Okta is perhaps not a household word, but it is the leader in the cloud-based identity management space and that is one of the core pillars of a cybersecurity strategy. Lately, Okta shares have been in a holding pattern; one that is frustrating for current holders and which I believe presents a substantial opportunity to acquire shares in a category leader at a relative valuation not seen for some time.
The bearish thesis goes something like this: Everyone has an identity management solution, right! Identity management is a saturated space, right! Okta’s (NASDAQ:OKTA) days as a high-growth cybersecurity vendor are coming to a close, right! That has basically been the consensus investment judgment for Okta for the better part of a year now. I have reached a different conclusion, one that suggests that the Okta story is still in the early innings and that the current share price pullback is an excellent buying opportunity.
Okta shares are not really cheap, some will say, but I think the excellent results of the most recently reported quarter suggest that the current market valuation is not really reflecting the trends that have recently animated the business and are likely to change the company’s growth rate to higher levels for a longer period.
Okta has been at the forefront of the high-growth IT space for several years now. The company first went public in 2017 at a share price of $17, although it closed the first day of trading at about $23.50. In 2017, the company had revenues of about $250 million, and the company’s most recent quarter, including the results of Auth0 which was acquired on 5/3, showed annualized revenue run rate of $1.265 billion. Because of the notable growth acceleration last quarter and the very substantial jump in the current RPO balance, I have adjusted my 4-quarter forward revenue estimate to a bit over $1.5 billion. While the company is not projected to post positive earnings this year, a function of the major merger with an erstwhile competitor Auth0, free cash flow generation is likely to be significant over the coming year and profit margins should start to ramp as the integration proceeds and the impact of purchase accounting wanes. On this latest earnings call, the CFO revised the company’s free cash flow estimate to a margin in the mid-single digits, and results through the first half of the year were at a stronger run rate than that.
The cyber threat landscape continues to evolve and cybercriminals continue to become more audacious. Of course, the headlines inevitably are focused on major breaches and ransomware attacks against significant targets. But that said, cybercriminals come in all shapes and sizes, and identity management is a necessary component of any holistic security strategy for an enterprise. Some of the major breaches seen recently have come through fraudulent identity credentials that wound up costing victims in the hundreds of millions. Given the modest cost, relatively speaking, of a robust set of identity management solutions, the payback seems obvious. And further, it would be hard to dispute that Okta is the leader in identity management solutions especially with the acquisition of Auth0, although, not surprisingly, there are numerous competitors of all shapes and sizes. I will discuss competition later in this article.
Over the years, I have placed my bets in the cybersecurity space on the most prominent advanced technology mainstream vendors such as CrowdStrike (CRWD) and Zscaler (ZS), although I also had a position in Rapid7 (RPD) until earlier this year. In fact, at the moment, about 20% of my Ticker Target High-Growth portfolio is invested in those two names, and some of my investment advisory clients have an even higher weighting in the space. But I have decided to begin to add a third cybersecurity position buying shares of Okta. Okta’s growth last quarter showed strong acceleration, even after adjusting for the impact of the Auth0 merger. And the company, despite the expenses associated with the merger, is exceeding targets for profitability and cash flow. No, the identity management space is by no means saturated, or close to saturated, and as it matures the definition of identity management has expanded and is likely to continue to do so well into the future.
Just to be completely transparent to readers, I began a starter position in advance of Okta’s earnings release, and deliberately, this article will not be published until after earnings which were released on Wednesday, September 1st. I don’t want to suggest that I had or have some special crystal ball as to what Okta was going to announce or what their guide was going to be, but I was willing to take such a risk with a starter position. I did expect that an upside was going to be reported, and I expected that more clarity about the financial impacts of the Auth0 transaction would be provided, but what level of expectations had been built into the current price was and still is hard to determine.
As it happens, the company listened to the complaints that its disclosure regarding Auth0 last quarter was less than transparent; this quarter basically every number possible was segmented between stand-alone Okta and Okta including Auth0. While the company did wind up reporting very strong numbers, apparently, investors were expecting more, although on what basis is a bit hard to determine. This is one of those quarters in which the adage of buy the rumor and sell the news was the appropriate strategy, but the results reported and the conference call presentation have given me the confidence to continue to add to my starter position. I certainly suggest that readers take advantage of what I consider a valuation anomaly to either establish or add to positions in this name.
Company management suggested that in future periods, while it would continue to report Auth0 recognized revenues, it would not continue to disaggregate every single number. Over time, as Auth0 becomes more tightly integrated with Okta, it will become more difficult to disaggregate what component of the business is coming from the acquisition, and what component of the business is core Okta.
Okta shares appreciated by 14% in the week before earnings were released, perhaps because of a strong-worded upgrade by the Raymond James analyst, Adam Tindle. On the other hand, the shares had more recently been in a downtrend since August 5th and that recent appreciation basically retraced the down move. Many cybersecurity names were strong at the end of August; more investors are appreciating that the cybersecurity area continues to show strong growth and that the latest major breaches reported this spring are part of an increasing threat environment.
But that seems to have changed as the calendar turned to September. The trading of cybersecurity names in the last couple of weeks has been more than a bit puzzling. Friday, Sept. 10th, after reporting what arguably was one of the strongest quarters ever reported by Zscaler, its shares were down about 3.5%. And of course, CrowdStrike shares, again in the wake of yet another blowout quarter, and another guidance increase have seen their valuation compress about 8.4% since they reported earnings. Perhaps investors believe that lions will lie down with lambs and that the cyber threat landscape will heal without further remediation. Or… I am not sure I can write something profound about the unenthusiastic reaction to some blowout results. But I think any IT growth portfolio needs to overweight in cybersecurity names, and I do feel that adding a position in the identity management space is a reasonable strategy.
The reaction of Okta shares to the earnings announcement remains a puzzlement to this writer. As I will discuss in the balance of this article, a careful review of the metrics released, and the metrics guided show a very clear picture of a company firing on all cylinders with the prospect of accelerating growth and continued over-attainment. In these days of algorithmic trading, it can be difficult to understand shorter-term share price movement, and the efforts of some to find a logical reason behind the decline of these shares after earnings is, at best, a fraught undertaking. It is my view that when anomalous share price moves take place, investors with a bit of perspective and some patience ought to take those moves as an opportunity and not as a cause for angst.
Okta shares were conspicuously weak during trading on Friday, September 10th, down by 4.7% and are now down around 4% since the company reported earnings. Given Friday’s noticeable decline in the shares, I have started to move beyond a starter position in terms of my personal commitment to the shares.
Okta shares have basically been in a holding pattern for almost a year at this point. The shares reached $243/share last October and as I write this on Friday, September 10th, the shares are around $254. On a year-to-date basis, the shares are up just marginally. The combination of a basically stagnant share price and sharply rising revenues have driven my projection of the company’s EV/S ratio to below 21X. For the first time in many years, the company’s valuation is below average for its growth cohort that I have estimated to be around 40%. Just to put some context around the valuation, Okta shares are valued around the same EV/S as shares of nCino (NCNO), Avalara (AVLR), and Dynatrace (DT). The company is growing faster than the latter two and is growing at rates comparable to nCino. Aside from the merger anomalies in current profitability, the company’s free cash flow margins are probably comparable to those of Avalara and nCino, although considerably less than those of Dynatrace.
While Okta doesn’t have the free cash flow margins of either of the two other advanced technology cybersecurity vendors, CrowdStrike or Zscaler at this point, and its growth rate hasn’t and is unlikely to reach the stratospheric levels of those two vendors, as the impacts of the Auth0 merger start to produce a variety of revenue and cost synergies, and as the deferred revenue write-down burns off, the prospective free cash flow margin is likely to achieve strong positive trends and longer-term growth rate estimates should rise. Long-term institutional investors today continue to seek vehicles in the cybersecurity area that fit parameters in terms of valuation, growth, and profitability. I think that the shares have finally made the running on all three points.
Identity management is an app with two faces. One of these is that of workforce identity, the foundational component of Okta. It’s been around a long time. Most people in the modern workforce are familiar with the app as they use it to sign-on to their devices, and to obtain access to various applications and data sources. It is often described as Single user sign-on (SSO) and it would be difficult for modern businesses to exist without this functionality. Over time, despite the simplicity of the concept, the web of permissions and data sources have made this application increasingly complex and it is often the target of cybercriminals who use it to gain access to corporate data and launch their ransomware attacks. I have linked here to a commercial/blog from one vendor in the space which may be of interest to readers. The net of the presentation is that ransomware attacks, facilitated by inadequate permissioning defenses, continue to escalate and to become more brazen.
There is a concept of Zero Trust as the animating factor in enterprise cybersecurity solutions. Most users probably understand that without Zero Trust architecture, sooner or later they will be subject to a successful breach and wind up paying ransoms to retrieve their data. Identity is on the forefront of Zero Trust. I certainly do not purport to be able to evaluate the different identity offerings that are targeted at enabling a Zero Trust architecture. I will note that Forrester Research ranks Okta as the best in this space with the highest possible scores in 14 of 18 evaluation criteria. Being the leading vendor both in terms of market share and product capability in a strong space is generally a formula for superior growth, and the numbers that the company reported this past quarter suggest that the company continues to gain share in a rapidly growing market.
Okta has been seen as a work-from-home name, and to some extent, the recent up and down performance of the shares reflects the up and down expectations of a return to in-office work on the part of many businesses. There is a theory that some demand for identity management solutions has been pulled forward as the result of the work-from-home paradigm that got an enormous boost from the impact of the pandemic. I try to take a longer-term view of these kinds of paradigms; my own view is that the return to on-premise work, as it happens, will lead to a far more hybrid workforce than heretofore, with some work in the office and some work taking place at home. I do not think it really makes much sense to classify Okta as a work-from-home stock or a reopening stock. It is a cybersecurity company whose solutions will be used in the office, remotely, and by workers who have to gain access to different levels of data regardless of where it is and they are.
The other side of the identity management space is that of customer identity. Okta started its business focusing on employee identity management and grew the offerings in that space rapidly; it entered the customer identity market a few years ago, and it has recently been 25% of revenues, one of the major growth engines for the company. In March, the company announced that it was buying a company with the catchy name of Auth0. This was not a cheap acquisition - at least notionally. Auth0’s recurring revenue had been about $200 million, but it has been growing at more than 50%. The purchase price for Auth0 was $6.5 billion, by far the largest acquisition that Okta has ever executed. The consideration of the acquisition was based on Okta shares. The assumed value was based on an Okta share price of $276.21. At that price, Okta issued about 23.5 million shares, which is about 15.5% of the total shares now outstanding. The acquisition of Auth0 notionally added about $38 million to the revenues recently reported; the purchase accounting haircut was about $13 million, so basically, Auth0 revenues, as adjusted, constitute about 15.5% of the adjusted revenues for the quarter that the company just reported. Being able to buy Auth0 without diluting revenues per share is a pretty fair bargain, based on the many synergies in terms of sales and costs that are in the nascent phase at this point.
Initially, the company really did not help investors much in the conference call in which the transaction was first discussed but which lacked transparency about its estimate of the likely contribution of Auth0. That has now been rectified; it would be difficult for anyone to want more metrics than were provided by Okta about the contribution of Auth0 in this latest conference call.
Auth0 was probably Okta’s leading cloud-based competitor in the customer identity management space most often called CIAM. There are, of course, many, many other competitors in that space such as Ping (PING), Salesforce (CRM), Oracle (ORCL), Microsoft (MSFT), and CyberArk (CYBR). Many of the companies in the space have acquired their solutions and not all of them provide the most advanced functionality. The space has been said to have a TAM of $25 billion, almost as large as the TAM of the employee identity management space. According to the analysis to which I have linked above, the space is supposed to have a CAGR of 17% over the next few years. On the other hand, the CEO referenced a total TAM for the space of $80 billion, which is considerably higher than that which I have seen in the studies that are available to me.
Some investors were skeptical about the $6.5 billion valuation of the acquisition and Okta shares fell when the acquisition was announced back in March. Auth0 had raised funding last summer at a valuation of $1.9 billion. Interestingly, the funding round with that valuation was led by Salesforce Ventures. One reason why Auth0 was purchased was defensive; self-evidently Okta feared the potential impact of Salesforce integrating Auth0 into its stack, something that might readily have happened given the stake that Salesforce had in the company. Probably more important, however, was the opportunity to join forces with a head-to-head rival and to thereby gain pricing power in the space. Further, Auth0 has had a developer-first go-to-market strategy. This is quite different than the direct approach that Okta has pursued. I have written in previous articles that I think in the current software sales climate, a developer-first strategy is highly beneficial to almost any business. Buying Auth0 will substantially help Okta in its go-to-market strategy, adding an additional leg to its stool.
At the end of the day, the addition of Auth0 was part of a consistent strategy to ensure that Okta “owns the CIAM market.” What precisely that means in terms of numbers is a bit more difficult to assess. But if the numbers just reported are any guide, the $6.5 billion purchase price that the company gave to acquire a revenue run rate of over $200 million as adjusted for the purchase price accounting haircut, growing at more than 60%, seems like a good deal all around.
The initial results for the merged company seemingly justified the purchase. As mentioned, the current term used for customer relationship management is CIAM. Overall, Okta CIAM ACV rose by 54%, with Okta legacy CIAM growing at 49% and Auth0 growing at 63%. Self-evidently, Auth0 did not cannibalize any Okta revenue and sales force productivity apparently grew noticeably.
What I consider at least equally telling is that Okta’s Workforce ACV grew by 37%. I regard ACV growth as the gold standard in assessing comparative growth percentages. Thus, the kind of result recently reported demonstrates the actual strength of what is still the largest share of Okta’s revenue. It ought to calm fears regarding possible growth rate compression and category saturation.
Of importance in terms of forecasting shorter-term growth, the company reported that its RPO balance grew 57% and its current RPO balance grew 60% in the latest quarter. On an organic basis, RPO balances rose by 42% and 43% respectively. With that as background, I find it hard to believe that Okta’s growth over the next 3 years, on an organic basis won’t be in the 40% range - or even a bit higher.
Overall, the revenue synergy potential is robust, and probably more so than was the case when the deal was initially announced. During the course of the conference call Q&A, the company COO and co-founder, Frederic Kerrest talked about Auth0 adding a target of more than 1300 users who could be sold on Okta’s workforce identity management solution. There have already been some cross-sells and up-sells within the installed base as both users and the Okta marketing team become familiar with the combined offering. In addition, Auth0, having been a relatively smaller vendor in the space, has installed customers who can use some of Okta’s add-on CIAM products such as Workflows, Access Gateway, and Server Access, which had not been available to those customers for Auth0 prior to the combination.
The company is moving to unify its sales effort sooner than anticipated. The company sees what it calls “an expansive opportunity” in the CIAM market which implies growth well above average for that class of solutions. CIAM is so ubiquitous these days, it is almost easier to say where it is not than where it is. Most readers will probably recognize the use of CIAM in their interactions with online commerce sites and with sites involving financial transactions. It might seem as though all CIAM capabilities are identical; the differentiator tends to be the end-user experience.
However, different identity solutions handle what is called IGA (Identity Governance and Administration) and PAM (Privileged Access Management) quite differently and security consultants find there is substantial differentiation between different vendors in terms of what they offer. As it happens, Okta has recently released what it believes to be substantial new capabilities in its latest releases of these two functions. I have linked here to the announcements of the latest that Okta is offering in these areas and I wouldn’t be surprised if some of the success the company had in closing business and raising its DBE ratio last quarter wasn’t a specific function of these new capabilities.
Okta is not without competitors of various shapes and sizes. This is, depending on which analyst projection is considered, a market space with a TAM of between $60 billion-$80 billion. Here is a link that outlines a few of the major competitors in the space.
Not all of the competitors listed in the link are really competitors of Okta. Almost all IT vendors of size claim to have some kind of identity management functionality, but enterprise users are looking for functionality that is not on offer from all so-called identity management vendors.
Many readers will recognize that Ping Identity is a major competitor of Okta. I have linked here to a 3rd party analysis of that competition. Ping’s operational performance has basically been underwhelming, to say the least. That said, results in its latest reported quarter were strong and the shares have rallied. Ping’s basic issue is that Cloud ARR is only 20% of the total ARR for this company, and while growing fast, it has prevented the company, except for last quarter, from achieving the kind of growth that most tech investors crave. On a Y-T-D basis, the shares are still down a little more than 10%.
The net of the analyst report that I linked is that Okta is thought to be in the pole position when it comes to identity management capabilities for cloud-based applications. As the world evolves toward the cloud, this analyst talks about the desire of many IT organizations to search for a new, cloud-based identity provider, and that most often turns out to be Okta. Many users, the analysis suggests, want to acquire solutions from a company that provides a holistic capability that combines identity, user, and access management with single sign-on capabilities. That is another trend favoring Okta.
Another publicly-traded competitor in this space is SailPoint (SAIL). Sail’s growth has been fairly pedestrian as reported, but in the last reported quarter, ARR grew by 43%. This is another company in the midst of a SaaS transition, with all that means to reported revenues and headline growth. SailPoint as an investment has seen its share of adverse winds, so to speak. Its share valuation has contracted by about 15% so far this year. Most of the company’s new bookings are coming from its SaaS consumption model, but the results last quarter were significantly influenced by term license growth and maintenance renewals.
Much of what had made SailPoint unique in its space, i.e. a focus on governance, particularly, is now being offered by Okta. Okta has a much broader range of total capabilities and with its new IGA offerings, it would seem to offer more functionality than SailPoint, overall.
Although offerings in the CIAM space are generally different than those whose purpose is workforce identity management, most of the competitors are the same. Here is a link to one list of competitors actually compiled by one competitor; here is another, more comprehensive list. One thing to note; most of the stack vendors offer some kind of solution, essentially tied to their own set of solutions. I have linked here to an evaluation of AzureAD identity management compares to what is on offer by Okta. Okta is often used with AzureAD. At this point, all of the cloud providers offer some kind of identity management solution - obviously tied to their own cloud offerings. Users go to Okta to get more features and a vendor-neutral solution.
I believe that a significant component of the Okta purchase recommendation case relates to the company’s ability to continue share gains. Part of that is coming as users move from on-prem to cloud workloads, and reevaluate their vendors, Okta wins a disproportionate number of competitor bake-offs. I think this is at least as much a function of the holistic vision and the holistic set of offerings available from Okta. But the results last quarter, both in workforce and CIAM, are strong evidence that Okta’s product strategy and go-to-market motion are seeing success.
Before reviewing the numbers in detail, I think it is worth noting two factors. One of these is that Okta’s current reported earnings reflect material impacts from the company’s recent merger, and are thus potentially misleading to readers and potential investors. The company had reached full-year non-GAAP profitability for its last reported full year. Okta has certain elements of seasonality in its business - typically Q4 shows the highest level of profitability and Q1 the lowest. Before the merger, Q4-2021 for Okta was marginally profitable and Q1-2022 showed a small loss. The loss shown in Q2 is far greater than should be estimated in any evaluation readers/investors might do, including both extra costs associated with the Auth0 merger, and the exclusion of $13 million of revenues due to purchase accounting.
Further, I use 153 million outstanding shares for the company representing the impact of the additional shares issued in connection with the Auth0 merger, but not any potential impact from implied shares outstanding. The estimate that I used is based exclusively on the outstanding shares reported by Okta in its latest quarterly statement, although I tend to add slightly to the count based on additional option shares that will be part of the capitalization over the period of my estimates.
Nowadays, some companies report something called “implied shares outstanding” which gives effect to the conversion of convertible securities. This caption is typically seen when a company reports non-GAAP profits. When Okta reported a profit for Q4 and the full year of fiscal 2021, the weighted average share count was increased by more than 13 million shares. In order for me to properly compare different companies, I have to exclude the additional outstanding shares whose existence is implied but not actually reported. I try to use the most consistent method available in a valuation analysis.
It is unlikely that Okta will report a non-GAAP profit this year so the issue is moot; despite the estimates shown by the published 1st Call Consensus, I imagine the company will report a profit in fiscal 2023 given both the revenue and the cost synergies inherent in the Auth0 merger as well as favorable business trends.
Last quarter, the company’s non-GAAP gross margins were 69% compared to 78% the prior year. Auth0, which was operated on a stand-alone basis this past quarter has had substantially lower gross margins than pre-Auth0 Okta. I expect that gross margins will rise meaningfully from this nadir, and given that Okta has increased pricing power in the CIAM space and that it continues to announce additional add-on offerings such as those described above, i.e. IGA and PAM, I expect that 12-18 months from now, Okta’s non-GAAP reported gross margins will exceed 80%.
Last quarter, non-GAAP operating expense was $340 million or 108% of revenues. That compares to $155 million of operating expense - about 78% of revenues - in Q2 the prior year. It should be noted that in the prior year, Okta, like many other vendors, restricted expenses and ceased travel due to the impact of the pandemic. But that said, the biggest factor in these expense ratios was, of course, the addition of Auth0’s expenses into the whole of Okta.
My expectation is that within the next 12-18 months, the expense ratios will return to pre-Auth0 levels and continue to improve from that point. Software mergers in general have significant cost synergies; this one in particular, where Okta wound up acquiring its most significant cloud-based competitor in the CIAM space should have relatively more cost synergies than most.
The investment case for Okta is, I think, quite straightforward. The threat vectors in the cybersecurity space have continued to increase, and sophisticated and holistic management identity technology is a key pillar for any enterprise security strategy. The growth slowdown in this particular segment that some had feared simply doesn’t seem to be happening, and with the rash of breaches and ransomware attacks, many of them facilitated by faulty or, perhaps better said as, inadequate identity management technology, enterprise demand for sophisticated and comprehensive identity management tools has accelerated. I have read other articles that articulate the high and growing level of cybersecurity threats that users confront; without incorporating a sophisticated zero trust architecture, the odds of sustaining a massive breach such as that announced this past week by Howard University are simply unacceptable for most enterprises.
The recent merger of this company with Auth0, its principal rival for cloud-based CIAM solutions, is a marriage, that if not made in heaven, certainly has many strongly positive outcomes for Okta. Obviously, swallowing one’s most significant competitor will provide Okta with increased pricing power that will ultimately be translated into stronger gross margins. In addition, there are significant cost synergies that almost surely will be realized, probably at a faster pace than is incorporated in current consensus estimates. At least, as significant as the “hard” benefits, is the potential to incorporate both the solutions of selling motion of Auth0, which are developer-first, into the go-to-market strategy employed by Okta. Many of the current most successful software vendors, including such stalwarts as Datadog (DDOG), Twillio (TWLO), DigitalOcean (DOCN), Elastic (ESTC), and Fastly (FSLY) are companies that have achieved their sales success by focusing on developers. Of course, there isn’t just a single go-to-market strategy that is guaranteed to be successful, but I think adding Auth0’s developer-first paradigm to the successful end-user/enterprise marketing that Okta has used will add strength to strength.
Okta shares have never been particularly cheap, one reason I haven’t chosen to focus on the name until recently. But the combination of a stagnant share price over the last year, and the negative share price reaction to what was really a blow-out quarter, has provided investors with a more attractive entry point than has been the case in some time. After the quarter that was just reported, and looking at some of the commentary in the conference call, I have forecast a 4-quarter forward revenue estimate of $1,535,000,000 and raised my 3-year CAGR estimate to 40%. That brings the shares to an EV/S of just greater than 20X, slightly below average for the company’s growth cohort.
While the cash flow projection for the current year is also just average for the company's growth cohort, that is really simply a function of the merger expenses and the merger-related deferred revenue write down. The company continues to exceed its cash flow forecast primarily because the growth in its deferred revenue metric has been so strong. The success of the company’s sales motion, as suggested by the 57% increase in the company’s RPO balance, suggests that quarterly attainments are likely to exceed the current consensus forecast. The company is forecasting that its free cash flow margin will grow to 20% or more over the next three years from the mid-single digit level of this year, and I think there are substantial opportunities for that target to be exceeded.
I think the potential for a positive alpha performance of the shares from current levels is substantial!
This article was written by
Disclosure: I/we have a beneficial long position in the shares of OKTA either through stock ownership, options, or other derivatives. I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.