OKTA · Research
Okta Owns the Login Every Agent Will Need. Owners Finally Got Paid, but Agents Still Ride Free on Human Seats
Owner cash turned from -$612M to $458M in three years as stock pay fell. Okta owns the record and the connection for agent identity, but growth is near 10% and it still bills by human user.
- Owner cash after all capex and stock pay
- $458M
- Stock pay as a share of operating cash flow
- 51%
- Dollar-based net retention
- 107%
1. Verdict and what this piece answers
Verdict: watch. Okta is the rare software company in this coverage whose owners are now being paid.
Owner cash, meaning operating cash flow of $987M less $26M of property, equipment and capitalized software, less $503M of stock pay, was $458M for the twelve months ended Jul 31, 2026, our calculation [2][3][10]. Three years earlier it was -$612M.
The turn came from two directions at once: operating cash flow rose almost twelvefold from fiscal 2023, and stock pay fell from a peak of $684M in fiscal 2024 [10].
The question this piece answers is whether identity becomes the gate that superintelligence agents must pass, and whether Okta can charge at that gate. Every agent that books travel, reads a mailbox or moves money has to prove who it is and who it acts for.
Okta already answers that question for people at more than 20,000 organizations [1]. The opportunity is that agents multiply the number of identities each customer must manage.
The problem is that growth has slowed to about 10%, retention has drifted to 106% to 107%, and the company still charges mainly for human users and product modules [1][3].
Our view: Okta has done the hard financial work. Stock pay is shrinking, the convertible notes are gone, and buybacks are now larger than the stock pay dilution.
2. Rating metrics
| Metric | Value |
|---|---|
| R&D share of revenue | 21.9%, research and development expense of $639M on $2,919M of revenue, fiscal 2026, our calculation [1][10]. R&D dollars fell from $656M in fiscal 2024 while revenue grew 29% |
| GAAP net margin | 8.1%, net income of $235M, fiscal 2026 [1]. It includes $110M of interest income and other, net; excluding it, pre-tax income would have been about $145M, our calculation [1] |
| API quality | 5 of 5, our scoring: documented public REST management and authentication APIs with self-serve developer signup and free Auth0 plans [1]; published Auth0 pricing tiers and rate limits; an agent surface through the Cross App Access extension to the Model Context Protocol and an Auth0 agent toolkit [1]; SDKs in many languages with public changelogs; and over 7,000 integrations in the Okta Integration Network [1] |
| Toll-gate score | 2 of 4 pass, 1 partial, 1 fail (section 2b) |
2b. Thesis and the toll-gate test
Identity is the one control every request has to clear. A firewall can be routed around and an endpoint agent can be missing from a device, but no application grants access without first asking who is calling.
Okta sits at that question for the workforce through the Okta Platform and for consumer and business applications through Auth0 [1]. Superintelligence agents add a third class of caller: software acting on behalf of a person, with delegated rights that need to be granted, scoped, logged and revoked.
The 10-K describes this as a potential long-term opportunity to be a unified, independent control plane for non-human identities and agents, and says adoption is in its early stages [1].
| Test | Result | Evidence |
|---|---|---|
| Owns the record | Pass | Universal Directory is the system of record for user, application and device profiles for an organization, and it is the foundation for authentication and lifecycle management [1]. Okta also holds the access policies and the sign-in logs that its threat products analyze [1] |
| Owns the connection | Pass | Single sign-on and multi-factor authentication sit in front of every connected application. Cross App Access moves authorization decisions for app-to-app and agent connections from each application to the identity provider, and Okta has extended it into the Model Context Protocol [1] |
| Prices close to outcomes | Fail | Revenue comes primarily from multi-year subscriptions that expand through added users and added product offerings [1]. Nothing in the filings shows a fee per agent, per token or per authorization. An agent acting for an existing employee may add no revenue at all |
| R&D on the gate vs features | Partial | The new products are on the gate: agent governance, Cross App Access, privileged access and identity threat detection [1]. The two recent deals, Axiom for $54M and Permiso on Aug 26, 2026, also target the gate [2]. But total R&D dollars are flat to down for three years [10] |
Two passes, one partial and one fail. Okta owns both the record and the connection, which is the strongest position on this test of any security name we have covered.
3. Growth
| Measure | Value | Change |
|---|---|---|
| Fiscal 2026 revenue | $2,919M | +11.8% [1][10] |
| Fiscal 2025 revenue | $2,610M | +15.3% [10] |
| Q2 fiscal 2027 revenue | $805M | +11% [3] |
| Q2 fiscal 2027 subscription revenue | $793M | +12% [3] |
| Remaining performance obligations, Jul 31, 2026 | $4,858M | +17% [3] |
| Current remaining performance obligations, Jul 31, 2026 | $2,585M | +14% [3] |
| Customers above $100,000 of annual contract value | 5,255 | +6.3%, from 4,945 [2] |
| Q3 fiscal 2027 revenue guide | $813M to $817M | +10% [3] |
| Fiscal 2027 revenue guide | $3,216M to $3,226M | +10% to +11% [3] |
Growth has stepped down every year: 21.8% in fiscal 2024, 15.3% in fiscal 2025, 11.8% in fiscal 2026, and a guided 10% to 11% for fiscal 2027, our calculation [10][3]. About one point of the fiscal 2027 slowdown is deliberate.
Okta is handing professional services work to systems integrators, and services revenue fell to $12M in the quarter from $17M [2][3]. Subscription revenue, the line that matters, grew 12%.
The leading indicators are better than revenue. Current remaining performance obligations, the contracted backlog for the next twelve months, grew 14%, faster than revenue, and the chief financial officer described it as accelerating [3].
Total backlog grew 17% to $4,858M, which means customers are signing longer commitments [3]. The guide for the third quarter, though, calls for current backlog growth of only 11% to 12% [3]
4. New products and how fast the company ships them
Okta's product list has grown well beyond single sign-on. The Okta Platform now includes Identity Governance for access requests and certifications, Privileged Access, Identity Threat Protection, which evaluates risk continuously during a session, Identity Security Posture Management, which finds admin sprawl and multi-factor bypasses, and Workflows for no-code automation [1].
The chief financial officer said new products, led by Identity Governance, made strong contributions to second-quarter growth [3]. The filings do not break out revenue by product.
The agent products are newer and mostly early. At fiscal year end, Okta's agent governance product for the Okta Platform and Cross App Access were both in early access; the Auth0 agent toolkit for developers was generally available [1].
Cross App Access is the most strategic: it is a standards-based protocol that lets an organization's identity provider decide what one application or agent may do inside another, while keeping the original user's identity attached [1]. Okta has extended the Model Context Protocol with it, and it also backs the Shared Signals Framework for sharing risk signals and ending sessions across SaaS applications [1].
Acquisitions are filling specific gaps. Axiom Security, bought on Sep 4, 2025 for $54M in cash, added privileged access capabilities [2].
Permiso Security, closed on Aug 26, 2026, detects threats across human, non-human and agent identities in multi-cloud environments; the price had not been disclosed as of the 10-Q
5. Net revenue retention
Net retention fell four points in two years and has now ticked up one, to 107% from 106% a year earlier [2]. The decline reflects slower seat growth at existing customers, since the company's expansion model depends on adding users and products within a contract [1].
A rising backlog and a one-point retention recovery suggest the bottom may be in, but 107% is low for a company whose thesis rests on selling more identities into each account. If agents become billable identities, this is where it will show first.
6. Owner cash
The twelve-month figures are built from the fiscal 2026 10-K plus the first half of fiscal 2027 less the first half of fiscal 2026, our calculation [2][10]. Stock pay fell to $114M in the second quarter from $144M a year earlier, or 14.2% of revenue against 19.8% [3].
Over twelve months it was 16.4% of revenue and 51.0% of operating cash flow, our calculation. That is still a large share, but it is down from roughly 790% of operating cash flow in fiscal 2023, when stock pay was nearly eight times the cash the business produced, our calculation [10].
Two adjustments under our standard. First, interest income: interest income and other, net was $95M over twelve months, our calculation [1][3].
Removing it gives owner cash of about $363M. That figure will shrink further on its own, because Okta spent $350M repaying its 2026 convertible notes in June and $372M on buybacks in the first half, and the fiscal 2027 cash flow guide already includes about one point of lost interest income [3].
7. Acquisitions in the last 24 months
Both deals are small against $2,299M of cash and short-term investments, and neither was financed with debt [3]. Payments for acquisitions, net of cash acquired, were $56M in each of fiscal 2025 and fiscal 2026 [10].
Goodwill is $5,487M, almost all of it from the Auth0 purchase in 2021, and intangible assets are down to $80M [3]. The acquisition strategy has shifted from a large platform deal to tuck-ins on the agent and threat-detection gate, which we view as the right order of priorities.
8. Risks and catalysts
Risks. Growth: revenue growth has slowed four years in a row and the fiscal 2027 guide is 10% to 11% [3][10].
Pricing: agents acting for existing users may be covered by existing seat licenses, so agent adoption could raise Okta's importance without raising its revenue [1]. Platform competition: the largest cloud and productivity suite vendors bundle identity with their own platforms, and Okta's pitch rests on being independent and neutral [1].
Security record: the January 2022 incident at a service provider and the October 2023 theft of data from Okta's customer support system harmed its reputation, and the 10-K says these incidents may continue to affect results [1]. Interest income: it is falling as cash is used for buybacks and debt repayment [3].
Control: the co-founder chief executive holds 26.7% of the voting power [4].
Catalysts: third quarter fiscal 2027 results, expected in early December 2026 (unconfirmed; the company had not announced the date as of Oct 31, 2026, and last year's third quarter results came out on Dec 2, 2025) [9]; general availability of the agent governance product and Cross App Access (unconfirmed timing)
9. Valuation anchor and balance sheet
Owner cash has been positive in two full fiscal years, $165M in fiscal 2025 and $319M in fiscal 2026, and for the trailing twelve months [10]. Our standard needs three positive years before a base value is set, so none is set here.
The anchor to track is twelve-month owner cash after interest income, about $363M today, our calculation. If fiscal 2027 closes positive, which the guide and first half point toward, Okta becomes eligible for a base value from the band low at the next review.
Okta has no debt. The last convertible notes matured on Jun 15, 2026 and were settled for $350M in cash, and the remaining capped calls expired unexercised [2][3].
Buybacks are worth covering here because they now change the share count. Okta bought back 4.57M shares for $366M in the first half, after $79M in fiscal 2026 [1][2].
Class A and Class B shares outstanding fell to 174.8M at Jul 31, 2026 from 177.4M at Jan 31, 2026, a 1.4% drop in six months, our calculation [2]. They are funded from cash, not debt.
10. Superintelligence angle
Tailwind, with one condition. Agents need identities, delegated permissions and an audit trail, and those are what Okta already sells.
Chief executive Todd McKinnon put it plainly in the second-quarter release: every agent needs a trusted identity and clear controls over what it can access and do [3]. Because Okta runs on public cloud, more agent sign-ins add little cost, unlike inspection-heavy security models.
The condition is pricing. Okta has built the gate for agents and helped write the protocol for it; it now has to charge per agent or per authorization rather than letting agents ride on human seats.
Until it does, agents strengthen Okta's position more than its revenue.
11. Leadership and control
Todd McKinnon co-founded Okta in 2009 and is chief executive officer and chairman [1][4]. He holds 6.51M Class B shares, 84.7% of that class, giving him 26.7% of the total voting power; directors and executive officers as a group hold 31.6% [4].
Class B shares carry ten votes and Class A one [4]. Co-founder Frederic Kerrest holds 14.2% of the Class B shares and 4.6% of the voting power and remains a director; the board does not count him or McKinnon as independent [4].
David Schellhase is lead independent director [4]. The largest outside holders are BlackRock at 10.3% of Class A shares, FMR at 5.8% and two Vanguard entities at 5.5% and 5.4% [4].
Brett Tighe is chief financial officer and signed the second-quarter 10-Q [2]. Eric Kelleher is president and chief operating officer, Jon Addison is chief revenue officer, and Shibu Ninan is chief accounting officer [2][4].
12. Questions for the owner and predictions
Questions for the owner. First, when will Okta price agents directly, per agent identity or per delegated authorization, rather than inside human seat counts?
Second, does current backlog growth hold near 14% or fall to the guided 11% to 12%? Third, with interest income falling and buybacks rising, will owner cash after interest keep rising in fiscal 2028?
Fourth, conviction on a 1 to 5 scale: our view is 3. Okta owns the record and the connection, and owners are finally being paid, but growth is near 10% and the agent opportunity is not yet a revenue line.
Predictions to register: third quarter fiscal 2027 revenue lands at or above $817M, the top of the guide (75%); current remaining performance obligations grow 12% or more at the third quarter (60%); dollar-based net retention is 107% or higher at Jan 31, 2027 (55%); fiscal 2027 stock pay is below $480M (70%); fiscal 2027 owner cash, as we define it, exceeds $400M (70%); Okta announces general availability of agent-specific pricing or a separately priced agent product by Jan 31, 2027 (40%).
Stock Profiles & Comparable Companies
OKTA Stock Profile →More Published Research
View All →Diebold Services the Machines Where People Use Cash but Owners Kept 113 Million Dollars
Diebold grew third quarter revenue 5.2%, but owner cash after capex and all stock pay fell to $112.7M over twelve months while buybacks continued.
Asure Holds the Payroll Record for 100 Thousand Small Employers but Owners Kept 1 Million Dollars
Asure grew recurring revenue 16% in the third quarter, but after capex and all stock pay owners kept $1.0M over the latest twelve months while the share count rose.