Too Aggressive S&M Spending At Okta Could Turn Investors To Ping Identity

Summary

• After the recent security breach at Okta made headlines, its smaller competitor, Ping Identity awoke the interest of the investment community.
• With its recently perfected full-stack SaaS solution Ping has become a viable alternative to Okta in many segments of the identity and access management market.
• Both companies have strong growth prospects accompanied by a very conservative valuation, which makes their shares an excellent medium/long-term investment at current levels.
• Looking solely at current growth forecasts and valuations, shares of Okta seem to be a better investment decision. However, for those investors who are concerned about large losses and a possibly too aggressive sales focus at Okta, Ping Identity could be the better choice.

mikkelwilliam/E+ via Getty Images

Investment Thesis

As the security breach at Okta (NASDAQ:OKTA) enjoyed great publicity in the past month a small competitor of the company emerged on the map of investors and analysts. Ping Identity (NYSE:PING) has come a long way from pioneering identity and access management (IAM) in the early 2000’s to build out it’s SaaS solution for the cloud, which now directly competes with Okta’s services. After some analysts were of the opinion that Okta’s negative publicity could benefit Ping, I was curious how the two companies compare to each other.

The product offering of the two companies experienced increasing convergence in recent years, especially after Ping made all its services available as SaaS. According to independent third parties both companies offer high quality services being in the TOP 3 in the IAM space besides the solution of Microsoft. The IAM market itself is expected to grow dynamically in the upcoming years, which leaves both companies ample room to grow.

Looking at fundamental trends we see accelerating revenue growth on both sides for several quarters, with Okta growing significantly faster. However, this comes at the cost of rapidly growing losses and an excessive sales focus that could hurt customer satisfaction in my opinion. This could make Ping an attractive alternative for those investors, who are looking for more stability from an operations perspective. However, due to its shifting business model resulting from an increased SaaS focus, fundamentals of Ping are surrounded by higher than usual unpredictability on the short run.

Looking at current valuations I think shares of both companies provide a compelling entry opportunity, with the valuation of Okta being somewhat more attractive considering current growth prospects.

Ping Identity: The Pioneer Of IAM

Ping and Okta have started from very different roots many years ago, but for today they became head-to-head competitors in the rapidly growing IAM space.

Denver based Ping was the pioneer of IAM. The company was founded in 2002 by Andre Durant, who still serves as company CEO and is passionate about IAM. Originally the focus of the company was to help large enterprises in creating a single-sign-on (SSO) for their employees, that can be used for all the applications available within the organization. This IAM solution was later extended to customers as well, enabling companies to securely manage and capture customer identity data. Ping started with zero competition, which partly explains the fact that currently they serve more than half of Fortune 100 companies, including the 5 largest global aerospace companies or 13 of the 15 largest U.S. banks.

Ping has a reputation for solving the complex IAM needs of large enterprises, who are now moving step by step to the cloud. Although the company consciously focuses on the global top 3-5000 companies, their recent improvements on the SaaS front and the introduction of their no-code identity orchestration service could open the way towards smaller companies as well.

Before the arrival of cloud-native, SaaS competitors Ping was in a comfortable situation characterized by a moderately competitive environment. Perhaps this was the reason that they didn’t adapt to the introduction of cloud services quickly enough and have been outpaced by cloud-native vendors like Okta (founded in 2009) and Auth0 (founded in 2013). Ping managed in recent years to build up its own cloud-based SaaS offering, which experienced accelerating growth in recent quarters accounting now for more than 25% of total annual recurring revenue (ARR). Coupled with their recently introduced no-code version of IAM, they will be able to provide a viable alternative to Okta’s services in my opinion. (Dear Reader, if you are a professional in the IAM space with experience in using both the solutions of Okta and Ping, I would be glad if you’d leave a comment regarding your experiences.)

Finally, a comment from trustradius from an IT director of a large pharmaceutical company, which I think reflects the strengths of Ping well: “In the end, what set Ping apart from the others was their level of engagement in understanding our use cases up front during the RFP stage and how they were focused on what we needed more than what they could sell to us. Additionally, they came in at a better price than the competition, …”.

Okta: The pioneer Of IAM In The Cloud

Let’s turn our focus now to Okta. The company was the pioneer of workforce identity management in the cloud, founded by two former Salesforce executives Todd McKinnon and Frederic Kerrest. They worked with Salesforce’s largest customers, which helped them identify the rare opportunity in the aftermath of the GFC, that the software industry is shifting from on-premise systems to SaaS and cloud based computing. They quickly realized that the IAM space will play an important role in this transition, so they founded Okta and capitalized on this idea.

In contrast to Ping, Okta established a customized, cloud-based, low-code workforce identity management solution, which was suitable for small and medium-sized (SMB) and somewhat larger businesses. Later the company extended the scope to larger enterprises and began to provide IAM solutions for hybrid environments as well. They also entered the customer identity and access management (CIAM) market, where they doubled down with the acquisition of Auth0 in 2021. So, for today Okta and Ping compete basically in every aspect of the IAM space, each one having its own strengths and weaknesses.

In my opinion before the acquisition of Auth0, Okta’s main strength besides its cloud focus was its unbelievably strong sales engine. I think Todd and Frederic capitalized on their experience at Salesforce very well, and efficiently sold their IAM SaaS solution to C-level executives of different companies. In the meantime, I suppose they didn’t want to get lost in specific customer needs, so they tried to provide a rather standardized solution for different companies. Based on comments on Hacker News this could have led to dissatisfaction among those customers who wanted a higher degree of personalization.

However, the acquisition of Auth0 could change this picture to a great extent. Okta didn’t just acquire one of its main competitors in the CIAM space, but they acquired a company, who approached CIAM from an entirely different perspective. Auth0 targeted developers directly by helping them to incorporate IAM into applications with a web-based SaaS solution. In contrast to Okta this provides a highly flexible and customizable solution, which made Auth0 very popular among developers. As we have seen in the case of Datadog or MongoDB the support of developers is a strong competitive advantage in today’s rapidly changing IT environment.

It will be a key, how Okta will manage the integration of the two services, because it may both turn out to be a huge success or a huge disappointment. The jury is still out on this one, however it’s a good sign that the YoY growth rate of Auth0’s annual contract value (ACV) increased from 63% in Q2 FY2022 to 81% in Q4 FY2022.

In conclusion, Ping and Okta started from very different points in the IAM space, but for today they compete in most aspects of the market providing viable alternatives to each other. Okta has an advantage in the cloud, but Ping worked hard in recent years to catch up. This is beginning to bear fruit as SaaS revenues at the company grew 56% YoY in 2021 Q3 and Q4 as well. Ping seems to be better at serving large enterprise customers with complex needs, but Okta is trying to push into this segment of the market as well. This could be evidenced in their last earnings call, where they called out large enterprises and business cases related to them several times.

Few Key Players In A Rapidly Growing Market

As shown above there is fierce competition between the two companies, which is amplified by Microsoft’s (MSFT) Azure Active Directory, which is also a popular and proven IAM solution, especially for those companies who already rely heavily on Microsoft’s other services. If we look at Gartner’s Magic Quadrant for the Access Management space for 2021, we can see can that these three companies are the leaders of this category indeed:

Gartner

Good news is that currently the IAM market seems large enough for all these players to grow comfortably further in the upcoming years. Ping estimates the size of the IAM market at ~$50 billion, while Okta at ~$65 billion (without privileged access management and identity governance and administration). If we look at third party research firms, we see significantly lower estimates of around $15 billion, with ~15% expected CAGR for the upcoming 5 years. The truth should be somewhere between the two estimates in my opinion. Either way, Okta and Ping taken together had annualized revenues of less than $2 billion in their most recent financial quarters, so there is ample room for both companies to grow further. I think this makes the case for a compelling long-term investment.

Both companies take this growth opportunity seriously, as they plan strong investments in sales and marketing this year. Okta has been grilled by investors for this after its recent earnings report, as they predicted a significantly larger loss for FY 2023 that has been expected. Ping is more conservative as they are planning to be breakeven on the unlevered FCF front in 2022 after posting a small surplus for 2021.

Okta: Accelerating Top Line Growth Thanks To Auth0

It’s hard to make a clear comparison between the fundamentals of Ping and Okta. Ping is in the middle of a transformation of its business model, characterized by rapidly increasing SaaS revenues to the detriment of term-based license revenues. Meanwhile Okta has a classic high-growth, SaaS company revenue profile, with a more predictable revenue stream, but this is complicated by the recent acquisition of Auth0.

To understand the fundamental trends at Okta better I have created the following spreadsheet, which summarizes key revenue trends for the last three quarters, since the integration of Auth0’ financials:

Created by author based on company financial data

In the first row we can see topline YoY revenue growth for Okta. This compares post-acquisition numbers of FY2022 to pre-acquisition numbers of FY2021, showing stronger than real underlying growth due to the addition of Auth0 revenue since Q2 FY2022. Simply looking at these numbers it is encouraging that the YoY growth rate increased sequentially both in Q3 and Q4 from already high levels.

Furthermore, the YoY growth rate of current remaining performance obligations ((cRPO)) - which represent subscription revenues to be recognized in the upcoming 12 months - tracks around the YoY growth rate of revenues (60% vs 63% in Q4 FY2022). This is a good sign that underlying revenue growth will at least remain around current levels in the upcoming quarters. This is supported by the fact that cRPO in Q4 totaled $1.35 billion, which was a little more than TTM revenue, signaling a strong predictive power for cRPO.

To analyze the real underlying revenue trend for the business, I have tried to clean the numbers from the Auth0 acquisition bias. Unfortunately, Okta doesn’t break out exact pre-acquisition revenue figures for Auth0, so I have used YoY growth rate in ACV for Auth0 instead of revenues, which is the best proxy provided by Okta management. Sadly, they didn’t provide the number for Q3 even after they have been asked on the Q3 earnings call, so I wasn’t able to provide data there.

If we look at Okta standalone in the third row of the spreadsheet, we can see that revenues have been growing stable at ~40% in the last three quarters, which is impressive in my opinion. However, if we look at Auth0 ACV growth, we can see that it increased from 63% in Q2 to 81% in Q4, so it seems that things are tracking good since the acquisition. If we take the weighted average of these figures based on Okta and Auth0 standalone revenues in these quarters, we can see in the fifth row of the spreadsheet that the underlying combined revenue growth rate of the business was around 45% in Q4. This is an improvement of 3 percentage points from two quarters ago mainly driven by Auth0. After the effect of the acquisition gets out from topline revenue figures in Q2 FY2023, we should see a revenue growth rate closer to this number.

To sum it up, with Okta we have a company growing revenues around 45% YoY (stripping out the one-time effect of the recent Auth0 acquisition), which is expected to be maintained in the upcoming quarters. Okta’s medium-term goal is to reach revenues of $4 billion in FY 2026 by growing at least 35% YoY in each year. In the light of current revenue trends, it seems to be a tough goal, as there is only little room for deceleration from current ~45% levels. This tells me that management is confident in what they do, and they see a large market opportunity in front of them indeed.

Okta: Questionably High Losses

Besides strong revenue growth let’s don’t forget about increasing losses, which are typically penalized in today’s growth-off stock market environment. Okta had $8 million non-GAAP operating profit in FY2021, which turned into a $74 million loss in FY2022. Now the company expects a loss of $180-185 million for FY2023 meaning a further deteriorating bottom line. Looking at FCF margins we saw a decline to 7% in FY2022 from 13% the year before. Okta expects a reduction of a further few percentage points in FY2023, while gradually increasing back to ~20% for FY2026. After questioned about this on the Q4 earnings call management argued that currently they are still prioritizing growth over profitability because they are experiencing a good return on their investment.

To verify their statement, I have calculated Okta’s Magic Number, a popular SaaS sales efficiency ratio, which compares the annualized nominal growth in quarterly subscription revenue to the previous quarter’s S&M spending (excluding expenses related to stock-based compensation). In Q3 the ratio was 0.86, which fell to 0.75 in Q4. According to most professionals a ratio above 0.5-0.75 means that a company should continue to invest in new customer acquisition, however some say that a ratio above 1 is considered best-in-class. In the light of this, last quarter’s ratio of 0.75 was not that reassuring anymore. As for comparison CrowdStrike (CRWD) reported a Magic Number of 1.3 in their most recent quarter, which clearly authorizes management to invest in growth further. I think the situation is not that obvious for Okta. It’s worth to keep track of this to recognize in time, whether management is rather focusing on empire building than on allocating resources as efficiently as possible.

Ping: Convincing Turnaround Fueled By SaaS Solution

Although Ping was founded 7 years earlier than Okta its TTM revenue of $300 million lags far behind of Okta’s $1.3 billion. One reason for this is that Ping always concentrated on large enterprise customers and didn’t go after smaller companies in the market. In my opinion the other, more important reason is that they underestimated the importance of SaaS solutions in the beginning and managed to launch their full-stack competitive offering in the space only recently.

In October 2020, Ping announced their first two stand-alone SaaS solutions for the cloud, PingOne MFA and PingOne Risk Management. Although the company provided particular SaaS solutions previously already, this was the first really big step in their SaaS journey. This was followed by the introduction of Ping Advanced Services in Q1 2021, providing feature parity with their core software capabilities with 99.99% availability. The real emergence of SaaS within Ping brought a drastic positive change in the fundamental picture, and suddenly everyone began to talk about it around the company. This is evidenced in the Q4 2020 earnings call, where the number of mentions of the word “SaaS” showed a remarkable increase:

Created by author based on earnings call transcripts

From this point on revenue dynamics changed completely as SaaS revenues began to replace traditional term-based license revenues in the sales mix. SaaS revenues are recognized ratably over the contract period, while term-based license revenues are recognized upfront. This results in an extended period of time for the recognition of the same recurring revenue as the share of SaaS revenues increases.

As an example, let’s imagine that Ping has a customer who closed a one-year contract of $1 million at the beginning of 2021 to use Ping’s software in its private or public cloud or on-premise environment. The customer paid the $1 million upfront and the whole term-based license revenue was recognized for Q1 2021. Let’s say that the same customer opts for using the same solution in 2022, but not with its own infrastructure anymore rather than as a SaaS operated by Ping. Let’s suppose that ACV increases to $1.2 million due to higher cloud and support costs for Ping, but this will be recognized in equal amounts through 2022 every month. This would generate a revenue of $300k for Q1 2022, significantly less than the $1 million a year before, despite increasing ARR from the customer in question. This is the reason that management advices to look at ARR growth and not revenue growth to understand underlying fundamental drivers of the business. Ping even illustrated this phenomenon in their latest quarterly investor presentation with the following helpful chart:

Ping Identity Q4 2021 investor presentation

As we can see from the chart the growth trajectory of ARR and revenue growth will converge in the medium term, but for 2022 there will be some discrepancy between the two. This results partly from the phenomenon described above but is also influenced by timing and duration of contract renewals. Ping guides for 21% YoY ARR growth at the midpoint for 2022, while only for 12% revenue growth at the same time. It is important that the ARR growth rate should be considered as the defining growth rate for the business.

If we look at the trend in ARR over time we can see that since Q4 2020 there is a lasting reacceleration in the growth rate from 15% to 21% in Q4 2021:

Created by author based on company financial data

This was driven by the success of Ping’s SaaS solution, which now represents more than 25% of total ARR after growing 56% YoY in two consecutive quarters. So, just like in the case of Okta revenue trends are compelling and there is no sign of slowing growth. No wonder that management is optimistic for the upcoming years in this case as well, projecting 25-30% exiting ARR growth rate for 2024, with 50%+ CAGR in SaaS revenue during the 2021-2024 period.

On the cash flow front Ping follows a similar pattern to Okta of investing heavily for future growth. This will result in a breakeven FCF in 2022 based on management’s guidance and is forecasted to improve afterwards as shown in the chart provided within the Q4 2021 investor presentation:

Ping Identity Q4 2021 investor presentation

The current guide for 2024 unlevered FCF margin lies in the 10-15% range. This is coupled with a 13-17% non-GAAP operating margin guide for the same year, which could be a significant improvement from current levels. This shows that profitability is not far away on the horizon.

Okta Vs. Ping: Increasing Sales, But At What Cost?

Until this point, I have tried to show that Okta and Ping are in the early innings of penetrating the rapidly growing IAM market with a size of tens of billions of dollars. They are experiencing accelerating revenue growth now for several quarters, which is not common even in the SaaS space. It is encouraging that both companies are expecting these strong revenue tailwinds to continue by providing seemingly aggressive medium-term growth targets compared to other SaaS companies.

To take advantage of this opportunity both Okta and Ping are heavily ramping up investments, which hurts short term profitability, but seems a rational decision over the medium/longer term. Although there is competition in the space from the side of large cloud providers (especially Microsoft), revenue trends discussed above indicate, that there is strong demand for the solutions of independent service providers. With the acquisition of Auth0, Okta and Ping are those two companies who currently satisfy these needs, which is quite a good competitive setup in my opinion.

By comparing Okta and Ping we can see that in terms of revenues Okta is 4-5 times larger than Ping, nonetheless it is growing twice as fast. The main reason for this is that Okta spends much more on S&M as seen in the chart below (non-GAAP numbers, stripping out the cost of stock-based compensation):

Created by author based on company financial data

While both companies increased their S&M spending in recent years, Okta did it more dynamically, especially in 2021, after S&M spending grew 83% (!), which is a huge jump, even with the Auth0 acquisition. With this they spent 52% of their 2021 revenue on S&M, which is a very aggressive approach in my opinion, especially for a $1 billion+ company. Based on my experience, public SaaS companies spend usually 30-40% of their annual revenue on S&M (e.g.: Datadog (DDOG) spent 26%, CrowdStrike 39% in its most recent fiscal year) just like Ping did in recent years.

Focusing too aggressively on S&M can lead to the deterioration of the service provided in my opinion. I came across several comments on Hacker News while doing my research (link provided in the introductory paragraph on Okta), that the customer support services of Okta are often not sufficient. This could have been evidenced in the recent data breach, where they disclosed the January breach only two months after it happened, and even then, they didn’t provide actionable details to customers. Now the company admits, that their made a mistake, but I think their reputation has been damaged to some extent even though the breach itself was not that serious.

In contrast to this, Ping has a good reputation for adapting well to customers’ needs and being there for them if needed. I think this is one important reason why they are successful partners in IAM of the world’s largest enterprises. This is something which differentiates them from Okta and can be their competitive advantage on the medium/long-term.

Besides the quality of the service provided, the extent of operating losses resulting from aggressive S&M spending should also be considered. Looking at 2021 numbers we see the following:

	Okta	Ping
Non-GAAP operating loss ($ mln)	-202	-23
Revenue ($ mln)	1,300	299
Non-GAAP operating margin	-15.5%	-7.8%

Click to enlarge

Okta’s non-GAAP operating margin showed a loss of twice the size than in the case of Ping and is expected to decrease to only -10% in 2022 based on the companies’ guidance. Unfortunately, Ping didn’t provide guidance on the operating result front, but based on 2021 numbers and their somewhat conservative S&M spending/Sales ratio I think they will improve their operating margin further in 2022. This comparison between the companies points also into the same direction in my opinion, that Okta probably spends too aggressively on S&M.

Okta Vs. Ping: Valuation

In the light of their strong growth prospects shares of both companies are deeply undervalued at current levels in my opinion. However, Okta has a proven track record of durable high revenue growth with a quite conservative valuation, while Ping is still in the early innings of its high growth phase. This favors Okta at current valuation levels in my opinion.

Okta targets revenues of $4 billion for FY2026 (CY2025), with a YoY organic growth rate of no less than 35% in any year until then. If we assume that they would grow revenues 40% this year and 35% each year thereafter for three consecutive years, they would reach revenues of ~$4.5 billion for 2025. At the time of writing the market cap Okta is ~$20 billion. If current share price would persist and we ignore potential shareholder dilution, we would have a company for the beginning of 2025, which grows revenues at 35% and trades at a forward Price/Sales (P/S) ratio 4.44 (20/4.5). Even in the current depressed growth-off stock market environment SaaS companies with ~30% growth rates trade at a forward P/S ratio of more than 10 (e.g.: ServiceNow (NOW), Dynatrace (DT)). Based on this, I think if fundamentals of Okta don’t deteriorate, the share price could more than double three years from now.

In the case of Ping the picture is not so clear. The company must show from quarter to quarter that it can further increase its ARR and revenue growth rates from current levels. Looking at the strong revenue trends of recent quarters, the size of its TAM and continued strong cloud adoption this seems achievable, but the big question is at what pace. If we assume that revenues will grow 15% this year (company guidance is 12%) and 20% each year thereafter for three consecutive years Ping would achieve revenues of ~$600 million for 2025. Currently the company has a market cap of ~$2.2 billion, so for the beginning of 2025 it would trade at a forward P/S ratio of 3.67 if share price and share count stay the same. For a ~20% growth SaaS company in a rapidly growing market serving the largest enterprises worldwide this price would be peanuts in my opinion.

However, if we compare this to the valuation of Okta discussed previously, I think Ping has to accelerate its growth even more to make me say, that at current valuations they are the better deal. Although at their hypothetical P/S ratio of 3.67 at the beginning of 2025 they would trade at a ~17% discount compared to Okta’s ratio of 4.44, but the 15%-point difference in their assumed growth rates (Okta: 35%, Ping 20%) would favor Okta in my opinion. If Ping would manage to accelerate its revenue growth rate to ~30-35% in the coming years, while Okta stays in the 35-40% range this would make them a better choice in my opinion, but currently I think the relative valuation favors Okta.

Main Risk Factors

One important risk that lies within investing in Okta or Ping is that the strong cloud adoption trends begin to fade over time. In H1 2022 this is not a real threat in my opinion as the recent earnings of Microsoft and Alphabet (GOOGL) showed that their cloud divisions are still firing on all cylinders with YoY growth rates tracking around the same as last quarter. Although revenue growth at the market leader, Amazon (AMZN) Web Services slowed to 37% YoY from previous quarter’s 40%, I think this is nothing to worry about currently, although it’s worth to keep an eye on.

Another risk factor is the competition from the big 3 cloud providers, especially Microsoft’s IAM solution, Azure AD. Currently I see no sign that this would substantially hinder the growth prospects of Okta and Ping, as the market seems large enough for these players and is predicted to grow at a double digit CAGR in the upcoming years.

A further important risk factor could be a global recession occurring this year or next as inflation eats into consumer spending, while increasing interest rates make credit more expensive (hard landing). In such an environment companies would probably cut back on IT spending, which would be a medium-term headwind for SaaS companies. However, this would only postpone the inevitable modernization of IT infrastructure in my opinion. Currently the analyst consensus doesn’t call for a recession this year or next, but some market participants began to emerge who are more pessimistic.

Conclusion

Okta and Ping are two leading companies of the rapidly growing IAM market, which constitutes one of the most important building blocks of today’s cloud environment. Both companies have their own strengths and weaknesses, which could make them appealing to a different set of investors. Based on current and forecasted strong revenue growth trends and a very conservative valuation I think both companies provide an excellent investment opportunity at this point.

Analyst’s Disclosure: I/we have a beneficial long position in the shares of OKTA, PING either through stock ownership, options, or other derivatives. I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.