Okta: Hold Until Management Provides Clearer Guidance (NASDAQ:OKTA)

Introduction and investment thesis

Okta (NASDAQ:OKTA) is a cloud-based identity and access management solution that outperformed the S&P 500 in 2023. While the company is expanding its profitability at a rapid pace, the company’s revenue slowdown is a matter of concern. Part of the reason behind the slowdown is tied to the security breach that the company faced in October, which, I believe, has contributed to slower pipeline growth and deal closure rates at the company. This was the second breach the company experienced after an earlier data breach that was led by a hacker group, Lapsus$.

The management has demonstrated that it is taking active steps to reinforce their access management platform by launching an internal program called Bedrock, announced on its last earnings call. However, the company hasn’t provided any updates on the level of progress since their last earnings call.

At the same time, the current valuation of the stock does not provide an attractive entry point from a risk-reward standpoint, in my opinion. Until I get further clarity as to the progress the management has made in reinforcing their internal security measures and how that will impact the company’s revenue growth, I will rate Okta a “hold” at the moment.

About Okta

Okta is a cloud software platform that secures digital access for people and organizations on cloud networks. The company offers its access management products to its customers via its Workforce Identity Cloud and Customer Identity Cloud. Customers use Okta’s products to manage access to their organization’s resources, such as cloud & mobile apps, servers, APIs, and other IT infrastructure.

In light of the heightened occurrence of global cybersecurity threats and the growing adoption of remote work, Okta’s access management and identity management solutions became very popular in the post-pandemic era. With the proliferation of AI, cybersecurity threats have become one of the top reasons why companies have flocked to the multitude of cybersecurity solutions, such as access management tools that Okta provides. However, the critical nature of such tools also poses inherent risks for Okta’s business, which I will discuss later.

In terms of its business model, Okta operates a subscription-based model by selling multi-year subscriptions for Okta’s cloud platform. As of its most recent Q3 FY24 quarter, Okta reported that it had 18,800 customers, which was 10% more than the previous year.

Building the bull case

Okta is growing its margins at an impressive pace, although revenue growth continues to slow.

As per their Q3 FY24 earnings call, the company beat its top and bottom lines by 4% and 51%, respectively. Revenue grew 21% YoY to $584M. At the same time, non-GAAP operating margin improved by 14.6% points from last year, as non-GAAP operating income grew to $85M. Meanwhile, the company held its Net Retention Rate (NRR) at 115%.

There are concerns pertaining to a possible slowdown as Current Remaining Performance Obligations (cRPO) have been trending lower than revenue growth at 16%. cRPO is a forward-looking metric that is impacted by factors such as the number of customers, size of deals, rate of upsells, and contract duration or renewals and plays a significant role in predicting the growth rate of subscriptions over the next 12 months. At the same time, while the number of customers with greater than $100K in average contract value (ACV) has been going up and currently stands at 4365, the growth rate has slowed down.

However, the bright spot for Okta is its growing profitability, which has shown significant improvement. On a GAAP basis, total operating expenses remained unchanged on a YoY basis. This indicates that the management has actively focused on driving operational efficiency, as it reduced Sales & Marketing spend by 7% YoY and still managed to grow its revenue by 22%.

Looking forward, the management is projecting to close FY24 with $2.245B in revenue, which would represent a growth rate of 21% YoY. Unfortunately, for Q4, it expects cRPO to continue to trend lower than the revenue growth rate. For the full year FY24, the management expects a non-GAAP operating margin of 13%, which is a huge improvement from FY23, where margins stood only at 0.5%. Unfortunately, the slowing trend in cRPO is going to take its toll on revenue growth in FY25, as management expects to generate a revenue growth rate of only 10% in FY25 at $2.465B. However, the margin expansion is projected to continue at 17% in FY25.

While the management’s focus on improving profitability is definitely a positive sign, I believe that the slowdown in revenue growth has deflated investor optimism at the moment. At the same time, the company faced a breach in October last year, which could be the underlying contributing factor to the slowdown in pipeline growth and close rates.

Management has demonstrated a certain degree of confidence to solidify its internal security measures, but uncertainties remain.

In the Q3 FY24 earnings call, Okta’s management mentioned that they had launched an internal program called Bedrock to up-level and reinforce their entire access management platform and make it more resilient after the breach. The management mentioned that they would be rolling out a combination of authorization and cryptographic tools to secure their clients’ cybersecurity administrator accounts. In addition, the company has also committed to working with external cybersecurity experts to include further risk mitigation strategies in its cybersecurity infrastructure. The company’s management mentioned on the earnings call that they have already embarked on a 90-day sprint to work towards solidifying the company’s product portfolio as well as reinforce their own internal security measures.

But in the absence of any further management updates about their Bedrock program, I don’t have clarity on the progress that the company has made on this front, as well as its perception amongst existing and new customers thus far. On a slightly different note, however, management did issue an update on Friday last week by announcing that it would reduce its headcount by 7% and thus incur a one-time restructuring charge of $24 million. No other details were provided as to which teams would be immediately impacted.

Building the bear case

Okta could face credibility risk should a breach re-occur.

The proliferation of AI has severely increased the target market opportunity for Okta as well as its peers since more companies are concerned about the implications of cybersecurity in the age of AI and how it may impact their businesses. Online adversaries are using AI with unparalleled speed and scale to get around the guardrails that most cybersecurity companies and access management companies, such as Okta, have in place. Hence, I believe, it is important that companies like Okta not only maintain the resiliency of their products, but cybersecurity companies themselves must be insulated from such attacks; otherwise, they face severe credibility risks in addition to other risks associated with cyberattacks.

While Okta said that the breach was contained, the stock lost about 23% of its market value due to the breach. Were such breaches to reoccur, it would cause significant erosion in credibility for the stock.

The competitive landscape is one to watch out for.

Since the cybersecurity and access management space needs to rapidly scale its capabilities to keep up with adversarial tactics used by hackers, innovation is fast-paced in this industry. If Okta fails to innovate, it risks falling behind in market share. While Okta is currently recognized as a market leader in the access management space, it faces close competition with some deep-pocketed competitors such as Microsoft and IBM, where both these companies tend to bundle their identity management and access management with their cloud computing products. However, I believe this will not materially impact Okta for now since Okta has built integrations to most cloud providers based on its hybrid-cloud offerings approach.

Tying it together: Okta is not yet offering an attractive entry point.

Okta is trading at a forward price-to-earnings ratio of 42 based on management’s earnings guidance for FY25. Since the company has not provided any long-term operating model, based on the information that we have at hand, I believe it would be fair to expect the company to grow in the low teens over the following 2 years until FY26, as a base case scenario. This would mean that the company should generate close to $2.8B in FY26. In the meantime, I would expect the management to continue to prioritize improving its operating leverage, with non-GAAP operating margins growing to 19% of revenue by FY26 at $520M. This would translate to a present value of $432M when discounted at 10%, or adjusted earnings per share of $2.6. This includes the $24 million restructuring charge the company sees due to the lowering of headcount. In reality, I see this as a long-term benefit to its operating margins.

Taking S&P 500 as a proxy, where it has grown its earnings by 8% on average over the last 10 years, with a forward price-to-earnings multiple in the range of 15–18, I believe that Okta should be trading at twice the forward multiple of S&P 500 at 34. As the management prioritizes improving the company’s profitability, we should see earnings grow at least in the mid- to high teens over the coming 2-3 years and possibly beyond. This would translate to a price target of $89, which is just 8% higher than current levels over a 2-year investment horizon.

In my opinion, while the downside of the stock may be contained at current levels, I don’t have longer-term clarity on the size of the progress the company has made thus far in solidifying its internal security measures, which would help the company regain the trust of their customers while driving new user acquisition growth once again. Plus, given the current valuation of the stock, it doesn’t provide an attractive entry point at the moment from a risk-reward perspective.

Conclusions

While Okta’s improving profitability is definitely a bright spot, I believe that the stock doesn’t provide an attractive entry point, given its current price point and valuation, until the management provides further guidance on its plan to reaccelerate growth.