# Okta Inc. (OKTA) — InvestMoat Analysis

_Last analyzed: August 26, 2026_
_Asset class: equity · Canonical page: https://investmoat.com/stocks/okta_

## Scores

| Dimension | Score (0–100) |
| --- | --- |
| Moat durability | 81 |
| Growth trajectory | 70 |
| Valuation | 31 |
| **Composite** | **51** |

Scores are computed deterministically from this asset’s data by the InvestMoat formula (see https://investmoat.com/llms.txt for methodology). Scores are not directly comparable across asset classes.

## Key stats

- **Ticker:** OKTA
- **Market Cap:** ~$30.1B

## Moat

Okta is the authoritative identity system of record for 20,000+ customers (FY26 10-K; call), embedded in every authentication event and anchored by compliance requirements and a 7,000+ integration ecosystem (Q2 10-Q) that competitors cannot replicate.

### The Identity System-of-Record Moat

Okta's moat is built on **Transaction Embedding, Regulatory Compliance, and System-of-Record Gravity**:

- **Transaction Embedding — Every Login Flows Through Okta:** Okta sits inline with every authentication event across an enterprise — every employee login, every app access, every API call. Removing it would break access to the 7,000+ integrated applications (Q2 10-Q; call said 8,000+) simultaneously, making it operationally irreplaceable in the short term. Okta for AI Agents, live since its April 30, 2026 GA, is extending this embedding to non-human identities — the 8-K names strong new-product contributions led by Okta Identity Governance; the call put new products at ~30% of Q2 bookings with a ~40% ACV uplift when attached (Q1 was ~25%). That is more transaction surface, not a reason to mark the pillar up because they beat.
- **System of Record for Enterprise Identity:** Okta's Universal Directory is the authoritative truth for who can access what across the enterprise — a repository of provisioning rules, group memberships, HR integrations, and access policies accumulated over years. Migrating this to a competitor requires re-mapping every app integration, re-certifying access policies, and reconciling years of audit logs — a 12–24 month project with significant business risk. The 10-Q subsequent-events note that Permiso closed Aug 26 (ITDR tuck-in) does not change this pillar.
- **Regulatory Lock-in and Compliance Inertia:** SOX, HIPAA, PCI-DSS, and FedRAMP audits depend on Okta's access logs and certification trails. FedRAMP High authorization locks in federal agency customers for the duration of their procurement cycle. Switching vendors mid-compliance cycle is not a practical option for regulated industries, creating a moat that renews with each compliance audit. No new filing in this print changes that.

**Moat verdict:** Okta is a net beneficiary of AI adoption in the long run: the explosion of AI agents creates an entirely new identity surface that every organization must manage, and Okta's position as the universal identity directory (human and non-human) makes it the natural registry. Transaction embedding and system-of-record are the strongest AI-era moats — AI agents amplify the number of transactions flowing through Okta rather than threatening them. The Q2 FY2027 beat (revenue $805M +11%; cRPO +14%; NRR 107%) does not change that, and it does not retire Microsoft Entra bundling as a growth residual. The primary AI-era risk remains that Microsoft uses AI-accelerated Copilot/Entra development to close Okta's feature gap faster than Okta can differentiate, pressuring the bundling and learned-interface moats in Microsoft-centric enterprises. On balance, Okta's identity infrastructure is AI-resilient: more agents mean more identities, more policies, and more Okta revenue. Call: AI still immaterial to FY27.

## Growth

Q2 FY2027 (quarter ended July 31, reported Aug 26) printed revenue $805M, +11% YoY from $728M, with subscription $793M, +12% (99% of revenue; posted commentary). RPO $4.858B (+17% YoY) and cRPO $2.585B (+14% YoY) — the 8-K flags accelerating cRPO. TTM dollar-based NRR held at 107% (10-Q / posted commentary; +1 pt vs 106% a year ago; same as Q1). Non-GAAP operating income $226M, or 28% of revenue, vs $202M / 28% a year ago — the Q1 −180 bps compression charge is stale. GAAP operating income $107M (13%) vs $41M (6%). FCF $227M (28% of revenue) vs $162M (22%). Cash, cash equivalents and short-term investments $2.299B after settling the remaining $350M of 2026 convertibles in cash; H1 buybacks $366M (Q2 1,542,442 shares / $125M; $555M remains on the $1B authorization). Posted commentary (not 99.1): Workforce Identity ACV +11% (59% of ACV); Customer Identity ACV +13% (41%); $100k+ ACV customers 5,255 (+6%); $1M+ ACV customers 605 (+22%). FY27 raised to $3.216–$3.226B revenue (10–11%; ~1 pt professional-services partner-shift headwind) and $910–$930M FCF (28–29%). Q3 guided $813–$817M revenue (+10%) and cRPO $2.590–$2.600B (11–12%). Call: new products ~30% of Q2 bookings, AI still immaterial to FY27. The named Q2 test (NRR reversing below 105%) did not fire.

- **Revenue CAGR estimate:** 9–12%
- **Primary type:** both
- **Margin trend:** stable
- **Key risk (moderate):** The Q2 NRR test did not fire: TTM dollar-based net retention held at 107% (10-Q). Next hard test is Q3 FY2027 revenue $813–$817M (+10%) and cRPO $2.590–$2.600B (11–12% vs the printed +14%). Falsifiable: Q3 revenue prints below $813M, cRPO prints below $2.590B, or NRR reverses below 105% for two consecutive quarters. Microsoft Entra ID capturing 10%+ of net new workforce identity ARR from SMB/mid-market by end of FY2028 is unchanged — Q2 did not produce a new fact that removes it. Residual: at $172.91 the stock is 12% above the $155 bull (~44× company FY27 non-GAAP EPS $3.90–$3.94, ~9.3× FY27 revenue); if the raise proves a one-off, the multiple compresses.
- **Drivers:**
  - Workforce Identity Cloud (Core) — Posted commentary: Workforce Identity ACV +11%, 59% of total ACV. Exhibit: total revenue +11%; RPO $4.858B (+17%); cRPO $2.585B (+14%). Q3 cRPO guided 11–12% — not a trend flip to accelerating (stable)
  - AI Agent Identity + IGA — 8-K: strong new-product contributions led by Okta Identity Governance. Call (not 99.1): new products ~30% of Q2 bookings vs ~25% in Q1; ~40% ACV uplift when attached; AI still immaterial to FY27. Okta for AI Agents GA April 30 (accelerating)
  - Customer Identity Cloud (Auth0) — Posted commentary: Customer Identity ACV +13%, 41% of total ACV. Auth0 for AI Agents GA Oct 2025. Do not invent a further CIAM mix (stable)
- **Score derivation:** Base 74 (9–12% CAGR, midpoint 10.5%, baseFromCagr: 70+((10.5−8)/7)×10 = 73.57) + 1.3 trajectory (1 of 3 drivers accelerating: new products / IGA / AI Agents; Workforce Identity ACV +11% and Customer Identity ACV +13% are stable, not a 3/3 mark-up) + 0 stable margins (non-GAAP OM 28% vs 28% YoY; Q1's −180 bps compression is stale) − 5 moderate keyRisk (Microsoft Entra bundling unchanged; Q3 cRPO guide 11–12% vs printed +14%) = 70. primaryType does not score. Do not bump because they beat. The old author string that added +4 both TAM/share and printed 70 against a site-derived 66 is retired.

## Valuation

Regular-session close $172.91 on Aug 27 (Yahoo Finance; market cap $30.053B). Aug 26 close $134.42 was pre-print (2:00 p.m. PT / 5:00 p.m. ET webcast); the Aug 10 card's ~$152 is also not the post-print tape — both of those are what not to use. Unchanged ladder $48 / $100 / $155. At $172.91 the stock is 12% above the $155 bull (1.2× bull = $186) — piecewise 31. The Q2 beat-and-raise does not move the ladder; trading through bull is a tape fact, not a reason to rewrite DCF. Live valuation will recompute against the tape; this static 31 is the Aug 27 close against the held corridor.

| Multiple | Value | Note |
| --- | --- | --- |
| Trailing P/E (GAAP) | ~125× | Yahoo TTM EPS $1.38 / P/E 125.30 at $172.91. Q2 GAAP diluted EPS $0.65; H1 $1.07. Retires the Aug 10 ~$1.63 / ~93× — do not treat this print as a restated TTM |
| Forward P/E (FY27, non-GAAP) | ~44× | company FY27 non-GAAP EPS $3.90–$3.94 at $172.91 (midpoint $3.92). Retires the Aug 10 ~$4.71 consensus / ~32× |
| PEG Ratio | ~4.2× | fwd P/E ÷ 10.5% revenue CAGR (cagrEstimate midpoint). Do not invent an EPS CAGR from one guide raise; the old ~25% EPS-growth PEG of ~1.3× is retired |
| Price / Sales (FY27) | ~9.3× | $30.053B ÷ $3.221B FY27 revenue midpoint ($3.216–$3.226B) |
| Price / FCF (FY27E) | ~33× | $30.053B ÷ ~$920M FY27 FCF midpoint ($910–$930M). H1 FCF $498M is not TTM; do not reprint the old ~$896M / ~29× as if this print restated it |

Post-print tape $172.91 (Aug 27 close, Yahoo) ripped +28.6% from the $134.42 Aug 26 pre-print close and sits at a new 52-week high of $174.85. Forward multiple is ~44× on the company's own $3.90–$3.94 FY27 EPS guide and ~9.3× FY27 revenue — richer than the Aug 10 ~32× on a stale ~$4.71 consensus, and 12% through the $155 bull. Yahoo 1y target est $146.34 (quote page; pre-print Street sitting below spot). The beat-and-raise, cRPO acceleration, and FCF raise still justify a premium to slower identity peers; the margin of safety versus the held $155 bull is gone. Next test is Q3 revenue $813–$817M and cRPO $2.590–$2.600B, not a restated ladder. _(as of August 26, 2026)_

## Price scenarios

### Bear — $48

Microsoft Entra's free bundling captures material SMB/mid-market share, NRR falls below 100%, and the AI agent identity opportunity fails to monetize at scale — triggering multiple compression to ~10× FCF. Ladder held; Q2 NRR 107% did not retire this path.

- Microsoft Entra ID expansion into Okta's mid-market base drives NRR below 100% by mid-FY2028, confirmed by two consecutive quarters of net customer ARR contraction — Q2 held 107% and did not produce a new fact that removes Entra
- Okta for AI Agents generates less than $50M incremental ARR in its first 18 months — call says AI is still immaterial to FY27 — insufficient to offset core workforce identity attrition
- Q3 revenue prints below $813M or cRPO below $2.590B, and FY2028 revenue growth decelerates to 4–6% with non-GAAP operating margin compressing back toward 20% as Okta increases discounting to defend renewals
- Multiple compresses to 10× FCF on ~$820M FCF → ~$8.2B market cap → ~$48/share

### Base — $100

Okta delivers the raised FY2027 guide (revenue $3.216–$3.226B, 10–11%; FCF $910–$930M, 28–29%), NRR holds 105–107%, and AI agent identity remains an attach story rather than a FY27 revenue line — rewarded with a 20× forward FCF multiple. Ladder held; do not mark this up because they beat.

- FY2027 revenue lands in the $3.216–$3.226B guide (10–11%), with NRR holding 105–107% (Q2 printed 107%). The old $3.18B / +9% point is retired by this print's guide
- Okta for AI Agents continues to attach (call: dozens of deals including several $1M+; still immaterial to FY27). Do not require 1,000+ paying deployments as a FY27 print fact — that remains a claim
- IGA remains the largest new-product bucket (8-K); $1M+ ACV customers 605 (+22%, posted commentary) keep the upmarket mix
- FY2027 FCF $910–$930M already clears the old FY2028 $900M crossing; 20× on ~$900M still maps to ~$18B / $100. Do not mark the target up because they raised FCF

### Bull — $155

AI agent identity becomes a $500M+ platform by FY2029, NRR re-accelerates to 112%+ as agents multiply per customer, and Okta re-rates to 25× FCF as growth returns to 15%+. Tape already through $155 is not a reason to rewrite this FY2029 scenario.

- Each enterprise customer deploys hundreds–thousands of AI agents, each requiring Okta-managed identity — average ARR per customer expands 30%+ by FY2029 as agent identity monetizes. Call: AI still immaterial to FY27, so this remains a FY2029 claim
- NRR re-accelerates to 112%+ by FY2028 as AI agent identity drives net-new expansion ARR without displacing existing workforce identity revenue — Q2 held 107%, it did not print 112%
- IGA + PAM convergence positions Okta as the end-to-end identity governance platform, displacing SailPoint/CyberArk in a subset of Fortune 1000 accounts. Permiso (closed Aug 26) is an ITDR tuck-in, not this thesis on its own
- FY2029 FCF reaches $1.1B+ at expanding margins; multiple of 25× FCF → ~$27.5B market cap → ~$155/share

---

InvestMoat is a research and education framework. Nothing here is financial advice. Past performance does not guarantee future results.