Combined average of Moat (AI Resilience), Growth, and Valuation scores.
Moat Score
Okta is the authoritative identity system of record for 20,000+ customers (FY26 10-K; call), embedded in every authentication event and anchored by compliance requirements and a 7,000+ integration ecosystem (Q2 10-Q) that competitors cannot replicate.
Okta's moat is built on Transaction Embedding, Regulatory Compliance, and System-of-Record Gravity:
- Transaction Embedding — Every Login Flows Through Okta: Okta sits inline with every authentication event across an enterprise — every employee login, every app access, every API call. Removing it would break access to the 7,000+ integrated applications (Q2 10-Q; call said 8,000+) simultaneously, making it operationally irreplaceable in the short term. Okta for AI Agents, live since its April 30, 2026 GA, is extending this embedding to non-human identities — the 8-K names strong new-product contributions led by Okta Identity Governance; the call put new products at ~30% of Q2 bookings with a ~40% ACV uplift when attached (Q1 was ~25%). That is more transaction surface, not a reason to mark the pillar up because they beat.
- System of Record for Enterprise Identity: Okta's Universal Directory is the authoritative truth for who can access what across the enterprise — a repository of provisioning rules, group memberships, HR integrations, and access policies accumulated over years. Migrating this to a competitor requires re-mapping every app integration, re-certifying access policies, and reconciling years of audit logs — a 12–24 month project with significant business risk. The 10-Q subsequent-events note that Permiso closed Aug 26 (ITDR tuck-in) does not change this pillar.
- Regulatory Lock-in and Compliance Inertia: SOX, HIPAA, PCI-DSS, and FedRAMP audits depend on Okta's access logs and certification trails. FedRAMP High authorization locks in federal agency customers for the duration of their procurement cycle. Switching vendors mid-compliance cycle is not a practical option for regulated industries, creating a moat that renews with each compliance audit. No new filing in this print changes that.
Moat Verdict
Okta is a net beneficiary of AI adoption in the long run: the explosion of AI agents creates an entirely new identity surface that every organization must manage, and Okta's position as the universal identity directory (human and non-human) makes it the natural registry. Transaction embedding and system-of-record are the strongest AI-era moats — AI agents amplify the number of transactions flowing through Okta rather than threatening them. The Q2 FY2027 beat (revenue $805M +11%; cRPO +14%; NRR 107%) does not change that, and it does not retire Microsoft Entra bundling as a growth residual. The primary AI-era risk remains that Microsoft uses AI-accelerated Copilot/Entra development to close Okta's feature gap faster than Okta can differentiate, pressuring the bundling and learned-interface moats in Microsoft-centric enterprises. On balance, Okta's identity infrastructure is AI-resilient: more agents mean more identities, more policies, and more Okta revenue. Call: AI still immaterial to FY27.
77.8 resilient · 60.9 vulnerable · 80/20 = 74.5 · = 74
Open a moat to read its note.
Okta's admin console, Workflow Builder, and policy configuration involve significant institutional knowledge — but AI-powered admin tooling is gradually reducing the expertise barrier.
Each enterprise has years of HR-to-Okta provisioning rules, app-specific lifecycle policies, and group management logic — rebuilding this in Microsoft Entra or Ping Identity is a 12–24 month migration project.
Okta's moat is not based on access to public datasets; its advantage is proprietary authentication event data and identity lifecycle records, which are distinct from public data access.
Okta-certified administrators are in demand, but AI-assisted policy configuration and auto-remediation tools are gradually lowering the skill bar required to deploy and manage identity workflows.
Workforce Identity + Customer Identity Cloud + IGA + Privileged Access creates meaningful within-identity bundling, though Microsoft bundles Entra ID more deeply within M365/Azure, capping the moat for Microsoft-centric customers. Q2 new-product attach and the Permiso close are more bundle surface, not a status change. Do not mark this up because they beat.
ThreatInsight aggregates billions of authentication signals across the customer base to detect credential-stuffing and account-takeover attacks — a network threat-intelligence dataset that cannot be replicated by a single-tenant deployment.
FedRAMP High, HIPAA, SOX and PCI-DSS audits lean on Okta's access certifications and logs, and switching identity providers mid-audit cycle is painful — but Microsoft Entra ID, Ping and CyberArk satisfy the same audits, and the friction is switching cost already rated under transactionEmbedding and systemOfRecord. Standard certifications are table stakes in this market — they bar small entrants, not the peers this name competes with — so they rate intact; strong is reserved for a barrier few competitors in the market can clear. Re-rated from strong to intact.
The Okta Integration Network (OIN) creates a genuine indirect network effect: 7,000+ ISV integrations (Q2 10-Q; call said 8,000+) make Okta the path-of-least-resistance identity choice, attracting more enterprises, which attracts more ISVs building native Okta integrations.
Every authentication event — employee logins, API calls, partner access, and AI agent requests — flows through Okta in real time. Removing it breaks all access instantly; it is embedded at the critical path of daily operations. Q2 new-product attach (call ~30% of bookings) is more traffic through the same pipe, not a status change.
Okta's Universal Directory is the enterprise's authoritative source of truth for who exists, what they can access, and what they are provisioned to — replacing it requires reconciling years of identity lifecycle data, a 12–24 month undertaking with significant compliance and operational risk.
Software at near-zero marginal cost: scale shows up as network effects, data or bundling, which are rated there. No separate unit-cost lead to credit.
Buyers are enterprises choosing on switching cost, integration and performance, which the other pillars rate. The name carries reputation, not a price premium it could hold on brand alone.
Moat in 5–10 years
Okta's moats hold at their current level. The authentication path and the Universal Directory remain the two strong pillars, and net retention held at 107% with cRPO up 14% in the latest print. Microsoft Entra ID inside Microsoft 365 is the named pressure, but the keyRisk test of 10% of net new workforce identity ARR by FY2028 has not been met and its effect is already priced in the intact bundle, so it is a watch item rather than a called narrowing. Agent identities could widen the record, but the company calls AI immaterial to FY27, so no widening is called.
No moat trending · 74 holds
Combined average of Moat (AI Resilience), Growth, and Valuation scores.
Moat Score
Okta is the authoritative identity system of record for 20,000+ customers (FY26 10-K; call), embedded in every authentication event and anchored by compliance requirements and a 7,000+ integration ecosystem (Q2 10-Q) that competitors cannot replicate.
Growth Score
Q2 FY2027 (quarter ended July 31, reported Aug 26) printed revenue $805M, +11% YoY from $728M, with subscription $793M, +12% (99% of revenue; posted commentary). RPO $4.858B (+17% YoY) and cRPO $2.585B (+14% YoY) — the 8-K flags accelerating cRPO. TTM dollar-based NRR held at 107% (10-Q / posted commentary; +1 pt vs 106% a year ago; same as Q1). Non-GAAP operating income $226M, or 28% of revenue, vs $202M / 28% a year ago — the Q1 −180 bps compression charge is stale. GAAP operating income $107M (13%) vs $41M (6%). FCF $227M (28% of revenue) vs $162M (22%). Cash, cash equivalents and short-term investments $2.299B after settling the remaining $350M of 2026 convertibles in cash; H1 buybacks $366M (Q2 1,542,442 shares / $125M; $555M remains on the $1B authorization). Posted commentary (not 99.1): Workforce Identity ACV +11% (59% of ACV); Customer Identity ACV +13% (41%); $100k+ ACV customers 5,255 (+6%); $1M+ ACV customers 605 (+22%). FY27 raised to $3.216–$3.226B revenue (10–11%; ~1 pt professional-services partner-shift headwind) and $910–$930M FCF (28–29%). Q3 guided $813–$817M revenue (+10%) and cRPO $2.590–$2.600B (11–12%). Call: new products ~30% of Q2 bookings, AI still immaterial to FY27. The named Q2 test (NRR reversing below 105%) did not fire.
Valuation Score
At ~$206.64 (September 24, 2026 close, after the post-Oktane price-target raises) OKTA sits between the reset base ($188) and bull ($253): ~10% above base, ~28% of the way to bull, and ~56% above the $132 bear — piecewise 59. The August ladder ($48 / $100 / $155) was already below the $172.91 post-print close when it was held, so it no longer described fair value and has been reset. The new corridor is anchored on the company's own raised FY27 guide (FCF $910–$930M, non-GAAP EPS $3.90–$3.94) and ~173.7M shares (market cap ~$36.1B at $208): bear 25× FY27 FCF, base 32× a ~$1.02B FY28 FCF path, bull 40× ~$1.1B FY29 FCF. At spot the market pays ~39× FY27 FCF and ~53× FY27 non-GAAP EPS for a 10–11% revenue grower — priced for AI-agent identity to monetize, not for the guide alone. Street targets moved to $200–$235 after Oktane (TD Cowen $200 Hold, Stifel $215, RBC $230, Needham $230), which brackets the base-to-bull corridor rather than the old ladder.
The Identity System-of-Record Moat
Okta's moat is built on Transaction Embedding, Regulatory Compliance, and System-of-Record Gravity:
- Transaction Embedding — Every Login Flows Through Okta: Okta sits inline with every authentication event across an enterprise — every employee login, every app access, every API call. Removing it would break access to the 7,000+ integrated applications (Q2 10-Q; call said 8,000+) simultaneously, making it operationally irreplaceable in the short term. Okta for AI Agents, live since its April 30, 2026 GA, is extending this embedding to non-human identities — the 8-K names strong new-product contributions led by Okta Identity Governance; the call put new products at ~30% of Q2 bookings with a ~40% ACV uplift when attached (Q1 was ~25%). That is more transaction surface, not a reason to mark the pillar up because they beat.
- System of Record for Enterprise Identity: Okta's Universal Directory is the authoritative truth for who can access what across the enterprise — a repository of provisioning rules, group memberships, HR integrations, and access policies accumulated over years. Migrating this to a competitor requires re-mapping every app integration, re-certifying access policies, and reconciling years of audit logs — a 12–24 month project with significant business risk. The 10-Q subsequent-events note that Permiso closed Aug 26 (ITDR tuck-in) does not change this pillar.
- Regulatory Lock-in and Compliance Inertia: SOX, HIPAA, PCI-DSS, and FedRAMP audits depend on Okta's access logs and certification trails. FedRAMP High authorization locks in federal agency customers for the duration of their procurement cycle. Switching vendors mid-compliance cycle is not a practical option for regulated industries, creating a moat that renews with each compliance audit. No new filing in this print changes that.
Moat Verdict
Okta is a net beneficiary of AI adoption in the long run: the explosion of AI agents creates an entirely new identity surface that every organization must manage, and Okta's position as the universal identity directory (human and non-human) makes it the natural registry. Transaction embedding and system-of-record are the strongest AI-era moats — AI agents amplify the number of transactions flowing through Okta rather than threatening them. The Q2 FY2027 beat (revenue $805M +11%; cRPO +14%; NRR 107%) does not change that, and it does not retire Microsoft Entra bundling as a growth residual. The primary AI-era risk remains that Microsoft uses AI-accelerated Copilot/Entra development to close Okta's feature gap faster than Okta can differentiate, pressuring the bundling and learned-interface moats in Microsoft-centric enterprises. On balance, Okta's identity infrastructure is AI-resilient: more agents mean more identities, more policies, and more Okta revenue. Call: AI still immaterial to FY27.
77.8 resilient · 60.9 vulnerable · 80/20 = 74.5 · = 74
Open a moat to read its note.
Okta's admin console, Workflow Builder, and policy configuration involve significant institutional knowledge — but AI-powered admin tooling is gradually reducing the expertise barrier.
Each enterprise has years of HR-to-Okta provisioning rules, app-specific lifecycle policies, and group management logic — rebuilding this in Microsoft Entra or Ping Identity is a 12–24 month migration project.
Okta's moat is not based on access to public datasets; its advantage is proprietary authentication event data and identity lifecycle records, which are distinct from public data access.
Okta-certified administrators are in demand, but AI-assisted policy configuration and auto-remediation tools are gradually lowering the skill bar required to deploy and manage identity workflows.
Workforce Identity + Customer Identity Cloud + IGA + Privileged Access creates meaningful within-identity bundling, though Microsoft bundles Entra ID more deeply within M365/Azure, capping the moat for Microsoft-centric customers. Q2 new-product attach and the Permiso close are more bundle surface, not a status change. Do not mark this up because they beat.
ThreatInsight aggregates billions of authentication signals across the customer base to detect credential-stuffing and account-takeover attacks — a network threat-intelligence dataset that cannot be replicated by a single-tenant deployment.
FedRAMP High, HIPAA, SOX and PCI-DSS audits lean on Okta's access certifications and logs, and switching identity providers mid-audit cycle is painful — but Microsoft Entra ID, Ping and CyberArk satisfy the same audits, and the friction is switching cost already rated under transactionEmbedding and systemOfRecord. Standard certifications are table stakes in this market — they bar small entrants, not the peers this name competes with — so they rate intact; strong is reserved for a barrier few competitors in the market can clear. Re-rated from strong to intact.
The Okta Integration Network (OIN) creates a genuine indirect network effect: 7,000+ ISV integrations (Q2 10-Q; call said 8,000+) make Okta the path-of-least-resistance identity choice, attracting more enterprises, which attracts more ISVs building native Okta integrations.
Every authentication event — employee logins, API calls, partner access, and AI agent requests — flows through Okta in real time. Removing it breaks all access instantly; it is embedded at the critical path of daily operations. Q2 new-product attach (call ~30% of bookings) is more traffic through the same pipe, not a status change.
Okta's Universal Directory is the enterprise's authoritative source of truth for who exists, what they can access, and what they are provisioned to — replacing it requires reconciling years of identity lifecycle data, a 12–24 month undertaking with significant compliance and operational risk.
Software at near-zero marginal cost: scale shows up as network effects, data or bundling, which are rated there. No separate unit-cost lead to credit.
Buyers are enterprises choosing on switching cost, integration and performance, which the other pillars rate. The name carries reputation, not a price premium it could hold on brand alone.
Moat in 5–10 years
Okta's moats hold at their current level. The authentication path and the Universal Directory remain the two strong pillars, and net retention held at 107% with cRPO up 14% in the latest print. Microsoft Entra ID inside Microsoft 365 is the named pressure, but the keyRisk test of 10% of net new workforce identity ARR by FY2028 has not been met and its effect is already priced in the intact bundle, so it is a watch item rather than a called narrowing. Agent identities could widen the record, but the company calls AI immaterial to FY27, so no widening is called.
No moat trending · 74 holds
Growth Analysis
Growth Drivers
Key Risk
The Q2 NRR test did not fire: TTM dollar-based net retention held at 107% (10-Q). Next hard test is Q3 FY2027 revenue $813–$817M (+10%) and cRPO $2.590–$2.600B (11–12% vs the printed +14%). Falsifiable: Q3 revenue prints below $813M, cRPO prints below $2.590B, or NRR reverses below 105% for two consecutive quarters. Microsoft Entra ID capturing 10%+ of net new workforce identity ARR from SMB/mid-market by end of FY2028 is unchanged — Q2 did not produce a new fact that removes it. Residual: at $172.91 the stock is 12% above the $155 bull (~44× company FY27 non-GAAP EPS $3.90–$3.94, ~9.3× FY27 revenue); if the raise proves a one-off, the multiple compresses.
Score Derivation
73.6 base + 1.3 trajectory − 5 risk = 70
Base 74 (9–12% CAGR, midpoint 10.5%, baseFromCagr: 70+((10.5−8)/7)×10 = 73.57) + 1.3 trajectory (1 of 3 drivers accelerating: new products / IGA / AI Agents; Workforce Identity ACV +11% and Customer Identity ACV +13% are stable, not a 3/3 mark-up) + 0 stable margins (non-GAAP OM 28% vs 28% YoY; Q1's −180 bps compression is stale) − 5 moderate keyRisk (Microsoft Entra bundling unchanged; Q3 cRPO guide 11–12% vs printed +14%) = 70. primaryType does not score. Do not bump because they beat. The old author string that added +4 both TAM/share and printed 70 against a site-derived 66 is retired.
Price Scenarios (12–24 Months)
Price vs Targets
Dashed lines mark the 12–24 month bear, base and bull targets. Daily closes.
Valuation Multiples
| Forward P/E (FY27, non-GAAP) | ~53× |
| PEG Ratio | ~5.0× |
| Price / Sales (FY27) | ~11.1× |
| Price / FCF (FY27E) | ~39× |
| Street targets | $200–$235 |
The re-rating since the Q2 FY27 beat-and-raise (Aug 26) and Oktane has taken OKTA from $134.42 pre-print to ~$206.64: ~39× FY27 FCF guide and ~53× FY27 non-GAAP EPS, versus ~33× / ~44× at the $172.91 post-print close. The reset ladder values the business on FCF because that is what the company guides: 25× (bear), 32× on a ~$1.02B FY28 path (base) and 40× on ~$1.1B FY29 (bull). Spot sits ~10% above base — the premium is the AI-agent identity option the call still describes as immaterial to FY27. Next test is Q3 revenue $813–$817M and cRPO $2.590–$2.600B.
Approximate figures as of September 25, 2026.
Where We Are vs Targets
Loading live price…
Microsoft Entra bundling caps mid-market expansion, NRR slips toward 100%, and AI agent identity stays an attach story — the market pays a mature-security 25× FCF for a high-single-digit grower.
- Microsoft Entra ID expansion into Okta's mid-market base drives NRR from 107% (Q2 FY27) toward 100% over FY28, confirmed by two consecutive quarters of net customer ARR contraction
- Okta for AI Agents stays immaterial (the Q2 call's own description for FY27) through FY28, so the Oktane re-rating unwinds
- Q3 revenue prints below $813M or cRPO below $2.590B, and FY28 growth decelerates to mid-single digits as discounting defends renewals
- 25× the ~$920M FY27 FCF guide midpoint → ~$23.0B market cap ÷ ~173.7M shares → ~$132/share (~36% below $206.64)
Okta delivers the raised FY27 guide (revenue $3.216–$3.226B; FCF $910–$930M; non-GAAP EPS $3.90–$3.94), grows FCF roughly in line with revenue into FY28, and AI agent identity adds to deal sizes without yet being a revenue line — rewarded with 32× forward FCF.
- FY27 revenue lands in the $3.216–$3.226B guide (10–11%), with NRR holding 105–107% (Q2 printed 107%)
- FY27 FCF lands at ~$920M (guide midpoint, 28–29% margin) and grows ~11% into FY28 to ~$1.02B — an assumption that FCF tracks the top of the revenue growth guide, not a company figure
- Okta for AI Agents keeps attaching (dozens of deals including several $1M+, per the Q2 call) and supports seat-price uplift, but stays immaterial to FY27 revenue
- 32× ~$1.02B FY28 FCF → ~$32.6B market cap ÷ ~173.7M shares → ~$188/share
AI agent identity becomes a priced SKU (seat uplift for human-assisted agents, consumption pricing for autonomous agents), NRR re-accelerates, and the market pays a growth-software 40× FCF on a larger FY29 base.
- Agent identity monetizes through the two models management described at Oktane — seat-price uplift for human-assisted agents and consumption pricing for autonomous agents — lifting ARR per customer
- NRR re-accelerates to 112%+ by FY28 as agent identity drives net-new expansion without displacing workforce identity
- IGA + PAM convergence positions Okta as the end-to-end identity governance platform, taking share from SailPoint/CyberArk in a subset of Fortune 1000 accounts
- FY29 FCF reaches ~$1.1B; 40× → ~$44B market cap ÷ ~173.7M shares → ~$253/share
OKTA: common questions
Is Okta stock a buy?
We rate Okta Speculative Buy, with a composite score of 66/100: moat 74, growth 70 and valuation 59. The valuation score is struck against our bear, base and bull targets and moves with the price.
What is Okta's moat?
Okta scores 74/100 on moat. Okta is the authoritative identity system of record for 20,000+ customers (FY26 10-K; call), embedded in every authentication event and anchored by compliance requirements and a 7,000+ integration ecosystem (Q2 10-Q) that competitors cannot replicate.
How fast is Okta expected to grow?
We estimate 9–12% a year over the next three to five years, for a growth score of 70/100.
What is Okta's price target?
Our base case is $188, with $132 in the bear case and $253 in the bull case.