Okta, Inc. (OKTA) Earnings Call Transcript & Summary

All right. Excellent. Hey, thanks so much for joining us at the Okta session, Day 2 of the Goldman Sachs Communacopia Conference. My colleague, Callie Valenti and I really excited to have Eric Kelleher, President and CEO of Okta and Savere. Hey, thanks for joining us today.

Thanks for having us. Great to be here.

Eric, I want -- I thought maybe the way we could start this conversation is to imagine that we're one of your larger enterprise customers. And the customer calls up calls you up or calls up their salesperson and says, "Look, we're really concerned. We want to do all this cool stuff with agents, but everything we hear in the news is terrifying. You are our trusted identity partner. make our problems go away. Talk to us about what that customer conversation journey looks like.

Yes. Our leadership with customers is typically to help them understand the problem. So the biggest competitor. Todd talked about this on earnings, but the biggest competitor we really have right now is just confusion. So for an enterprise is trying to navigate the technology landscape today, it's never been more volatile. And the security landscape has never been scarier. And so -- and every vendor is pitching to them all the various ways they're going to solve all of their problems. And so, one of the first steps that we've taken to help customers is just to simplify the landscape. And so we published what we call the blueprint for the secure agentic enterprise. So hey, we want to do something with agents. We don't know how to navigate this. So we've given them a blueprint. And the blueprint tells them they need to solve for 3 things. One is they need to know where are my agents. So, there's a problem of discovery of understanding where agents have been activated by employees, where they exist within the company, where are my agents. The second challenge they need to solve is knowing what can these agents connect to? So what systems have these agents been allowed to connect to the talk to? And the third thing they need to solve is what can they do? What have they been authorized to take? Can they read? Can they write? Can they delete? So those 3 questions, where are my agents? What can they connect to? What can they do? Those are the 3 things that customers need to be able to address to give them confidence in their -- what we call their security posture related to agents. And our -- not surprisingly, our implementation to address the blueprint maps to our product offerings with Okta AI agents, and we help them do exactly those 3 things.

I want to ask you an architectural question, which is we'll hear particularly from new entrants in the identity space that the way that you do identity access for agents is fundamentally different than the way you do for humans. And the reason that is, is because agents are a femoral. And so it's really tricky to take an architecture like Okta and make it work for an agentic architecture because of this change in scalability throughput, a femoral mess for lack of the better word. Maybe push back against that hypothesis?

Say we don't agree with that, so that's not surprising. First of all, not all agents are femoral. Part of the challenge is in this landscape is the word agent means many things to many people and vendors reapply it to whatever is going to suit whatever narrative that they want to share. At its core, we have over 20,000 customers today that trust Okta to secure identity. Securing identity started for them with securing their human identities with their workforce and then their extended work for us and then their customers. And from that base, we've earned the trust of customers that we have the capabilities and the know-how to secure identity and keep them secure. It's a natural extension of that trust to talk about how we're going to help secure the agentic identities. And agents, pieces of autonomous software that typically today run on behalf of the human in the future, we can all see a future where that's less the case. But today, they run on behalf of a human that's enacted them. They need an identity, whether they're ephemeral, they come on and off as they're needed or whether they're permanent, they're running 24/7 the agents need to have an identity. As a company, I need to know what agents exist. I need to know who created them. I need to know what they've been given access to and what actions they're authorized to take. And to do all of that, I need to have an identity for that agent. So Okta provides the Universal Directory of identities. And historically, those identities were human. First workforce, then customer, then service accounts and now agentic. And so that directory has expanded into this use case that allows people to manage that. And then once you have the identities in your directory, all of the capabilities of the Okta Identity Security Fabric applies. So single sign-on, we just launched Agent a couple of weeks ago. It's now GA to all of our customers on our workforce platform, which means customers can now add agentic identities into their directory at no charge with their existing platform. Our governance capability, which allows people to provision and deprovision accounts. So in the case of an femoral agent, just-in-time provisioning and then deprovisioning, turn it on when it's needed, turn it off when it's not. So it doesn't have standing privileges. Things like auditability, who authorized an agent to access the system, who gave it delete access, all of that is captured in our governance product, which does all of that for human identity and we'll now also do it for agentic identity. So the Identity Security Fabric story has never been more real than right now with this new category of identity, which we've elevated as a first-class identity category in our stack and all of the use cases for humans are now available to agents as well.

I want to ask you a little bit about what separates out the customers who are signing the multimillion dollar deals from those that are still deliberating and evaluating and saying, look, the technology is changing cyclically. We don't want to commit right now. How do you get more customers from the evaluation uncertainty, confusion stage through to here is a multimillion dollar deal?

Yes, it's -- the sample size is still small, I'll speak to the examples that we have. But we announced with our quarterly call, we've done dozens of transactions on this product. Remember, this product went GA April 30. So we're less than 120 days in at this point. So we're still learning actually just cross-or.So we're still learning how how to shape this product and how to shape the transactions and how to shape the pricing in a way that's going to get people over the hurdle. But I'll say there's a couple of different categories of what causes first movers. One is, we have some enterprise CIOs and Chief Information Security Officers, CISOs, who are very forward-looking in their vision and the see where the market is going, and they know that this is something that they have to solve more so than their peer group and they're investing ahead. We have some customers that have seen a genic activity that's caused them concern. And that gives them an acute need to make sure that they're investing ahead. And we have some customers that surprised themselves. So one of the examples Todd talked about on the call was a multimillion dollar deal we booked in the quarter with the Fortune 50 health care company and one of the specifics you shared on the call is we had a discovery call with them to talk about Okta agents and what we could do. And at the moment of that initial discovery call, we asked them how many agents that they had deployed and it was 50, that 50 agents deployed. And we came back to them a few weeks later for a follow-on call, and that number had increased from 50 to 1,500. And so that realization -- the customers realization, they can't wait. Like they -- this wasn't a problem that they could wait. They saw the path, and that was a catalyst for them. Then another thing that we're doing to help convert people is we made it easy to buy. A lot of vendors that are in this space right now are experimenting with pricing models and they're exploring agent-based pricing models, but it's you create a chicken and an egg where you ask people how many agents they're going to have. But they don't know how many agents they're going to have.

And not all agents are created there.

Not all agents are the same. An agent that monitors your e-mail is different than an agent that runs your quote-to-cash process. So because -- what ends up happening is your buying cycles become very long and very detailed and very onerous. And so we've removed all that complexity right now. Our pricing model today is setting an uplift on the per user pricing, which is imperfect from an agent architecture standpoint, but it's really easy to buy. And so our customers know that there's a predictable purchase amount. This is what we're going to pay with Okta to allow us to secure agentic identities. And our agreement with these first transactions is we're mostly doing 1-year transactions. The one you mentioned is a multiyear, but we're mostly doing 1-year transactions and very open expectations with the customer that, "Hey, a year from now, you're going to have better information on how you're using agentic identity and securing that with Okta. And we'll have better information on what it's costing us to manage that security." And so the price model will likely evolve. But today, we're making it really easy to get started, which is what our CISOs need. They need to be able to get started to secure this challenge that they have.

Let me ask you one more on pricing, and then I'll hand it over to Callie. How did you pick the pricing uplift given all of the moving pieces that you just sell in?

In close collaboration with early customers. So we've created a specialist team for securing agentic identity that has these conversations all day every day. And we've talked to you many hundreds of large enterprise customers who have an acute need and a need to buy in a procurement process and a budget and we have set the price to value based upon what these customers have shaped with us. So we feel right now very good about where we're starting, and we're very confident we will evolve this over time.

Yes. So I wanted to ask, a year ago, we were having a conversation on which part of the is going to benefit most as a result of Agentic. And it feels like what you guys have come out with is kind of grabbing a little bit from each of those categories. You've talked a little bit about the PAM functionality. We know that at some point, organizations are going to have agents don't have access to parts of an organization that they're not supposed to improve that to regulatory agencies. So with all that being said, like how do you think about what that product looks like today versus kind of what you would need to secure a human?

I think it's interesting for -- I talked about this, I think, last time we were here. But a year ago, our user conference every year is in September, and it's coming up in a couple of weeks. We'll have a bunch of exciting stuff to announce, so pay attention. But last year, our headline for our user conference only 12 months ago was the Okta Identity Security Fabric. And the Security Fabric story was our -- are very common narrative with customers that what I hear from customers is the complexity in their fragmented environment causes them to feel insecure and looking for an identity partner that can solve for all their categories of identity across all their identity use cases from access management to governance to privileged access to development is very important to them. And that was our headline a year ago at our conference. And our subtext, our secondary topic was securing AI. And boy, how the world has changed in the 12 months since then, where we have -- we continue to provide Okta's Identity Security Fabric. We continue to innovate very aggressively. We feel great about our product philosophy right now. we've continued to acquire technologies which improve our product capabilities. So our Premiso acquisition, which we closed the day of earnings is going to significantly accelerate our product road map for identity Threat Protection product. These are all exciting innovations into that Identity Security Fabric. But the conversation that's been most vocal has been the conversation about this need to figure out what's going on with agents and how we secure agents, but both of them are very real. So for us, the way that we look at the landscape, the security fabric is still the core. People don't need to solve just token management or just just-in-time provisioning or just access management or just on behalf of ability, they need to solve all of that. And our product portfolio is the most broad portfolio to address all those use cases. So we'll be talking more about that this year at Okta as well, which is in 2 weeks. But -- but yes, I guess that's how to respond to that.

And the identity M&A has become very popular, both from companies that sit in security, but maybe haven't traditionally been part of that identity stack and also for companies that are outside of that security definition, I would say. How has that kind of changed the competitive landscape where do you see kind of the pros of Okta's positioning versus those other companies? And maybe as part of that, you can talk a little bit about like the importance of being independent.

We think it's really validated. And we've been saying for 17 years that the identity is the fundamental perimeter. And there are different players that have felt network was the perimeter or that felt that systems were the perimeter or endpoint was the perimeter. We have have longest dollars identity as the perimeter and how to ensure you have a secure enterprise corporation. So the steps that you just mentioned recent acquisitions are really validating that you have to be with identity to secure it. And we have a 17-year head start on establishing that and broad distribution with our customer base to demonstrate our ability to deliver on that. And that's been -- and we've been very successful with that. That being said, we also partner with everyone. The -- you mentioned the importance of neutrality. The Stack vendors, whether it's an application stack or a security stack or a network stack, the stack vendors that are dabbling in identity are just that, they're doubling. And everything that they build in their road map is going to evolve to perpetuating their stack. We're the only provider that has identity as the perimeter that integrates with everything. There's over 8,000 integrations with Okta out of the box. And people have come to Okta to integrate their technologies with us because they see us as the identity layer as the perimeter. And because of that, buyers that buy into Okta and know that they have flexibility. They know that they can use best-of-breed technologies wherever they want to because they'll all work with Okta. And right now, we are seeing more volatility in the tools than we've ever seen. If you look at these -- the frontier models right now, they're leap rocking each other every 30, 45 days. So our buyers are seeing this need to be agile. They need to be able to adjust the technologies that are in their environment more acutely than they've ever felt it before, which makes neutrality that much more important, which speaks to a core differentiator for us.

Yes. And then I wanted to ask about CrowdStrike specifically. I think they've had some identity offering out in the market for a long time. But I think labeling it is identity versus oxides, they almost sit a little bit next to each other versus overlapping. So if you could walk a little bit through like how some of these tools are complementary to Okta versus competitive, that will be helpful.

Yes. We have thousands of mutual customers with CrowdStrike as an example, and we expect that to continue. And their positioning in endpoint, in particular, is uniquely strong and they're a provider of shared signals into our threat detection product. and we continue to leverage that. So we believe there's plenty of room for their stake and what they're doing and we're Okta. And we haven't seen any material change in our competitive dynamics on that front with CrowdStrike.

And the developer ecosystem has been a very popular topic of conversation recently. All the Zero has kind of had that outsized developer mind share for a long time now. So how are you leveraging that mind share that, that product already has in this new agentic world? And kind of walk us through that Auth for AI agent use.

Yes. So one of the missing factors in the industry right now with securing a genetic identity is the early lack of standards. And the challenge has been that there hadn't previously been standards that developers could build to that would allow their agents to be deployed in the sicker fashion. We saw this happening early. And a year ago, we proposed a new standard called what we call cross-app access. And cross-app access is designed to allow agents who support it to integrate with the model context protocol for various applications and harnesses in a secure way, where those agents can then be managed in a directory and secured. Cross-app axis is an open standard. It's not an Okta standard, and we proposed that from the beginning. It has since been embraced as an extension to the context protocol. It has been established now as a standard. It is being adopted. We have a lot of exciting announcements about this in a couple of weeks. But there's broad industry interest in having a standard that can be used to build and secure agents. All of Okta's pro support cross out of the box. So if customers are using Okta for AI agents to build their agents, those agents are able to be stored and vaulted in any IDP, including Oktas but not exclusively Okta. And so that gives developers a peace of mind in knowing that they're building agents that customers actually can deploy and can deploy in a secure fashion. So that's a significant differentiator for us there. But we continue to serve the developer community closely. They're having an exciting time right now because their technologies have never been evolving more rapidly than what they're seeing today. And so with things like fine brand authorization, allowing agents specific access to take specific actions with specific applications, they have that in the use toolkit already.

Yes. And on that point, as AI is creating more code going forward, how do you think about making sure that AI coding agents are using Auth and not kind of going off and building something on their own?

I think that's an early space. And I think the evolution of Vibe coding and the SaaS pokalypse will be fun for all of us to kind of navigate and see as this goes. But developers who are developing agents that are going to be deployed as autonomous actors in the company are going to need to have those agents built in a way that they can be managed across is a key to that.

You've made several rounds of kind of go-to-market changes over the last couple of years, but it feels like things have been stable for a little bit now.

I'm glad it it feels that way.

I hope it feels the way for you, too. But -- could you talk a little bit about what you've learned over the past couple of years and kind of how you've repositioned the sales force for this like New World and and stability and everything?