Good afternoon. We'll go ahead and get started. Thank you for joining us at the Okta session this afternoon. I'm Gabriela Borges. I cover security and emerging software here at Goldman. Delighted to have Todd McKinnon on stage with me, CEO and co-founder of Okta. Thanks for having me. It's great to be here, the Palace Hotel. So, Todd, I want to start on what appears to be a little bit of paradigm shift in security, which is the idea that identity is the new perimeter. And so as we think about the traditional architectures and network security dissolving, help us understand how and when identity becomes a more strategic cornerstone of the security budget. I think it's an important question, and it is the perimeter. I talk to people often. Before I get to that question, I talk to people a lot about even beyond that, why it matters and what. First of all, what is identity? And it's really like a system of record that stores the people and what they can do and what they can't do and gives you information about that in a full kind of comprehensive visibility kind of way across customers and employees and partners. So out of that comes a lot of things. You get, even before you get to cyber, you get simple things like, can your customers log in, and are your partners able to get to the applications and get the value of all the technology you're deploying? Then you get to the cyber, which is: Are your customer accounts getting taken over? Do you have fraud? Are your employees getting hacked and phished, and do you have visibility into who's doing what, going where? So it's essentially the... At the end of the day, you're trying to get all this technology and all this information to people, and if you have a system of record that says who's supposed to get what, when, where, and how, that's the natural point to answer all these other questions, cyber being a big set of these questions. The old way of doing it, where you had the perimeter of the firewall or the perimeter of the office or, it just wasn't going to stand up to the complexity and the devices and the proliferation of technology that we have today. So there are a couple of concepts in there, which is Okta being an aggregator of identities and, and being able to authenticate. There's a level above that, which is being able to use the identity data that you have for more effective breach, breach prevention. Mm-hmm. How do you think about evolving the product mix or the product portfolio longer term into more threat detection, threat remediation, threat intelligence, et cetera? The specifically on many breaches, you hear this stat a lot, like, you know, some number of breaches are all caused by passwords or forgotten passwords. Right. That's definitely true. We can talk about passwords and why I think, you know, hopefully, we start using them less and so forth. But the other breaches, I think, are probably caused because someone had access to something that no one knew they had access to, or there was overly permissive access. That's a hard problem because you have these companies that have tremendous amount of complexity with the systems and the users and the groups and the roles and the permissions, and, there's... It's really hard to have comprehensive visibility into, you know, any kind of mistaken configurations or overly permissive access or accounts that aren't shut down. That's kind of like the boring problem, but it's a really serious problem. You know, I talk to a lot of customers that are they just want that visibility and some kind of proactive system to give them comprehensive view, but also proactive alerting or warning on, "Hey, who... Where am I being overly permissive here? How could I shut this down? How could I not just leave an account open?" I think that's a challenging problem, but you can't solve it unless you have... You know, you gotta start with a kind of a centralized system of record. Back to the concept I started talking about before, it's like you need a comprehensive system of record of who can do what, who are the people, what can they go to, what's the technology, where they're allowed to, where they're not. Then you can start to do some of these proactive things around notifications. When you have things set up too loosely, as things change, you can kind of be on top of it or at least have a chance to be on top of it. I want to stay on this theme of where Okta can go longer term with adjacencies and security. One of the more interesting observations around Microsoft's new network products is that they're intrinsically connecting their new network products to the identity land, to their identity product family. So do you think it makes sense longer term for Okta to include more adjacencies, either on endpoint or network, as you think about your longer-term product roadmap? At Okta, we're culturally, I want the company to feel like it's, you know, the employees' company. You know, they're working as a builder and owner to build this great company together. And part of that is they have to understand our strategy very clearly, 'cause if you're an owner of something, you're a builder of something, you have input into the strategy, the strategic vision, and you're more fired up to execute on it. So we've done a bunch of work to really clarify in the whole company what our strategy is. And one of the things everyone's, maybe not everyone at Okta, but we aspire to have everyone at Okta be very clear on, is that we are an identity company. Our strategy is to leverage our lead in identity by offering the best products in all the identity markets: Customer, Workforce, Privilege, Governance, identity markets. Stay focused on identity, and it's important strategically because it kind of tells the company where to focus, but it also gives, enables us to better integrate with the ecosystem.... We strongly believe that, especially in security, ecosystem integration really, really matters because it's an adversarial environment, meaning that you can think you have all the holes plugged, but the adversary is trying to find the next hole. And if you're trying to get everything in security from one vendor, you're inherently not well equipped to have the ecosystem plug that hole and give you that defense. So our strong belief is by focusing on identity and building a solid technical foundation for integration, we're going to have the strongest ecosystem of integrations and technical integrations and give that all to the customer. So we're very clear that's where we're focused. Not about endpoint security, it's not about network security, it's about identity. Now, there might be some gray areas, like what does identity mean on the margins and what is... And, yeah, we'll figure those out, but we're very clear about where our swim lane is long term. So one of the things that Microsoft is right about this. Sorry, I mean- Please. I'm just really excited about this. There is one thing Microsoft is really correct about, that identity does need to be integrated strongly to network, and it needs to be integrated strongly to the device, and it needs to be integrated strongly to every app in your ecosystem, not just the Microsoft stuff. So they're right, but it's incomplete because they're, at the end of the day, they're focused on Microsoft, not on the entire ecosystem. Microsoft will oftentimes communicate to its customer base that it does have ecosystem integrations outside of the Microsoft ecosystem. So when you have sales reps in the field, how do they counter some of those claims? What are some of the more nuanced points that investors and customers should be paying attention to when Microsoft makes that claim? It's a really good question because especially as we at Okta, as we work really hard to enable our sales team and have really compelling messaging, and everyone's clear on the strategy and the vision. But a lot of times with the customer, the vision of the company or the strategy of the company doesn't matter as much. They're trying to solve a problem today, and in the macroeconomic environment that has questions, they want to deliver business value, and it's not as much about your high-level vision. It's like, solve my problem. So this is a really important point. So I think this point about identity being important and then the integrations of identity to everything, there's really two layers you can kind of prove the point to a customer. One is, like, the very specific, like you mentioned, the specific examples of how Okta works better, whether it's integrating with a diverse set of HR systems to have your joiner, mover, and leaver process really comprehensively automated across your whole suite. There's just specific examples where our integration is stronger, and you can do the same thing for different client operating systems or mobile phones or if you want to get phishing-resistant access, you can't do it across a variety of platforms with anyone else but Okta. It's just unequivocally, technically true. But you know, Microsoft can spend a lot of money, and they can invest, and they can do things that other vendors are doing. So then you get to kind of a high-level philosophy of just and this doesn't always resonate. It resonates with some companies, but there's just a philosophy of, at the end of the day, if you're a product manager at Microsoft and you come to your boss with a great innovation that really logs people in quickly and securely to Amazon Web Services better than Azure, you're just not going to get promoted. You're just. It's a cultural thing. You're. They're. Microsoft is doing a great job selling Azure, selling collaboration apps, and they're even, you know, making a lot of efforts in security. But at the end of the day, it's about those three things. It's not about identity per se. We're different. We're about identity. We're connecting to everything. We're going to be what's best for the customers at a philosophical and, like, an alignment level. But again, you've got to prove it in the details. You've got to prove it by having more integrations, which we do. You've got to prove it by having deeper integrations. You've got to prove it by a better ecosystem that works better out of the box, and that's what we're focused on doing. So, I want to connect the dots between the longer-term vision that you're articulating and some of what you're seeing in the near term. Earnings call last week, talking about seeing the demand environment stabilize based on trends in duration, average deal size, new business, a lot of the metrics stable to improving. Would love to get your qualitative overlay on what you're hearing on the ground from your customers. How is the demand environment? Yeah, I think you mentioned the quantitative aspects. Anecdotally or qualitatively, I think there just seem to be fewer, like, random changes in the deal just being gone or slipping out. We saw that happen in Q1. We didn't really see that happen in Q2. It was, you know, kind of like stability of forecasting and kind of, like, less random things happening in the cycle, which I think is a sign of this macro stability. Particularly, and then inside of that, I think the SMB part of our business, the budget's pretty conservative and projects pretty not as flowing through the system. Larger enterprise, seems like they set their budgets at the beginning of the year, and they're kind of executing on them. I think you saw that in our results with, you know, our 25 biggest deals were $100 million of TCV, which is very, very good result for us. And then the cohort of $1 million ACV deals was the biggest, really healthy, large growth numbers there. And I think that's just a result of identity is important, particularly for large companies, which have a lot of complexity, a lot of users, a lot of technology, a lot of critical projects on the customer identity side, things they want to do on the workforce side around cyber and better user experience, and I think you just see those, kind of seeing those budgets roll through. ... So there are a couple of different pieces to that, the customer identity piece and the workforce piece. One of the trends that we're trying to better understand in the workforce is how far along the product cycle are we? Because SaaS-based Single Sign-On has been around since Okta pioneered innovation in this space- Almost 15 years. Yeah. And so when you have large customers that are still investing in Workforce, what are they investing in? Yeah, this is a—I think it's a misconception people have. A lot of, especially in larger enterprises, they have a lot of, kind of a mixture of a lot of things. They haven't really standardized on one platform for identity, not even for workforce identity, let alone workforce and customer. They, they'll have, common thing you'll see is you'll see parts of the business will have, maybe some Active Directory on software, something called Active Directory, Active Directory Federation Services. They'll have legacy software environments in other pockets that really grew up around certain applications or certain use cases, maybe for partners. Then you'll get, you'll get, clusters of identity around apps, like you'll see the Oracle stuff around the Oracle apps, IBM stuff around the IBM apps. You still see a bunch of Computer Associates stuff out there. And then there are companies that have solved it for the Microsoft apps with Azure AD. But they still have problems in that those systems don't work together, and then particularly when they're talking on the cyber side about visibility, if you're a CISO, congratulations, you're hired as a chief information security officer of a large company, one of the first things you need to try to do is get visibility across it all. I meet with CISOs all the time, they're like: "Just show me everything." And so one of the things they do is they kind of get a roll-up of all these systems. So they put Okta in place, and they kind of get visibility in all these systems. And then they can take some of them out over time. They can maybe do new use cases 'cause they started with just single sign-on, and they go to phishing-resistant multi-factor authentication. Now, with identity governance, we can give them more reporting and more workflow capability. So it's a pretty complex environment, and this, this idea that you either have identity or you don't, it's really not how it works. It's like you have pieces of it all over the place, and it's, we're trying to move the industry to the next one unified platform, specifically for identity. Can you give us a sense for within your large enterprise customers on Workforce, what percentage of penetration do you have? So if you just say within Workforce, I think a good, a good proof point is, the upsell rates from the -- what we're seeing in, in the value of upsells for governance, because for those of you that have been following Okta, the Workforce product portfolio is essentially... There, there's some other products, but the main ones are Single Sign-On, Multi-Factor Authentication, and Lifecycle Management. Like, simply, it's basically like authentication, strong authentication, and then automating the creation of profiles and the deletion of profiles and the synchronization of profiles. That's lifecycle management. So with, with governance, we're seeing an average... So and governance is really, it's like a, it's a piece on top of lifecycle management, kind of rounds out the solution. So with governance, we're seeing 30% more, 30% plus increase in the ACV of a Workforce customers by adding governance. And we have over, you know, 12,000 plus Workforce customers and a ton of room to run in that customer base with governance. And that's not even including privilege, and so it's. There's a lot of room to run. And that's not even including Customer, too. So, you know, we talk about doing well with upsells and new business being a little slower recently. I think a lot of that is because we have a lot more products to sell, and as the economy gets tougher, I think the rational thing to do is sell to your customer relationships. And when you have a product portfolio that's really expanded over the last couple of years, I think that's why you're seeing some of that upsell, those upsell rates happen. The idea of a standardized or unified identity platform at enterprise makes a ton of sense. Outside of CISO turnover, what are some of the catalysts that Okta can help affect to go from, "Hey, customer ABC has seven different identity vendors across different pieces of their organization," to "We're all in on Okta on Workforce, and then we're going to upgrade to OIG," et cetera? There are a couple. So a lot of the breaking through that inertia and getting... There has to be a catalyst, as you mentioned. If you're a large enterprise, and you have a lot of complexity in your technology and a lot of complexity in your identity stacks, plural, there has to be a breakthrough to catalyze that, or there has to be a forcing function to catalyze that. And sometimes it's a champion that gets hired, a progressive leader, CISO or CIO, that wants to do more with less, you know, have better cyber posture and make things easier to use. That certainly happens. Another big one is M&A. So, like, a company will bring in a new company, and they'll have to consolidate the systems to get the M&A to reap some of the synergies that they want in the deal case. Last a couple weeks ago, or last week, we launched something called Okta for the Global 2000, and it's really an advanced capability to help companies decide, so when companies have a business strategy, they basically, a lot of business strategy is deciding which markets to be in, how to win. And so you got to decide which divisions of your company are going to go after which markets, which things you're going to try to do centrally from a G&A and cost improvement perspective, which companies you're going to buy, which companies you're going to divest, and so on. And so now there's so much technology involved in it, in that all those decisions are technology decisions, and because they're technology decisions, all those decisions are identity decisions. So Okta for Global 2000 really explains to people that you can, identity can help drive your business strategy. It gives you the flexibility to decide what you want to centralize, what you want to buy, what you want to sell, how you want to attack these markets. And these kind of things catalyze some of these enterprise-wide standardizations of Okta. And, you know, it's an example of how we're raising the visibility of some of these decisions, 'cause too many companies still think about identity as something tactical that's done as a department in a fragmented way, and there's tons of benefits they could accrue by standardizing this, you know, standardizing this capability across the board. So that's a catalyst for some of these migrations. And I think another big one now is just, you know, cyber. There, companies are, you know, boards of directors and CEOs are sick of hearing about phishing attacks and ransomware, and inevitably, these things come down to some password or some phishing, and that's how they got in, and they just want it to stop. And by standardizing some of this across the board with a phishing-resistant product like Okta, they can do that. I'd like to tie some of this together into the heavy lifting that you all have been doing on your go-to-market and to some extent, on your R&D as well over the last two years. What are some of the incremental efforts that you're focused on from an organization or a process standpoint with your internal sales and marketing organization? And then, same question for R&D? We have the strategic plan for this year, our operating plan for this year is, you know, it's we're executing it well. We have growth. We're doing well in growth, we're doing well on efficiency. And despite the improvements in efficiency, we're actually investing a fair amount of money in efficiency for future periods. So one of the things that's missed when people look at our results is we're actually spending a decent amount of money making things better in terms of efficiency for the future. Like, a good example of this is, we don't right now have an automated way to seamlessly bill customers for overages on the service. You know, like a lot of things, we threw bodies at that in the past. We said, "Hey, you know, automating that is going to be hard. It's going to take some money. Let's just hire more people, and we can manually go after this." But, you know, like a couple of years ago, actually, and really it ramped up at the beginning of this year, we're automating all that. So that's costing money. I mean, that's like making us less efficient this year, but, you know, five-10 years ago, five-10 years from now, as Okta grows to be, you know, $2 billion, $4 billion, $10 billion, and beyond, it's going to be automated, and those kind of- that revenue is going to be much more efficient. So that's one example. So we're doing well at that. There's also just a lot of... As our vision comes together with one company selling Customer and Workforce and, the acquisition of Auth0 really being fully integrated, there's just a lot of things that get more efficient and effective, whether it's sales reps learning how to sell both clouds, Customer, and Workforce, whether that's enablement that happens to train people, the value props that resonate in an economy that's soft, how they sell in that environment, how we prosecute. There's just all. And just, I would just say it's like a lot of continuous improvement. We're trying to get better all the time. We're not. The journey is not done. We don't think that, you know, we have a decent couple quarters, that we can just relax. We got to keep working harder and push harder, and we think that we have a big opportunity, and we can grow and we can be efficient, and we can really fulfill the potential we have. Is there a way to think about what inning Okta is in realizing the full potential of the Auth0 acquisition? I think it's like one out in the third inning. Okay, sure. We had a rough first inning. Fair. Gave up a few hits, but we're in the third and a lot of room to run. Where did you all land on the best go-to- It was your analogy, not me. No, I appreciate that. Where did you land on the best go-to-market approach between product-led growth, winning the hearts and minds of developers, versus more of a top-down motion for customer identity, in particular? I think they're, the go-to-market on customer identity is really important, and it's not, it's not an either/or. Okay. I think one of the realizations before we did the Auth0 acquisition and throughout it, it's been confirmed, which is developers in customer identity are a really important constituency, but no developer signs a PO for $1 million. It's done by a CTO or an architecture person or a product officer or a market digital officer. So you really have to have both. And what we learned at Okta is that the product and the platform we had built was really good for CISOs and CIOs, and really kind of when you wanted to put a system in top-down, and it was kind of preordained how it configured everything. Okta was really good at that. Pre-integrated, kind of set the standard from the top. But Auth0 was really good at, as the product was built, as the engineers first thought about should they buy this or build this, I need an identity stack that does exactly what I need it to do and not too much. It's very flexible, very, kind of component-oriented, does exactly what, which is very different than saying, "Hey, here's your identity solution from the CIO or the CISO. It's the standard way we access apps. This is how it works." And so what we saw is that the and many times, the marketing person or the technology officer, or the VP of engineering, they actually not only was the platform a wrong fit for them, they actually didn't want the thing that the CIO picked. It was like, you know, I've worked with companies that I was trying to get them to buy Okta for customer identity before the acquisition, and the VP of engineering is like: "We're not using that, that's what the CIO picked." But now, after with Auth0 and Customer Identity Cloud, they're like, "My developers love this. I love working with one company. It's easier to do business with you. It's easier. You have one support team, one services team, kind of one throat to choke, so to speak, on customer success, but and my developers love this. It's a, it's a natural extension. I'll pay you more for that." So it's kind of that balance of top-down relationship influence with the developers loving it, and the bottom-up, which we think is a winning combination and why it's so exciting to be just in the third inning. Another thing to know about this is that it informs our... So our strategy is we want to double down on our lead in identity by having a product in every category, and then use that neutrality to have this ecosystem advantage. It makes sense, then, to have one sales rep that is selling all products in the account, because what that sales rep is supposed to be able to do is sell higher. So I don't want a sales rep that can only talk to CIOs or only talk to CISOs. I need reps that can talk to the engineering person and the marketing person and the technology person. It's harder to do. It takes a skilled rep, someone that really wants to focus and learn and learn how to do it, but you're in a much more strategic position once you can land it. Now, that being said, they still have to be able to execute transactions. They can't sit there and try to call on, on the CEO and the board all day and not actually close the deal. But that's how the go-to-market strategy is aligned with our company strategy. You've made so much progress on the alignment of go-to-market. What is the limiting factor today to hiring a new sales leader? Finding the right person. It's really important, and I can... I'll expand on that. So the search started in February, and I talked to a bunch of people that had—I wanted to find someone that had done it before, taken a SaaS company from 2 billion to 4 billion to 8 billion and beyond, and there aren't that many. There's, you know, a handful, and those folks are either in their jobs or they're retired. So then we shifted the search to more, I call it, someone that hasn't actually done it before but has, I wouldn't call them an up-and-comer, 'cause these people are amazingly accomplished, but just haven't been the person in the driver's seat in all go-to-market at the scale we're getting to. And at the same time, I think it's a very important hire for the next three-five years, and we just want to get it right, and we're doing our homework and checking references and networking a lot, and we're going to find someone great. Good stuff. Okay, I'm going to pause. Questions from the audience. Todd, we spend a fair amount of time with channel, and channel tells us we would love to have an identity platform that's easy to implement, that's comprehensive. We think there's a gap in the market. Okta still has progress to be made before we commit to them wholeheartedly. What do you still need to do to get the channel fully on your side and leverage some of that momentum or potential momentum? I think just like we talk about balanced enablement of our field with customer identity, I think we have to make sure we educate and enable the channel on Customer Identity. I think the channel is. There's a lot of companies in the channel. It's a pretty big group. But to generalize, I would say they're more workforce-centric. You know, it's like cyber and traditional outsourced IT type of orientation. So I think we have to enable them on customer, and I think very few, especially the mid-size channel players, very few of them have dedicated id... They think about identity as a broad platform in the same way that we do, so we have some work to do there. I think on the larger, the big, the biggest size and the biggest companies and players in the channel, I think we just have to make sure that we, as the product portfolio expands and as we have a set of capabilities, that we'll give them a lot of work to do around this... because I'm not sure the big SIs, the big SIs can add a lot of value to customers at scale. It's not so much about the solution being easy, it's about how much value can they add around it. So I think we have work to do in educating them and partnering with the big SIs to not only on the governance opportunity, but 'cause governance is complex, and there's, to fully automate governance end-to-end in a big company, there's going to take a partner, it's going to take an SI. And then on the customer identity side, all should be really in line with what these big guys—SIs want to do, 'cause they want to really be the digital transformation partners and, so I think we have. We made a lot of progress in the big SIs, but we can do more there. So I think our channel program, writ large, has, over the last year, I would say, we are focused on fewer partners, and we want to make it very clear the ones we're focused on and where we direct customers, and then we also commensurately want the partners to, like all these top partners do, really add a ton of value. And so it's like a focus, and it's a really strong partnership 'cause we don't, we don't like to see the negative channel checks. It bums me out. So we're focusing on fewer partners, still a lot of partners, but fewer than we were before with kind of like white glove, strong partnership with the ones we're focusing on. I want to end back on product, which is, if you reflect upon some of your more interesting customer conversations to date, your most sophisticated customers, what are the one or two things that they're doing that are particularly interesting with how they approach identity? And what is the next big technical challenge that those customers are asking you to solve? Yeah. I think the most sophisticated customers I talk to have been able to balance this, so there's, like, two extremes. Like, one extreme is, you know, the Wild Wild West. It's like all the groups and the different application owners and the different, you know, companies in a big company all do their own thing. This is like the scenario I was describing, where you have the Oracle identity around the Oracle apps, you have CA doing some stuff around mainframes, you have Microsoft around Microsoft, and you have a bunch of small players using point solutions. That's the Wild Wild West. The other extreme is, you have a company that just basically centralizes everything and says, "You do it my way." It's locked down, it's not a lot of flexibility. It's kind of they have strong visibility, strong security, but it's kind of rigid. So I think the most sophisticated companies have figured out how to do both. They've figured out how to, like, centralize what they want to centralize and have the standards they need at a global level, while still enabling people to run and be fast at the local level, and I think that's, you know, as a CEO at Okta, that's a lot of the challenge of running the business. It's like, as you start to scale and you start to grow, how do we balance the efficiency and the scale of doing things centrally, but we don't have the stifling lack of flexibility and innovation that keeps people from running? When I see customers, they're able to do that in their business strategy and their technology strategy and in their identity strategy, it's pretty impressive. Good stuff. Yeah. Thank you for your time. We'll leave it there. Thank you. It's good to be here. Thank you all for being here.