Okta Stock: It’s Good, But Not Good Enough (NASDAQ:OKTA)

Investment Thesis

Okta (NASDAQ:OKTA) is a leading cloud-native cybersecurity company best known for its identity access management tools such as single sign on or multi-factor authentication. The company has grown revenues at a 50% CAGR since 2018, and is poised to take a large chunk of the market opportunity ahead of it. Yet the combination of a substantial acquisition & Okta itself falling victim to a cyber-attack has seen shares sell off ferociously over the past year.

But is the market simply overreacting, and does Okta look like a good investment right now? I put it through my framework to find out.

Business Overview

Okta is a leading independent identity provider, with a vision to free anyone to safely use any technology, and a mission to bring simple and secure digital access to people and organisations everywhere. The company its most well-known for its SSO (single sign on) and MFA (multi-factor authentication) solutions, enabling its customers to securely connect the right people to the right technologies and services at the right time.

The Okta Identity Cloud is the backbone of everything Okta does, and organisations can use it as a central system for connectivity, access, authentication, and identity lifecycle management. There are two primary ways that this cloud platform is used:

• Workforce Identity: used by organisations to manage and secure employees, contractors, and partners, simplifying the way that these users connect to an organisation’s applications and data from any device. It enables organisations to provide their workforces with immediate and secure access to every application they need from any devices they use, without requiring multiple credentials.
• Customer Identity: used by development teams to incorporate identity management, such as SSO, into customer-facing cloud, mobile, or web applications.

The company has grown rapidly too, boosted by the remote working trend that we’ve seen over the past couple of years. Total customers have increased from 8,400 in Q1’21 to 15,800 in the most recent quarter, representing a ~37% CAGR; even more impressive is the growth in customers with >$100k in annual contract value, growing at a ~45% CAGR over the same period. Although, it’s worth highlighting that 1,650 total customers were added through the acquisition of Auth0 in FY22.

When it comes to cybersecurity companies of any form, my general approach is to seek out the best. I don’t think cybersecurity is an area that any businesses can afford to cut back on, and so being a technological leader can prove to be a huge advantage. Taking a look at the 2021 Gartner Magic Quadrant for Access Management, I would say that Okta ticks this box – almost being named a leader twice, since the recently acquired Auth0 is also a leader.

It’s not just Gartner; Okta is the clear leader in Identity-as-a-Service according to the Q3’21 Forrester Wave. Clearly, Okta dominates its niche in the cybersecurity landscape.

Economic Moats

With every business, I look to see if there are any durable competitive advantages (aka economic moats) that will help the company continue to thrive whilst protecting itself from competition.

The first economic moat I’ll give Okta credit for is switching costs, and this is generally prevalent in most cybersecurity platforms – mainly because it’s a pain & a potential risk for any organisation to change their cybersecurity provider, given how embedded cybersecurity is in the day-to-day running of a business.

Furthermore, independent research shows that Okta is the industry leader. Until a competitor starts offering a superior service or a much more attractive price (again, I don’t think businesses will skimp on cybersecurity spending), customers will not have a reason to switch from Okta.

There are also switching costs related to the application integrations. Once a developer incorporates Okta’s identity management technology into a customer-facing cloud, web, or mobile application, it would be onerous to then change providers.

This is demonstrated in part by Okta’s dollar-based net retention rate being consistently at 120% or above. Not only are customers staying with Okta, but they are spending more and more each year.

If I were writing this article 6 months ago, I would definitely have given Okta credit for its brand as an economic moat, driven by its technological leadership. As I said, companies will almost always want the best when it comes to cybersecurity, and Okta had built an indisputable reputation as a leader.

Sadly, this took quite a whack in recent months after Okta itself was hacked by Lapsus$ in January 2022 – the brand value was hit doubly hard since Okta failed to disclose the hack until March 2022, two months later. Despite the hack not leading to any consequential breaches for Okta or its customers, a successful hack is the nightmare of any cybersecurity business.

I will also give Okta a little bit of credit for its network effect. The company has a substantial number of customers to whom it can roll out new products & upsell – again, this is apparent in Okta’s dollar-based net retention rate >120%. Whilst this will not necessarily help Okta to grow customers, it does provide them with an easier sell for their new products (rather than having to go out and find new customers each time.)

It also benefits from another network effect, this time because nearly all of the leading cloud application providers are Okta partners, and these cloud application providers help drive customer acquisition for Okta through co-selling arrangements, as well as by building Okta’s offerings directly into their products.

Outlook

Okta believes its total addressable market to be worth ~$80B, split between $50B for workforce and $30B for customer identity. To put this into perspective, Okta’s revenue over the past 12 months of $1,464m represents just under 2% of this TAM, so clearly this industry leader has a lot of room to expand within this growing opportunity.

Management

When it comes to fast-paced, innovative companies, I always aim to find founder-led businesses where inside ownership is high. I get two for the price of one at Okta, since there are two co-founders still involved in the business: CEO Todd McKinnon and COO Frederic Kerrest.

I want to invest in companies where leadership has skin-in-the-game, and there is a fairly good amount of ownership from the founders – just under 7%, whilst they also have a combined voting power of 43.5%, with CEO McKinnon having the bulk of ownership and voting power.

I also like to take a quick look on Glassdoor to get an idea about the culture of a company, and Okta gets some OK scores from the 745 reviews left by employees. Any score over 4.0 is impressive, and Okta actually fails to achieve this in any category apart from Compensation and Benefits, where it achieves exactly 4.0. The company has particularly poor scores when it comes to Senior Management, and it has a Positive Business Outlook score of only 67%. The one bright point would be an 87% CEO Approval Rating for McKinnon, but even so, these scores are average at best.

It’s worth highlighting that the hack suffered by Okta earlier this year could be contributing to the current scores. If we look at the overall trend on Glassdoor for Okta over the past 18 months or so, it’s clear to see a dip in early 2022 – so, perhaps these scores are indicative of a company that fallen on some tough times.

Financials

Okta has seen impressive revenue growth from 2018 through to 2022, achieving a ~50% CAGR. On the surface, it would appear that the slowing revenue growth then jumped from 43% in 2021 to 56% YoY in 2022, but this has been skewed by the acquisition of Auth0 – excluding this revenue, the 2022 YoY growth would have been ~39%, which is in line with the deceleration. I say deceleration, 39% YoY growth is still rapid!

Gross profit margins have also continually expanded, but again were impacted in 2022 by the acquisition – in fact, pretty much everything was, including the horrendous looking EBIT as well as the $565m in stock-based compensation. Mind you, even if you exclude the SBC related to Auth0, this is clearly a company that has historically used stock-based compensation liberally.

I also don’t love the balance sheet here, but it’s not too bad – particularly when you consider that the company remains free cash flow positive, and so it does have room to manoeuvre in more difficult times.

This company may have diluted shareholders by 74% since it came public, but that has been impacted by the Auth0 acquisition in 2021, and its shares have returned 300% since IPO despite the recent pullback. Whilst the SBC is looking a little too high, it’s clear that this company has been able to still reward shareholders substantially, even once this dilution is taken into account.

Valuation

As with all high growth, disruptive companies, valuation is tough. I believe that my approach will give me an idea about whether Okta is insanely overvalued or undervalued, but valuation is the final thing I look at – the quality of the business itself is far more important in the long run.

Before I get into the valuation model, I want to highlight Okta’s targets for 2026, taken from its Q1’23 Investor Presentation.

With that in mind, let’s get into the valuation model.

I have assumed revenue growth for 2023 in line with the guidance offered by management in their Q1’23 press release, and have used the 2026 targets to help with my assumptions. My model primarily allows for organic growth, and so I have Okta falling short of their $4B target because I would put money on them having to make another fairly large acquisition in order to achieve this revenue run rate.

I have assumed that Okta will hit the 20% FCF target in 2026, but I have also assumed that shareholders will continue to get diluted over the upcoming 5 years – resulting in a 28% increase in shares outstanding.

Put all this together, and I can see Okta shares achieving a 17% CAGR from 2022 through to 2027 in my mid-range scenario.

Risks

There are two risks that I view as fairly substantial for Okta right now.

The first relates to the impact of their security breach, and the damage that it might have done to their reputation. The QoQ growth in customer acquisition in Q1’23 (the quarter during which Okta announced the breach) was at its lowest over the past 5 quarters, and dropped from 7.3% in Q3’22 and 7.1% in Q4’22.

It’s worth highlighting that CEO McKinnon said the following in the Q1’23 earnings call:

Finally, I’m sure this audience is wondering what impact the security incident had on our financial results. While we’ve done a lot of analysis, it’s difficult to attribute any quantifiable impact on our solid Q1 results. When looking at key indicators, our competitive win rates and renewal rates have remained strong.

This may turn out to be just a blip in Okta’s story rather than a long-term problem, but companies are not going to want to take any risks when it comes to cybersecurity. I believe that Okta will be fine, as long as nothing like this occurs again & it maintains its technological leadership position.

The second risk I see for Okta relates to its acquisition of Auth0. Whilst there is no denying that the companies complement each other, the all-share transaction was valued at ~$6.5B. Given that the combined company now has a market capitalisation of closer to $15B, this was clearly a substantial acquisition. I personally do not have any issues with companies that I invest in making smaller, bolt-on acquisitions, but a significant acquisition such as this creates much more risk for a business. Shareholders are diluted, the balance sheet now looks a lot worse, and there is a risk that the implementation of Auth0 is unsuccessful.

There are the usual risks as well, such as competition from the likes of Microsoft (MSFT) – but according to the independent researchers, Okta remains the top dog in this space. There is also the risk of a recession, but I think Okta is pretty recession-proof, although it could impact growth if its customers delay new projects, application launches etc.

Bottom Line

There is a lot to like about this company. It has been growing rapidly, is founder-led, has a reasonable share price, and is an industry leader with a big opportunity ahead.

Yet there is also a fair amount to dislike; substantial stock-based compensation and a far-from perfect balance sheet, a substantial acquisition, and the bad publicity that comes with a cybersecurity company being hacked.

I completely understand why many investors are bullish on this company, and I would certainly not bet against it. But, I personally believe that there are superior investments in the cybersecurity realm, with the likes of CrowdStrike (CRWD), Cloudflare (NET), and Zscaler (ZS) much higher up on my list than Okta.