Arena: Market Conditions Before Okta
IT departments at companies moving to hosted business applications · 2010 · United States
Changing technical requirementsHigh setup and upkeep costsBarriers to participation
A company moving work onto hosted applications such as Salesforce and Google Apps found that the systems giving employees automatic access to email, files and printers on the office network did not reach those services OK21 OK24. A large firm could run more than ten thousand seats of one hosted application, each needing its own account and password, and its own removal when someone left OK45. On-premises identity suites could link the systems, but their meta-directories broke whenever an application vendor upgraded and needed paid consulting to repair. Firms under about 2,000 employees could not justify the cost, so many went without OK21 OK1.
How each step happened
Step 1 of 5 · 2009–11
Hosted sign-on, funded far ahead of the category
Okta began in 2009 as a plan to monitor whether hosted applications stayed up. Its founders, Todd McKinnon and Frederic Kerrest, both from Salesforce, interviewed about 100 CIOs and IT administrators and heard a different problem: employees could not log into the new cloud services OK2 OK45 OK24. The first product let employees reach Salesforce, Box, Workday and Google Apps with their Windows passwords by copying one central directory into each application OK24 OK22.
Okta ran it as a hosted service and carried the upkeep that broke on-premises meta-directories on every vendor upgrade OK21. With no catalog at first, it built connectors to each prospect's own list of applications, and each one was then ready for the next customer OK53.
Money set Okta apart from the start. A $10 million first round and a $16.5 million second round in August 2011 brought its total to $28 million OKX-9 OK22. That capital paid for the connector work and, next, for the sales force large companies required.
Rivals OneLogin built the same product at the same moment, starting from Zendesk customers who were tired of managing yet another set of passwords OKX-9. By June 2011 it listed more than 1,700 integrated applications, against about 1,200 for Okta that December, but it had raised a $150,000 seed round and a $1.5 million first round OKX-12 OK23 OKX-9.
Customer DiscoveryManaged Service
Step 2 of 5 · 2012–17
Go upmarket with a large enterprise sales force
Okta first copied Salesforce's approach of selling to small companies, and in 2010 its typical customer had fewer than 2,000 employees OK24 OK21. McKinnon later called that a mistake: the more users a company has, the bigger its identity problem OK24. Okta built a large, aggressive enterprise sales force to get into larger accounts, while competitors offered more features OK3.
By November 2013 Okta had more than 500 enterprise customers running an average of 21 applications each OKX-5. A $75 million round led by Sequoia in 2014 brought total funding to $155 million OKX-6. In 2015 Okta had more than 2,000 customers and was the only Leader in Gartner's ranking of cloud identity services OKX-19. Because these buyers reviewed a supplier's security before signing, the sales teams came to include a security team OK38.
Rivals OneLogin chose small and mid-sized businesses on purpose in 2011 OKX-12. By December 2014 it had 1,000 customers on about $45 million raised, against Okta's $155 million; it went through three marketing chiefs and four sales leaders in three years and ended 2017 with 2,000 paying customers OKX-11 OKX-14.
Top-Down Selling
Step 3 of 5 · 2012–21
Sell security and uptime, not features or price
This choice ran alongside the sales build-out; it was what the sales force sold. McKinnon says Okta competed on being the most secure option that never went down, not on feature count OK3. For a sign-on service an outage locks every employee out of every application, and a breach exposes all of them. Large buyers tested it; Flex put Okta through a 150-question security assessment OK41.
The record held while Okta grew: it had no major breach until January 2022, by which time it had more than 10,000 customers OK43 OK29. A 2021 outside analysis rated Okta well ahead of OneLogin on ease of use and features, which it traced to Okta's larger research spending OKX-18. The funding from step 1 paid for that depth, and the clean record gave large accounts a reason to widen their use.
Rivals OneLogin was breached in August 2016 and again on May 31, 2017, when an attacker with stolen cloud-hosting keys may have gained the ability to decrypt customer data OKX-21 OKX-13. Its revenue fell sharply the next quarter, and in 2018 Gartner saw it competing mainly on price against Okta and Microsoft, with list prices of $2 to $8 per user per month OKX-14 OKX-17.
Trust
Step 4 of 5 · 2016–21
Land and expand inside large accounts
Inside a large company Okta usually started with one group of users and then spread. The US State Department first bought it to sign in more than 100,000 outside industry partners and in 2018 extended it to its whole workforce OK39. Flex began with a portal for its suppliers, then connected about 200,000 employees OK41. The first deployment proved the system inside the buyer's own walls, and expansion reused the same directory and connectors OK38.
Dollar-based net retention compares what last year's customers pay now with what they paid a year earlier. It was 120% in fiscal 2016 and still 119% in fiscal 2020 OK1 OK40. Customers paying more than $100,000 a year grew from 1,450 to 1,950 in fiscal 2021 OK40 OK29.
A second market, then a purchase
Expansion also opened customer identity: a pharmaceutical customer asked to use Okta to log in its own customers, and by about 2020 such uses were near a quarter of revenue OK24 OK3. Okta reached those buyers through IT, not through the developers who pick a login service while building an app, so in 2021 it bought Auth0, a developer-first rival, for about $6.5 billion in stock OK18 OK20. Auth0 added $140 million of Okta's $1.30 billion fiscal 2022 revenue OK19. Merging the two sales forces too quickly then slowed growth, a choice Okta reversed in fiscal 2026 OK55 OK8 OK11.
Rivals After its 2017 breach OneLogin kept its customers, but they stopped expanding and its sales pipeline dried up, chief executive Brad Brooks said OKX-15. In January 2019 it had more than 70 customers paying above $100,000 a year, against Okta's 1,450 a year later OKX-15 OK40.
Land and ExpandM&A Strategy
Step 5 of 5 · 2016–26
Integration network vendors build to, locked by switching costs
Vendors build to the network
Okta's catalog of prebuilt connections, the Okta Integration Network, grew from 3,000 applications in 2013 to more than 5,000 at the IPO and 8,000 by 2026 OKX-5 OK1 OKX-24. Okta's prospectus described the loop: more customers bring more software vendors who build on its platform OK1. By 2020 vendors submitted and certified their own integrations through a self-service portal OKX-23 OK49. McKinnon says some large buyers tell vendors to certify an Okta integration before they can sell OK4. Okta's 2026 pitch to vendors is its base of more than 17,000 customers, including two thirds of the Fortune 100 OKX-24. The enterprise accounts won in steps 2 and 4 are what make vendors do the work.
The network is worth most because Okta sells no applications of its own. Microsoft bundled a rival sign-on service into a suite from 2014 OK26, and Kerrest argued it could not be neutral because its first business is Office 365 OK44. In 2022 a third of Okta's Microsoft 365 customers also ran four or more applications that compete with Microsoft's, such as Zoom, Slack or Google Workspace OK27.
Switching costs hold the base
The same connections make Okta hard to leave. Customers ran 89 applications each through Okta in 2022, and 101 by 2025 OK27 OK28. Leaving means moving every connected application's sign-on together and rebuilding provisioning and access policies OK14 OK16. That held when Okta's own record broke, with breaches in 2022 and 2023 OK43 OK32. Gross retention, the revenue kept from existing customers before any expansion, stayed in the mid-90s through fiscal 2026 OK31 OKX-8. Expansion slowed instead: net retention fell from about 120% in fiscal 2022 to 106%, and revenue growth from 56% to 12% OK14. Resellers quote migrations of under 60 days, so the cost slows exit rather than preventing it OK17.
Rivals OneLogin listed more applications in 2011, but by 2026 its product page claims only thousands and describes no program for vendors to submit their own OKX-12 OKX-27. Its customers were sticky too, with churn under 5% after the 2017 breach, but its base stopped at about 5,500 customers and was sold to One Identity in 2021 OKX-9 OKX-26 OKX-7. Microsoft Entra, included in Microsoft 365 E3 and E5 licences, is now the main alternative OK14.
Platform network effectsSwitching costsCounter-positioning