Why Okta Wants 'Authentication to Disappear' | At Barron's

It's going very well. Thanks for having me.

The core function is authentication. Nice. And it's keeping our customers secure. Our customers, about 20,000 companies around the world, big names you've heard of like FedEx or OpenAI. They have hard challenges. They have to make all of their people productive by letting them connect to all the tools they need to do their jobs, whether it's their email system or their collaboration system or more recently all their AI agentic applications they're trying to use. They have to connect those people to those resources securely. It's not only their employees, it's also their customers. They want their customers connecting to their websites and their mobile apps in a secure and predictable way. And that's what we do. We're an infrastructure provider that makes the lives of our end users easy, employees or customers very easy. But we also the security teams and our customers love us because it's more secure and more manageable and helps them get the most out of their technology.

Well, the thing we really try to do is have accurate authentication. Okay. So it's all about making sure the right person's going to the right resource. And there's a bunch of different ways to do that. The most simplest way is you ask them a password. But now the industry has moved way beyond this. Now we can use fingerprints or face IDs. And our mission is to just make it very seamless. So the person doesn't even know they're being authenticated. They just go to their technology they're trying to use and they're in and they're doing their job. They're productive. They're buying a product on the website or they're being productive at work. We really want authentication to disappear. We want it to be seamless but also at the same time have it be very secure. That's the challenge. That's why we're in business. That's why we have these 20,000 customers because doing that is important and not as easy as it looks sometimes.

The key, the name of the game in our business is flexibility. Okay. Meaning there's think of all the different ways that people can use technology or all the different ways different computers can connect to other computers and other systems and applications. The AI revolution we're in now is largely about that. You have AI agents and AI bots working on behalf of users. So imagine all the different ways in the world with all the different devices and all the different networks and all the different applications. It's basically an endless amount of complexity. So the key is flexibility. Giving our customers the flexibility for exactly their risk profile, for exactly their use case, making it super flexible. In some cases that may be a very low level of assurance. It's like do a simple check, make sure it's a computer I've seen before and that's enough to get the person into maybe not sensitive information. But in other cases, it might be the crown jewel IP of a company and they want to do triple and quadruple checks and make sure that every 5 minutes they recheck the person is who they say they are. So it's that flexibility and that configuration that really sets us apart.

Yeah. So it's going on 16 years now. So it's been quite a journey and we're very proud of our progress. So you have to rewind the clock a little bit. But at the time, I was working at Salesforce. I was running engineering at Salesforce and cloud computing was a new thing. There were applications like Salesforce and they were just starting to be new types of computing infrastructure. Amazon was starting to build computer services in the cloud versus something you'd buy in your data center. And so I got really excited about what would the world look like when IT departments at companies were building everything from the cloud. So I left and had a few different ideas of companies to start and after talking to hundreds of potential customers landed on this idea of an identity service, this identity management, this authentication service that would be purpose-built for the cloud. And it was hard at first because there weren't a lot of systems in the cloud yet, but over the years more and more things moved to the cloud. And we were, after 3 or 4 years of hard work, we were fortunate to be right in the right place at the right time.

The name is actually a meteorological scale for the amount of cloud cover. So pilots use it. So if they're going to land in an airport and it's very cloudy, it's 8 octa, and if it's halfway partly cloudy, it's 4 octa. But it's kind of cool now. No one really knows that. They just know it's a company that does identity and security.

Yeah. Well, when we first started, we wanted something that was short and easy to type in because we knew that customers would go to the website to then get to their applications. So we didn't want a long complex name. We wanted a short name. So we found this word that was easy. We could buy the domain. That was important and it was short and easy to type in and it had the, you know, 7 years later after we founded the company, it was also available as a ticker symbol which is fortunate as well.

Yeah, it's interesting in the cyber security industry, there's all this focus on the negative and the threats of what could happen. We actually take a little bit of a different approach. We try to be positive and say what do we allow our customers to do. We give our customers one of the hallmarks of our infrastructure is that we really give our customers choice and they can choose whatever piece of technology they want to use in their companies and we'll make sure it's secure and easy to set up. So we judge ourselves on how many different types of technology and how much value our customers get out of that technology. That's our hallmark. There are other folks in our industry that have a different approach. They want to sell identity as part of their applications or as part of their platform. Big companies do this like Amazon and Microsoft and Google to some degree. We have a different approach. We want to sell identity management, authentication, and really hang our hat on the flexibility that we have to connect to different systems and let our customers get the value out of that technology.

Yeah, it's a great example. So many customers have what they call phishing attacks where you get the email or someone says, 'Hey, click on this link and it goes to a fake website. You type in your password and now the threat actor has your password and they can log in as you.' We can eliminate that from companies. Right. Right. Right. So if they use Octa, we don't use passwords anymore. They can use their fingerprint. They can use their face ID. And so it's phishing resistant. They can't be phished. So we look at how many phishing attacks did you have? Last year, I was talking to the CIO, chief information officer of a big healthcare company, and he said he gets 800,000 a month. 800,000 a month accounts of his customers stolen from phishing. And we can take that down to near zero.

It's a recurring subscription. So we're delivered as a cloud service. So customers pay us basically per user that uses the service. So if it's employees, it's a named user. If it's their customers, it's more of a monthly active user. But the simple way to think about it is they pay a subscription to us. We provide the services and then there are different products that they can, you know, more products or more per user. And we have a flexible array of different products to cover different types of use cases. We're a global company. We have about close to $500 million of revenue internationally. The total company is about $2.5 billion of revenue a year. Last year we generated about $700 million of cash. It's a profitable growth company. And most important about this though is that we feel like the market for what we do is massive.

Yeah, we think the TAM for what we do is $80 billion a year and we're about $2.6 billion. Yeah. So we have a lot of growth. I think with what's going on in the world, there's more and more cloud computing and there's more and more security risk and the fact that more people are working remotely and more people are working from different devices and all this technological proliferation means that there's more and more of a requirement for identity and authentication and that's driving a lot of the growth. We're also expanding into new categories. So there have been traditional markets of access and then governance and then privileged access and now we've broadened the product portfolio to have a market leading product in all three of these categories. So it's expanding the TAM at the same time as we're gaining market share in the TAM.