Okta — Blitz Index 55 (C)

Growth slowed four years straight. Gross margin rose three. The line is about proof, not pace.

Last re-scored: October 18, 2026.

Score breakdown

Think we scored it wrong? Score it yourself →

Radar axes (0–100): Moat 63.3 · Speed 56 · Creative 66.7.

Watch item

Gates: G1 ✓ · G2 ✓ (borderline — 36.5% of claimed TAM). The atlas line: margin direction decides.

Strengths

• cRPO +14.1% outrunning revenue +10.6% — leading indicator ahead of sales
• ~30% of Q2 bookings from new products (Identity Governance leading)
• First GAAP annual operating profit + 28% FCF margin
• $1M+ ACV customers 600+ (+20%) — large-enterprise penetration accelerating

Concerns

• 4 straight years of decelerating revenue growth — re-acceleration still a cRPO signal
• Microsoft Entra bundling — structural headwind, vulnerable to price destruction
• Two security breaches (2022·2023) at an identity company
• McKinnon 26.7% voting control on 3.9% economics

Research notes

Thesis: a mature identity platform whose margins have proved the business, while its growth still waits for proof of a second acceleration

Okta, Inc., listed on NASDAQ under the ticker OKTA, scores 55 out of 100 under the BlitzLab v1.0 model, grade C, made up of Speed 14 out of 25, Moat 38 out of 60, Creative Destruction 10 out of 15, and deductions of 7 points. The score is ten points below the 65-point threshold, and no FLAG applies, because total deductions of 7 fall below the 15-point FLAG trigger. This is a first scoring, scored on 18 October 2026, on the basis of the most recent confirmed financials: the second-quarter fiscal 2027 10-Q, filed on 27 August 2026, for the quarter ended 31 July 2026. Third-quarter fiscal 2027 results, for the quarter ending 31 October 2026, were not yet published as of the scoring date; aggregator sites conflicted between 1 and 2 December 2026, with no official company notice, so that date is recorded as expected only. Those results appear in this draft solely as a future marker, with no anticipated outcome attached. The confidence level recorded in the score file is high, because the 10-K, 10-Q, 8-K and DEF 14A texts were reviewed directly from SEC EDGAR, together with inline XBRL, with a two-year offset in the XBRL fiscal-year tags corrected by period-based mapping. Okta is classified as mature: fiscal 2026 revenue of 2,919 million dollars, a market capitalisation of approximately 32.7 billion dollars, founded in 2009 and listed in 2017.

The thesis of this draft can be stated in one sentence, and the rest of the draft is an attempt to test it against the filings. Okta is a mature software company that has already traded its first act of explosive growth for a second act built on margin, expansion inside existing customers, and a widening product portfolio — and the score of 55 describes exactly how far that second act has been proved, and how far it has not. The margin proof is confirmed and quantified: three consecutive years of gross-margin expansion, a first annual GAAP operating profit, and a free-cash-flow margin above 28 percent. The growth proof is not yet there: four consecutive years of deceleration, a headline growth rate in the low double digits, and a reacceleration signal that exists only in a leading indicator, current remaining performance obligations, which is running ahead of recognised revenue but has not yet converted into it. The tension between those two facts — margin proved, reacceleration awaited — is the whole story of this score.

Two gate verdicts frame everything that follows, and they pass in different evidentiary registers. Gate G1, sustained growth or a second growth curve, passes on confirmed figures: revenue grew for six consecutive years, from 586.1 million dollars in fiscal 2020 to 2,919 million dollars in fiscal 2026, the most recent four quarters grew between 10.6 and 11.6 percent year on year, remaining performance obligations reached 4,858 million dollars, up 17.0 percent, and current remaining performance obligations grew 14.1 percent in the second quarter of fiscal 2027, faster than the 10.6 percent revenue growth in the same quarter. Gate G2, a ten-year ceiling in a new market at least ten times current revenue, passes only on an estimate, and only at the boundary. The bar is 29.2 billion dollars, ten times fiscal 2026 revenue. Against the company's own claimed market of 80 billion dollars, stated in 2022 and including identity governance and privileged access management expansion, that bar demands a 36.5 percent share — a demanding figure, and one that leaves little room for error. Against third-party estimates, the pass looks more comfortable: identity and access management at 25.23 billion dollars in 2026 rising to 45.22 billion dollars in 2030, plus customer identity and access management at 49.9 billion dollars in 2026 rising to 101.15 billion dollars in 2030, both on a press-reported basis from TBRC, sum to approximately 146 billion dollars in 2030, and to more than 200 billion dollars by 2036 if compound annual growth of 15 to 19 percent is applied. On that combined basis the bar is roughly 11 to 15 percent of the market. The score file is explicit that this is a borderline pass, and that the company's own narrower market definition makes the arithmetic tight. A further possible market, identity for AI agents, is noted in the score file on the basis of a company claim — that 91 percent of organisations use AI agents while only 10 percent govern them — but it is unquantified, and it is conservatively excluded from the gate calculation. The gate therefore rests on the existing identity market, not on a speculative new one, and any future review of the gate will turn on whether agent identity produces quantified revenue rather than a striking claim.

Moat: expansion inside the installed base, defended by switching costs rather than by network effects

The moat section is the strongest part of the score, at 38 out of 60, and its composition explains both the strength and the ceiling. The single largest item is gross margin, scored 10 out of 12. Gross margin expanded for three consecutive years, from 74.3 percent to 76.3 percent to 77.4 percent across fiscal 2024 to fiscal 2026, with subscription gross margin at 80 percent. Fiscal 2026 brought the company's first annual GAAP operating profit, 149 million dollars at a 5.1 percent margin, and the second quarter of fiscal 2027 showed a free-cash-flow margin of 28.2 percent. The score file treats the direction of margin as the test that separates a real business from a merely fast one, and on that test Okta lands on the real side: growth has decelerated, but margin has expanded through the deceleration rather than in spite of it being hidden by it. That is the sense in which the score file's first key driver is phrased — margin is the side on which the explosion is being proved.

The distribution item, scored 11 out of 18, describes how that margin is reached. Subscription revenue accounts for 98 percent of the total, which makes the business a renewal and expansion engine rather than a perpetual hunt for new logos. Net revenue retention of 107 percent, stable after 106 percent, means existing customers spend more each year, and deals that include new products carry an average contract value uplift of 40 percent. Large-customer penetration is the visible form of that engine: customers with more than 100,000 dollars of annual contract value rose from 4,485 in fiscal 2024 to 5,255 in the second quarter of fiscal 2027, an increase of 17.2 percent, and customers above 1 million dollars of annual contract value number more than 600, up 20 percent year on year. The score file also records, on a press-reported basis, that the public sector has been the best-performing vertical in recent years, including the largest deal of the second quarter. One deliberate subtraction sits inside the same item: the professional services business was intentionally reduced by 29 percent, described as a low-margin cleanup, as work moved to partners. That is a quality-of-distribution decision rather than a loss of distribution — shrinking a low-margin line to defend an 80 percent subscription gross margin — and it is consistent with the broader pattern of a company choosing margin over headline growth.

What the moat does not have is a true network effect, and the score is honest about that limit. Network effects are scored 8 out of 18, in the same band as Datadog and Zscaler, both also at 8. Identity is a utility-type product: one more customer does not make the product intrinsically better for the next customer in the way a marketplace or a social graph improves with scale. What Okta has instead is a developer ecosystem around Auth0, more than 8,000 pre-built integrations in its application catalogue, and switching costs created by deep integration into single sign-on and provisioning workflows. Once an organisation has wired its applications, its joiner-mover-leaver processes and its access policies through Okta, leaving is expensive and disruptive, and that stickiness is real even if it is not a network effect in the strict sense. The land-and-expand pattern reinforces it: new-product deals lift contract value by 40 percent, and the count of million-dollar customers grows by a fifth in a year. But the score file withholds the higher bands for a reason. A catalogue and a switching cost defend a position; they do not compound it automatically, and they do not drive customer acquisition cost toward zero. Distribution is scored 11 rather than the 12 given to Datadog for the same reason: the engine is expansion, not virality, and price competition with the Microsoft bundle is a constant condition rather than a passing headwind.

Market size, scored 9 out of 12, is the gate argument restated as a moat item. The borderline gate pass caps the score: the full 12 points would require quantified evidence of the AI agent identity market, which does not yet exist in the filings. As it stands, the moat is a 38: a high-margin, subscription-heavy, expansion-driven position with real switching costs, a broad integration catalogue, and a market large enough to support the gate on third-party estimates but tight enough on the company's own definition to keep the score honest. It is a moat built for holding and expanding, not for compounding on its own.

Speed: deceleration with a leading indicator running ahead of revenue

Speed is the weakest of the three positive sections, at 14 out of 25, and its four items tell a single coherent story about a company past its blitz phase. Growth itself, scored 5 out of 10, is the centre of that story. Fiscal 2026 revenue of 2,919 million dollars grew 11.8 percent, extending a four-year deceleration from 55.6 percent through 42.9 percent, 21.8 percent and 15.3 percent to 11.8 percent. The most recent four quarters grew between 10.6 and 11.6 percent year on year, and guidance for fiscal 2027 is 10 to 11 percent, described in the score file as conservative. The score file is explicit about what would change this item: a demonstrated reacceleration to 15 percent or more would be required for the full 10 points, and that evidence does not yet exist in recognised revenue.

What does exist is a leading indicator pointing in the right direction. Current remaining performance obligations grew 14.1 percent in the second quarter of fiscal 2027, ahead of the 10.6 percent revenue growth in the same quarter, and total remaining performance obligations of 4,858 million dollars grew 17.0 percent. Net revenue retention is stable at 107 percent, up from 106 percent. The score file treats this as the early signature of a Datadog-style reacceleration, but it is careful to mark the difference in trajectory: Datadog's reacceleration was demonstrated over twelve consecutive quarters above 24 percent, while Okta's signal is still at the stage of a leading indicator running ahead of revenue. In addition, on a press-reported basis, approximately 30 percent of second-quarter bookings came from new products, led by Identity Governance — described in the score file as the seed of a curve transition. A seed is not a curve. It is the reason the growth item is a 5 rather than a lower number, and the reason it is not higher.

The other three speed items confirm the picture of a company no longer blitzing. Capital velocity, scored 3 out of 5, reflects a capital-return phase rather than a capital-expansion phase: a 1 billion dollar share repurchase authorisation approved on 5 January 2026, with 372 million dollars executed in the first half of fiscal 2027, and 350 million dollars of convertible notes repaid at maturity in the same half. The share count has still risen 7.5 percent over two years, with repurchases offsetting dilution rather than reversing it. Hiring and productivity, scored 3 out of 5, shows 6,366 employees and revenue per employee of approximately 459,000 dollars in fiscal 2026, characterised in the score file as a mature software standard, with no trace of a hiring blitz. Share-of-market velocity, scored 3 out of 5, records the large-customer penetration already described — 4,485 to 5,255 customers above 100,000 dollars of annual contract value — together with the 10-K management discussion statement that large enterprises are replacing legacy identity systems, but it withholds the fourth point because no quantified market share is disclosed and because Microsoft 365 bundling remains, in press reporting, a structural headwind. The pattern across all four items is consistent: the company is moving, but it is moving at the pace of a mature incumbent expanding its base, not at the pace of a company seizing a market before competitors can react.

Creative destruction: replacing the old order, with the perimeter giving way to identity

Creative destruction scores 10 out of 15, the highest of the three sections in percentage terms, and it is the section where Okta's strategic claim is clearest. The order being replaced, scored 3 out of 5, is legacy on-premises identity management, typified by Active Directory, giving way to cloud identity. The 10-K's own framing, quoted in the score file, is that in the Zero Trust transition, identity is the most critical layer. The score stops at 3 because the replacement is in progress but limited in scope: on-premises systems remain, and the displacement is partial rather than complete. This is a genuine disruption of an incumbent order, but it is a migration measured in years and in coexistence, not a sudden overturning.

The behavioural change, scored 4 out of 5, is the strongest single creative-destruction item, and it describes why the migration is hard to reverse. The centre of an organisation's security has moved from the network perimeter to identity itself: single sign-on, multi-factor authentication and passwordless access are not features that an organisation adopts and then casually abandons, because they restructure how every employee and every application authenticates every day. The score file adds, on the basis of the 10-K and industry reporting, that agent identity is emerging as a new standard in the AI agent era — the same unquantified market that the gate excludes from its arithmetic, but a real structural claim about where the behaviour is heading. A 4 rather than a 5 reflects that the new standard is emerging rather than established.

The cost-structure change, scored 3 out of 5, is the most modestly evidenced of the three. Consolidating identity through Okta reduces identity-tool sprawl and systems-integration costs, and the expansion into identity governance and privileged access management creates the consolidation economics of replacing n point solutions with one Okta platform. But no measured collapse in unit cost is disclosed, so the score file holds the item at 3 rather than crediting a cost revolution it cannot measure. Taken together, the section describes a company that is genuinely on the destructive side of a structural shift — the perimeter is giving way to identity, and the change is sticky — but whose destruction is incremental and enterprise-paced rather than explosive. That is consistent with the overall verdict: a mature company reshaping an old order from inside it, not a challenger overturning it from outside.

Deductions and risks: a clean balance sheet, heavy equity compensation, concentrated voting, and the shadow of two breaches

Deductions total 7 points, and their composition matters more than their sum, because each one points at a different kind of risk. Debt, scored minus 2 out of a possible minus 10, is the mildest item and almost a compliment in context. Total debt of 2,165 million dollars against equity of 6,973 million dollars leaves the company effectively debt-free, and the convertible repayment described above reinforces that position. The deduction comes instead from equity compensation: stock-based compensation of 544 million dollars in fiscal 2026, equal to 18.6 percent of revenue. That is a marked improvement from 30.2 percent in fiscal 2024 and 21.6 percent in fiscal 2025, and it is lower than the 24.5 percent recorded for Zscaler, which drew minus 3 on the same yardstick — but in absolute terms it remains high, and repurchases are offsetting dilution rather than eliminating it. The score file applies the same yardstick used for Roblox and Zscaler, and the minus 2 reflects improvement recognised but not yet completed.

Revenue quality, scored zero, is the clean item. No material weakness in internal control over financial reporting is reported in the 10-K. The shareholder class action arising from the 2022 LAPSUS$ breach was settled for 60 million dollars in June 2024, on the basis of court documents, and is resolved, with no material contingency recorded in the fiscal 2026 10-K. With 98 percent of revenue from subscriptions, the quality of the revenue itself is good, and the score file records this item as a no-trigger.

Governance, scored minus 2 out of a possible minus 5, is a structural rather than a behavioural deduction. Class B shares carry 10 votes each, and McKinnon holds 84.7 percent of the Class B shares, giving him 26.7 percent of the voting power on an economic stake of only 3.9 percent, on the basis of the DEF 14A proxy statement filed on 7 May 2026, with figures as of 1 April 2026. Directors, officers and related persons together hold 31.6 percent of the voting power. The score file places this in the same band as Datadog, where 32.8 percent insider voting drew minus 2, and well below the bands where Roblox at 58.8 percent and Duolingo at approximately 76 percent drew heavier deductions. The point is not that control has been misused — no such claim appears in the score file — but that the wedge between economic ownership and voting control is a permanent feature of the governance structure, and it is priced into the score accordingly.

The heaviest deduction, and the most consequential risk in the whole assessment, is regulatory and social cost, scored minus 3 out of a possible minus 5. Okta suffered breaches in two consecutive years, and for an identity company, that fact strikes at the essence of the business. In March 2022, the LAPSUS$ intrusion, via the Sitel support provider, affected 366 customers. In October 2023, the support case management system was breached through stolen credentials, giving access to customer HAR files; the initially reported scale of approximately 1 percent of customers was revised upward on 29 November 2023 to all users of the support system, on the basis of press reporting from The Register, with BeyondTrust, Cloudflare and 1Password among those affected. The share price fell 11.5 percent and market capitalisation fell by more than 2 billion dollars. The score file benchmarks this against Coupang, where a breach of 33 million accounts plus a 410 million dollar provision drew minus 4: Okta's breach was smaller in scale and was absorbed within operating costs with no provision or fine, which is why the deduction is minus 3 rather than minus 4 — but the trust damage to an identity business is treated as intrinsically serious, and the deduction is, in the score file's own phrase, an honest discount for a security company's security failures. The class action is settled and no material contingency remains, but the history itself remains part of the score, and it is the single largest reason the total stops where it does.

Beyond the deductions, the score file names one further risk that does not carry its own line item but shadows the entire moat. The blitzscaling analysis identifies the maximum risk as the bundle swallowing the platform: Microsoft's Entra, bundled with Microsoft 365, drives the price of basic identity toward zero, and Okta's independent, neutral positioning is defended, for now, by the switching costs described above. The danger is concentrated in new workloads, above all AI agent identity: if the bundle becomes the default standard there, the foundation of the moat shakes. The breach history sharpens this risk rather than softening it, because trust is the weapon an independent identity provider would most want in a contest against a bundled incumbent, and it is the weapon these two breaches damaged. That interaction — a structural bundle threat meeting a trust deficit — is the most important risk judgement in the draft, and it is worth more attention than any single deduction line.

What to watch: the conversion of a leading indicator, and the gate's re-examination triggers

The score file leaves three explicit things to watch, and they map neatly onto the three things that would have to change for the score to move toward 65. The first is the conversion of current remaining performance obligations into recognised revenue over the next two to four quarters. The signal is already visible — 14.1 percent against 10.6 percent — and the question is whether it is a timing difference or a genuine reacceleration. The score file's own test is demanding: sustained growth at 15 percent or more would be required to lift the growth item toward its full marks, and a single quarter above that line would not be the same as the twelve-quarter run that Datadog demonstrated. The second is the composition of bookings: whether new products, led by Identity Governance and now approaching 30 percent of bookings on a press-reported basis, continue to expand inside the installed base, and whether the count of million-dollar customers keeps growing at around 20 percent. That is the second curve becoming visible in numbers rather than in narrative.

The third is the re-examination of the gate itself. The score file names AI agent identity revenue evidence as the trigger for revisiting Gate G2: if agent identity produces quantified revenue, the market ceiling argument strengthens and the borderline pass becomes comfortable; if it does not, the gate continues to rest on third-party estimates of the existing market, with the company's own 80 billion dollar definition demanding a 36.5 percent share. Alongside that, the model-level questions recorded as version 1.1 candidates are worth noting, because they show where this scoring may itself be revised: whether a leading indicator such as current remaining performance obligations can count as reacceleration evidence or whether recognised revenue is required, with Okta, Datadog and Samsara at 57/C forming a three-company comparison set; whether breaches at companies whose business is trust itself should carry an additional weight, an "essence-damage coefficient" benchmarked against Coupang; and where the dual-class voting bands should be drawn, with Okta at 31.6 percent and Datadog at 32.8 percent in the lightest band. None of these questions changes the present score, which is frozen under version 1.0, but they are the questions a future rescoring would have to answer.

One final note belongs outside the score but inside any honest reading of it. The valuation note in the score file, which does not affect the score, records a market capitalisation of approximately 32.7 billion dollars as of 16 October 2026, a price-to-sales ratio of approximately 11 times fiscal 2026 revenue, a 52-week range of 62.66 to 235 dollars, and a 2026 year-to-date rise of 116.6 percent on a press-reported basis. The business score deliberately does not look at price — the score file cites the ARK test as the lesson for that separation — and this draft follows the same rule. The market's enthusiasm, whatever its cause, is not evidence for or against the 55. What would be evidence is narrower and more checkable: a leading indicator converting into revenue, a second product curve widening inside the installed base, a bundle contest in which independence keeps winning new workloads, and a security record with no third chapter. Until those appear in the filings, Okta remains what the score says it is: a mature, high-margin, expansion-driven identity platform, ten points short of the threshold, with its proof half delivered and its growth still waiting.

More Platforms companies

Other Platforms names on the Blitz Index, highest score first: Alphabet (83/A), Meta (78/B), Airbnb (76/B).

Next earnings

Dec 2, 2026 · Expected

Coverage

Okta, Inc. · Q3 FY2027 due Dec 2026 (expected) · Score 55 · Grade C

Embed this score

Copy the HTML below to show this score on your site. The badge links back to this page and updates automatically when the score changes.

<a href="https://blitzlab.app/companies/okta/"><img src="https://blitzlab.app/badge/okta.svg" alt="Okta Blitz Index 55/C — BlitzLab"></a> Copy HTML

Preview:

BlitzLab scores businesses against a scholar’s standard — not investment advice. No price targets, no buy/sell recommendations. Figures are from SEC filings (XBRL) as labeled in the source scorecard.