Okta
B2B SaaS subscriptions (98% of revenue; subscription $750M of $765M in Q1 FY27); per-user/per-MAU pricing across Workforce Identity and Customer Identity (Auth0) clouds, sold direct and through partners
Earnings, margins, COGS & capex
Okta has completed the pivot from growth-at-all-costs to profitable growth: revenue growth has settled at ~10-12% while non-GAAP operating margin reached 25% and free cash flow runs near $900M/yr. GAAP operating income is positive (7% of revenue in Q1 FY27) as stock-comp intensity declines. RPO growth (+16%) outpacing revenue growth signals improving large-enterprise bookings, driven by go-to-market specialization and new products (Identity Governance, Privileged Access, Identity Security Posture Management, Auth0 for GenAI / agentic-AI identity). Balance sheet is strongly net cash.
Income statement — where each revenue dollar goes
% of revenueOf every $1 of revenue, ~22¢ is cost of goods and ~71¢ operating expense, leaving ~7¢ of operating profit.
Revenue trend
Margins
stable
improving
improving
structurally high
COGS structure
COGS ($170M in Q1 FY27) is cloud hosting (primarily AWS), third-party software, customer support, and professional services delivery; subscription gross margin is structurally low-80s non-GAAP. Okta is deliberately shifting professional services to partners (~1pt revenue headwind in the FY27 guide) which mixes revenue toward higher-margin subscription.
Capex
Minimal (~$20-30M/yr, ~1% of revenue) - no owned data centers; capacity scales via AWS opex, so FCF closely tracks operating cash flow ($277M OCF vs $271M FCF in Q1 FY27).
Latest earnings
Beat: revenue $765M vs ~$751M consensus (+$13-14M); non-GAAP EPS $0.91 vs ~$0.85 consensus. Stock rose ~8% after hours and surged ~21% the next session (May 29) to a 52-week high (~$134) on agentic-AI demand commentary and the raised guide
Q2 FY27 revenue $790-794M (+9%), non-GAAP operating margin 26%, non-GAAP EPS $0.95-0.97; FY27 raised to $3.185-3.205B (+9-10%), non-GAAP operating income $806-826M (25-26% margin), non-GAAP EPS $3.79-3.87, FCF $855-885M (27-28% margin); guide absorbs ~1pt headwind from shifting professional services to partners
- RPO
- $4.719B, +16% YoY (Q1 FY27)
- cRPO
- $2.499B, +12% YoY (Q1 FY27)
- Dollar-based net retention (TTM)
- 107% (Q1 FY27)
- Cash + short-term investments
- $2.589B vs $350M convertible notes (2026-04-30); notes cash-settled at June 2026 maturity
- FY26 free cash flow
- $863M (30% of revenue) vs $730M (28%) in FY25
Growth drivers
- New product cross-sell — Okta Identity Governance, Privileged Access, ISPM, and Device Access broaden ACV per customer beyond core SSO/MFA
- Agentic AI identity — securing non-human/AI-agent identities (Auth0 for GenAI, Cross App Access protocol) - management's framing for the next demand wave
- Large-enterprise and public-sector traction from go-to-market specialization (workforce vs customer identity sales motions); 5,180 customers with $100K+ ACV as of Q1 FY27
- Consolidation of point identity tools onto a unified platform amid identity-centric breaches
- Partner ecosystem expansion (SIs, hyperscaler marketplaces) and international, which remains under-penetrated vs US
Reported financials — SEC EDGAR
Audited GAAP figures pulled from SEC filings · latest filing 2026-03-05. The audited primary-source spine — not financial advice.
Revenue — annual (GAAP)
Margins & balance sheet — FY’26
Bull & bear
A profitable, net-cash identity leader trading at a reasonable ~7-8x forward revenue with a fresh growth catalyst: securing AI agents, where Okta's neutrality and integration graph make it the default non-Microsoft answer. RPO acceleration says the enterprise motion is working before it shows in revenue.
- FCF machine: ~$870M FY27E FCF (guided $855-885M) on a ~$23B EV is ~27x EV/FCF - reasonable for a security platform with rule-of-40 economics (~10% growth + ~28% FCF margin)
- RPO +16% and record large deals suggest revenue growth can stabilize or re-accelerate as multi-year bookings convert
- Agentic AI is a genuine TAM expander: every AI agent needs identity, authorization, and credential vaulting - Auth0 for GenAI and Cross App Access give Okta a first-mover standard-setting position
- New products (IGA, PAM, ISPM) attach to an installed base of ~20,000 customers (5,180 at $100K+ ACV) with low penetration, supporting years of cross-sell
- Vendor-neutrality is durable: multi-cloud, multi-app enterprises don't want their identity layer owned by Microsoft; Okta is the Switzerland of identity
- Margin runway remains - non-GAAP operating margin has risen from ~0% (FY23) to 25-26% guided, and GAAP profitability has inflected
A decelerating ~10%-growth company whose core seat-based market is saturating, squeezed between Microsoft's bundle above and developer-first auth startups below, with the agentic-AI story still monetizing near zero today - and the stock has already re-rated hard off its lows.
- Growth has fallen every year (22% -> 15% -> 12% -> 9-10% guided); NRR at 107% leaves little embedded expansion - the base case is a low-double-digit grower, not a re-acceleration
- Microsoft Entra ID keeps winning Microsoft-centric workforce deals at effectively zero marginal cost; that gravitational pull worsens as E5 penetration rises
- AI-agent identity revenue is negligible today; the ~21% post-earnings surge (May 2026) prices in a catalyst that may take years, and standards could tilt to hyperscalers
- Palo Alto Networks + CyberArk creates a heavily-resourced identity-security bundle aimed directly at Okta's PAM/machine-identity expansion
- If AI agents reduce human seats and app count, Okta's per-user pricing model faces a structural headwind in its core
- Trust is fragile: a third security incident would trigger churn an identity vendor cannot easily win back
- Stock-comp still consumes most of the GAAP P&L gap; ~18pt spread between GAAP (7%) and non-GAAP (25%) operating margin means economic earnings are thinner than headline
What it is worth
EV/FCF and EV/forward revenue cross-check vs security-software comps
~$95-115
Microsoft bundling + seat compression push growth to mid-single digits, NRR under 105%; de-rates toward ~5x sales / low-20s x FCF
~$145-165
9-11% growth, 26-28% FCF margin sustained; multiple holds ~7-8x forward sales, consistent with the current ~$147 price
~$190-210
growth re-accelerates to mid-teens on IGA/PAM attach + early agent-identity revenue; ~9-10x forward sales, ~30x FCF on a higher base
At ~$25B market cap and ~$2.2B net cash, EV ~$23B: ~7.2-7.4x FY27E revenue ($3.185-3.205B guided) and ~26-27x FY27E FCF ($855-885M guided). That is a discount to faster-growing security peers (CrowdStrike, Zscaler trade at materially higher forward-sales multiples) reflecting ~10% growth, and roughly in line with mature-FCF software. Multiple expansion requires either revenue re-acceleration (RPO conversion, agentic-AI monetization) or continued margin gains. Figures as of 2026-07; not financial advice.
SWOT
Strengths
- Largest independent, vendor-neutral identity platform with ~7,000+ integration network (Okta Integration Network) creating high switching costs
- Two-franchise portfolio: Workforce Identity plus Auth0/Customer Identity - few rivals span both
- Strong profitability inflection — 25% non-GAAP operating margin, ~30% FCF margin, GAAP profitable, ~$2.2B net cash
- RPO growth (+16%) ahead of revenue growth indicates improving multi-year enterprise commitments
- Early, credible position in AI-agent identity (Auth0 for GenAI, Cross App Access) - a greenfield identity surface
Weaknesses
- Revenue growth decelerated to ~10-11% from 20%+ two years ago; net retention drifted down to 107%
- Security-vendor trust scar tissue — the 2022 Lapsus$ incident and the Oct 2023 support-system breach damaged credibility for an identity vendor where trust is the product
- Seat-based workforce pricing exposed if AI-driven headcount efficiency shrinks enterprise seat counts
- Still heavily stock-comp funded (GAAP operating margin 7% vs non-GAAP 25%), an ongoing dilution drag
- SMB and contraction pressure keeps NRR near historical lows; upsell now depends on newer, less-proven products
Opportunities
- Non-human identity — machine, workload, and AI-agent identities could outnumber human identities 10:1+ - Okta is positioning as the neutral control plane
- Identity governance (IGA) and privileged access (PAM) displacement of SailPoint/CyberArk incumbency in mid-enterprise
- Federal/public sector (FedRAMP High) and international expansion
- Identity-based breaches keep rising - budget shifting from network perimeter to identity-first security
- Partner-led services model frees margin and scales reach
Threats
- Microsoft Entra ID bundling with E5 licenses is the structural competitive threat - 'good enough and effectively free' for Microsoft-centric shops
- Palo Alto Networks' acquisition of CyberArk (closed Feb 2026, ~$21-25B) puts PAM + machine identity inside a mega-platform bundle, escalating platform-consolidation pressure alongside CrowdStrike and Zscaler
- Agentic AI could commoditize or bypass traditional login flows — protocol shifts (MCP-era auth) may favor new entrants (Stytch, Clerk, WorkOS) in developer CIAM
- Another security incident would be disproportionately damaging to an identity vendor
- Macro IT budget scrutiny keeps seat expansion and renewal uplifts muted
Moats, dependencies & bottlenecks
Moats
Identity is the control plane wired into every app, directory, and device policy; rip-and-replace is a multi-year project with outage risk
7,000+ pre-built integrations (Okta Integration Network); ISVs integrate with Okta first among independents
Moderate-Strong Only at-scale identity platform not owned by a cloud/app/security mega-vendor (Microsoft Entra, Google, Palo Alto-CyberArk) - valuable to multi-cloud enterprises, but only as long as neutrality matters more than bundling economics
FedRAMP High, broad certifications; partially impaired by 2022/2023 incidents and rebuilt via Secure Identity Commitment
~$650M annual GAAP R&D run-rate ($163M in Q1 FY27) across two clouds outspends independent IAM rivals, though a rounding error vs Microsoft
Dependencies
Okta's clouds run predominantly on AWS; concentration and cost dependency, though multi-region
Platform/competitor Must integrate deeply with Active Directory/Entra/Office 365 while Microsoft is also the primary competitive threat
Deliberately shifting professional services and more of go-to-market to partners; execution dependency in FY27 guide (~1pt revenue headwind)
emerging agentic protocols) Value rides on open standards; a protocol shift for AI agents (e.g. MCP-adjacent auth) controlled by others would erode position
Seat-based expansion tied to customer headcount and app counts; macro-sensitive
Advantages
- Independent, neutral identity control plane spanning workforce and customer identity - unique among at-scale vendors
- Structural FCF margin near 30% with negligible capex
- Net cash balance sheet (~$2.2B; converts retired June 2026) funds M&A optionality
- First-mover standards position in AI-agent identity (Cross App Access, Auth0 for GenAI)
- Deep enterprise install base for cross-sell of governance and privileged access
Weaknesses
- Decelerating core growth and 107% NRR
- Microsoft bundling pressure in workforce identity
- GAAP-vs-non-GAAP margin gap driven by stock comp
- Breach history creates asymmetric reputational risk
- Seat-based pricing exposed to AI-driven seat compression
Bottlenecks
- Net retention at 107% — upsell engine now depends on newer products (IGA/PAM/ISPM) maturing to enterprise-grade parity with incumbents
- Go-to-market transition (specialized sales, partner-led services) must land without disruption to hit FY27 numbers
- Monetization lag on agentic-AI identity: real revenue contribution is not yet visible in guidance
- Security-incident sensitivity constrains risk-taking; heavy compliance overhead on every new product surface
Top signals & trends
Top signals
Multi-year enterprise bookings outpacing recognized revenue; leading indicator of stabilization
Raise on both top and bottom line one quarter into the year
Expansion within installed base remains muted; watch for a turn back up as new products attach
Agentic-AI re-rating front-runs monetization; expectations bar now higher
Real-earnings quality improving; stock-comp intensity declining
Near-term optical growth drag, structurally margin- and scale-positive
Consolidates PAM + machine identity into a mega-platform bundle adjacent to Okta's expansion products
Trends
Majority of breaches are credential/identity-based; budgets follow
Every agent needs authN/authZ and scoped credentials; greenfield TAM where Okta is standard-setting early
Microsoft, Palo Alto Networks (now including CyberArk), CrowdStrike bundling identity capabilities pressures independents
Per-user pricing models face headwinds if agents replace human seats
Compliance-driven demand floor, especially public sector
Ecosystem & competitor graph
Suppliers feed the company; customers pull from it. Line thickness shows the strength of each tie (supply-chain dependency, customer earnings contribution). Hover to isolate a tie.
Primary cloud infrastructure for Okta and Auth0 clouds
Edge/network services used by SaaS delivery chains; also a zero-trust partner-competitor
Flagship workforce identity customer
Large enterprise identity deployment
Global workforce identity standardization
Cited AI-native customer cohort (Auth0/CIAM) alongside other GenAI startups
Dominant workforce-identity competitor via E3/E5 bundling; the structural threat
PAM leader with machine identity (Venafi); acquired by Palo Alto Networks Feb 2026 and delisted from Nasdaq - now converging on Okta with mega-platform distribution
Identity governance (IGA) leader; Okta's IGA product attacks it from below (re-listed on Nasdaq Feb 2025)
Thoma Bravo-owned (private); enterprise IAM and CIAM rival, strong in finance
Legacy enterprise IAM base
MFA/device trust competitor in workforce identity
Workspace-bundled identity; strong in Google-first shops
Private developer-first auth startups attacking Auth0's CIAM base and racing for AI-agent auth
Identity threat detection adjacency bundled into Falcon platform