top of page
Business & Enterprise
Cybersecurity
Identity & Access Management
Okta
Created and led the independent identity layer by replacing fragmented on-premises directories and VPN-centric access with cloud SSO, MFA and lifecycle management, despite Microsoft’s bundling power and entrenched Active Directory dependence.
1
MODEL
BUSINESS MODEL
SaaS
- Founded in 2009 by Todd McKinnon and Frederic Kerrest to provide cloud-based identity independent of Microsoft.
- Built the Okta Integration Network to connect identity with thousands of SaaS applications, infrastructure providers and security tools.
- Landed with workforce SSO, then expanded into MFA, lifecycle management, governance, privileged access and device trust.
- Acquired Auth0 in 2021 for $6.5 billion to enter customer identity and developer-led authentication.
- Operates a subscription model, with approximately 98% of FY2025 revenue recurring.
1. Identify a foundational control point fragmented across legacy systems and cloud applications.
2. Build a neutral layer that connects rather than replaces every surrounding system.
3. Start with one high-frequency workflow, such as employee sign-on, that creates daily dependence.
4. Build an integration ecosystem so each new connection increases the platform’s value.
5. Expand into adjacent identity workflows only when they reuse the same directory, policy and integration assets.
Avoid: positioning as neutral while making the platform dependent on one operating system, cloud or productivity suite; the neutrality claim must be structurally real.
DISTRIBUTION MODEL
Okta, founded in 2009, framed Identity-as-a-Service as a new category when enterprises relied on Active Directory, VPNs and disconnected application passwords. It educated buyers around neutral cloud identity, then expanded from SSO into MFA, lifecycle management, governance, privileged access and customer identity through Auth0.
HOW THEY BUILT IT
HOW TO ARCHITECT IT
Enterprise Sales, Direct Sales, Partnerships, Product Integrations
HOW THEY OPERATIONALIZED
HOW TO REPLICATE WHAT WORKED
dm
- Enterprise sellers targeted IT and security leaders replacing fragmented access management.
- The Okta Integration Network made prebuilt connections to SaaS, infrastructure and security vendors a distribution asset.
- Technology partnerships with AWS, Google Cloud, Microsoft-adjacent tools, ServiceNow, Salesforce and others embedded Okta in customer environments.
- Auth0 added developer-led self-service distribution for customer-facing applications.
What worked: Make integrations the distribution system: every prebuilt connection reduces implementation risk and makes the platform more likely to be selected in heterogeneous environments.
Trap if copied blindly: Integration-led distribution fails when integrations are shallow or unsupported; the cost is implementation friction, security exceptions and weak enterprise trust.
| PATTERNS OF THIS MODEL
PATTERNS IN NEUTRAL IDENTITY PLATFORMS:
1. Integrations compound platform value. Each connected application increases switching costs and makes the identity layer more useful.
2. Neutrality expands the addressable market. A vendor independent from Microsoft, Google or AWS can serve mixed environments.
3. Identity becomes the policy control point. Once the platform manages sign-on and lifecycle events, it can extend into governance, privileged access and device trust.
THE WEAKNESS: The neutral platform can be squeezed by hyperscalers and productivity-suite vendors that bundle adequate identity at low incremental cost.
What companies with this model reveal
| OPPORTUNITY INTELLIGENCE
GOLDMINE 1 — IDENTITY GOVERNANCE FOR AI AGENTS. Enterprises need to issue, scope, monitor and revoke access for autonomous agents, service accounts and machine workflows; this is a materially larger problem than human SSO.
GOLDMINE 2 — IDENTITY SECURITY POSTURE MANAGEMENT. Customers need continuous detection of orphaned accounts, excessive privileges, risky authentication paths and misconfigured integrations; identity inventory alone is insufficient.
GOLDMINE 3 — B2B IDENTITY AS A REVENUE PRODUCT. SaaS companies need secure partner, supplier and customer access; external identity can become a monetizable product rather than an IT cost.
THE PIT — SUITE COMPLEXITY. Expanding from SSO into governance, PAM, device trust and customer identity can make deployment heavy and dilute the original simplicity.
THE SECOND PIT — SECURITY-INCIDENT CONCENTRATION. Because Okta sits at the access layer, a breach or outage affects many downstream systems simultaneously.
MOVE WITH CAUTION: Do not claim neutral identity while allowing a major cloud or productivity vendor to control critical authentication flows; customers will eventually question independence and pricing power.
Untapped Business Model / Gaps / Goldmines / Pits
Patterns & Insights
2
MARKET
mkt mt es
Okta named and popularized Identity-as-a-Service when identity was largely on-premises and tied to Active Directory. It educated the market around cloud SSO, MFA and lifecycle management, creating a buying category distinct from VPNs, password vaults and directory servers.
MARKET TYPE
Emerging Market
ENTRY STRATEGY
Greenfield Entry
WHY THEY WON
When Okta launched, cloud identity was an emerging category inside a mature directory and security market. Enterprises had urgent access problems but no standard cloud-neutral identity layer. Okta exploited this by making SSO the visible entry point while quietly building the integration network and lifecycle capabilities that made identity strategic. The transferable lesson is that category creation succeeds when the vendor defines both the problem and the integration standard before incumbents reframe their existing products.
EXECUTION
Okta created a cloud-native identity service rather than acquiring an incumbent or replacing a single legacy product. Its critical bet was that enterprises would adopt a neutral identity layer as they moved applications to SaaS. This was viable because cloud adoption made Active Directory and VPN-centric access increasingly awkward, while SSO delivered immediate user and IT value. The prerequisites were broad integrations, reliability and a credible security posture; the approach fails where a customer is fully standardized on one vendor’s identity stack or will not externalize authentication.
FOOTHOLD STRATEGY
Wedge Strategy
Okta’s first wedge was workforce single sign-on for cloud applications. IT teams were reachable through SaaS adoption pain, could pay from existing identity and security budgets, and experienced immediate value through fewer passwords and centralized deprovisioning. Once embedded, Okta expanded into MFA, lifecycle management, governance, privileged access and customer identity.
GROWTH CAMPAIGN
CAMPAIGNS THAT WORKED
SO WHAT: The Okta Integration Network converted integrations from a product feature into a market-making asset, making Okta the default neutral identity layer across heterogeneous SaaS environments.
KEY LEARNING: In platform categories, the ecosystem can become more strategically important than any individual feature.
HOW TO USE: If your product sits between systems, invest early in the integrations that reduce customer risk and make your platform the natural connection point.
KEY LEARNING
THE STANDARD: In an emerging market, the winner defines the problem, establishes the integration standard and converts early adoption into platform dependence.
RULE 1 — NAME THE JOB TO BE DONE: Customers need language for a problem they experience but have not yet categorized.
RULE 2 — BUILD THE CONNECTIVE TISSUE: The platform must integrate with the systems customers already use before asking them to centralize control.
RULE 3 — CONVERT UTILITY INTO POLICY: Start with a visible workflow, then expand into governance and risk controls.
RULE 4 — KNOW WHEN CATEGORY CREATION FAILS: If incumbents can bundle the capability and customers see no need for neutrality, the new category becomes a feature.
MARKET TYPE: Emerging Market (category).
gc
Market Context
| MARKET INTELLIGENCE
PATTERNS IN ECOSYSTEM-LED PLATFORM GROWTH:
1. Integrations create inbound relevance. Customers discover the platform while connecting the systems they already use.
2. Partners reinforce the neutral positioning. Technology alliances make the platform credible across competing ecosystems.
3. The first workflow creates policy rights. Once a vendor manages sign-on, it can reasonably manage lifecycle and access risk.
4. THE WEAKNESS: Ecosystem-led platforms can become dependent on partners whose strategic interests change, especially when those partners build competing identity capabilities.
| MARKET ENTRY PLAYBOOK
THE STANDARD: Greenfield entry is appropriate when the customer’s current approach is fragmented and cloud adoption creates a new integration requirement.
RULE 1 — SOLVE THE FIRST VISIBLE PAIN: Choose a workflow that delivers immediate value without requiring full platform adoption.
RULE 2 — BUILD TRUST BEFORE CONTROL: Security and reliability must be proven before customers centralize access.
RULE 3 — MAKE THE PLATFORM CONNECTIVE: Prioritize integrations and interoperability over closed-suite breadth.
RULE 4 — REJECT WHEN THE INCUMBENT IS EMBEDDED: If the customer’s operating system, productivity suite and directory are already integrated, neutrality must offer decisive value.
How to enter
| FOOTHOLD STRATEGY PLAYBOOK
THE STANDARD: A wedge strategy starts with one high-frequency workflow and expands as the same platform becomes the control point for related risks.
RULE 1 — PICK A WORKFLOW WITH A CLEAR OWNER: SSO had an IT owner and an immediate operational benefit.
RULE 2 — DESIGN FOR LATERAL EXPANSION: Ensure the first deployment creates identity data, integrations and policy context.
RULE 3 — EXPAND ALONG RISK, NOT FEATURES: Move from access convenience to lifecycle, governance and privileged access as trust grows.
RULE 4 — AVOID PREMATURE SUITE BREADTH: If each new module requires a separate implementation, the platform loses its original simplicity.
How to get the first strong position
MARKET PATTERNS & PLAYBOOK
3
MONEY
money rev pri
Okta landed customers with workforce SSO and expanded into MFA, lifecycle management, governance, privileged access and customer identity. FY2025 revenue reached $2.61 billion, up 15%, with subscription revenue of $2.58 billion; the company served more than 18,000 customers and nearly 1 billion unique monthly users.
REVENUE MODEL
Subscription
PRICING MODEL
Tiered Pricing, Custom Enterprise Pricing, Usage-Based Pricing
WHY THEY WON
Okta earns recurring subscription revenue from Workforce Identity and Customer Identity Cloud. Workforce Identity expands by users, modules and governance needs; Customer Identity expands by monthly active users, authentication volume and enterprise features. High integration depth supports retention but raises implementation and security-operating costs.
Okta prices Workforce Identity per user with tiered modules, while Auth0-based Customer Identity uses monthly active users and product tiers. Enterprise pricing is quote-based because governance, privileged access, support and scale vary; the strategic consequence is that SSO becomes the entry point for broader identity spend.
TARGET AUDIENCE
Mid-market and enterprise IT teams (Workforce Identity; want SSO, MFA and lifecycle automation); Security and compliance teams (Governance/PAM; want least-privilege access and auditability); SaaS and consumer app companies (Customer Identity; want embeddable authentication); Public sector and regulated organizations (Enterprise; want compliance-ready identity).
CUSTOMER BUYING BEHAVIOUR
A SaaS rollout, security audit, M&A, remote-work shift or identity incident triggers evaluation. IT and security teams assess integrations, deployment effort and compliance, then security leadership and procurement approve a multi-year subscription; expansion follows new applications, user types and governance needs.
| PRICING INTELLIGENCE
What makes this model effective & make customers pay
Customers are not buying login software; they are buying centralized control over who can access what.
RULE 1 — PRICE THE CONTROL POINT: Users and monthly active users are durable meters because both grow with digital adoption.
RULE 2 — SELL THE COST OF FRAGMENTATION: The comparison is password resets, manual deprovisioning, audit failures and breach exposure.
RULE 3 — EXPAND ALONG RISK MATURITY: SSO creates adoption; MFA, governance and privileged access capture higher-value security budgets.
RULE 4 — WATCH THE BUNDLING TRAP: If Microsoft or Google provides adequate identity within an existing agreement, the neutral platform must prove cross-ecosystem and governance value.
The buyer is purchasing access control and reduced identity risk, proven by managed users, connected applications and enforced policies.
PRICE & REVENUE
| Revenue Risk - The biggest threat to revenue stability
Microsoft bundling: Entra ID, Intune and M365 can make standalone identity appear redundant for Microsoft-centric customers.
Security-incident concentration: Because Okta is the access layer, breaches or outages can affect many customer systems and damage trust broadly.
Platform complexity: Governance, PAM, device trust and CIAM can make implementation heavier than the original SSO wedge.
Auth0 integration risk: Combining seat-based workforce identity with MAU-based customer identity creates different sales motions and pricing expectations.
Price pressure: Identity is increasingly treated as infrastructure, inviting procurement-driven discounting.
Competitive convergence: Ping Identity, CyberArk, Microsoft, Google and Cloudflare all overlap with parts of Okta’s roadmap.
Okta reported FY2025 revenue of $2.61 billion and subscription revenue of $2.58 billion; its public-market valuation and current ARR are disclosed through investor reporting.
Where the model can break
4
MOTION
motion ge cs
Okta sells multi-year, security-sensitive identity platforms through IT, security, compliance and procurement stakeholders. Its enterprise motion supports SSO adoption, module expansion, governance deployments and Auth0-led customer-identity programs.
GROWTH EXPANSION MODEL
Land & Expand, Platform Expansion
HOW THEY EXPAND
Okta landed with workforce SSO, expanded within accounts through MFA, lifecycle management, governance and privileged access, then acquired Auth0 to enter customer identity. The Okta Integration Network and security partnerships extended the platform from employee access to customers, partners, devices and applications.
COMPETITIVE STRATEGY
Differentiation
HOW THEY COMPETE
Against Microsoft, Okta differentiated through cross-platform neutrality and integration breadth. Against Ping Identity and CyberArk, it encircled identity with workforce, customer, governance and privileged-access capabilities, making Okta the broader identity control plane.
GROWTH ENGINE
GTM
Content Flywheel
A customer adopts SSO for cloud applications → Okta becomes the identity and access control point → each new application integration increases value → lifecycle, MFA and governance modules expand the account → Auth0 extends identity to external users. The loop compounds when integration breadth and policy depth make Okta the default connection layer.
Okta runs an enterprise-led GTM supported by ecosystem partnerships and developer-led customer identity. Direct sales targets IT and security buyers; the Integration Network and technology alliances create implementation relevance; Auth0 brings developer self-service and product-led adoption. The primary motion is enterprise sales, with product-led growth supporting Customer Identity. The transferable implication is that platform companies need one dominant sales motion and complementary motions for different buyer types.
SUSTAINING MOATS
High Customer Lock-In
moat
The moat is the Okta Integration Network and embedded identity dependence. Once thousands of applications, policies, user lifecycles and authentication flows run through Okta, replacement requires reintegration across the customer’s entire software environment.
| MOAT INTELLIGENCE
THE STANDARD: Platform moats last when the vendor becomes the connective layer between critical systems.
RULE 1 — INTEGRATION BREADTH CREATES GRAVITY: Each connected application increases the cost and risk of migration.
RULE 2 — LIFECYCLE CONTROL DEEPENS LOCK-IN: Automated provisioning, deprovisioning and governance make Okta operationally embedded.
RULE 3 — NEUTRALITY EXPANDS THE DEFENSIBLE POSITION: Serving mixed Microsoft, Google, AWS and SaaS environments makes Okta harder to replace with one vendor’s native tool.
THE SIGNAL: More than 18,000 customers, nearly 1 billion monthly users and 98% subscription revenue indicate broad platform dependence; the moat does not protect against a major security failure, aggressive bundling or superior AI-agent identity capabilities.
Why this company remains defensible
ARR & TAKEAWAY
ARR Journey - what to do at each stage
PRE-$1M ARR — PROVE CLOUD IDENTITY. After its 2009 founding, Okta had to convince enterprises that a neutral cloud identity layer could secure access better than on-premises tools.
$1–5M ARR — WIN EARLY SSO DEPLOYMENTS. The company needed reference customers and reliable integrations with major SaaS applications.
$5–10M ARR — SYSTEMATIZE ENTERPRISE SALES. SSO had to become a repeatable entry point for MFA and lifecycle management.
$10–50M ARR — BUILD THE INTEGRATION NETWORK. Okta scaled partnerships and made ecosystem breadth a core differentiator.
$50–100M ARR — EXPAND BEYOND SSO. Governance, advanced MFA and security use cases increased account value.
$100M+ ARR — OWN WORKFORCE AND CUSTOMER IDENTITY. Okta acquired Auth0 in 2021 for $6.5 billion, reached $2.61 billion revenue in FY2025, and served more than 18,000 customers.
Rule: Win a visible workflow, build the connective ecosystem, then expand into the risks that workflow exposes.
COPY PLAYBOOK : What Worked → What Failed → What to Replicate → What to Avoid
THE STANDARD: Create a neutral control layer for a fragmented foundational workflow, then convert early utility into ecosystem dependence.
SEQUENCE:
1. First, solve one high-frequency workflow that creates immediate operational value; prerequisite: the workflow is fragmented and has a clear owner.
2. Next, build integrations with the systems customers already trust; gate: each integration reduces deployment risk or increases platform utility.
3. Then, expand into governance and risk controls only after the core workflow is embedded; gate: the expansion reuses the same identity and policy data.
WORKED: Okta’s Integration Network and SSO wedge enabled expansion into MFA, lifecycle, governance and customer identity.
CAUTION: Do not claim neutrality while relying on a single ecosystem for distribution or authentication. Also avoid expanding into high-risk identity controls before reliability, security posture and implementation capacity are proven.
bottom of page