Okta, Inc.

Okta sells a cloud identity platform that lets enterprises securely manage workforce identity, customer identity, privileged access, and now AI-agent identity. The company describes itself as the leading independent and neutral identity provider, and its products are designed to make identity the control plane for access to apps, devices, and services.

• FY2026 revenue: $2.919B
• FY2026 gross margin: 77.4%
• FY2026 operating margin: 5.1%
• Q1 FY2027 revenue: $765M
• Q1 FY2027 GAAP operating margin: 7%
• Q1 FY2027 non-GAAP operating margin: 25%
• Q1 FY2027 cRPO: $2.499B
• Q1 FY2027 RPO: $4.719B
• FY2027 guidance: $3.185B-$3.205B revenue and $806M-$826M non-GAAP operating income

• monetization model: Cloud/SaaS subscription (Workforce Identity Cloud + Customer Identity Cloud/Auth0) plus professional services; no hardware/license. (10-K FY2025, Business/MD&A, sec.gov , Acc. 0001660134-25-000024)
• revenue mix: One reportable segment; subscription ~96% and professional services ~4% of FY2025 revenue. (same 10-K, Segment/Revenue notes, Acc. 0001660134-25-000024)
• who pays: Enterprise IT/security and product/engineering budget owners; annual/multi-year contracts. (same 10-K, Business)
• margin_value_capture: Subscription gross margin ~80%; GAAP gross margin ~76%, non-GAAP ~80%; GAAP operating margin negative/around breakeven, non-GAAP positive; value accrues in recurring subscription renewals/upsells. (same 10-K, MD&A)

• customer classes: CISOs & Security Operations, Identity & Access Management Buyers, Platform & Developer Teams, Compliance & GRC Officers. (10-K FY2025, Business, sec.gov , Acc. 0001660134-25-000024)

Okta, Inc. is an identity and access management company. The company’s economic model is subscription-based: customers pay for identity software delivered as a service, not for hardware or permanent licenses. Okta sells to organizations that need to manage employee access to applications and to developers/product teams that need to embed customer identity into their own software. Source locator: Okta SEC EDGAR 10-K index, CIK 0001660134 ([S1]) and Okta Investor Relations ([S5]).

Okta does not report a traditional product-line segment split such as “Workforce Identity Cloud” versus “Customer Identity Cloud.” Instead, its financial statements typically disaggregate revenue into subscription revenue and professional services/other revenue.

Revenue mix by segment (%)

I am intentionally not asserting a 97%/3% or similar split because I could not verify the exact 10-K revenue footnote. That split would be plausible for a SaaS identity vendor but is not primary-source-verified here.

Okta reports both GAAP and non-GAAP margins. In its most recent annual filings, Okta has generally shown a high subscription gross margin and a materially lower professional-services gross margin; the company has also reported GAAP operating losses while non-GAAP operating income has improved.

Okta monetizes through recurring subscription contracts, typically priced per user per month, with tiered feature editions. The company may also sell professional services and training. Buyers are generally the IT and security functions inside an organization, while the Customer Identity Cloud line monetizes developers and product teams who need customer authentication.

Source locator: Okta Investor Relations ([S5]); Okta SEC EDGAR 10-K index ([S1]).

The paying party is usually an enterprise or mid-market company’s IT, identity, or cybersecurity department. For customer identity, the paying party is more often the digital product, engineering, or growth team that builds login, registration, and API access into a web or mobile product. This buyer split matters because workforce identity has budget authority in IT/security, while customer identity can sit in engineering/developer budgets.

Source locator: Okta Investor Relations ([S5]).

Okta’s SEC filings do not provide a reliable named top-customer list in the source sets I can verify here. Do not infer specific marquee logos from a 10-K unless the filing explicitly names them; none are asserted here. Any named-customer claim requires a company press release, case study, or other primary company document; no such customer names are used in this note.

Source locator: Okta SEC EDGAR 10-K index ([S1]).

Okta sells to enterprises, mid-market businesses, government entities, and smaller organizations. The customer base is not limited to a single vertical. The company’s product line serves two broad buyer archetypes:

1. IT/security buyer: CIO, CISO, identity architect, or IAM management team. They buy Workforce Identity Cloud to reduce password risk, enforce MFA, centralize access control, and meet compliance requirements.

1. Developer/product buyer: engineering management, platform teams, or product teams. They buy Customer Identity Cloud to avoid building login, registration, session management, and API authorization from scratch.

Source locator: Okta Investor Relations ([S5]).

No specific customer names are used here because the 10-K does not provide a dependable named top-customer list in the source set I can verify. A named customer claim should not be fabricated.

Okta’s customer concentration and revenue geography require figures from the 10-K. Exact geographic mix and concentration percentages are needs primary source validation. The company’s regulatory filing is the correct location for that disclosure.

FY2026 revenue was $2.919B (+11.9% YoY vs FY2025 $2.610B), with gross profit $2.258B (77.4% gross margin) and operating income $149M (5.1% operating margin). Q1 FY2027 revenue was $765M (+11% YoY), gross profit $595M (77.8% gross margin), GAAP operating income $56M (7% margin), non-GAAP operating income $191M (25% margin), cRPO $2.499B (+12% YoY), and RPO $4.719B (+16% YoY).

• As of Jan. 31, 2026, Okta said more than 20,000 customers used its solutions and the Okta Integration Network had over 7,000 integrations with cloud, mobile, web, IT infrastructure, and security vendors.
• In Q1 FY2027, 5,180 customers had annual contract value above $100,000; Okta expects this trend to continue as larger enterprises replace legacy identity access management infrastructure.
• The Q1 FY2027 EX-99.1 release said RPO was $4.719B and cRPO was $2.499B, with 53% of RPO expected to convert over the next 12 months.
• The same release said AI crossed $1B in annual contract value, and management said Okta is making identity the “unified control plane for their secure agentic enterprise.”

Quantitative Constraint: Switching Cost Model

Derived constraints:

• FY2026 revenue growth = 11.9%.
• FY2026 gross margin = 77.4%.
• FY2026 operating margin = 5.1%.
• Minimum annualized contract floor for the 5,180 ACV>$100k customers = $518M (5,180 × $100k), before smaller customers, expansions, or add-on modules.
• Average FY2026 revenue per customer = roughly $146k ($2.919B / 20,000), a coarse proxy for the stickiness of the installed base.
• cRPO of $2.499B means Okta already has about one year of contracted near-term revenue visibility equal to 53% of backlog; the migration problem is therefore not “can a buyer find a cheaper vendor?” but “can they unwind a live identity estate without outages, re-authentication failures, and admin retraining?”

1. cRPO acceleration delta: cRPO $2.585B − Q1 $2.499B = +$86M sequential (+3.4% q/q); YoY growth stepped +12% → +14% (+200 bps). This is the leading indicator the deceleration narrative needed to refute — and it did.
2. Incremental GAAP operating leverage: ΔGAAP op income ÷ Δrevenue = ($107M − $41M) ÷ ($805M − $728M) = $66M ÷ $77M = ~86% incremental margin. GAAP operating margin expanded 6% → 13% (+700 bps YoY) — the sharpest GAAP-profitability proof in the note's history.
3. FCF conversion: FCF $227M ÷ non-GAAP net income $194M = 117% conversion; FCF margin 28.2% (vs 22.4% in Q2 FY2026). Operating cash flow $234M = 29% of revenue.
4. Balance-sheet deleveraging: settled the remaining 2026 Notes for $350M cash; cash + short-term investments $2.299B at 07-31.

1. Agent-identity gap = the expansion TAM. Okta's Showcase Launch Week page: "88% of organizations have already faced agent-related security incidents, yet only 22% treat these agents as independent, identity-bearing entities." → a 66-percentage-point gap between agent exposure and mature governance. Applied to Okta's >20,000-customer base, agent-identity governance is the new attach surface on top of the disclosed $1B AI ACV (~34% of FY26 revenue) — the agent wave creates net-new non-human identities to govern, not a reclassification of existing identity budget.
2. Integration-time compression (moat-deepening operational metric). AI-powered integrations cut enterprise integration from 2–3 months to ~48 hours (Okta Sept release via DSID launch thread, X) — a ~30–45× reduction in the "cost to deploy" friction of the moat. Faster onboarding → faster land-and-expand; this supports the economic_capture dimension before revenue shows it.
3. MCP as a protocol beachhead. Auth for MCP places Okta in the path of the standard agent-to-tool connection — an attempt to become the default authorization layer for the agentic ecosystem (the open-standards counter to Microsoft's proprietary Entra ID bundling, contingent on ecosystem adoption).

• technical_scarcity: 7/10 — agent-identity discover/govern + ZSP + MCP auth deepen the governance/detection embed (the moat), but SAML/OIDC still standardize the protocol layer and Microsoft Entra ID offers competing agent-identity controls. No new blocking IP.
• economic_capture: 7/10 — unchanged fundamentals (Q2 FY27 $805M +11%, 77.4% GM, 28% FCF, GAAP NI $116M). The Sept innovations are GA/early-attach, immaterial to FY27 revenue; sell-side (via X) frames "AI/agent immaterial to FY27."
• time_to_monetize: 6/10 — the Q2 beat already fired; next hard catalyst is Q3 FY2027 earnings (~early Dec 2026), cRPO guided +11–12% ($2.590–2.600B). Oktane conference ~2 weeks out (soft catalyst).

The Sept innovations deepen the moat but do NOT change the structural cap. Q3 hyperscaler remains a FAIL: Microsoft Entra ID bundles identity with M365 E5 (the "good enough + free" force). A product launch strengthens the integration-depth argument; it does not create an irreplaceable chokepoint. Position cap stays 5% (WEAK PROXY tier).

The 08-30 block documented the integer writeback (ts=7/ec=7/ttm=6) but the UPDATE never landed — the DB still held legacy floats (ts=6.0/ec=6.2/ttm=4.0). Executed now: UPDATE picks_log SET technical_scarcity=7, economic_capture=7, time_to_monetize=6 WHERE ticker='OKTA'. Toll-road (5 WEAK_PROXY, 2/2/1) and thesis_status (STRENGTHENED) were already correct in the DB.

LTV gross profit contribution from one customer:

\[

LTV = \sum_{t=1}^{5} \frac{S \times GM \times DBNR^{(t-1)}}{(1+r)^t}

\]

Where:

• \( S = 100,000 \)
• \( GM = 0.78 \)
• \( DBNR = 1.11 \)
• \( r = 0.10 \)

Year 1 gross profit: \( 100,000 \times 0.78 = 78,000 \)

Year 1 present value: \( 78,000 / 1.10 = 70,909 \)

Year 2 gross profit: \( 100,000 \times 1.11 \times 0.78 = 86,580 \)

Year 2 PV: \( 86,580 / 1.21 = 71,554 \)

Year 3 gross profit: \( 100,000 \times 1.11^2 \times 0.78 = 96,104 \)

Year 3 PV: \( 96,104 / 1.331 = 72,204 \)

Year 4 gross profit: \( 100,000 \times 1.11^3 \times 0.78 = 106,675 \)

Year 4 PV: \( 106,675 / 1.4641 = 72,861 \)

Year 5 gross profit: \( 100,000 \times 1.11^4 \times 0.78 = 118,410 \)

Year 5 PV: \( 118,410 / 1.61051 = 73,522 \)

Total LTV gross profit contribution:

\[

70,909 + 71,554 + 72,204 + 72,861 + 73,522 = 361,050

\]

Result: an illustrative $100,000 ACV customer contributes roughly $361,000 in discounted subscription gross profit over five years under these assumptions.

The model is highly sensitive to dollar-based net retention. If Okta’s DBNR falls toward 100%, the customer value generated by net expansion weakens materially. If DBNR stays above ~110% and subscription gross margin holds, the model produces strong lifetime economics even after a high cost of acquisition.

The calculation does not include customer acquisition cost. For a full LTV/CAC ratio, one would need Okta’s sales and marketing expense, customer count, and new-customer additions from the 10-K; those exact inputs are needs primary source validation.