Brett describe in more detail, but Okta is actually what secures all of you in this audience. So at Jefferies, we really care about our clients, and so for customer identity, we actually use Okta. We care less about our employees. We use another vendor, I won't talk about that. But just wanted to give that background. But Brett, really appreciate you joining us here today. Maybe the room is certainly filled with some generalists, maybe just to give a background on, you know, what Okta does and why it's so mission-critical for security.
Yeah, absolutely. Thank you, Joe. So happy to hear that you're, you know, happy Jefferies customer. We do need to get that other side. So I'll talk about both sides of the business real quick. So there's, you know, Okta is two main businesses. One is workforce identity, and that is where we secure our customers, employees, and partners' identities. And then what Joe was just talking about is there's a second side of the business, which is customer identity, where we secure our customers' customers' identities. If you look at the business in total this year, we're guiding a little north of $2.5 billion of revenue, growing around 12%, for fiscal year 2025. If you look at that, it's just in the very early innings of what we think the total addressable market is.
The total addressable market, we believe, in total, is about $80 billion. That is broken down between workforce being about 50 and customer identity being about 30 billion of that. So you can see that we're very early on in this opportunity. The way we deliver the product is via cloud infrastructure, so it's a multi-tenant offering in most cases. There are some situations where we do offer a single tenant or a hybrid on-prem connector for those who are making that transition from on-prem over to the cloud. In terms of a couple other financials, I talked to you about the revenue side of the house. In terms of margin this year, we're guiding about 19%-20% non-GAAP operating margin and about 22% free cash flow margin. So at scale, generating a good amount of margin.
So that's just a quick overview.
Awesome. Thanks. That's helpful context. Maybe to start super high level on macro and the environment before we drill into Okta, there's been a wide dispersion of results so far, right, in cyber and broader software. I think cyber has hung in better, but what are you seeing out there when you look at budgets? Is AI cannibalizing budgets? Where is cyber in the prioritization? And then maybe-
Mm
... if you could talk about enterprise versus SMB as well.
Yeah, absolutely. So macro is definitely a headwind to us. We've talked about it for several quarters now. We don't see it getting worse or getting better at this point. When you look at our guidance for the balance of the year, we're assuming really the macro as it is today, which is a headwind, and it's a headwind in a variety of ways. But the main one that we see it on is on new logo acquisition. It is harder to do business with new customers at this point. If you look at the last several quarters for us, most of the business or most of the net new ACV is coming from an upsell side of the house, upsell being either seats or from cross-sell.
And when you dial in and you dive deeper into that, it's really more cross-sell than it is more seats. People are much more thoughtful about their budgets at this point and their contractual spend. So, when we look at it from a segment perspective, what, Joe, you were just saying, enterprise seems to be holding up a little bit better than SMB. So it's always, it's been a challenge a little bit more from a small, medium-sized business. I think just with the assumption they don't have quite the balance sheets that the enterprise and strategic customers do. Also, we do service public sector and have done quite well there recently as well, so think of that being very much like enterprise and strategic. The balance sheet is much stronger for those government agencies.
In terms of AI versus security, we haven't seen any difference, to be honest with you. It feels like you know, we're still a high priority. Identity or security is still a very high priority for not only our current customers, but also, any prospects out there.
That makes sense, and we would expect cyber to continue to be resilient. Despite those macro challenges, you still grew CRPO 15%.
Mm-hmm.
You guided 2Q to 10%-11% growth, and historically, you've been very prudent. I won't ask you the degree of prudence, but maybe as we think through upside drivers or top drivers of growth, you know, what, what are the three or four things that could maybe eventually reaccelerate growth?
Yeah. So if you look at the top three strategic initiatives we have this year as a company, first one is security, second one is reigniting growth, and the third one is scaling the organization to continue to improve the leverage of the business. So I'll dive into the second one, which is reigniting growth. So we have come up with and driven a lot of new products lately, so you can look at governance, you can look at PAM. Customer identity is obviously a massive opportunity that we continue to expand in with Fine-Grained Authorization. So improving the product set so our sellers have more to sell to our customer base. The other one is expanding our partner ecosystem. So historically, Okta has been reseller-focused or traditionally reseller-focused, think SHI, CDW.
The last time we spoke about it, about 40% of the total revenue stream came through the partner channel, with the vast majority of that being the reseller organization. Now, there are two areas that we want to get more deeply ingrained in, which is the cloud service providers like AWS, which we announced last quarter at the end of Q4. It was about $175 million of ACV, or annualized contract value, growing about 130% year-over-year. The other area that we need to invest more into is the GSI community. We have historically not had as much attention from them, primarily because Okta is easy to turn on.... That's one of the benefits of Okta. A lot of times, you just, you go and purchase it, it turns on pretty easily.
There's a very light amount of implementation work. You can see that through our professional services as a percentage of revenue. It's only about 2% of total revenue, at least in Q1, and it's been about 2%-3% for the last couple of years. So we need to be able to improve our relationship with the GSIs and focus on them and show them how identity can play into one of their practices and make them a lot of money. So those are the areas that we're from a partner perspective, we're focused on. And then the third area is something we just implemented in early February, which is a hunter/farmer model in our Americas SMB business. So I talked about earlier that new logos are harder to attract right now.
So what we saw in our, in our quant that we felt that was the best decision for us, was to split our lower-end SMB, meaning small and medium-sized businesses, our lower-end customer sizes into a hunter model, which is a rep who only gets paid money when they bring in a new logo, versus a farmer who is, you know, farming the current customer base. So we think that those three areas, the new products, the partner ecosystem, and the hunter/farmer, should help us reignite growth over the medium term. I'm not saying-
Yeah
... it's over the near term. I mean, in a SaaS revenue model, it's hard to accelerate that in such a short-term time frame, so it'll take us some time.
That AWS number is super eye-popping, you know?
Mm-hmm.
Is that the only marketplace you're on, or are you investing in other marketplaces? And then, how do you think about what inning we are in, in that AWS? Is that a-
Yeah
... a long runway? Is that helping you move further down market? Maybe just give us a little more detail on that.
Yeah, it's. We have a, I think, a special relationship with AWS. We're one of the largest users of their service, just from a pure AWS perspective, so we've got a very close partnership. Yeah, I mean, we're excited about the partnership. I think there's still a lot of room to run. And I think it'll get us both, you know, SMBs and enterprise strategic, so I think it's definitely a good opportunity for us. In terms of the other marketplaces out there, we are in the early days with GCP, and Azure not so much, given-
Yeah
... they are a competitor to us. So, we're looking to continue to build out the GCP side, not just from a go-to-market partnership, but also from a product perspective, having a diversity of platform. Because we are actually on all three platforms at this point, but the vast majority of it is AWS. So-
So $2 billion business, $80 billion TAM.
Mm.
You've had fantastic improvement in margins-
Mm-hmm
... the last year.
Thank you.
How do you think about- ... Hey, credit where credit's due.
Yeah.
You really have. How do you think high level, and then a few follow-ups, but how do you think high level about the growth versus profitability? 'Cause you obviously-
Mm
... the investors in the room want profitability, but you also want to make sure you're not under-investing-
Agreed
... to capture that TAM.
Yeah, so we're, we are gonna do the same thing that we've done for years, which is manage the business through the lens of the Rule of 40, where, you know, balancing growth with profitability. If there's opportunity to grow faster, we're gonna take it. If there's an opportunity to create leverage, we will do that. I think we've done a really nice job of increasing leverage over the last couple of years. It's taken a lot of work by a lot of people across the company. And, you know, I think we've built the pillars to be able to not only invest in the business but also create leverage.
It's something that's paying off specifically, actually, in FY 2025, to be able to deliver these types of margins, while also investing a lot of money in areas like security or reigniting growth or scaling the business. I think I'm really proud of the team, but there's still a long ways to go.
How do you think about, you know, the sales and marketing side of the investment?
Mm.
You know, where are we on capacity?
Mm-hmm.
Are we still hiring? How do we think about efficiency going forward?
Mm.
And then, you guys have made a ton of structural changes the last few years. Is there anything left to do on the go-to-market side?
Yeah. I mean, from a capacity perspective, we feel like we have the right amount of capacity for the balance of the year. Right now, what we're looking for is... I kind of look at it as capacity is the glass, and the water level is, in the glass, is the productivity, and we still are not overflowing the glass. When we see productivity get to a certain point, we'll start adding more in, but at this point, we feel, you know, happy where we are. In terms of potential changes in the field, we're always looking at new things and making sure that we're getting the best ROI out of the things we're doing today. So, for example, with the hunter/farmer, you know, that's only been in place for a quarter now.
We you know, we're optimistic that it'll be accretive to both logo count and growth in the future, but it's only in a smaller segment in a larger geo. There's a potential that we could expand beyond that, but we want to make sure that it's successful first before doing something like that.
And then, how do you think through sales force's capacity to sell everything? 'Cause, I mean, really, in your tenure-
Yeah
... as CFO, you've gone from largely one product-
Mm-hmm
... then adding a major CIAM customer identity market, as well as-
Mm
... IGA and PAM in the last couple of years. And so is that an easy sale, a complex sale? How do we think about sales force's ability to sell?
I think we are getting better. I would say that there's areas like customer identity, which is a massive market in its own right. We have definitely gotten better. We actually track participation in the field of which deals you participate by product. So, for example, if you look back two years ago, you know, the vast majority, vast, vast majority of the field was in a workforce identity deal, 'cause that's our... That's where we came from. That's where we started. If you looked two years ago, the delta between the workforce participation and the customer identity participation in the field was, I mean, not super scientific, but like this. Let's just imagine that. If you go, flash forward two years, this number's basically stayed the same, but they're getting closer together. So we are getting better.
There is still improvement in the field to get better on customer identity. In terms of the newer products like governance, PAM, Posture Management , Threat Protection , Fine-Grained Authorization , I think those are still a ways off in terms of maturity and in terms of the field being able to sell them. Some of them are easier sells. The governance tool is basically an extension of our Lifecycle Management and Workflows tool, which is under the Workforce Identity Cloud. That is an easier sell for a lot of our sellers because it's tangential to what we've done for years and had a lot of success in.
Things that are a little further afoot, like a PAM offering, will take longer for us to be able to sell because it's something, frankly, not exactly what we've sold in the past. So it's something new, and it'll take some time. So we need to be patient. We need to enable the field. We need to make sure the products are good enough to be able to compete. I mean, there's a lot of things and a lot of steps to releasing a product. It's not just you come out, "Hey, there's a new product here!" You've gotta actually do a lot of steps to make the field successful because you wanna show the field that they can make a lot of money, and then they'll get out there, and they'll sell it, so.
Let's double-click on the customer identity side of the business.
Mm-hmm.
I think a lot of people in the room are probably familiar with the workforce side. You compete with Microsoft, Ping-
Mm.
-and we'll talk about that later. But what is the competitive landscape on the customer side, and how do you think about the durability of growth in that business?
Mm-hmm.
'Cause I know your aspirations are to kinda get to a 50/50 business, so.
Yeah, those are our aspirations, and to be clear, I should have said this earlier in my intro, which is about 60% of the business is workforce, and about 40% is customer identity. Look, the competitive environment there is really a buy versus build. We need to convince the market they need to buy from us than build it themselves. You know, one of the key metrics we have internally is you know, number of developers on the platform, right? Because that's one of the key personas that we need to go after. Customer identity is an interesting market in the sense that the developer is very important because they could be starting as a hobbyist, starting with a very low dollar or even free self-service subscription. I'll give you an example.
OpenAI, one of our largest customers now, started out paying us, I think it was, like, $100 a month, and then they... You know, it was a monthly credit card thing. It was nothing, and because the OpenAI dev team was starting to experiment with our product, over time, they realized how valuable it was and then upgraded into an enterprise contract and have been doing upsells over a variety of quarters over the last couple of years. So it's, that's a... That developer up motion is very important for us. So we need to be able to continue to make inroads there.
Another stat that we've talked about in terms of the developer upmarket motion is about 45% of the new logos that come into the customer identity business come from that self-service subscription, either the free or the paid. So think of it as another area of pipeline for us. Then there's also a top-end sale that we do from sales, you know, head of product, head of R&D, head of marketing, even a CIO, very rarely a CISO, but so it's an interesting market to work in, and there's a lot of opportunity. The thing is, it's not like workforce. There's some dynamics about workforce, not just the developer upmarket motion, but also the fact that customer identity is fairly new.
Historically, this has been kludged together with a bunch of different simple technologies and is not really scalable for the people who are trying to build it themselves, and so we need to teach that market they need to buy it from us, as opposed to trying to figure it out on their own. So, a lot of work to do there. There's a lot of opportunity there. We hope to continue to make a lot of inroads there.
Earlier, you said one of the growth drivers was leaning more into the channel.
Mm-hmm.
Historically, the channel is always coin operated, right? They do what's in the best interest-
Mm-hmm
... for the channel, as most people do. You being a super easy-to-deploy and use solution doesn't necessarily help them build up a services portfolio around you. Now that you have customer identity in full force-
Mm-hmm
... now that you have IGA and PAM, is that helping you make inroads-
Sure
... with the channel? And then-
Yeah
... as the CFO, are there any other levers you can pull to help drive the channel motion?
Yeah, I mean, that's definitely. The products are an important. Those new products are important areas for us to be able to explore with the partners, the GSIs specifically. Yeah, I mean, if you think about customer identity, if you're a GSI, you can build an application business, identity being one of those pieces, right? There's tons of new applications being built on a regular basis. Governance, our tool does work out of the box and is very flexible. We think it's a lot better than the legacy products out there, but there's a lot of work before you actually turn the product on in a governance tool. You've gotta figure out who has access to what, when, right? And so that work, it's not coding, right?
It's basically just figuring out, "Oh, Joe should have access to this r- system at this time," and make sure he doesn't have too much access. So those are definitely the main area is product focus, but frankly, as an organization, we need to be better about being partner-friendly. In fact, at our executive staff meeting a few weeks ago, with 40 top people in the company, we brainstormed for a couple hours as a team and, and then as, in individual groups and functions like G&A, sales and marketing, R&D, of how we can operate as a more partner-friendly organization because it's not just developing the products. We have to be open to it, to ourselves and how we operate the business.
So, there's a variety of things that we're working on to try to push that forward, and this is not something that's gonna result in numbers, you know, being produced overnight. This is a multi-year journey and a long-term relationship set that we wanna have with a handful of these GSIs.
Maybe going back to the workforce side, yeah, you guys recently launched, you know, last year, IGA, and then this year, I guess in December, PAM. Yeah, how are those businesses going?
Mm-hmm.
And then, as financial analysts or investors, you know, how should we track the traction of those businesses?
Yeah, governance is off to a start that definitely beat our expectations. You know, we're up to hundreds of customers at this point, but frankly, if you think about that, compared to the 19,100+ customers we have, it's just a rounding error on the upsell opportunity just on that front. So we're doing well, and like I said earlier, it's an easier transition for that sale for our field than probably some of the other things like PAM. I mean, Privileged Access just came out in, you know, basically a quarter ago, so it's very early on. But the bottom line is what we're trying to drive here is a, as a workforce platform that has three major pillars to it. One is access management, something we've always done historically. Think single sign-on, multi-factor, you know, Universal Directory .
That's the core access management that we started with early on in the company's history. Then you've got the pillar of governance, and you've got the pillar of PAM. We do have dozens of customers now who've purchased all three, even though the PAM product's only been out for, you know, like, about a quarter at this point. So that is our long-term strategic bet into the market, is these three pillars, that people wanna buy all three of them, 'cause frankly, each individual product is very powerful, but together they're more powerful, and add more value to our customers and, and frankly, improve their ROI, which is what we wanna be able to drive, from our, from a customer success perspective.
Obviously, you, as everybody else, is seeing seat-based pressures.
Mm-hmm.
But is there a world where PAM and IGA can help reaccelerate your NRR going forward?
Yeah, I, I think in the long term, yes. Right now, to be able to move that NRR, it's a very large number. We have to sell, you know, a lot of IGA and a lot of PAM to be able to get that number to move, 'cause remember, it's a 2.5 billion-dollar business at this point. So it's, it's definitely... It will be helpful over the long term. I wouldn't expect it in the short term, given the size of the businesses at this point.
At RSA, you guys made a ton of, you know, product announcements.
Mm-hmm.
You know, what were the top two or three that you think were most important?
Yeah, I. For us, it's really the security-based products. So, we had talked about Threat Protection before, but Threat Protection is something we continue to talk about, which is continuous authentication. So, you know, a lot of the, a lot of situations are stolen sessions right now, when you think about security incidents. So what continuous authentication can do is say, "Okay, Joe is still Joe, doing what Joe should be doing on the laptop or computer, and what system he's going after," in terms and instead of, "Okay, Joe's gotten in," and we just forget about it. Continuous auth is there to be able to improve the security footprint of our customers. That was one of them, and then the other one is really around Posture Management .
It's also a workforce identity tool, which is how to look at your current setup and say, "Do you have problems?" I think we've all heard about service accounts, and that's been a challenge for a lot of companies. One of the things that Posture Management does is takes a look at your infrastructure and says, "How many service accounts are sitting there open?" basically. And so that's one of the many tools that it can do, but that's one of the ones that I think everybody's aware of, given the challenges that folks have had across the world with service accounts lately. So, excited about those security offerings because it... We believe it's, you know, it underscores the importance of security and the importance of identity and security, but it also adds a security layer.
And then frankly, we can land new customers just with, like, Posture Management , for example. So it's once again trying to add to the bag for our sellers to be able to make their quota.
And then given, you know, you're the CFO, what are the financial implications of these announcements? Are they top-line drivers? Are they more gross retention rate stabilizers? How should we think about-
I'd say a little bit of all of it, right? I mean, in the long run, should be able to help with the NRR, or Net Retention Rate. Should be able to help, in theory, with gross retention, should be able to help with growth. I mean, it's all across the board, frankly. So, yeah.
And then earlier, you mentioned an increased focus on security. You obviously had a cyber incident a while back.
Mm-hmm.
Maybe just describe that briefly, and then, you know, update us on how customers are thinking about that incident.
Yes, actually, so I just talked about service accounts, and so that was the core of the issue that we had in October. And if hopefully all of you had a chance to see, we published the Okta Secure Identity Commitment, which is a blog, where you can go look it up. It's on the investor website, or it's on our own website. You can have a look at it, but it's really got four main pillars to it, which is you know, making our infrastructure as a company better, making our product even more secure, being leading with best practices with our customer base, and then leading the market. Those are the four main pillars. There's like 15, 16 pages.
You can go through and see everything we've already accomplished and everything that we're planning to do out in the future, because we wanna be one of the world's most secure companies. Identity is security, and we wanna be able to get there over the years. So that's a key part of the-
Yeah
... the commitment to our customers is to really be better when you know, frankly, we weren't at our best last October.
Have you seen any changes in pricing, any changes in gross retention rate, contract duration, anything from the incident?
No, we haven't seen any, like, really quantifiable evidence of the impact to, to the financials from the security incident. But look, there's a potential. It's just, we're just not picking it up in our financial data, right? Think about someone who was thinking about Okta but never actually looked at Okta after the incident. We'd never find them in our data anymore, 'cause they're not in Salesforce, they're not a lead, they're not a contact, and so there's a potential it's out there. We just can't seem to find it from a material perspective in the financials and frankly, even when speaking with, you know, parts of the field.
your biggest competitor has also had an incident. Like, has that helped you with the federal business? Like, I guess, how would you describe-
Yeah
... federal attraction, and, like, where is the U.S. government in identity adoption, and where can it be?
Yeah, very... I mean, it's very early on in our public sector business. I mean, we've been having some really nice deals. The team has done a great job. We've got great leadership in that part of the organization. We've got great products. We spent a lot of time on US FedRAMP certifications, which is not only helps you with US federal business, it helps you with SLED business. It also helps you learn how to get these certifications in other countries around the world, and so we believe we're very early in that opportunity. In terms of your question around Microsoft, you know, maybe it's helped us.
I haven't heard anything one way or the other, but look, we believe we can win with or without those, and we wanna be able to solve as many use cases as we possibly can, to be able to address and solve as many problems that our customers have.
Maybe for the final question, if you had a magic wand to remove one constraint from your business, is there one thing that you would remove to help turbocharge growth or whatever it may be?
Macro. I just think it's still a heavy headwind for us. And I think I'd love for that to go away, but we're not gonna sit here and wait for the macro to turn around to try to reignite our growth profile. That's what we talked about earlier with these products, the partnerships, and then the Hunter/Farmer model. We're not gonna just let the macro control us. We wanna be able to be better than we are today. So, yeah, I'd take macro out of it all day long.
Awesome. Brett, really appreciate the time today.
Yeah.
Thank you.
Yeah, thanks, Joe.