Getting all of security from one vendor is dangerous. Clearly, getting everything across infrastructure and collaboration and devices from one vendor like Microsoft is dangerous. If you're still thinking about cybersecurity in terms of a firewall that surrounds and protects your organization, you're leaving yourself vulnerable. In a world of remote work teams, aging systems, and AI agents, protection is no longer about securing a perimeter. With companies adopting cloud-based software and employees accessing data on their phones or laptops in multiple locations, the cybersecurity market is moving toward identity-first protection, focusing on validating user identities to defend access to systems, not just protecting the systems themselves. Okta's latest products seek to position the company as the platform enterprises trust to manage identity across their entire tech stacks, battling both human and AI cyber threats. In the latest quarter, Okta posted 12% revenue growth and $238 million in free cash flow. But despite the strong performance, Okta's share price dropped as a result of the market's disappointment that the company kept its full-year guidance unchanged instead of moving it upwards, citing economic uncertainty. We sit down with Okta CEO and co-founder Todd McKinnon to talk about the quarter, what could boost his confidence in the macro outlook, and what it means to protect every login in an AI-powered world. Let's get into it.
Todd, thank you very much for joining. I want to dig into your earnings to start with. You had a very strong performance, but I've got in front of me your earnings presentation and something in there caught my eye which I haven't seen on very many occasions. And that's one slide where Okta lays out quote, 'Okta is the superior choice versus Microsoft every time.' Explicitly calling out your virtues relative to a named competitor is something I don't see super often. Tell me why this is in there and what it means for how you think about the competitive landscape.
Well, thank you so much for having me. It's great to have the conversation. We are the leading independent and neutral identity platform, and the reason we talk a lot about Microsoft is because they have a very different worldview and we have a different perspective than they do. But it's really about the whole industry and how it evolves. I think our view is that identity needs to be this independent and neutral layer that will lead to great security outcomes for customers. It'll make it really easy to log into things. It'll make it really easy for security teams to have visibility. It'll really create this fabric across a company that everything plugs into seamlessly, and you get these great security outcomes: you decrease security risk and you increase usability. The different worldview is people like Microsoft think that everything in technology should come from one company and they should sell you all the communication platform and the collaboration platform and the cloud computing infrastructure and the AI tools, and it all should come from Microsoft. Our view is pretty simple: if you get identity as part of another platform, it's not going to be good at securing and granting you access to different platforms. In this world, companies need to be smart and have flexible technology and have the leverage to use different platforms. Think about all the innovation that's going on in AI. Do you want to be stuck into only the innovation in one model company or one tool company? No, you want choice. You want to use Google and you want to use Amazon. You want to use all the small innovative startups out there. Having an independent and neutral identity company and trusting that for your identity security fabric gives you that flexibility while also solving a huge security problem in the enterprise, which is identity security. So that's why we call out Microsoft, to try to make it clear. When I describe it like I just did, it's kind of abstract. But when you really say, 'Hey, your choice is between getting your identity with Microsoft and being locked in there, or your choice is about flexibility,' it makes it more clear for customers.
It's also really fascinating, Todd, because so much of the dialogue for some of these big enterprise software names, people like Palo Alto Networks or people like Salesforce, platformization has become sort of a buzzword, and you've laid out sort of one piece that could stand alone. Talk to us about who you're actually selling into. When I look at your product suite, you talk about one set of products for developers, you've got another set of products for IT teams. How are you positioned with those two different customer sets?
Well, our company is getting large, almost coming up on $3 billion of ARR, and we have nearly 20,000 customers. So we're going to have a broad range of products and capabilities for different audiences. But it's all about what is the theme and what is the thing that ties them together. If you flip it around and think from the customer perspective, they're never going to have one vendor for everything. They're going to have thousands and thousands of vendors, but they still want some of the benefits of scale and they want to simplify and consolidate certain areas. So it's all about what are the points of consolidation in their enterprise or in their company. Our pitch is essentially you should consolidate on identity. You should not consolidate on all of security. Getting all of security from one vendor is dangerous. Clearly, getting everything across infrastructure and collaboration and devices from one vendor like Microsoft is dangerous. So that's how we balance the two. We want to be the one-stop shop for identity for all these companies. In terms of who we sell to, it's CIO, it's the head of security, application security, it's people building applications. If you're a builder, you can use Okta's platforms and technologies to add identity securely into your application. So the thread between it all is identity, while the different buying constituencies can be different. Everything from CTO, chief product officer, to IT and security, we can address use cases in every area of the company. It's just all around that theme of identity and identity management.
And talk to us about how that's translating into your financial performance. Okta did beat expectations this quarter. Strong revenue growth up 12%. And you posted your first GAAP profit. It's not a perfect measure, but it is a milestone. Just break down for us the top drivers of that outperformance, where you're seeing the strongest growth and expansion.
Well, it's a big market and it's growing quickly, and we're the leader. We're the largest independent neutral identity platform by far. I think you have these forces in the world and in the economy that are powering that growth for many, many years. Okta is 16 years old and we were born out of the cloud transition. So applications like Salesforce and then Amazon Web Services, everyone's very familiar with that story now. That was one wave. The second major wave was the whole security wave. People have realized over the years that to secure your environment you have to have strong identity security. Identity is security. You can't do it with firewalls anymore. People aren't accessing things through your firewall. You can't do it just with endpoints. You have to do it with identity. It's a key pillar. So that's a second huge wave. The most recent wave is all the energy around AI. We're seeing tremendous promise and success of fast-growing applications and services we all know and love. What companies are realizing is that if they want to build the AI future, if they want to have agents automating work, if they want to buy these platforms that are offering agents as part of their platform, that really puts a spotlight on the identity security inside their organizations. We can help secure the identities that these agents need to log into. We can help give the agents themselves an identity and manage how it delegates that identity to other agents or from users to agents. So this third mega trend for us is the AI revolution, this agentic revolution. The reality of this one is it's very early and most customers are in this mode where they have prototypes of these types of agents, automated tasks usually around software development or customer service, and now they're getting ready to move them into production. That means these agents need access to real data, customer data, which is in databases and data warehouses and CRM systems. That's identity risk. By selling this identity fabric and this vision about this neutral platform that can weave it all together, it's really resonating and that's powering the results.
Let's talk a little bit more about human activity. We'll come back to AI, but let's start with human intelligence and human motivations. Todd, when I think about how identity protection has evolved, it feels as though I'm constantly having to log into things multiple times. It's a manual process still. While your enterprise clients understand clearly the need for what you're offering, when it comes to the actual human beings using your technology, talk to us about end user adoption. Are end users getting fatigued by this constant verification process?
Well, I think there's good news and bad news on this. I think the good news is that the industry over the last three or four years has come up with a lot of fundamental advancements that make it easier and better. There's something in the world that's new. It's called passkeys. You may have heard of them. The adoption is starting especially around some of the big consumer internet sites and services like Google and Amazon. Think about it as a different way to have a password that's more secure and harder to hack and easier to use. This was a collaboration between operating systems, Google and Android and iOS and Windows and Mac, collaboration between browsers and people making infrastructure software. This is benefiting Okta because we can provide the back-end capabilities that if you are running a website and you want to support this new capability, we can make it super easy for a developer to support that by calling a simple API and you'll support passkeys. So this is very encouraging. The concrete end-to-end implementation of it across all apps and all devices is going to take a while on the consumer side in your personal life, but it's very real and very possible at work because in the work environment, IT and security control the whole environment. When you're in your personal life, you go to the websites you want, you download the apps you want. But in IT, there's more control. So it's solvable at work. If your company has passwords still at work, you do not have to have them anymore. At Okta internally, we have no passwords. It's all biometrics. It's all passkey-based. It's all automated and secure. That's where a lot of the progress on this end-user simplicity is happening now. I am very optimistic about that extending into the consumer world as passkeys get adopted more, as people use technologies like ours to add them to their websites and mobile apps. There are some other exciting standards coming. Eventually, it'll take a bit longer, it's a little more complex on the consumer world, but I think the future is very bright there.
Well, let's talk about biometrics because if there's a level of intrusion that perhaps consumers may respond less positively to, it feels as though biometrics could be one of them. Whether it's facial recognition, whether it's fingerprints, whether it's retina scans, you just said you do use biometrics at Okta. What are you using and what's your employee response been to it?
Yeah, the biometrics is an important topic. I think that there are ways from a computer science perspective to make them private and have the user have it be, you know, not a biological representation stored. You can store a reference to the biological representation, etc. But a lot of times you have to do two things. You have to convince people that it's not selling their data or it's not somehow abusing their data. The advantage we have with that is our business is identity. Our business is security. Our business is helping customers be more productive, and they pay us for a recurring subscription. We're not trying to use the information for something else. We're not trying to sell ads. We're not trying to monetize the data in a different way. So that business model alignment is really important in this discussion. Ultimately, it comes down to people making a choice. If the convenience and the ease of use is at the bar that they want, and their concerns about privacy and the motivation of the people providing the technology is aligned with what they're trying to do, I think we can be successful, and that's what we're seeing.
Can we touch for a second, Todd, on quantum? Here's the reason why. I was lucky enough to interview the former deputy director of the NSA. The question I posed to him is, what is the one technological advancement that keeps you up at night? Didn't miss a beat, didn't even blink. The answer was quantum. It's quantum because quantum computing has the ability to break codes faster than we've ever seen before. As quantum advances, what does that mean for Okta's business model?
Well, I think it is very exciting technology, quantum. In terms of the implications on security keys and encryption, there is potentially a threat. Some of these cryptographic algorithms and the length of what's called the key, which determines how long it would take an attacker to guess all the keys and come up with the answer, quantum could theoretically break them if it works. But we need to take a step back. A lot of these implementations of quantum computers are very early, and it's not quite where we're ready to have a working real-world computer with software and all the algorithms running on it. But assuming it did get there, these computers could break some of the algorithms out there. The good news is that the keys and the size of these keys can be increased. There's no theoretical maximum to how complex and long the keys could be. So theoretically, whatever advance in quantum computing, we could increase the key lengths and keep up with that. The challenge is that's a change management problem. The thing about security issues is most often it's because the old stuff is still around. The systems aren't patched. The identities or the accounts aren't comprehensively covered. They don't all have strong credentials. It's never the bleeding edge that gets broken. It's always the laggards or the things that haven't upgraded and gone to the latest thing. So it would be a change management problem. We'd have to get the new algorithms to a size and a length, and then we'd have to get them out there as quickly as possible. So we watch the advancements and make sure that as an industry we're ready to increase the key lengths as this stuff starts to become a reality. The other thing is there are performance problems. The reason why these encryption keys aren't super long is because it's slower. It takes longer time to set up the connection to send your secure email or send your secure WhatsApp message. But again, quantum could be the answer there because if these quantum computers can break the keys, they could address this performance problem and they could set up the encrypted channels faster, and it would benefit the solution as much as it would be the problem.
