To The Moon

Summary

• Okta's recent security incident could undermine customer trust in the company and further slow growth.
• Okta's vision of a unified identity security is coming together, with the recent release of its PAM solution. Okta also appears to be entering the consumer identity protection space.
• While Okta's valuation is modest given the company's potential, share price performance is likely to be determined by the company's ability to stabilize growth and continue progressing towards breakeven.

MASTER/Moment via Getty Images

Okta (NASDAQ:OKTA) remains a leader within identity security, but it has faced a number of headwinds in recent years, most of which have been self-imposed. While Okta's stock isn't overly expensive, growth remains modest and the company's leadership position is less clear than in the past. The expansion of Okta's identity platform into IGA and PAM could help reaccelerate growth and strengthen the company's competitive position, but this will take time as these products are still relatively new. Okta also seems to be counting on Identity Threat Protection to drive growth, but CrowdStrike's success in this area suggests that competition will be fierce.

Market

While Okta's share price is up significantly over the past 18 months, the company's growth rate and valuation remain depressed. This could be attributed to execution issues, market conditions, competition, or some combination thereof.

Okta has stated that while the macro environment has stabilized, demand remains depressed. Net new customer additions are still low, expansion continues to fall and contract durations have shortened. While the demand environment is clearly weak, Okta's commentary stands in sharp contrast to CyberArk (CYBR). CyberArk said little about macro conditions on its last earnings call, although noted that identity security remains a priority for customers and that it was seeing increased demand for its platform. This is not surprising, as approximately 80% of attacks exploit identity-based vectors according to CrowdStrike (CRWD).

Primary competitors within access management include Ping Identity and ForgeRock. There are also large platforms, like Microsoft, who are trying to drive adoption of their identity products. While Microsoft will generally have a lot of success in any market it targets due to its distribution, Okta doesn't seem overly threatened. Despite being free, only 34% of Microsoft admins adopt MFA compared to 90% of Okta admins. Microsoft integrations also favor its own platform, which is sub-optimal for most customers. There is little to suggest that Okta's soft growth is due to competition. Management commentary has pointed towards a stable pricing environment and strong win rates. Churn also remains relatively low.

Okta's expansion into IGA and PAM, and the general convergence amongst identity security categories, is likely to shift the balance of power over time. Okta Identity Governance has been on the market for some time now and seems to be doing well. The company's PAM solution has only just been made generally available though.

Okta believes that the switching costs for both its customer identity and IAM products vary. Companies with relatively light implementations can switch fairly easily, while implementations that involve a lot of custom integrations have high switching costs.

Security Issues

Okta had another security incident in October 2023, potentially undermining customer trust in the company. Attackers obtained the details of some of Okta’s customer support agents, which could be used for targeted phishing attempts.

The longer-term impact of this will only likely be felt in coming quarters, but Okta reported that business slowed somewhat towards the end of the third quarter. This could be related to the security incident and Okta took this into account when providing forward guidance.

As a one-off, this type of incident would be understandable, even if far from ideal, as the importance of identity security and Okta’s strong position in the market make it a high-profile target. Multiple serious incidents in relatively short succession could result in customers having zero trust in Okta though.

Product Innovation

The three main segments of identity security are:

• IAM - provides single sign on and multi-factor authentication.
• PAM - provides identity security for infrastructure and users with elevated access.
• IGA - helps with the management of identity (account creation, access levels) by providing automation and reports for auditing.

While IAM is the core of Okta's business, the company is trying to create a unified identity platform by expanding into PAM and IGA

Okta Identity Governance is seeing adoption amongst larger organizations and has been exceeding Okta’s expectations amongst customers that had an existing governance solution. Okta believes that OIG has a bright future amongst smaller organizations, even if adoption has been slower so far. Around one third of workforce spend is coming from IGA, indicating the growing importance of OIG.

Okta’s expansion into governance was supported by its replication and synchronization engines, which synchronize accounts across directories and applications. The ability to change profiles and update permissions, along with automation and the customization provided by workflows, formed the basis of Okta’s governance solution. Okta also had to develop access certification workflows to contact managers so that they can attest to changes.

Okta Privileged Access is also now generally available, which Okta believes has synergies with its IAM solution. If customers are already using Okta for IAM, it potentially makes sense to leverage the same engine and access controls for privileged servers and containers. Customers may also find value in having Okta manage the privileged accounts in SaaS apps. As a counterpoint to this, customers may consider it a risk to rely on one vendor for all of its identity security needs. It will likely take at least a few quarters for the impact of Okta's PAM solution to become apparent, but I think this is one reason to think the company's forward guidance is overly pessimistic.

Okta is also now providing identity threat protection in collaboration with companies like Zscaler (ZS), CrowdStrike and Palo Alto Networks (PANW), by leveraging Okta AI. This solution addresses post-authentication threats, like session hijacking, Adversary-in-the-Middle and MFA bypass attacks. Okta doesn’t want to compete with companies like CrowdStrike. Instead, it is positioning its product as identity threat protection specifically for Okta. CrowdStrike’s product has greater scope, encompassing things like on-premises AD and Azure AD. Identity is currently one of the strongest performing parts of CrowdStrike’s business, with identity ARR now in excess of 200 million USD, up nearly 200% YoY, and the market opportunity expected to be worth 17 billion USD in 2028.

Okta is also introducing Okta Personal, the company's first consumer facing offering. Okta recently stated that it wants to provide security to everyone, meaning there are likely to be more consumer applications to come. Okta recently acquired Uno in support of this initiative.

Financial Analysis

Okta's revenue growth was 21% YoY in the third quarter, driven by a 22% increase in subscription revenue, implying soft non-subscription revenue growth. Growth was fairly even across geographies.

RPO only increased 8%, which was largely the result of a shortening of contract term lengths. Overall average term length remains just over two-and-a-half years.

Okta expects 585-587 million USD revenue in the fourth quarter of FY2024, representing YoY growth of 15%. Guidance is soft due to ongoing macro headwinds and the recent security incident. As a result, I expect fourth quarter revenue to be something more like 610 million USD. The market reaction to this may be fairly muted though as Okta has a history of providing soft guidance and beating expectations by a wide margin. Preliminary FY2025 revenue guidance is 2,460-2,470 million USD, representing 10% revenue growth at the midpoint.

Figure 1: Okta Revenue Growth (source: Created by author using data from Okta)

The number of job openings mentioning Okta in the job requirements has been fairly steady over the past 12 months, although it remains depressed relative to 021 and 2022 levels. This suggests that demand remains sluggish, something that is supported by weaker growth in Okta's customer count.

Figure 2: Job Openings Mentioning Okta in the Job Requirements (source: Revealera.com)

Okta has struggled to attract new customers in recent quarters, something that the company has attributed to the macro environment. While net new customer additions ticked up in the third quarter, Okta is still struggling to add customers.

Figure 3: Okta Quarterly Net Customer Additions (source: Created by author using data from Okta)

Okta's gross retention rate has been fairly consistent in recent quarters in the mid-90% range. The company's dollar-based net retention rate for the trailing 12-month period declined to 115% though. This is problematic as Okta is heavily reliant on upselling and cross-selling to drive growth at the moment.

Figure 4: Okta Dollar-Based Net Retention Rate (source: Created by author using data from Okta)

Okta's operating profit margin has improved significantly in recent quarters, which is likely due to a combination of:

• Operating leverage
• Cost cutting efforts
• Realizing synergies from the auth0 acquisition

Okta is already generating strong free cash flow, but this is being more than offset by the company's heavy use of stock-based compensation.

Figure 5: Okta Operating Profit Margin (source: Created by author using data from Okta)

The number of Okta job openings has trended up modestly over the past 12 months. While this could begin to undermine margins at some point if growth continues to soften, it is probably suggestive of a stable macro environment. This stands in contrast to a number of cybersecurity peers who have sharply ramped up hiring in recent months.

Figure 6: Okta Job Openings (source: Revealera.com)

Conclusion

Given Okta's growth rate, it would not be unreasonable to expect the company to trade on a higher revenue multiple, particularly given the fact it is a leader in its core market. Investors remain skeptical towards the company even after meeting a number of its of own goals.

While Okta has faced a number of issues over the past few years, the company's revenue growth hasn't actually been that bad considering the macro environment. Recent product introductions and improved sales force productivity could also see growth improve or at least stabilize going forward.

Of greater concern at this point could be Okta's losses. While the company's operating profit margin has improved significantly in recent quarters, losses are still relatively large for a company its size and growth rate. Investors are also likely concerned about Okta's competitive positioning given the recent security incident, although this appears unfounded at this stage.

While software stocks in general are beginning to look expensive, Okta probably has further upside, particularly if the company's growth rate stabilizes. Based on a discounted cash flow analysis, I estimate that Okta's fair value is around 125 USD per share.

Figure 7: Okta Relative Valuation (source: Created by author using data from Seeking Alpha)