Thesis: own Okta for the identity governance cycle, not the agent story. Governance and privileged access are compounding across twenty thousand incumbent accounts and delivered last quarter’s operational upside. Agents remain an unpriced call option on top, and unpriced for good reason: Okta tariffs agent identity per human head, meaning the structural expansion in autonomous agents fails to reach its top line. Net retention, flatlined for eight quarters, is the decisive metric revealing which narrative holds water.
The business
Okta governs access across the enterprise application estate. A user launches Salesforce; Okta interrogates identity, enforces policy, and grants or denies passage. A new arrival receives instant provisioning across every corporate environment; a leaver is excised that very afternoon.
The architecture comprises two distinct halves. Workforce Identity, sold to chief information officers and security executives, accounts for roughly sixty per cent of total revenue. Auth0, acquired in 2021, is sold directly to developer teams requiring a turnkey authentication portal within their proprietary products, representing the remaining forty per cent.
The structural lock-in resides not in simple authentication—which has succumbed to commoditisation—but in eight thousand pre-built application integrations and seventeen years of accumulated access policies. No enterprise displaces that architecture for a marginal performance increment elsewhere. With twenty thousand corporate accounts, the business is robustly cash-generative and has sustained Rule of 40 performance continuously since its initial public offering.
Why growth stalled
Growth has decelerated from fifty per cent five years ago to eleven per cent last quarter. Management routinely attributes this to macroeconomic friction, sales reorganisation, and a deliberate pivot toward channel partners. While those dynamics transpired, none fully accounts for a multi-year deceleration that traversed distinct macroeconomic regimes and persisted past every operational corrective.
Okta operates a per-seat monetisation model. When enterprise headcount growth flatlined, Okta’s expansion stalled accordingly. Net retention contracted from historical levels above one hundred and fifteen per cent to the mid-hundreds, remaining pegged within that band for eight consecutive quarters.
Growth has consequently assumed a barbell distribution. Customers generating over one million dollars in annual contract value grew twenty-two per cent last quarter, whereas the hundred-thousand-dollar cohort grew merely six per cent. That divergence visually illustrates a bundled competitor winning the mid-market segment.
Bull case
Identity constitutes the primary locus of value creation once the network perimeter dissolves. Approximately eighty per cent of enterprise breaches exploit identity vectors; modern adversaries log in rather than breach perimeters.
Autonomous agents render this vulnerability structural. An agent holds long-lived credentials, acts without human oversight, and can be coerced via data inputs. No patch remediates that architecture. The sole effective control is strictly bounding what the agent may touch and execute—the core capability of Okta’s platform.
Okta confronts this market equipped with the primary directory, the integration graph, and twenty thousand enterprise relationships. It stands as the only credible neutral broker. Enterprises deploying agents across OpenAI, Anthropic, Google, Microsoft, and Salesforce simultaneously will not accept a referee owned by one of the competing players.
Crucially, the baseline valuation requires zero agent revenue contribution. Next-generation products account for roughly thirty per cent of new bookings and deliver a forty per cent contract uplift when included in a transaction. Okta Identity Governance surpassed two thousand accounts within three years and now lands net-new accounts rather than merely attaching to the base. Governance expands in the mid-twenties while core access management grows at ten per cent; this structural mix shift inherently elevates the consolidated growth rate, a process already underway.
Bear case
A seat-priced business model is entering a technological paradigm explicitly designed to decouple operational output from human headcount. The commercial model directly opposes the underlying technology trend.
Net retention has remained stagnant for two years while marketing around agentic workflows reached peak volume. Were agents expanding wallet share, the inflection would register in net retention first. It has not.
Four formidable bundlers have entered the domain within eight months. Microsoft released agent identity bundled directly into existing enterprise licensing, offering native compatibility with agents running on AWS and Google Cloud to neutralise Okta’s neutrality proposition. Palo Alto Networks acquired CyberArk and rebranded it as an identity fabric for the agentic enterprise. CrowdStrike announced its proprietary agent identity platform, leveraging a recently acquired runtime authorisation platform to layer over existing directory providers, including Okta. Cisco is widely reported to be pursuing an acquisition in the space.
Each competitor introduces identity as an add-on into accounts where they already enjoy deep incumbency. Okta sells standalone identity to buyers procuring standalone identity. That dynamic remains viable while the broader category expands rapidly, but turns perilous once identity is repositioned as a loss leader.
Todd McKinnon’s rebuttal holds that consolidation within cybersecurity invariably founders, and that securing agentic architectures demands a multi-vendor ecosystem. Historical precedents support his view. However, it represents the obligatory stance of a specialist vendor, and sits awkwardly alongside Okta’s internal strategy, which relies heavily on platform consolidation.
The deciding question
Okta prices agent identity as a marginal uplift on a named human user—not per autonomous agent, but per human head.
Consider that commercial model against the go-to-market pitch. Management asserts that enterprise customers will ultimately maintain vastly more agent identities than human employees, citing a client whose agent deployments expanded from fifty to fifteen hundred instances within weeks. Under Okta’s current pricing schedule, that client’s invoice remains entirely unchanged.
McKinnon acknowledges the cognitive dissonance, noting that the immediate reaction from observers is that the framework appears illogical. His counter-argument posits that corporate buyers demand predictable cost structures, that most current agents act on behalf of a named individual, and that Okta is intentionally pricing for market share rather than immediate rent extraction. That rationale is coherent and potentially sound, yet entirely indistinguishable from what an executive would articulate upon discovering that clients simply refuse to pay per agent.
Two corroborating facts bear mention. First, Okta integrated agent single sign-on into its core SSO tier free of charge, a move that defends an existing user seat rather than monetising a new vector. Second, the product contains an un-enforced rate cap on agent authentications—precisely how one installs a meter prior to turning the switch. The Chief Financial Officer has been transparent: artificial intelligence remains revenue-immaterial this fiscal year and merely potentially material in the next. Anyone attributing recent operational momentum to agent monetisation is anticipating accounting realities the company itself has not recognised.
What to monitor
Net retention rate. A sustained move above one hundred and ten per cent demonstrates that agent capabilities are genuinely additive. Another year of flat performance alongside accelerating agent deployment is nearly fatal to the bull case, confirming that agents arrived without Okta capturing value.
The meter. The precise moment Okta enforces consumption- or agent-based tariffs, and the corresponding renewal behaviour. Quietly extending the unenforced usage cap represents the clearest negative signal available.
The hundred-thousand-dollar customer cohort. Six per cent growth exposes the mid-market vulnerability. Platform neutrality only offers a durable moat if this metric recovers.
Next year’s formal guidance, marking the first instance management must assign concrete numbers to agent revenue rather than describing qualitative pipeline. Oktane in late September serves as the immediate benchmark; the key variable is not product launches, but whether pricing structures evolve.
Bottom line
Underwrite Okta on its identity governance foundation. Treat agentic capabilities as an unpriced call option for which little has been paid.
The near-term growth vector is visible, operational, and requires no speculative assumptions. The long-term structural question—whether any identity vendor can successfully monetise machine entities at rates comparable to human employees—remains unresolved across the entire sector.
When pressed on the scale of the agent opportunity, McKinnon noted the pipeline was larger than any in the company’s history, before immediately clarifying that pipeline does not convert directly to revenue. He further acknowledged that a return to fundamental security hygiene is driving current operational performance, while agentic identity has yet to impact financial results. Management is explicitly signalling which half of the business is generating real cash flow.
