Welcome, everybody. Thanks for joining our fireside chat here with Okta today. I'm Eric Heath, Senior Research Analyst here at KeyBank. Come on. I really appreciate you doing this. Great.
Yeah. Thanks for having me.
Look, so I mean, you might be a new face to some investors.
Sure.
It'd be great to just get the overview and your perspective on the business, what, what your role is, and.
Yeah.
We'll go from there.
Sure. So good morning, everybody. Monty Gray. I'm responsible for corporate development at Okta. I've been there a little just past six years, so it seems like a long time. What I cover is I'm responsible for corporate strategy, M&A, technology partnerships ecosystem, Okta Ventures, our social impact ESG efforts, and just a number of other cross-functional initiatives for the company.
Yeah. That's great. Great perspective. So just given that purview, at Okta, just give us your high-arch or overarching view of the Okta corporate strategy and why you think that's the right strategy.
Yeah. Sure. So our ambition is really to enable anybody to use any technology securely, right? That's kind of the tagline vision as a company. Our ambition is to actually elevate and have identity itself be a major prime. We use the term primary cloud internally, which could show up as, you know, think of a company or a business that's $5-$10 billion in size. To do that, we participate in two related but distinct categories. One would be workforce identity, which I think is what a lot of people know Okta for. Workforce identity is when you interact with your employer or business partner, interact with your applications within the organization. The other is the customer identity segment. Customer identity is if you're a consumer. So think of the B2C use case, a brand interacting with their users, right?
That's customer identity. There's another subcategory of that, which is how to power SaaS applications. So when you think of the SaaS applications, we have a part of our business that will actually be embedded in those and power that as well. And so ultimately, like, those are the two categories. How we're gonna be successful for those are a couple key tenets. One of them is the tenet of neutrality. So we believe in enabling best-of-breed and being a neutral vendor, not part of another stack. And, you know, we can get back to that part. Another one is security, having a security focus. So we do this, and, you know, we have the number of inbound requests we're getting, number of inbound threats we're getting. We have to do all this in a secure fashion, security-forward.
And then finally, developer-centric. So particularly on the customer identity side, just, like, meeting the developers where they are early in the cycle because that tends to be a different top-of-funnel cohort. And we support all of that with just a, you know, multi-pronged go-to-market operating model, multi-segment, multi-GEO, multi-product, direct, indirect. And for each of those, we have different nuance that we've been evolving over time.
Great. That's great. So you guys had a solid Q4 earnings results, and I know that must have took a lot of work to deliver those results, in light of the security incident. So can you talk about where the sources of strength were and how you guys were able to deliver such a solid report despite what I imagine was a lot going on in terms of Project Bedrock and.
Yeah.
A lot of customer communication. So how was the team able to execute on those results, and what were the sources for the upside?
Yeah. So I think the team did an amazing job in light of Bedrock and the security incident. I think there was a lot of conversations, a lot of distraction during it, but we're fairly proud of how that showed up. I think the highlights of the quarter were really around overperformance in, you know, free cash flow, operating margin, and on the top line, which is really the narrative there is really one of large deals, large customers, which when we think about large customers, it's with an ACV of over $100,000. And so we look at that cohort, and that average is at an all-time high. And then you look at the over-$1 million ACV cohort as well. That's also an all-time high for us. So those were some areas that we were super proud of that happened.
I would say the team managed through the conversations. There was a natural maturity that happened there, right? First, it was, you know, what happened, what's customers wanting to understand. You know, I was part of a number of these conversations myself with some of our largest customers. Like, what's really happening in, in the incident? Then the next one was, like, was I impacted? And then after that was the natural arc was, well, wait a second. You guys have done all this work around it. Tell us what you did. And we, we kinda walk them through, like, everything that we've been doing ourselves and kinda the broader security health of the company. And then the, the natural next step is, like, great.
We wanna see that checklist so we can do that ourselves 'cause we, we know if you're being attacked as much as you are, we also wanna see that. And so I think it's just a high-calorie effort, honestly, with the customers there.
Yeah. I mean, I think the feedback we got is, look, you guys are a big company now, a lot of customers, and one of the most widely deployed identity solutions out there. So just not too dissimilar to Microsoft. Like, if you're gonna be the biggest gorilla in the room, you're gonna have a big target on your back. And it seems to me that reassurance of the how serious you're taking this incident from Project Bedrock to the Secure Identity Initiative, etc., seems to me like the part that's resonating with customers.
Yeah. And I think it goes back to a longer-term trend that's out there, the relationship between identity and security. And for those of you who have followed the space, like, the early incarnation of identity was one of enabling technology, right? It's like companies would want to adopt a best-of-breed solution. And so you need an identity stack to enable that to happen. And then that quickly started to evolve into, great. Now that's proliferated across large organizations out there. People started realizing, well, that's actually an attack vector.
Mm-hmm.
So the posture of how you think about identity, from also from how you manage it, from the default settings, from the different categories around identity started to evolve to more of a security focus. And we've been thinking about this actually long before the incident. We've been thinking about this for multiple years. And I think just bringing our customers along that journey has really been helpful.
Yeah. So let's, let's talk about some of the products. And, there's a lot of stuff to get excited about when it comes to the Okta portfolio. Look, I think identity is probably one of the last areas of security to consolidate. So I, I, I think you guys are, are well-positioned to lead the charge there. And you had IGA come out last year. So let's, let's start there. And it sounds like it's been, nothing but, success above and above and beyond what you anticipated. So where are you finding success when it comes to the IGA, product suite?
Sure. So I think if you look at the IGA market, we're seeing a couple different categories of customers there, right? One customer would be somebody who doesn't have IGA at all. They're kind of probably a smaller company, probably new to the cloud. They're probably growing up, and they now realize they have to get into more governance. That's kinda one category. Another category would be a customer who's using some of our more advanced features, say, lifecycle management, workflows. So they're doing IGA type of, you know, use cases in the organization but without doing the full entitlements and the compliance aspects to it. Then you have another customer, which would be, you know, probably heavy SailPoint. Somebody has an embedded, very sophisticated governance solution in place.
The first two are where we do really well with our product, and we're seeing early traction. That's what makes sense, right? It's obvious. These are probably cloud-native companies. But they're also reacting to the convergence story that we tell. So when you think about what Okta historically has done on the workforce side, we have the users. We have the directory. We have all the app integrations. It's a natural launching point for where you can then do the next thing, which is, like, what's the depth? What's happening within the application? What are the entitlements? What are the access requests? That's a natural upsell for us. That's where we're seeing a lot of good momentum.
Yeah. And you've had some success in the enterprise, if I'm not mistaken.
We have success in the enterprise. Where that tends to work is, there's something episodic that happens around, like, moving a workload to the cloud or you're deploying Workday or something else, and you wanna actually have that part be governed as well in a cloud-native fashion. And that works well for us. So we're excited about that.
And in an enterprise setting, would you coexist with a traditional IGA solution that maybe addresses more of their on-prem environment, and you guys are addressing more of the SaaS and?
That's right.
Okay.
That's exactly right.
So, well, that's great. And then on PAM, so it's newer and just recently released. So there's not a ton of feedback, but maybe you can talk about some of the initial traction that you're seeing. And second, what are the learnings from IGA that you guys picked up, and how can you replicate this with PAM and see similar success?
Yeah. So PAM, as you mentioned, is probably about a year behind in terms of when we released it to market. The converged platform story is resonating with PAM. The early PAM success we're seeing are customers that actually have, you know again, if you look at that maturation of the platform where it's you have the users. You have entitlements. You have the connectivity. The privileged access story is just a natural extension of that. And another area of PAM where we're seeing some interesting results that relates back to security is we can provide privileged access against the Okta admin dashboard. That's a unique thing that only we do. And that's a huge threat vector that we're seeing. People understand what's happening there, through all the breaches. And so, like, PAM is actually resonating in that whole area.
To your question about what we're learning, we learned from IGA. I think it's really just understanding our customers and understanding where they're on that journey so we can do the upsell part of it. And that's, you know, that's a big focus for us this year. We see a lot of upsell opportunity. The dynamic is very similar to IGA in terms of large enterprise.
Mm-hmm.
I think the type of workloads you cover with PAM might be more expansive. When you think about databases, you think about servers, right? Servers meaning, like, if you have a cloud infrastructure, if you're a large enterprise with a build-out on AWS or GCP, like, our PAM offering will do well in some server access there. And all that is related to the converged story, so.
Yeah. Well, that's excellent. And both these products, right, our understanding is it's about a 30% uplift on both these relative to a core access management.
Correct. That's right. Correct.
Great. Given your perspective in corp dev, a couple acquisitions in the past 12 months in Uno and Spera, so just curious to get your perspective on why these capabilities were important to plug into the platform?
Yeah. So, those are very different types of acquisitions. We're always looking at innovation that can support a market trend or a roadmap. I think in the case of Uno, it's very small. We found a talented team to support a small nascent innovation that we have. So we wanted to bring them in quickly. Uno represents. We have something that we announced at Oktane last year. It's still pretty early. It hasn't really been released to market. And then there's Spera. That's a trend we've been looking at for a good 18 months. What Spera represents is a security offering to make our customers more secure, to provide more visibility into your customers' environments of your Okta and your non-Okta identity kind of your landscape, right?
We looked at, you know, the approach we typically take for M&A. We look at a theme. We meet with all the different market participants in that theme, and we get to know the management team and see if there's a deal and a situation that makes sense for us. We're very excited about the Spera team. I was just meeting with them yesterday. They're over here from Israel.
Mm-hmm.
We're excited about what they can do for our customers.
It's a workforce product, correct?
Yes.
Is it a standalone kind of solution, or does it plug into maybe PAM or?
It's a standalone solution.
Okay.
So, Spera is a standalone solution. And what it does is, think of it in the identity security posture management.
Mm-hmm.
So you can put it in your environment. It'll tell you everything about what's happening in terms of users, what access they, where they have access, maybe if someone's over-permissioned or under-permissioned, if they're Okta, if they're non-Okta. So we can show you other IDPs. We can show you service account access they might have. So it's really just a full view of what a user has above and beyond what might be governed through an IDP.
Mm-hmm. Yeah. And one other thing that was new from the, I think, on the earnings call was the Highly Regulated Identity.
Yeah.
It was new to me, and I'm curious to learn what, what gets you excited about this opportunity?
Yeah. So Highly Regulated Identity is on the Customer Identity side, right? Customer Identity again, if you're a large brand and you're engaging with your users, Highly Regulated Identity really focuses on the financial institutions. So if you're a large bank and you wanna have your customers, you think about the requirements that come from a solution like that and around identity. Identity requirements could be knowing and having the right journeys for someone to open a bank account. Like, that's a highly sophisticated thing, and you have to understand who the user really is. Another part of it is understanding if they wanna do something that's a high-value transaction within the environment. So a little bit beyond identity. So you authenticate into a bank, for example, and you wanna do a big withdrawal. Like, what are the different configurations of policies around that?
And so we're very excited about this. It opens up a good opportunity, and it supports that vertical, which is important to us.
Great. So maybe switching gears a little bit to the go-to-market side of things. So, I think Todd mentioned that sales productivity is, is probably the biggest source of, for upside, that he sees in the business going forward. So I guess give us a little bit more perspective on, on what he means by that and what are some of the initiatives you guys are putting in place to, to drive that productivity.
Yeah. I think productivity is—there's a lot of different elements that go into productivity. I think there's tenure is one of the you know, rep tenure is one of the four leading indicators of that. And so I was at our sales kickoff the week before last in Las Vegas. And it's always a great opportunity to speak to the reps themselves, understand the ground truth of how they're feeling, what the sentiment is at the beginning of the year. And there's a couple things that we did to keep them excited. I think one is just, and you saw this in some of our announcements around just the executive stability in the field where Jon Addison is the Chief Revenue Officer.
And a lot of people were coming directly up to me and saying how just how excited they were to see Jon in that role, and some of the changes he's able to make as a result of him being in that role. Another is just looking at the territories themselves, right? Having territory consistency year-over-year makes the reps just have a lot of confidence in their ability to actually close their deals. 'Cause at the end of the day, it's like the reps are gonna be here. They're gonna stay longer if they can close deals, if they can make their quota, if they can ultimately be successful. And the other part of that is everything we've been talking about around the growth opportunity for customer identity.
We spent a good part of the programming at our sales kickoff just enabling the field at a tactical level on how to sell customer identity. And that resonated with people. They realized that the growth opportunity there, the large deal opportunity there. And so I see a lot of people were super excited about that. And so that's something we're gonna be very deliberate on is introducing innovation to the field at the right cadence.
Mm-hmm.
Enabling them at the right on the right windows and putting the right incentives in place for them. And that seems to be resonating early on in the year.
Yeah. So, I mean, the salespeople have a lot to sell this year, right?
Yeah.
They have the core business. They have CIAM. They have PAM, IGA. They have Spera that's coming down the line as well. How are these people spending their time? What's the incentives you put in place to make sure these salespeople are going out to the right opportunities?
It's still so we still have a generalist sales model. We give the priorities of what we want to enable the field. So we try to space out the innovation that we have, the new products, as you mentioned, whether it's IGA, PAM. Spera will be a little bit later.
Mm-hmm.
And then the customer identity, the customer identity as a whole. Like, that's a priority for us as a company to get that out there. So I think a lot of it is just having them understand and how to actually get the heuristics from their install base so they can do those upsells. In there's a certain segments. For example, this is a new motion for us in the commercial segment. We actually are transitioning over to from pure generalist to a Hunter-Farmer Model. We talked about that last week at our earnings. That's just adding specialization to people who go after new business and people that go after install-based business. That's a trend we've been looking at for a good part of a year, just to see how can we optimize that relationship with them.
The fields they're very excited about that.
Yeah. Yeah. And in the enterprise space, are there certain incentives to sell CIAM, or?
We have, there's some incentives to sell CIAM.
Mm-hmm.
I think there's some more kickers on top to sell CIAM.
Yeah. Yeah. Makes sense. And then also something that you guys, I think were purposely calling out was, I guess, the channel momentum. So.
Yeah.
I forget the exact numbers, but six of the top 10 deals—Dave can correct me if I'm wrong—that were.
Eight.
Eight of the top 10 deals were influenced by the channel. So obviously, you guys, my perspective is historically a little bit more of a direct model.
Correct.
What might that have looked like a year or two ago in terms of these large deals being channel influence or channel source? And what's being done internally to drive that change?
Yeah. So I think today, roughly 40% of our ACV was channel was from the channel. And last year, it would have been about a third. And that's, that's there to your point, there's a lot of opportunity for us to evolve the channel. And when we think when we talk about channel, it impacts our business in different ways. We have when you think about the global SIs, right? The global SIs and you have to think about the role an SI plays in a large company, in a large implementation, and whether they're upfront implementing another SaaS application. We want them to think about how Okta can help enable that, right? And so we're seeing a lot of momentum in the large deals with the global SIs you're doing.
We're also seeing global SIs impact on the customer identity side, which is like.
Mm-hmm.
They're building out full solutions with their customer, and authentication is part of it. Now, another area on the distribution side would be our relationship with AWS. I think we did $175 million this year, going 130%. That's a big one for us. We're very excited about that. We see a lot of opportunity in front of us.
Yeah.
On AWS. And another part on the partner side. It's still early. We didn't announce it, so it hasn't really been impacted. Was just what we're doing with MSPs.
Mm-hmm.
In SoftBank in Japan. So MSPs is a new way for us just to gain some distribution. We're looking at the SoftBank opportunity as something that can go after the Japanese market for us. And we're very excited about that one.
Yeah. So I'm curious as part of, like, the identity and the GSIs and the customer that I don't know, symbiotic relationship, do customers just wake up one day and say, "I wanna swap out my identity stack, whether it's workforce or CIAM," or is there usually some sort of catalyst with a move to the cloud or application modernization? Just is it usually part of a broader project, and that's where the GSI kind of influence and relationship kind of comes into play?
It's, it's definitely more the latter part, right?
Mm-hmm.
There's something episodic that happens within the organization, whether it's, you know, deployment of a new HR system in the cloud where they realize, "Wait, my users are moving to the cloud. What else what else should go there?" So, like, that's a good leading indicator.
Mm-hmm.
IT modernization. We talked about the build-out on the PAM side of, like, adopting public cloud in large enterprises. Like, these are all catalysts where they realize, "Wait, we need identity. We need some security. We need some visibility to what's happening in those environments and with, with our users going to those environments." And so GSIs can help there, help have us top of mind as we as they think about that and think of us as enabling technology for that.
Yeah. And I did wanna come back to that, the MSP.
Yeah.
Partnership you talked about with SoftBank. I think it's interesting. So curious to hear how incremental that could be in the near term. And maybe, I don't know, just more broadly, the MSSP market, just how penetrated you are within that. 'Cause I think a lot of, we're seeing a lot more ISV security vendors started leaning to that channel a little bit more.
So we think there's a huge opportunity for MSPs. There's different flavors of MSPs. Like, sometimes you could have an account-based MSP, or you could have a full-scale managed MSP. What we did with SoftBank is a new development for us. It actually required some product work. So think of it as a single pane of glass to manage multiple Okta instances, right? We developed that not just for MSPs, but for some of our larger customers. So we looked at some commonality that we're seeing with some of our more sophisticated environments. And so, like, this looks very similar to what an MSP would like. So we built this Project Aerial. We announced that at Oktane.
Project Ariel.
Yeah.
It's like a multi-tenancy.
Correct.
Platform.
Exactly. Exactly. It's a multi-tenancy, single pane of glass. You can manage and you can do it from delegating down, but also.
Mm-hmm.
From a billing perspective. So we looked at what market makes sense for us. And, you know, again, Japan. SoftBank has 16,000 customers in this program. And we think that's a huge opportunity for us to actually gain some reach. We're looking at it for other GSIs, but this year is really just about making SoftBank successful and making that multi-tenant successful. But we think that's a big lever for us going forward.
Great. So any questions in the audience before we yeah, one in the back. Alex?
Any comments on the solution you had in terms of what you learned, what you changed, how you addressed it? And secondly, given that you're almost strong, is there anything about the Python leading to 200 breaches?
Yeah. So the question was about the breach, what we've learned. I think there's tactical things you learn internally, right? With every breach, there's some nuance there about what happened itself. And there's a report and a blog post out there, so all the details I don't have to go over. I think what we've mostly learned is how we talk to our customers and how we engage with them early on. So there's a right balance about being early in the communication to your customers, but also being thorough in the communication to your customers. And you don't wanna over-index on either of those. If you go too early, you might have incorrect information. If you wait to be too thorough, you might be too late. And there you introduce uncertainty.
So what we found is just activating our, you know, our team to actually have those, you know, high-touch conversations with the customers really matters upfront. And yes, we are doing a lot. You know, we've announced at earnings last week the Okta Secure Identity Commitment, which is really a manifestation of things we've been working on for a long time, but this is more like public-facing, just about what some of the things that we are doing internally. I would say it has prioritized a number of things that, from a roadmap perspective internally over the past we talked about some 90-day sprints. Some of those are ongoing about things that we're doing, both from our own internal security, but also as we add security to our products. Like, those have all been prioritized as a result of this.
The other part of the question was around pipeline and how we feel about that going forward. We feel very comfortable about it. We have a great pipeline, going into Q1 this year. It's we don't see any quantifiable impact at this point from the security incident. And so we're pretty optimistic.
Great. Any others before I go? Okay. Look, so one area that I think still could use some improvement is probably on the new logo side of things. And I think part of this is being addressed with the Hunter-Farmer Model. But what's happening from a go-to-market perspective or a macro perspective that's weighing on that number? And I know, obviously, the Hunter-Farmer Model's partly addressing that. But are there any other things that you're doing to spark that?
Yeah. I think it's Hunter-Farmer. You covered it. So macro, from our point of view, has been fairly consistent in terms of, you know, the segments, right?
Mm-hmm.
So we've been looking at the small commercial segment and the small business segment for some time now, which is why Hunter-Farmer didn't just show up. Like, that's something.
Yeah.
That takes a lot of change and adjustments. And so we've been looking at that for a good part of a year. So we're super hopeful about that. We're reacting to what we're seeing in the market with that for new logo. The other part of new logo is really the large customers.
Mm-hmm.
We think there's gonna be more momentum on that one. So those two combined, I think, we're still cautious. We see that as we plan for the year. But we're reacting to what we're seeing in the market.
Great. And again, coming back to kind of your purview at Okta, but just when you talk to Brett, how do you guys think about capital allocation going forward in terms of, I don't know, M&A?
Yeah.
From your perspective or buybacks, what have you?
Sure. We're gonna be thoughtful about M&A going forward. You know, we're in the opportunistic position where we don't have to do M&A. But there's a lot of good innovation that's happening out there. And, you know, my team is, you know, we meet with hundreds of companies per year. And.
Mm-hmm.
We really have a good idea of what's out there. We're trying to be as prescriptive as we can to what we as we stagger our innovation. I think from the balance sheet perspective, there's a focus on just looking at the debt part of it right now.
Mm-hmm.
You saw some things we announced around the net settlement method we're doing.
Great.
So those are all part of, like, the bigger picture. And, you know, Brett and I meet quite regularly to figure out the best ROI there.
Okay. All right. Well, we're about time here. So, Monty, really appreciate you doing this. And it was great.
Yeah. Likewise.