All right. Welcome, everybody. We are at the anchor spot of the conference and delighted to have Okta here with us today. I'm Mita Marshall. I cover networking and cybersecurity here at Morgan Stanley. We're delighted to have Todd McKinnon, CEO and co-founder, here with us after a great quarter last night.

Thanks for having me. Nice to see everyone.

So, Todd, it's great to have you here, not only after earnings that you reported last night, but just this is a critical time for the identity market, particularly as identity moves front and center in the AI enablement discussion. Just how are you thinking about what type of holistic identity solution the market needs in order to better secure agents, and just how are

you designing towards that? So first of all, when we talk about agents, I think some people I talk to think about them as a discrete thing that's going to be delivered in a certain way. When I think of agents, everything is going to be agents. I think every piece of what we think of SaaS now will be take agentic features, reinvented as agents, replaced by agents maybe. I think every piece of software built will have some agentic capability. So we're really talking about the future of all of technology. Devices will have agentic capabilities, autonomous sequels, and so when we think about the potential of what we're doing with Okta for AI agents and Auth0 for AI agents, that's the long-term ambition. We want to be the identity layer, the identity infrastructure for everything. So what that means is simply put, a company would use Okta as a system of record of how many agents they had, what they could do, how they're governed, how they perform. Right now, the product has a list of the key features that are resonating with customers is it has the ability, it knows about what agents have been delivered by which platform. So it can download agents and synchronize agents from Salesforce and Amazon and Microsoft, and it can give you a central view of all those agents. and then it can control what they can connect to and it can do that connection in a secure way so you don't leak session tokens or leak API tokens. And the connections of these agents is really important because that's how they get all the context to make them super valuable. So it's a big opportunity and we're really – I'm blown away by the interest. And then in Q4, the actual sizable deals on the board was super interesting. It's still early, a $3 billion run rate. The product is still in early access. The Okta for AI agents is early access. Auth0 for AI agents is GA for about a quarter. But it's very exciting.

The identity market, maybe as we think of it more traditionally, has been this best-of-breed market with kind of distinct swim lanes. Does AI finally push us more towards the platform, and why do you guys think that you guys are in the best position to kind of lead?

I think it does. But I think the linchpin of that is the, call it the system of record or the registry. And that has, you know, if you can give that value to customers, to give them this platform agnostic, independent, neutral view of all their agents and let them control the connections, that's a very powerful position to deliver value. So that probably leads to more ability to cross-sell governance for people and agents and privilege for people and agents and core human identity probably makes it even having more. We're already seeing platform gravity with the multiple solutions we have with our identity products. This being a system of record for agents probably makes more platform gravity. It's very early now. I mean, I think there's a lot of I've talked to hundreds of customers specifically about Agentic and what their requirements are and what we're doing. Big companies And there is some spectrum of maturity from the most mature ones have really thought through deeply how they can build an internal enterprise platform for Agentec, including where it's going to run, how it's going to access models, how they're going to incorporate a system of record for identity into that, and they've really thought through strategically how that's going to all fit together. The other extreme is it's really early, and they're thinking about how can we control which prompts our employees are giving to the chat bot. So there's quite a spectrum of maturity. The early deals we've had with our Agentec products have been with the companies in the former category. They've thought through the platform and they've said, hey, we want to really holistically do this. We're going to do big-time automation across our business. The future is Agentec. What pieces do we have to invest internally to make this all work? And our approach really resonates there. So, yeah, we feel like it's early, but the signals are pretty compelling and clear that this could be a big deal.

Yeah, we had this discussion earlier in the year, but, you know, in the market there's been kind of a lot of identity startups or, you know, acquisitions of kind of startups within the space. Just what do you think that people are missing about kind of what is necessary and what kind of others are doing with these smaller identity acquisitions?

You're talking about like CrowdStrike?

Or just... CyberArk is on a small company.

ServiceNow, yeah, yeah, yeah. Well, I think it's... I think when you... I think what's driving a lot of this is it's a big problem for customers. I think people don't – Okta has a unique view of how messed up the identity world is out there for customers. So we've been living it for a long time. But I think people underestimate how fragmented and confusing and the jargon and the vernacular and the acronyms. It's very complex for customers. And by its definition as an industry, it's in the middle of everything. And so it's got this other dynamic of – It's just very complex, and a lot of our success, forget about AI for a second, a lot of our success is just bringing some simplicity and some sanity to that, which we've done a very good job of. There's never been a company like Okta. There's never been an at-scale, independent, neutral identity company. They all got to a certain size, and then some big platform scooped them up. Happened back in client-server days, happened in the web days. Oracle bought a bunch of them and then kind of killed them all. We're the only one ever, And it's because we've been able to make it simple and rational. And now we have multiple products across different categories. That's never existed before. So that's a powerful position. So I think – sorry, it's a long-winded answer. But I think what – I think people from these big companies, whether it's ServiceNow or Palo Alto or CrowdStrike, they talk to customers and they're getting a firsthand look into how messy it is. And then they're seeing all these breaches caused by identity. And so they're trying to react to customer demand, which is rational. But I think what they don't realize is that if you don't own and you don't operate the identity infrastructure, the directory, the connections, the core of what it is, it's much harder to do security around it. If you own the infrastructure, you can make the infrastructure itself secure, and you can build the detections and the monitoring and the posture management tightly coupled to that identity infrastructure and make it better. versus if you're trying to do what some of the other folks are doing, which is trying to do identity security tooling across a broad range of complexity. I think we're in a better position to deliver that value.

Got it. It's great having you here just as a voice as a founder. We've seen concerns of late of what AI can do to cyber. just how do you see that discussion evolving and how do you talk to your ongoing moats and do you think that the market is missing anything about that kind of AI eating, software eating cyber?

Yeah, everyone thinks about it. I think it's super interesting. I think there's so much, I think there's a lot of zero-sum thinking there, meaning that if someone builds something with cloud code or someone vibe codes something, there's a zero sum it's going to replace something and that's immediately going to be cost cutting because they're going to take out some you know workflow tool or some infrastructure tool i think in general there's so much we can do with technology and so much power and automation and cost efficiencies and revenue i mean the industry technology industry i mean the i mean the technology industry you all know this you're conversing in the numbers but the it services so the people doing IT work, implementing systems, designing systems, coding, it's $1.8 trillion. And so I think the zero-sum nature of it is people are getting that wrong. And then I think you get to, when you're figuring out, there is definitely going to be, like you heard me say it, I think everything is going to be agentic. It's going to be what we think of as a SaaS app now will have to get agentic or it will get disrupted. No, but I think they will get agentic. Some will, some will, and some will get more, or have the religion get authentic faster. There'll be more or less disruption. But I think what companies are going to have to do is figure out, okay, what am I going to try to build? What am I going to try to augment? What am I going to replace? And I think when you get down to this infrastructure layer that has to work, like identity infrastructure has to work. Like it's not optional. If it doesn't work, you can't log in. You can't go where you don't know your people, your agents are going to connect to. And then it has to be secure. And so I think we're fortunate that we're in this infrastructure category that has a pretty high bar for, I think, the build-your-own bar has to be pretty high to cross over. But it's incumbent upon us to make sure that we make sure our R&D teams are using all the latest tools to build way more capabilities than we have in the past and get leverage from that and make it not only our reliability and our security top-notch, but the capabilities we deliver is so good, it would really be hard to get to the decision that you would want to build it yourself.

Got it. You just mentioned Auth0 for AI agents, which has been out for a quarter, Okta for AI agents still kind of in testing. Can you just walk through?

It's dozens of customers. So when we say early access, It just means it's still paid for. So customers in production, it's just we haven't totally opened the floodgates on it yet.

What are kind of some early learnings that have kind of helped inform either further development as you look to roll it out to the broader suite?

I think it's – the way we're organized is that we have a go-to-market tiger team that is working closely with customers to iterate the cycle of iteration and the feedback loops into the product team is very fast. This is a fast, evolving environment. So stepping back, we set it up to learn a lot and learn a lot fast. And I think one of the most valuable things we're learning is that we can provide this central system of record I'm talking about, which is valuable, But we can also help in this category of agents that's broad across systems. So what we see is that the companies that are building agents in their app, they tend to be more siloed. They tend to work on HR data or customer data. We can really help those flows spread across different silos, go to the data warehouse, different custom systems, different SaaS systems. And I think the industry probably will start talking about that as a new kind of agent. It's broader, it's more capable, it can automate more things versus a stovepipe agent. And because we're so good at spanning different stacks, it's been an area that's really resonated with customers.

And then just how does what you learned from Auth0 for AI agents kind of inform what you've put into Okta for AI agents?

Well, I think the link, so Auth0 is for people building agents, like if you're building a custom agent, whether you're a SaaS company that's trying to build agents into your product or you're a company that's building some of your own agentic software internally, you can use Auth0 for AI agents to do a bunch of things that are common that agents need to do. It handles the interchange between the system and the back-end systems it needs to talk to in a way that makes it really easy for developers. And the connection is that Okta for AI agents helps a security and enterprise team have this authoritative system of record of what agents the customer has and what they can connect to. So if you build an agent with Auth0 for AI, it seamlessly plugs in and goes into the registry and manages the lifecycle. But Okta for AI agents also works with Salesforce agents and AgentCore from Amazon and Microsoft Fabric and Google and the 50 other agent platforms that are coming up. And in this dynamic market, that's really valuable to have the central registry and the source of truth of everything in your environment.

Got it.

I mean, there's no way for these customers to even keep track of all the stuff coming at them. It's probably another learning coming at them so fast, especially companies that aren't very far along on the maturity curve of thinking about what this means. Just the visibility and they're like, who has agents is valuable.

Yeah, I mean, we spoke earlier in the year, and you talked about kind of the system of record. You are also kind of talking about some of the protocols that you were going to have out there to kind of get different stakeholders to ease this standardization. Just where are we on that, and, you know, how should we measure kind of whether we're seeing traction there?

I feel like I keep saying it's early a lot, but it's early.

It's a common theme this week. Don't worry about it.

Yeah, yeah, yeah. Which is, I mean, it's very exciting, right? But I feel like there's a lot of work to do, which is invigorating. this agentic world and I've said it a few times now everything is going to be agentic there's no good standard way for how it plugs into a company so the company can make sure it's secure, they have visibility in what it's doing they can stop it if it starts doing things that they don't want it to do that whole interface needs to be defined and it's going to be defined as some kind of technical standard. There'll be de facto standards. People will get a bunch of traction and kind of set the default and other people will follow, but it needs to have some technical standards there. The best standard so far in the agentic world is MCP, but MCP is really how the models talk to the tools and the tools can share their data in a standard way, a discoverable way with the agents and models, but there's not a technical standard of how the agents get visibility and are monitored and controlled. So we've done some things working with the folks on the MCP standard to add capabilities to MCP to make it more compatible with enterprises. I'm sure there will be more of that. I'm sure there will be more just technical standards in the industry to make it all plug together, and we're going to be right in the middle of making sure we define that.

Got it. So I want to turn to results from last night. You reported 12% CRPO growth, 11% overall growth. You noted 30% of bookings, of Q4 bookings, were from new products and that you were seeing 40% average uplift when they were a part of deals. Just where are you seeing, you know, those are great stats. Where are you seeing the most traction with those new products?

Strength of our business has been larger enterprises. That's been consistent over the last few years, which kind of makes sense because they have, there's a lot of complexity. There's a lot of security. There's a potential to upgrade security with a great identity system. There's a lot of, like I mentioned before, there's a lot of complexity. There's a lot of, you know, these companies have 20, 30, 40 identity systems, and it's just hard to manage, and it's expensive, and they don't get a lot of the security outcomes that could be available to them if they standardize it in something modern like Okta. So large enterprise is a highlight, and our message with multiple products and our identity suite. And by the way, a lot of people say they have a suite. Ours is different and that's an identity suite. And you have to standardize on something and we'll save you cost and all the identity products. And then we also have the added benefit is you can choose the best cyber stack around that. You can use CrowdStrike, use Palo Alto. You can use any app you want. You can use any agentic world. You can use any agentic development platform, any model you want. So this neutrality, it's like pick something to standardize on our pitches. Like, hey, pick identity. We'll handle all the identity use cases. We'll consult it all as vendors, and then we'll give you the choice. We're not going to say, hey, it's any model you want as long as it's our model.

And then just on the new products, I think you mentioned that OIG was kind of where you had seen kind of the most strength in the new products.

2,000 customers now.

Perfect. In the outlook, there was kind of a small step back on operating margins as you kind of invest more in go-to-market and agentic solutions. Just kind of what is giving you kind of the thought that this is, you know, where you want to invest right now?

Well, I think the two areas of investment are, incremental investment are go-to-market and then R&D. And I think there's, in terms of the go-to-market investment, I think there's, we're seeing productivity. We're very comfortable where the productivity is now after it accelerated last year. And we feel like there's more market share to be gained with that investment. R&D side is mostly about making sure we continue to innovate, have this comprehensive set of products. The agentic investments are a good part of that. We're also, I think maybe something else that's maybe not obvious, well, maybe it is obvious looking at the numbers, but I think an advantage for us is the company is in a good spot in terms of being able to invest more at an efficient rate so we can get more bang for the buck because of the way we have global R&D development centers now. We have, of course, that's all being accelerated with AI tools. So just structurally, I think we're in a better place to get more bang for our dollar. And so it's almost like more leverage when we do tick up the investment in these areas, which is something that's – we're just in a much better position than we were three or four years ago in terms of that. Got it. Because of all the hard work we've done.

Yeah. One of the other kind of announcements you made last night was just about kind of this professional services business and moving that more towards kind of the GSIs and the channel. Just, you know, why was now the time that that made the most sense?

So I think one of the things that is also maybe a little bit unique about Okta is that for an identity product, set of products, any product in a set of products were pretty it's pretty low services. Pretty easy, you know, like implementations are relatively easy. I mean, it's not, I would never say they're easy, especially in some of the large complex enterprises, they can be complex, but compared to other stacks, it's relatively easy. So I think we've gotten to a scale where maybe, you know, if it wasn't so easy, the global systems integrators would have been more aligned with us and really staffing up to do the services early in our life cycle. But with the products getting more powerful, with governance really hitting its stride, there's just more work in the large enterprises that these GSIs can do. So we kind of had to make a choice. Are we going to lean into that and lean into their interests? Because they see us as the leader. They see other vendors in the specific identity space as maybe not innovating and not pushing the boundaries forward. And then they see Agentic and all the potential there, and they're leaning in on us, and we're at this point where our products are capable of really doing these transformations that require more GSI support or services dollars. We had to make a decision. Are we going to – do we want to grow our own services, or do we really want to lean into this enabling GSIs? And I always say that if you're going to make a decision, unless it hurts a little bit or unless it's a hard decision to make, it's probably not worth a lot. And so when you have to really forego some services revenue, it means it's probably a decision that might hurt a little bit in the short term, but be something really good long term. So that's where we are.

Got it. As investors are looking for reacceleration in the business on the back of some of these go-to-market investments and Agentec, Like, just how are you thinking about kind of fiscal 27?

I think it's like a beginning of a new era for Okta. And I think it's maybe it was the startup era, and then we went public, and then there was the COVID era and the zero interest rates, and we've kind of settled things down and normalized it. I think this is the beginning of a new era. And I think the platform approach we have, just identity, this unique approach to an identity platform. No one else has it. No one else has a broad identity platform like we do that's not super tied into another stack. So it's unique in the industry. And the opportunity to be the foundational layer for agentic identity and agentic connections, that could be bigger than all of identity is now. That could be bigger than cyber. And that's a massive opportunity. You're talking about a tech stack that's going to, This Agentex tech stack, just for starters, is going to have a huge impact on $1.8 trillion of IT services, and not to mention the other, you know, what the leverage and the productivity and the effectiveness of a billion-plus knowledge workers. That's massive, and that's exciting to us. I mean, we don't want to – we're not here to build just an okay, medium, fast company. We want to build one of the best, great, impactful companies ever. And I think this could be, you know, this could be the start of a new era, and it's up to us to make sure we capitalize that over the next several years to make it a reality.

Got it. It's almost like a great end, but now we're going to get it. Yeah, but I want to make sure it's clear.

I did not die to $1.8 trillion in revenue.

Let's talk about go-to-market for a second and just kind of how you go and sell that vision. And you've implemented a number of go-to-market changes over the last year, focusing on some kind of specialized sellers and Okta and OffZero teams. Just where do you feel like you're seeing kind of the most traction there? Yeah, I guess.

I think so about change and go-to-market change, I think the notable thing this year is there wasn't much change. And we already saw that in the performance at the start of Q1. So it's what you'd expect. There wasn't a lot of cost to change so far. It's only a month in, but it's what you'd expect. And I think, so if you go back a year ago, the main change was more specialization around Ops Zero and Okta. And those platforms both had become so capable that it was really hard for one rep to get their head around it all. And so that's been working great. And I think the new products is probably the best evidence of that. But if you're not specialized in all the innovation, the new products, it's hard to sell them. If you're spread across too many, it's hard to deliver that pitch and know what they're talking about when they drill into the details of identity security posture management and what's the difference between that and identity threat protection and security center and Auth0. So we're seeing that pay off.

I mean, as you think about kind of AI as almost or I know you've mentioned everything will be agentic, and so maybe this is kind of the point, but do you need kind of these special teams for AI sales versus kind of this split between Okta and Okta?

Yeah, that's a – well, I think right now it's a – I think the operating principle right now at Okta is that it's a tiger team that is designed to iterate fast and get feedback from the customers of the product. And that Tiger team, they basically are doing a lot of things, but they're also sitting with a bunch of reps through these deals. So the reps, these AI deals still go through the reps. You basically have this Tiger team that's the overlay or the specialist. We're thinking that it will be a generalized sales motion, but I think we're flexible on that as we scale it out. it might make sense that the products evolve in a way that they're more separable than the core platforms. So we might do it separate. But the way the plan now is that it'll be like the AI products are horizontal across there and Okta, meaning that if you buy Okta for AI agents, your AI agent identity gets some connections with login. It gets some connections with universal logout, some connections with government, governance, and kind of horizontal. And same with Auth0. We're trending now toward a more generalist model, but I think the reality is that this could change as we go down the path.

We've had this discussion before, but just in terms of, you know, as you move up market, as you have these bigger conversations, those can tend to lead to kind of longer sales cycles. And so just how are you kind of balancing the – we have solutions we can give you day one and then progressing that conversation along?

I think it's a real thing. Like I think it leads – part of this is why our years are so back-end loaded. As we move up market, we get a lot of deals that, you know, we could just do a smaller deal, but we wait until the end where it's a big platform deal. I think it's hard when you're trying to deliver broad value across multiple use cases sometimes it's hard to start small the fact that it's relatively straightforward and possible from a technology perspective and packaging pricing perspective is some kind of buffer to that but it is a real thing I don't think it's getting worse I think it's been steady as we've moved up market I would say the biggest difference is that when the deals come, they're bigger. So the sales cycles are not any longer, but when they come, they're bigger. And when someone actually does delay them for a couple quarters to get the big one at the end, it's actually bigger, which is what you want. You don't want people delaying for two quarters and then delivering the small one.

But maybe, you know, you talked about this. You guys have built an incredible platform. You generate a fair amount of cash. You announced the billion-dollar share repurchase program earlier in the year. Or just how are you thinking about kind of capital allocation?

So I think we think the stock is undervalued. That's why we did the buyback. And then the other variable there is we're looking at ways to grow the business with M&A. And when we've done M&A in the past, Auth0 is an exception for that strategic asset. But a lot of our M&A has been small tech and technology and teams. We had great success with that. And the at-scale acquisitions in our strategic zone of identity would have been legacy companies that are software companies. So we've never done anything like that. And I think that's the right decision. So basically, it's a long-winded way of saying is that we keep looking for acquisitions, but they tend still to be tech. Even the things we're looking at around AI tend to be small teams that are innovating quickly, not something that would be a huge capital allocation. So with that, cash generation and trying to return some value to shareholders with buybacks, we think the stock being undervalued makes sense. I think going forward, we've talked about a billion-dollar pool for buybacks. We'll do that in a moderate way because we can't predict the price week-to-week, month-to-month, quarter-to-quarter. but we're comfortable with that and then going forward I think beyond that I think the question will be really around what M&A could move the needle as the company evolves into this infrastructure for AI agents and what that will mean there. That will probably be the next decision point.

Got it. Well Todd, thank you so much for being here today and congrats on the quarter.

Thanks everyone.