Okta Inc.
Combined average of Moat (AI Resilience), Growth, and Valuation scores.
Moat Score
Okta is the authoritative identity system of record for 20,000+ customers (FY26 10-K; call), embedded in every authentication event and anchored by compliance requirements and a 7,000+ integration ecosystem (Q2 10-Q) that competitors cannot replicate.
Okta's moat is built on Transaction Embedding, Regulatory Compliance, and System-of-Record Gravity:
- Transaction Embedding — Every Login Flows Through Okta: Okta sits inline with every authentication event across an enterprise — every employee login, every app access, every API call. Removing it would break access to the 7,000+ integrated applications (Q2 10-Q; call said 8,000+) simultaneously, making it operationally irreplaceable in the short term. Okta for AI Agents, live since its April 30, 2026 GA, is extending this embedding to non-human identities — the 8-K names strong new-product contributions led by Okta Identity Governance; the call put new products at ~30% of Q2 bookings with a ~40% ACV uplift when attached (Q1 was ~25%). That is more transaction surface, not a reason to mark the pillar up because they beat.
- System of Record for Enterprise Identity: Okta's Universal Directory is the authoritative truth for who can access what across the enterprise — a repository of provisioning rules, group memberships, HR integrations, and access policies accumulated over years. Migrating this to a competitor requires re-mapping every app integration, re-certifying access policies, and reconciling years of audit logs — a 12–24 month project with significant business risk. The 10-Q subsequent-events note that Permiso closed Aug 26 (ITDR tuck-in) does not change this pillar.
- Regulatory Lock-in and Compliance Inertia: SOX, HIPAA, PCI-DSS, and FedRAMP audits depend on Okta's access logs and certification trails. FedRAMP High authorization locks in federal agency customers for the duration of their procurement cycle. Switching vendors mid-compliance cycle is not a practical option for regulated industries, creating a moat that renews with each compliance audit. No new filing in this print changes that.
Ten Moats Verdict
Okta is a net beneficiary of AI adoption in the long run: the explosion of AI agents creates an entirely new identity surface that every organization must manage, and Okta's position as the universal identity directory (human and non-human) makes it the natural registry. Transaction embedding and system-of-record are the strongest AI-era moats — AI agents amplify the number of transactions flowing through Okta rather than threatening them. The Q2 FY2027 beat (revenue $805M +11%; cRPO +14%; NRR 107%) does not change that, and it does not retire Microsoft Entra bundling as a growth residual. The primary AI-era risk remains that Microsoft uses AI-accelerated Copilot/Entra development to close Okta's feature gap faster than Okta can differentiate, pressuring the bundling and learned-interface moats in Microsoft-centric enterprises. On balance, Okta's identity infrastructure is AI-resilient: more agents mean more identities, more policies, and more Okta revenue. Call: AI still immaterial to FY27.
84.3 resilient · 60.9 vulnerable · 80/20 = 79.6 · + 1 strength · = 81
Okta's admin console, Workflow Builder, and policy configuration involve significant institutional knowledge — but AI-powered admin tooling is gradually reducing the expertise barrier.
Each enterprise has years of HR-to-Okta provisioning rules, app-specific lifecycle policies, and group management logic — rebuilding this in Microsoft Entra or Ping Identity is a 12–24 month migration project.
Okta's moat is not based on access to public datasets; its advantage is proprietary authentication event data and identity lifecycle records, which are distinct from public data access.
Okta-certified administrators are in demand, but AI-assisted policy configuration and auto-remediation tools are gradually lowering the skill bar required to deploy and manage identity workflows.
Workforce Identity + Customer Identity Cloud + IGA + Privileged Access creates meaningful within-identity bundling, though Microsoft bundles Entra ID more deeply within M365/Azure, capping the moat for Microsoft-centric customers. Q2 new-product attach and the Permiso close are more bundle surface, not a status change. Do not mark this up because they beat.
ThreatInsight aggregates billions of authentication signals across the customer base to detect credential-stuffing and account-takeover attacks — a network threat-intelligence dataset that cannot be replicated by a single-tenant deployment.
FedRAMP High, HIPAA, SOX, and PCI-DSS compliance audits depend on Okta's access certification and audit logs. Switching identity providers mid-compliance cycle requires full re-certification — a multi-quarter undertaking that effectively anchors regulated customers. No new filing in this print changes that.
The Okta Integration Network (OIN) creates a genuine indirect network effect: 7,000+ ISV integrations (Q2 10-Q; call said 8,000+) make Okta the path-of-least-resistance identity choice, attracting more enterprises, which attracts more ISVs building native Okta integrations.
Every authentication event — employee logins, API calls, partner access, and AI agent requests — flows through Okta in real time. Removing it breaks all access instantly; it is embedded at the critical path of daily operations. Q2 new-product attach (call ~30% of bookings) is more traffic through the same pipe, not a status change.
Okta's Universal Directory is the enterprise's authoritative source of truth for who exists, what they can access, and what they are provisioned to — replacing it requires reconciling years of identity lifecycle data, a 12–24 month undertaking with significant compliance and operational risk.
Combined average of Moat (AI Resilience), Growth, and Valuation scores.
Moat Score
Okta is the authoritative identity system of record for 20,000+ customers (FY26 10-K; call), embedded in every authentication event and anchored by compliance requirements and a 7,000+ integration ecosystem (Q2 10-Q) that competitors cannot replicate.
Growth Score
Q2 FY2027 (quarter ended July 31, reported Aug 26) printed revenue $805M, +11% YoY from $728M, with subscription $793M, +12% (99% of revenue; posted commentary). RPO $4.858B (+17% YoY) and cRPO $2.585B (+14% YoY) — the 8-K flags accelerating cRPO. TTM dollar-based NRR held at 107% (10-Q / posted commentary; +1 pt vs 106% a year ago; same as Q1). Non-GAAP operating income $226M, or 28% of revenue, vs $202M / 28% a year ago — the Q1 −180 bps compression charge is stale. GAAP operating income $107M (13%) vs $41M (6%). FCF $227M (28% of revenue) vs $162M (22%). Cash, cash equivalents and short-term investments $2.299B after settling the remaining $350M of 2026 convertibles in cash; H1 buybacks $366M (Q2 1,542,442 shares / $125M; $555M remains on the $1B authorization). Posted commentary (not 99.1): Workforce Identity ACV +11% (59% of ACV); Customer Identity ACV +13% (41%); $100k+ ACV customers 5,255 (+6%); $1M+ ACV customers 605 (+22%). FY27 raised to $3.216–$3.226B revenue (10–11%; ~1 pt professional-services partner-shift headwind) and $910–$930M FCF (28–29%). Q3 guided $813–$817M revenue (+10%) and cRPO $2.590–$2.600B (11–12%). Call: new products ~30% of Q2 bookings, AI still immaterial to FY27. The named Q2 test (NRR reversing below 105%) did not fire.
Valuation Score
Regular-session close $172.91 on Aug 27 (Yahoo Finance; market cap $30.053B). Aug 26 close $134.42 was pre-print (2:00 p.m. PT / 5:00 p.m. ET webcast); the Aug 10 card's ~$152 is also not the post-print tape — both of those are what not to use. Unchanged ladder $48 / $100 / $155. At $172.91 the stock is 12% above the $155 bull (1.2× bull = $186) — piecewise 31. The Q2 beat-and-raise does not move the ladder; trading through bull is a tape fact, not a reason to rewrite DCF. Live valuation will recompute against the tape; this static 31 is the Aug 27 close against the held corridor.
The Identity System-of-Record Moat
Okta's moat is built on Transaction Embedding, Regulatory Compliance, and System-of-Record Gravity:
- Transaction Embedding — Every Login Flows Through Okta: Okta sits inline with every authentication event across an enterprise — every employee login, every app access, every API call. Removing it would break access to the 7,000+ integrated applications (Q2 10-Q; call said 8,000+) simultaneously, making it operationally irreplaceable in the short term. Okta for AI Agents, live since its April 30, 2026 GA, is extending this embedding to non-human identities — the 8-K names strong new-product contributions led by Okta Identity Governance; the call put new products at ~30% of Q2 bookings with a ~40% ACV uplift when attached (Q1 was ~25%). That is more transaction surface, not a reason to mark the pillar up because they beat.
- System of Record for Enterprise Identity: Okta's Universal Directory is the authoritative truth for who can access what across the enterprise — a repository of provisioning rules, group memberships, HR integrations, and access policies accumulated over years. Migrating this to a competitor requires re-mapping every app integration, re-certifying access policies, and reconciling years of audit logs — a 12–24 month project with significant business risk. The 10-Q subsequent-events note that Permiso closed Aug 26 (ITDR tuck-in) does not change this pillar.
- Regulatory Lock-in and Compliance Inertia: SOX, HIPAA, PCI-DSS, and FedRAMP audits depend on Okta's access logs and certification trails. FedRAMP High authorization locks in federal agency customers for the duration of their procurement cycle. Switching vendors mid-compliance cycle is not a practical option for regulated industries, creating a moat that renews with each compliance audit. No new filing in this print changes that.
Ten Moats Verdict
Okta is a net beneficiary of AI adoption in the long run: the explosion of AI agents creates an entirely new identity surface that every organization must manage, and Okta's position as the universal identity directory (human and non-human) makes it the natural registry. Transaction embedding and system-of-record are the strongest AI-era moats — AI agents amplify the number of transactions flowing through Okta rather than threatening them. The Q2 FY2027 beat (revenue $805M +11%; cRPO +14%; NRR 107%) does not change that, and it does not retire Microsoft Entra bundling as a growth residual. The primary AI-era risk remains that Microsoft uses AI-accelerated Copilot/Entra development to close Okta's feature gap faster than Okta can differentiate, pressuring the bundling and learned-interface moats in Microsoft-centric enterprises. On balance, Okta's identity infrastructure is AI-resilient: more agents mean more identities, more policies, and more Okta revenue. Call: AI still immaterial to FY27.
84.3 resilient · 60.9 vulnerable · 80/20 = 79.6 · + 1 strength · = 81
Okta's admin console, Workflow Builder, and policy configuration involve significant institutional knowledge — but AI-powered admin tooling is gradually reducing the expertise barrier.
Each enterprise has years of HR-to-Okta provisioning rules, app-specific lifecycle policies, and group management logic — rebuilding this in Microsoft Entra or Ping Identity is a 12–24 month migration project.
Okta's moat is not based on access to public datasets; its advantage is proprietary authentication event data and identity lifecycle records, which are distinct from public data access.
Okta-certified administrators are in demand, but AI-assisted policy configuration and auto-remediation tools are gradually lowering the skill bar required to deploy and manage identity workflows.
Workforce Identity + Customer Identity Cloud + IGA + Privileged Access creates meaningful within-identity bundling, though Microsoft bundles Entra ID more deeply within M365/Azure, capping the moat for Microsoft-centric customers. Q2 new-product attach and the Permiso close are more bundle surface, not a status change. Do not mark this up because they beat.
ThreatInsight aggregates billions of authentication signals across the customer base to detect credential-stuffing and account-takeover attacks — a network threat-intelligence dataset that cannot be replicated by a single-tenant deployment.
FedRAMP High, HIPAA, SOX, and PCI-DSS compliance audits depend on Okta's access certification and audit logs. Switching identity providers mid-compliance cycle requires full re-certification — a multi-quarter undertaking that effectively anchors regulated customers. No new filing in this print changes that.
The Okta Integration Network (OIN) creates a genuine indirect network effect: 7,000+ ISV integrations (Q2 10-Q; call said 8,000+) make Okta the path-of-least-resistance identity choice, attracting more enterprises, which attracts more ISVs building native Okta integrations.
Every authentication event — employee logins, API calls, partner access, and AI agent requests — flows through Okta in real time. Removing it breaks all access instantly; it is embedded at the critical path of daily operations. Q2 new-product attach (call ~30% of bookings) is more traffic through the same pipe, not a status change.
Okta's Universal Directory is the enterprise's authoritative source of truth for who exists, what they can access, and what they are provisioned to — replacing it requires reconciling years of identity lifecycle data, a 12–24 month undertaking with significant compliance and operational risk.
Growth Analysis
Growth Drivers
Key Risk
The Q2 NRR test did not fire: TTM dollar-based net retention held at 107% (10-Q). Next hard test is Q3 FY2027 revenue $813–$817M (+10%) and cRPO $2.590–$2.600B (11–12% vs the printed +14%). Falsifiable: Q3 revenue prints below $813M, cRPO prints below $2.590B, or NRR reverses below 105% for two consecutive quarters. Microsoft Entra ID capturing 10%+ of net new workforce identity ARR from SMB/mid-market by end of FY2028 is unchanged — Q2 did not produce a new fact that removes it. Residual: at $172.91 the stock is 12% above the $155 bull (~44× company FY27 non-GAAP EPS $3.90–$3.94, ~9.3× FY27 revenue); if the raise proves a one-off, the multiple compresses.
Score Derivation
73.6 base + 1.3 trajectory − 5 risk = 70
Base 74 (9–12% CAGR, midpoint 10.5%, baseFromCagr: 70+((10.5−8)/7)×10 = 73.57) + 1.3 trajectory (1 of 3 drivers accelerating: new products / IGA / AI Agents; Workforce Identity ACV +11% and Customer Identity ACV +13% are stable, not a 3/3 mark-up) + 0 stable margins (non-GAAP OM 28% vs 28% YoY; Q1's −180 bps compression is stale) − 5 moderate keyRisk (Microsoft Entra bundling unchanged; Q3 cRPO guide 11–12% vs printed +14%) = 70. primaryType does not score. Do not bump because they beat. The old author string that added +4 both TAM/share and printed 70 against a site-derived 66 is retired.
Price Scenarios (12–24 Months)
Valuation Multiples
| Trailing P/E (GAAP) | ~125× |
| Forward P/E (FY27, non-GAAP) | ~44× |
| PEG Ratio | ~4.2× |
| Price / Sales (FY27) | ~9.3× |
| Price / FCF (FY27E) | ~33× |
Post-print tape $172.91 (Aug 27 close, Yahoo) ripped +28.6% from the $134.42 Aug 26 pre-print close and sits at a new 52-week high of $174.85. Forward multiple is ~44× on the company's own $3.90–$3.94 FY27 EPS guide and ~9.3× FY27 revenue — richer than the Aug 10 ~32× on a stale ~$4.71 consensus, and 12% through the $155 bull. Yahoo 1y target est $146.34 (quote page; pre-print Street sitting below spot). The beat-and-raise, cRPO acceleration, and FCF raise still justify a premium to slower identity peers; the margin of safety versus the held $155 bull is gone. Next test is Q3 revenue $813–$817M and cRPO $2.590–$2.600B, not a restated ladder.
Approximate figures as of August 26, 2026.
Where We Are vs Targets
Loading live price…
Microsoft Entra's free bundling captures material SMB/mid-market share, NRR falls below 100%, and the AI agent identity opportunity fails to monetize at scale — triggering multiple compression to ~10× FCF. Ladder held; Q2 NRR 107% did not retire this path.
- Microsoft Entra ID expansion into Okta's mid-market base drives NRR below 100% by mid-FY2028, confirmed by two consecutive quarters of net customer ARR contraction — Q2 held 107% and did not produce a new fact that removes Entra
- Okta for AI Agents generates less than $50M incremental ARR in its first 18 months — call says AI is still immaterial to FY27 — insufficient to offset core workforce identity attrition
- Q3 revenue prints below $813M or cRPO below $2.590B, and FY2028 revenue growth decelerates to 4–6% with non-GAAP operating margin compressing back toward 20% as Okta increases discounting to defend renewals
- Multiple compresses to 10× FCF on ~$820M FCF → ~$8.2B market cap → ~$48/share
Okta delivers the raised FY2027 guide (revenue $3.216–$3.226B, 10–11%; FCF $910–$930M, 28–29%), NRR holds 105–107%, and AI agent identity remains an attach story rather than a FY27 revenue line — rewarded with a 20× forward FCF multiple. Ladder held; do not mark this up because they beat.
- FY2027 revenue lands in the $3.216–$3.226B guide (10–11%), with NRR holding 105–107% (Q2 printed 107%). The old $3.18B / +9% point is retired by this print's guide
- Okta for AI Agents continues to attach (call: dozens of deals including several $1M+; still immaterial to FY27). Do not require 1,000+ paying deployments as a FY27 print fact — that remains a claim
- IGA remains the largest new-product bucket (8-K); $1M+ ACV customers 605 (+22%, posted commentary) keep the upmarket mix
- FY2027 FCF $910–$930M already clears the old FY2028 $900M crossing; 20× on ~$900M still maps to ~$18B / $100. Do not mark the target up because they raised FCF
AI agent identity becomes a $500M+ platform by FY2029, NRR re-accelerates to 112%+ as agents multiply per customer, and Okta re-rates to 25× FCF as growth returns to 15%+. Tape already through $155 is not a reason to rewrite this FY2029 scenario.
- Each enterprise customer deploys hundreds–thousands of AI agents, each requiring Okta-managed identity — average ARR per customer expands 30%+ by FY2029 as agent identity monetizes. Call: AI still immaterial to FY27, so this remains a FY2029 claim
- NRR re-accelerates to 112%+ by FY2028 as AI agent identity drives net-new expansion ARR without displacing existing workforce identity revenue — Q2 held 107%, it did not print 112%
- IGA + PAM convergence positions Okta as the end-to-end identity governance platform, displacing SailPoint/CyberArk in a subset of Fortune 1000 accounts. Permiso (closed Aug 26) is an ITDR tuck-in, not this thesis on its own
- FY2029 FCF reaches $1.1B+ at expanding margins; multiple of 25× FCF → ~$27.5B market cap → ~$155/share