can get more bang for the buck because of the way we have global R&D development centers now. We have -- of course, that's all being accelerated with AI tools. So just structurally, I think we're in a better place to get more bang for our dollar. And so we get -- it's almost like a more leverage when we do tick up the investment in these areas, which is something that's -- we're just in a much better position than we were 3 or 4 years ago in terms of that. It was all the hard work we've done last year.

Got it. Yes. One of the other announcements you made last night was just about this professional services business and moving that more towards the GSIs and the channel. Just why was now the time that, that made the most sense?

It's -- so I think the -- one of the things that is also maybe a little bit unique about Okta is that for an identity product set of products -- identity product and a set of products, we're pretty -- it's pretty low services, pretty -- like implementations are relatively easy. I mean it's not -- I would never say they're easy, especially in some of the large complex enterprises, they can be complex. But compared to other stacks, it's relatively easy. So I think we've gotten to a scale where maybe if it wasn't so easy, the global systems integrators would have been more aligned with us and really staffing up to do the services earlier in our life cycle. But with the products getting more powerful with governance really hitting its stride, there's just more work in the large enterprises that these GSIs can do. So we kind of had to make a choice. Are we going to lean into that and lean into their interest because they see us as the leader. They see other vendors in the specific identity space as maybe not innovating and not pushing the boundaries forward. And then they see agentic and all the potential there, and they're leaning in on us, and we're at this point where our products are capable of really doing these transformations that require more GSI support or services dollars. We had to make a decision. Are we going to -- do we want to grow our own services? Or do we really want to lean into this enabling GSIs and I always say that if you're going to make a decision, unless it hurts a little bit or unless it's a hard decision to make, it's probably not worth a lot. And so when you have to really forgo some services revenue, it means it's probably a decision that might hurt a little bit in the short term, but be something really good long term. So that's where we are.

Got it. As investors look towards -- are looking for reacceleration in the business on the back of some of these go-to-market investments and agentic, just how are you thinking about fiscal '27?

I think it's like a beginning of a new era for Okta. And I think it's maybe that there was the start-up era and then we went public and then there was the COVID era and the 0 interest rates, and we've kind of settled things down and normalized it. I think this is the beginning of a new era. And I think the platform approach we have just identity, this unique approach to an identity platform, no one else has it. No one else has a broad identity platform like we do that's not super tied into another stack. So it's unique in the industry. And this -- the opportunity to be the foundational layer for agentic identity and agentic connections, that could be bigger than all of identity is now. That could be bigger than cyber. And that's a massive opportunity. You're talking about a tech stack that's going to -- this agent tech stack just for starters is going to have a huge impact on $1.8 trillion of IT services and not to mention the other -- what the leverage and the productivity and the effectiveness of 1 billion-plus knowledge workers, that's massive. And that's exciting to us. I mean we don't want to -- we're not here to build just an okay media and SaaS company. We want to build one of the best, great, impactful companies ever. And I think this could be the start of a -- this is the start of a new era, and it's up to us to make sure we capitalize that over the next several years to make it a reality.

Got it. It's almost like a great end, but now...

But I want to make sure it's clear. I did not guide to $1 trillion in revenue.

Let's talk about go-to-market for a second and just kind of how you go and sell that vision. You've implemented a number of go-to-market changes over the last year, focusing on some kind of specialized sellers and Okta and Auth0 teams. Just where do you feel like you're seeing kind of the most traction there? And yes, I guess.

I think -- so about change in go-to-market change, I think the notable thing this year is there wasn't much change. And we already saw that in the performance at the start of Q1. It's what you would expect. It's -- there wasn't a lot of cost to change so far. It's only a month end, but it's what you expect. And I think -- so if you go back a year ago, the main change was more specialization around Auth0 and Okta. And those platforms both have become so capable that it was really hard for one rep to get their head around it all. And so that's been working great. And I think what you're -- the new products is probably the best evidence of that. You don't -- if you're not specialized on all the innovation in the new products, it's hard to sell them. If you're spread across too many, hard to deliver that and know what they're talking about when they drill into the details of identity security posture management and what's the difference between that and identity threat protection and security center and Auth0. So we're seeing that pay off.

I mean as you think about AI as almost -- or -- I know you've mentioned everything will be agentic and so maybe this is the point. But do you need these special teams for AI sales versus this split between Auth0 and Okta?

Yes, that's -- well, I think right now, it's -- I think the operating principle right now at Okta is that it's a tiger team that is designed to iterate fast and get feedback from the customers of the product. And that tiger team by -- they basically are doing a lot of things, but they're also sitting with a bunch of reps through these deals. So the reps -- these AI deals still go through the reps. You basically have this tiger team that's the overlay or the specialist. We're thinking that it will be a generalized sales motion, but I think we're flexible on that as we scale it out. It might make sense that the products evolve in a way that they're more separable than the core platform. So we might do it separate. But the way -- the plan now is that it will be like -- the AI products are horizontal across Auth0 and Okta, meaning that if you buy Okta for AI agents, you can -- your AI agent identity gets some connections with log-in, it gets some connections with universal log-out, some connections with governance and some kind of horizontal and same with Auth0. So we're trended now toward a more generalist model, but I think it's -- the reality is that this could change as we go down the path.

Okay. We've had this discussion before. But just in terms of as you move upmarket, as you have these bigger conversations, those can tend to lead to longer sales cycles. And so just how are you balancing the -- we have solutions we can give you day 1 and then progressing that conversation along?

I think it's a real thing. Like I think it leads -- part of this is why our years are so back-end loaded. As we move upmarket, we get a lot of deals that we could just do a smaller deal, but we wait until the end where it's a big platform deal. I think it's hard to -- when you're trying to deliver broad value across multiple use cases, sometimes it's hard to start small. The fact that it's relatively straightforward and possible from a technology perspective and packaging pricing perspective that has some kind of buffer to that. But it is a real thing. I don't think it's getting worse. I think it's been steady as we've moved upmarket. I just -- I would say the biggest difference is that when the deals come, they're bigger. So the sales cycles are not any longer, but when they come, they're bigger. And when someone actually does delay them for a couple of quarters to get the big one at the end, it's actually bigger, which is what you want. You don't want people delaying for 2 quarters and then delivering the small one.

Right. But maybe -- you talked about this. You guys have built an incredible platform. You generate a fair amount of cash. You announced a $1 billion share repurchase program earlier in the year. Just how are you thinking about capital allocation?

The -- so I think we think the stock is undervalued. That's why we did the buyback. And then the other variable there is we were looking at ways to grow the business with M&A. And the -- when we've done M&A in the past, Auth0 is an exception for that strategic asset, but a lot of our M&A has been small tuck-ins, technology and teams. We had great success with that. And the at-scale acquisitions in our strategic zone of identity would have been legacy companies that are software companies. So we've never done anything like that. And I thought that's the right -- I think that's the right decision. So basically, it's a long-winded way of saying is that the -- we keep looking for acquisitions, but they tend still to be tech even the things we're looking at around AI tend to be small teams that are innovating quickly, not something that would be a huge capital allocation. So with that, cash generation and trying to return some value to shareholders with buybacks we think the stock being undervalued makes sense. I think going forward, the -- we have -- we talked about a $1 billion pool for buybacks. We'll do that in a moderate way because we can't predict the price week-to-week, month-to-month, quarter-to-quarter. But the -- we're comfortable with that. And then going forward, I think beyond that, I think it will be -- the question will be really around like what M&A could move the needle in this -- as the company evolves into this infrastructure for AI agents and what that will mean there. That will probably be the next decision point.

Okay. Got it. Well, Todd, thank you so much for being here today, and congrats on the quarter.

Thanks for having me. Thanks, everyone.