Okta's Vision For The Next Decade

Identity Access Management

Summary

• Just over a decade since its founding in 2009, Okta has risen to the top in the Identity Access Management market.

• The founders, Todd McKinnon and Frederic Kerrest, who foresaw software migration to the cloud, were massive contributors to the company's success.

• Today, they aim to make Okta one of the most critical technologies in the next decade to become what they called ‘the primary cloud’.

• At Oktane21, the company announced it is already making huge strides by introducing two major products to enter the PAM and IGA markets. In addition to this was the acquisition of Auth0.

• Combining all three big moves, I have little doubts that Okta is already on the way to achieving the primary cloud status and, with some imagination, perhaps even more.

Introduction

Incredibly, Okta (OKTA) was labeled a login-box company just a few years ago. In this article, I want to show you its true potential.

Now, you see just the beginning of an extraordinary company that is already making giant steps to realize its ambitious dreams of becoming the most important cloud platform.

To answer this question, the article will be divided into seven sections. The first section will refresh your memory of how Okta became one of the leading identity solution providers.

The second outlines what big dreams Okta is planning for the next decade. The third gives you the ins and outs of identity technology and the industry's evolution.

The fourth dives into why Okta's technology is so impressive. It helps you understand why Okta can aim big to be one of the most important cloud companies. This is the fifth section.

The sixth section goes deep into the two product announcements that are giant strides into making Okta the first comprehensive end-to-end identity solution in the industry.

Finally, I discuss the acquisition of Auth0. Auth0 will deepen Okta's technology, solve unique problems, and go into areas that Okta currently lacks. I believe it's a match made in heaven.

There is a lot to cover, so let's start.

I. Big dreams - exemplary execution

Todd McKinnon and Frederic Kerrest, the two co-founders of Okta, are among a few other leaders to truly understand and execute Andreessen Horowitz's infamous prediction in 2011 that 'software is eating the world.' The pair knew this even before. Okta was created in 2009 to address more complex identity needs for the future enterprise.

From the start, they could see that companies would have to modernize their IT systems and move to the cloud to access business tools and technologies. Thus, Okta has been building the technology we know today as the Okta Identity Cloud, 'one platform - many use cases.' It claims to be independent and neutral, which means it can serve a broad array of Identity-related solutions for any technology stack and infrastructure.

The platform can also provide flexible, customizable, and extensible solutions for customers thanks to the programmable modules and over 7000+ integrations through partnerships. In hindsight, the vision and roadmap to becoming what it is today looks obvious. But at the time, it was a truly pioneering approach. For context, the dominant player and the elephant in the room - Microsoft - only transformed its on-prem identity solution to work on the Azure Cloud three years ago, in 2018, almost a decade after Okta had pioneered the space.

II. The next decade's visions

Today, the co-founders, Todd McKinnon, and Frederic Kerrest, set their sights on lifting Okta even higher in the next decade.

At the Oktane21 annual conference and Investor Day 2021, they announced that the Okta Identity Cloud would be the primary cloud.

The statement is bold. The title places the Okta Identity Cloud as one of the essential cloud platforms, rubbing shoulders with names like Salesforce (CRM), the go-to solution for CRM, and Workday (WDAY) for HR. To earn this status, Okta must innovate and expand to serve the most critical needs of businesses and consumers, accelerate its use cases, and address a much larger market.

Talk about big dreams and visions! If successful, at a $35B market cap and $1B revenue run rate, this is only a start.

The next four sections (III to VII) will show why Okta will achieve this momentous mark.

First, for the benefit of the newer investors, I will explain identity and access management (section III). We will refer to it as IAM from now on. I will show you how IAM has evolved into one of today's most important technologies.

Secondly, in section IV - 'What is Okta's solution to Identity?', I will show you why the identity solution offered by Okta - the Okta Identity Cloud platform is so impressive. I will discuss Okta's capabilities, competitive advantages, and the numbers to back up. Combined, they build the foundation to understand why Okta can dream big to be the primary cloud.

Then, in section V - 'The vision of the next decade - The primary cloud,' I will attempt to define the primary cloud. As there isn't an official definition, I will dissect McKinnon's statement to read between the lines. Then, I use a scorecard to assess what Okta needs to achieve this goal.

In the last sections, VI and VII, I will show that Okta is already making big moves toward this goal. At Oktane21 and the recent Investor Day, the company announced two new products to enter the Identity Government Administration ('IGA') and Privilege Access Management ('PAM') markets, which are substantial expansions to the Okta Identity Cloud. They make Okta the complete Identity solution provider in the industry. Moreover, the recent acquisition of Auth0 doubles its business and deepens its capabilities in the customer identity market.

This article is a mega update, so let's go!

III. What is IAM?

To appreciate Okta's vision for the next decade, let's start with the basics of IAM. If you are familiar with the technology and Okta, you could go straight to the third section - 'The next decade vision - the primary cloud.'

IAM is widely mistaken as just a 'login box.' Underneath, it's a comprehensive and complex technology.

It's a technology that allows the right user to access the right resource at the right time for the right reasons. That means the technology solves three things in the order:

1. Verify an identity

2. Determine what the Identity can access and do

3. Define the policies and processes used to manage identities within an organization's networks and systems

In technical terms, verifying Identity is a process known as authentication. It matches the user with factors; there are three:

• something the user knows, such as a PIN code, a password, and secret answers, or

• something the user has, such as your employee badge and a smartphone or

• something the user is; think of biometric IDs like fingerprint, retina, or iris pattern.

Once the technology verifies the user and validates who he/she/(or it) claims to be, the next step is to determine what the identity can access and do. This step is often labeled as authorization. It involves setting a series of perimeters based on the employee's role or the type of customers, often based on the level of loyalty.

After authentication and authorization, the last part of the technology is access governance and administration. Tasks include advanced controls, monitoring, logging, reporting for compliance, analytics, and audits. As the names imply, this last step is more the admin part of IAM. You could argue it's an extension to IAM. This part will help you understand why Okta introduced the two new products, Identity Government Administration ('IGA') and Privileged Access management ('PAM'), to become the primary cloud. More on these in the fourth section - 'Big, bold moves.'

Evolution of IAM

So, now you have the basic knowledge about what IAM does and the three fundamental steps. To understand why technology is so crucial to today's digital-first world, let's look at how IAM has changed over the year. I think you'll understand why it is, including PAM and IGA, an $80B TAM or total addressable market,

Source: IDaaS for Dummies, 2020

In the early days of computers, IAM would simply mean managing users' usernames and passwords for just a mainframe computer, where organizations used to store critical applications and data. As technology evolves, the number of resources and applications inside organizations grows and is shared across functions. At this stage, employees had multiple logins on more applications and devices. But every connection still happened inside the organization's wall. Therefore, they were relatively secure and limited. As a result, the organization's IT department did not need a sophisticated identity management system to control, manage and secure all these connections and identities.

Today, the perimeter of the contacts and resources expands beyond the organization's walls. IAM means managing hundreds of thousands of employees' access to data, applications, and devices on the local IT system/on-prem and external/on the cloud, running on different technologies. On top of that, people have also moved online and experienced the customer journey on Amazon.com (NASDAQ:AMZN). They expect it to be seamless on every other website. Thus, businesses now also have to manage, control, and protect customers' credentials while ensuring they provide a frictionless online experience. It is a whole new level of complexity, scale, costs, and security challenges, not to mention the limited amount of specialist IT resources.

The following two slides are from Okta Q3'21 earnings presentation. They illustrate how IAM has changed over time. The customer identity solution evolved from a simple, built-it-yourself application that works within the organization's wall to today's microservice, which operates across infrastructures.

Similarly, the workforce identity solutions advanced from being a part of a tech stack to a stand-alone technology platform that allows seamless sign-on experience on any device, platform, and across infrastructures.

As you can see, the role of IAM has changed dramatically, from a simple IT cost line in the income statement to a strategic C-level decision that connects everything in the organization. Its role in the organization can determine its success, how it innovates and how it future-proofs itself.

IV. What is Okta's solution to Identity?

Today, Okta is already a leader in IAM, shoulder to shoulder with Microsoft in the top spot, according to Gartner. Its product - the Okta Identity Cloud platform, is impressive. We will examine what it can do, its competitive advantages, and the numbers.

The foundation of the Okta Identity Cloud platform is Platform Services. There are six, and they are the building blocks for all other products which serve both the workforce and customer identity segments.

Okta FY22 Investor Day Presentation

Customers can either come to pick standardized products shown above, from Single Sign-On to Lifecycle Management. The following slides were from 2019, but it shows how a customer can choose a product. It's like looking at a buffet menu. You can pick what you want depending on your needs.

What's more, if customers can't find what they need, they can customize all those solutions to their specific use cases. As the Okta Identity Cloud platform is independent and neutral, it is technology agnostic. In other words, it allows developers to use the Okta software development kits ('SDKs'), templates, and APIs to customize the solutions and plug-in any IT system, any tech stack.

This ability allows flexibility and is a big advantage over the on-prem solution. It also helps developers to shorten the development time, costs, and complexity of the solution.

Okta Q3'21 earnings presentation

Moreover, customers also have access to more solutions through Okta Integration Network (see below). It's the easiest way to adopt the latest apps, centralize user management and automate access workflows across infrastructures, and it allows customers to go deeper than just Single-Sign-On applications. It connects customers to over 7118 applications, unlocking new value from their existing IT system.

You can see that some of the biggest names are on the network, such as Zoom (NASDAQ:ZM), Salesforce, Slack (NYSE:WORK), Microsoft Office 365 (NASDAQ:MSFT), and more.

Below you can see the list of categories, including HR applications, ID Proofing, DevOps, and Security Analytics.

The benefit of having a broad array of integrations is that it gives flexibility and extensibility to customers. As customers grow, their use cases change, and a large catalog ensures choice. In return, Okta gets all the data on how these integrations are used and can extract network effects from these connections.

So, the ability to build customizable solutions and access to over 7000 external solutions make Okta impressive and differentiated. The slide below illustrates how these two points create massive competitive advantages for Okta.

Okta Q3'21 earnings presentation

First, as developers from all parties come to the platform to build new applications, Okta could see how they were built, used, improved, and then share with the rest of the ecosystem. Over time, new use cases and better solutions can grow exponentially, adding more value to customers and expanding the addressable market.

The graph above put it simply:

more customers + more partners = more value

And the result is the data network effect moat. It's one of the most potent moats.

In addition, better products provide higher value to customers, leading them to integrate more external solutions into their system. Thus, there will be high switching costs as customers will be less inclined to start over again, making the Okta Identity Cloud platform very sticky.

Okta's management also shares my confidence that Okta is differentiated.

Principal competitive factors in our markets include flexibility, independence, product capabilities, total cost of ownership, time to value, scalability, user experience, number of pre-built integrations, customer satisfaction, global reach and ease of integration, management, and use.

We believe our product strategy, platform architecture, technology, and independence as well as our company culture allow us to compete favorably on each of these factors.

Source: Okta 10-K (emphasis mine)

But don't take my rosy interpretation of the Okta Identity Cloud or the management comments for granted. Always check the story, look at the numbers. For Okta, they are also really top-class.

As of Q4'21, Okta has

• Over 10,000 customers, which tripled since IPO in 2017, and 2,000 customers were large enterprises (with contracts value over $100K).

• Current revenue run rate of $1B (FY2022 guidance)

• Rapid revenue growth, 43% YoY in Q4'21

• Net dollar-based retention rate (including customer churn) of 121%, demonstrating stickiness

• High gross margin at 74%

• Impressive free cash flow margin of 33%

To sum up, the Okta Identity Cloud is truly impressive because of its flexibility, customizability, and scalability. But the next decade is even more exciting. As the CEO, Todd McKinnon first touched on this vision at the Q2'21 conference call and explained at Oktane21:

[…] Okta will be the primary cloud in the enterprise in the future.

What does he mean by this statement? Is it achievable? What steps does Okta have to take to achieve this goal?

V. The vision of the next decade, the primary cloud

At Oktane20, the first virtual annual conference, we had the first glimpse of the primary cloud concept.

Driven by the three megatrends, cloud adoption, digital transformation, and zero-trust security, the role of identity solution can be the most critical in any modern company.

Source: Okta Investor Day presentation 2021

At Oktane21 and the Investor Day event this year, Todd McKinnon announced that Okta would work towards becoming a primary cloud.

Source: Okta Investor Day Presentation 2021

Todd McKinnon explained (emphasis mine):

If you look out 10 years for Okta, the strategic priority for us is continue to establish Identity as what I call a primary cloud. There'll be hundreds of thousands of vendors that will sell technology to companies and a handful -- but only a handful, 5 or 6 or so, that will rise up to that really strategic level as one of those primary clouds in the company's environment.

If you think about it, in the world of cloud solutions, we have Salesforce for CRM, Workday for HR, AWS/Azure/Google for Infrastructure, a few for Collaboration and ERP but none for Identity yet.

Thus, Todd McKinnon believed that

[…] Identity will be one of these primary clouds. Identity is the connected tissue to all of the other primary clouds as it facilitates choice and flexibility while enhancing security and reducing risk in all other technologies.

Todd McKinnon - Q4'21 CC

But what does he mean by 'the primary cloud'?

There isn't an official definition, so here is what I have gathered. There are criteria that the Okta Identity Cloud platform will have to achieve:

+be the growth enabling solution

+has broad use cases

+addresses massive problems and opportunities

In other words, the Okta Identity Cloud will have to demonstrate clearly that it is not a cost expenditure by that its impact directly improves productivity, provides a frictionless customer experience, and secure access, and drive innovation. Okta's use cases also have to cover all aspects for the employees and customers and more. Finally, Okta has to solve mission-critical problems; thus, the market would be significant and sustainable in the long-term future.

Okta's scorecard

Looking at the current state of Okta, I believe it meets quite a lot of these requirements already.

First, Okta is already solving the most critical problems making Identity the most pressing strategic move for organizations in the current business environment. In the recent Okta survey, 74% of CIOs think security is the most crucial decision in modernizing IT, while over 60% want more automation and adopt new cloud applications. Identity is at the heart of all these decisions. On security specifically, identity is the only and the best way to secure key resources in the digital-first world.

Second, Okta's solutions cover a lot of employee and customer use cases. As mentioned in the previous section, Okta has emphasized its customizable capabilities to the deepest level by offering templates, developer tool kits (SDKs), and APIs. In addition, the Okta Integration Network allows access to the newest applications provided by external providers.

Finally, IAM is a huge market worth an estimated $80B today (including IGA and PAM). Don't forget that TAM is always a yearly number. With the three megatrends still in the early innings, the total addressable market will be growing for many years to come.

Source: Okta Investor Day 2021

However, even with that impressive scorecard, ticking all three criteria. Okta is far from reaching the primary cloud status.

I believe Okta still relies heavily on external solutions through integrations. For example, for IGA solutions, SailPoint (NYSE:SAIL) is the principal provider. Then for PAM, it's CyberArk (NASDAQ:CYBR) and Beyond Trust. You could argue these are not IAM, but they are essential solutions and are complementary extensions to IAM that I described in the third section - 'What is IAM.' Then there are also many adjacent use cases that Okta has yet to provide.

If you look at the list of integrations again, you can spot many parts of the identity market and use cases that Okta has not addressed thoroughly.

Then, Okta also lacked capabilities in the customer identity segment, being launched just two years ago.

This brings us to the next section.

VI. Big, bold moves - entering PAM and IGA markets

Every year, Okta holds Oktane, a three-day conference where it showcases the latest technologies. For example, last year, it launched the Okta Identity Cloud. This year, at Oktane21, the company announced four significant developments.

• Auth for All: Unveiling Okta's new experience for developers

• Expanding the Okta Integration Network for Customer Identity

• Introducing Okta Identity Governance and Okta Privileged Access

• Okta for Good Drives Sustainability

The two biggest ones are the announcement of two new products to enter the PAM and IGA markets. I believe they will provide the most significant push to help Okta reach the primary cloud status eventually.

PAM - Privileged Access Management

First, PAM. It allows more advanced access configurations to essential applications and assets, such as servers, databases, and containers. PAM is also an expansion to Okta's existing Advance Server Access product.

Source: Okta Investor Day 2021

It can also be categorized as a security product since it tightens access and protects the most prized assets in the organization.

Previously, to serve this market, Okta partnered with SailPoint. But it was a solution for customers who operate in the legacy environment where they might not intend to modernize their IT system, and they don't want to move to the cloud.

But Okta can see the trends firsthand: most companies are moving to the cloud. Thus, the announcement to bring their PAM product is a huge step towards meeting the demand for the future enterprise.

So, what does PAM allows you to do that the Okta core IAM products can't?

PAM allows the IT administrator to create individualized access to prized assets, set the precise time and parameters that the user can do once in. Once the period expires, the PAM system takes back the account, changes the password, and logs all activities for audit. As a result, IT administrators can say goodbye to 'shared username and password.' PAM allows just-in-time and more customized access to key resources, improving security and aligning with Zero-Trust security posture.

IGA - Identity Governance Administration

Second, IGA, as the name implies, the product provides governance and administration of identities. One of the biggest reasons IGA was introduced was that identities and IT systems could be manipulated. The prime example is what happened in the Enron scandal. Following the event, compliance requirements such as Sarbanes-Oxley ('SOX') and the Health Insurance Portability and Accountability Act ('HIPAA') emerged to ensure IGA the standard practice for identity governance.

However, the standard was set for the workplace 20 years ago. The cloud-first world is a lot more complex, where the number of resources accessed by employees has exploded, and employees are no longer just traditional employees. Employees today can be contractors or partners whose access and governance needs are just as extensive.

IGA can be thought of as the police of identity management, setting policies and enforcing rules for all employees.

Source: Okta Investor Day 2021

Some of the tasks carried out by IGA are:

• setting clear access rules and policies,

• automated reviews of periodic access rights, approvals, and certifications,

• managing the life cycle of identities, and

• help with audit and compliance.

The result? Boosted productivity and security.

To compare PAM and IGA, whereas PAM can be seen as the technological addition to IAM, IGA can be the policy and process component.

Altogether, the three allow Okta to provide end-to-end solutions across tech stacks in a single control panel. What's immediately accretive when the three are on the same platform is that using Okta Workflow, customers could automate processes across the three products, from authentication, authorization, to governance and reporting, embedding deeper and deeper into customers' workflow.

Finally, customers still have the flexibility, customizability, and freedom (no lock-in any vendor) through the use of APIs, templates, and SDKs to create the best combination of these three to match their business specifications. It's a thing of beauty.

Meanwhile, the market opportunity is enormous and still new as the most prominent incumbents are still using internally built solutions. Thus, it is no surprise that the estimated addressable market for these two products is $15B annually, expanding Okta's total addressable market to $80B.

Source: Okta Investor Day 2021

Customer Identity is the customer data that shops and stores have about you. Suppose you go to Nike (NYSE:NKE) and an app could show you what fits best with your sports interests. It's a fast-growing part of Okta's business.

To sum up, both PAM and IGA will expand use cases and deepen capabilities, giving customers a complete suite of Identity solutions from setting up rules to audit and compliance. I believe they are huge strides towards making Okta Identity Cloud a primary cloud.

VII. The Auth0 acquisition

If PAM and IGA were big moves, then you will be in for a treat. The acquisition of Auth0 (pronounced Auth Zero) announced in March can lift Okta's capabilities even higher. The most significant and most obvious benefit comes from the Auth0 developer's tool kit. Then, there are many synergies too. I believe it's a match made in heaven. One that will also increase the chance for Okta to become a first-class cloud.

Here is what the CEO of the two companies said in the announcement:

Combining Auth0's developer-centric identity platform with the Okta Identity Cloud will drive tremendous value to both current and future customers. said Todd McKinnon

Okta and Auth0 have an incredible opportunity to build the identity platform of the future. We founded Auth0 to enable product builders to innovate with a secure, easy-to-use, and extensible customer identity platform. Together, we can offer our customers workforce and customer identity solutions with exceptional speed, simplicity, security, reliability, and scalability. said Eugenio Pace

You could sense the excitement in both CEOs at the announcement and why they have been working on this deal since 2015 (!).

From the financial standpoint, it makes sense as the acquisition will double Okta's customer identity segment. Auth0 is also growing faster at >50% compared to Okta's >40%. Like Okta, its products also demonstrate impressive product stickiness with a >120% net retention rate. All great so far.

Source: Okta + Auth0 presentation slide

But it is the non-financial aspects that make this acquisition compelling.

1. Common vision and ethos

2. Product complementary and channel synergies

3. Geographical synergies International presence

4. Accelerate TAM penetration

The first and the most crucial factor is that both companies share the same vision.

Okta's vision is to

"Accelerate a world where everyone can safely use any technology. We bring simple and secure access to people and organizations everywhere."

And Auth0's vision is:

"Our vision is to provide people with secure access to any application in one-click or less."

These statements are uncannily similar. Both aim to build simple and secure identity solutions for the digital-first world. Thus, it's not surprising to see that both companies' values are also aligned.

Source: Okta + Auth0 presentation slide

And that both of their solutions are cloud-first, developer-led, and customer-centric.

However, the difference and complementary features between the two companies are what make this deal tick.

Whereas Okta is more focused on the workforce identity segment (more IAM), Auth0 is purely on customers (more CIAM). Then, Okta focuses on building a broad and integrated platform, appealing to C-suit execs; Auth0 is laser-focused on building a develop-first and extensible platform.

These are compelling complementary features. Together they would be able to sell to different customers using different channels. They could also give customers more choices, from the most straightforward and out-of-the-box solutions to the most unique and customized ones.

As Todd McKinnon explains and illustrated on the slide below

[…] it extends our go-to-market model through self-service and allows Okta to efficiently address more market segments.'

- Q4FY21 CC (emphasis mine)

The third reason why the acquisition is compelling is the synergies for international expansion. Auth0 was founded in a global environment with Eugene Pace, the CEO, and the CTO co-founder, Matias Woloski, running the company while 7000 miles apart. It is no surprise that over 40% of Auth0 business comes from outside the U.S, twice the proportion of Okta at 20%.

Lastly, combining the two doubles the total customer identity business and adding thousands of customers, developers, millions of users, and the thousand strategic partners. Not to mention the billions of signals in logins, applications, devices, and usage insights. All together improves the competitive moat of a larger data network effect that I explained earlier to penetrate the market quicker.

Ultimately, the acquisition of Auth0 is accretive both financially and strategically. The deep developer-led capabilities from Auth0 also allow developers to build unique products and use cases. It extends the potential for Okta the serve adjacent markets in the future.

Putting the big moves in PAM, IGA, and the Auth0 acquisition together, I think initially it might be about expanding use cases and strengthen the market position.

Source: Investor presentation 2021

But looking at the slide above, you could see that the next level is to expand to adjacent markets. IGA and PAM first, then analytics, security, and many more.

To imagine how it might look at the end of the decade, the Okta Identity Cloud could look like something on the slide below.

Source: Auth0+Okta presentation slide

It will be the central hub to all other primary clouds, the key to the most critical technologies. So, given the unique vantage point and access to essential insights that Okta has, it could gradually creep into more adjacent technologies. The announcement of PAM and IGA has just replaced SailPoint and CyberArk products. What stops it from developing other technologies it is opening the door to?

I mentioned ID Proofing earlier in the article, then there is End Point Security, Email Security, and Security Analytics (see below). Any of the technologies below could be the next target.

The possibilities are endless.

Conclusion

Okta has achieved a lot since its founding in 2009. It has transformed how the industry looks at Identity, from just the 'login box' to the connecting tissue of technologies today.

In the next decade, Okta's vision is to make its Identity Cloud Platform one of the essential technologies and become the key to all technologies.

To achieve that, as the first significant step, they have extended their cloud platform capabilities to PAM and IGA, providing the most comprehensive end-to-end identity solution in the industry. Then, they acquired Auth0. It promises to strengthen Okta in so many ways that the $6.5B price tag will look small in the future.

Ultimately, I believe Okta has made huge strategic moves. It has everything to be a primary cloud and more. The opportunity is gigantic. I would absolutely pay more than $35B market cap to own a slice of this company.