Okta History: From SSO Specialist to Identity Security Platform

Direct answer

Direct answer: Okta was founded in 2009 by two former Salesforce engineers with the thesis that identity management needed to be cloud-native from the start. The company went public on Nasdaq in April 2017 at $17 per share, went through a hypergrowth phase acquiring Auth0 in 2021 for approximately $6.5 billion, experienced damaging security incidents in 2022 to 2023, and then shifted strategy toward GAAP profitability while expanding the platform into governance, privileged access, and AI-agent identity.

2009: The founding thesis

Okta was founded in 2009 by Todd McKinnon and Frederic Kerrest, both engineers who had worked at Salesforce during its early growth years. Their experience at Salesforce gave them a firsthand view of an emerging trend: enterprises were adopting cloud-based software services that each came with their own authentication systems, creating a fragmented and insecure identity landscape. Employees needed separate credentials for each application. IT teams had no central view of who had access to what. Provisioning a new employee or revoking access for a departing one required manual work across dozens of systems.

McKinnon and Kerrest's founding thesis was that this problem needed a cloud-native solution built from the ground up, not an adaptation of on-premises identity software. They also identified a second insight: the solution should be vendor-neutral, working across any cloud service rather than being tied to a specific platform or ecosystem. This neutrality thesis would become both Okta's primary competitive advantage and its primary competitive challenge as Microsoft, Google, and Amazon each built identity capabilities tied to their own platforms.

The company was initially incorporated in San Jose, California, and went through early venture capital funding rounds before establishing itself in San Francisco. It focused on enterprise customers from the beginning, with a direct sales model targeting IT decision-makers at mid-sized and large organizations.

2010 to 2016: Enterprise cloud identity comes of age

In the years between its founding and its IPO, Okta built the foundational infrastructure that would define its business model. The company focused on three core products: single sign-on (giving employees one set of credentials to access all their cloud applications), multi-factor authentication (adding a second verification step beyond passwords), and lifecycle management (automating the provisioning and de-provisioning of accounts).

The market dynamics during this period were strongly favorable for Okta. Enterprise SaaS adoption was accelerating. The number of cloud applications used by a typical enterprise grew from a handful to dozens and eventually hundreds. The credential-sprawl problem that McKinnon and Kerrest had identified at Salesforce became a universal enterprise IT challenge. Okta's pre-built application integrations grew year after year as it connected to an ever-wider range of SaaS applications, creating the integration library that would become a core competitive asset.

Simultaneously, the security landscape was shifting. Major data breaches in this period, including the Target breach (2013), the Sony Pictures breach (2014), and the Yahoo breach (2016), drew boardroom-level attention to cybersecurity. A recurring theme in these incidents was compromised credentials as an initial access vector. This elevated multi-factor authentication from a best practice to a requirement and accelerated enterprise demand for Okta's core products.

By the time of its IPO preparation, Okta had built a growing customer base, primarily in technology, financial services, healthcare, and retail, and had established a net revenue retention profile above 100%, indicating that existing customers were expanding their use of Okta products over time.

2017: Nasdaq IPO

Okta went public on the Nasdaq stock exchange in April 2017, listing under the ticker symbol OKTA at an IPO price of $17 per share. The IPO raised approximately $187 million in gross proceeds, which the company planned to use for continued product development, sales and marketing expansion, and general corporate purposes.

At the time of the IPO, Okta had approximately 1,700 customers, was generating annual recurring revenue approaching $200 million, and was growing revenue at roughly 60% year over year. The company was not yet profitable on a GAAP basis, which was typical for high-growth SaaS companies of the era. Investors were willing to value such companies on a multiple of forward revenue rather than earnings because the subscription model created predictable future cash flows once the customer base was established.

The IPO was an inflection point that gave Okta the capital and public profile to accelerate growth, hire aggressively, and invest in enterprise sales infrastructure. The Nasdaq listing also raised Okta's visibility among enterprise technology buyers, some of whom pay closer attention to the financial stability of the vendors whose software they embed in their infrastructure.

2017 to 2021: Hypergrowth and platform expansion

The years following the IPO saw Okta grow at rates that outpaced most of its software peers. Revenue grew consistently above 40% year over year for multiple years as enterprise cloud adoption accelerated and the company expanded its integration library, sales force, and product depth. The COVID-19 pandemic of 2020 to 2021 was, counterintuitively, an accelerant for Okta: the sudden shift to remote work made secure cloud access a critical priority rather than an aspirational IT project, and Okta's platform was positioned to address exactly this need.

During this period, Okta expanded well beyond its SSO and MFA origins into adjacent identity products. The company launched advanced server access (for controlling access to server infrastructure), API access management (for securing machine-to-machine communications), and early versions of identity governance capabilities. The integration library grew to thousands of pre-built connectors, making Okta progressively harder to displace because any replacement would need to replicate years of integration work.

The stock price reflected this growth trajectory, rising substantially from its IPO price and reaching all-time highs in late 2021 as investors applied hypergrowth multiples to forward revenue estimates.

2021: The Auth0 acquisition

In May 2021, Okta completed the acquisition of Auth0 for approximately $6.5 billion in stock, the largest acquisition in the company's history. Auth0 was founded in 2013 by Matías Woloski and Eugenio Pace and had built a developer-oriented identity platform specifically designed for software developers building authentication into customer-facing applications.

The strategic rationale was to give Okta two distinct routes to the identity market. The Workforce Identity business sold top-down through enterprise IT procurement departments to secure employee access. Auth0 sold bottom-up through developer adoption, embedding in customer-facing applications built by Okta's customers and their customers. These two buyer profiles are distinct: IT buyers evaluate vendors on security posture, enterprise support, and compliance, while developers evaluate platforms on ease of integration, documentation quality, and time-to-implement.

The acquisition also expanded Okta's total addressable market substantially. The customer identity use case (securing logins for consumer or B2B applications) is large and grows with the number of applications being built worldwide. Auth0's developer community represented a different growth vector from organic enterprise sales expansion.

The challenges of the acquisition were also significant. Integrating two distinct engineering organizations, two product architectures built on different technology stacks, and two sales motions targeting different buyers is operationally complex. The $6.5 billion all-stock price added substantial dilution to Okta shareholders. Some integration complexity persisted into subsequent years, and the effort to unify the Workforce and Customer Identity platforms into a cohesive product story became an ongoing initiative that investors monitored closely.

2022 to 2023: Security incidents and their consequences

Okta experienced a series of security incidents between 2022 and 2023 that were particularly damaging given that the company's core value proposition is protecting its customers' access and credentials. For an identity provider, a security breach is reputationally different from a breach at a typical software company: customers trust Okta with their most sensitive access controls, and a breach of Okta's own systems implies potential exposure of those controls.

The 2022 incidents

In early 2022, Okta disclosed that a third-party customer support provider had been breached, potentially exposing a limited number of customer support accounts. The company's initial communication around this incident drew criticism for the timeline of disclosure and the degree of transparency, which added to investor and customer concern beyond the technical scope of the breach itself.

The October 2023 support system breach

The most significant incident occurred in October 2023, when Okta disclosed that attackers had gained access to its customer support case management system and were able to view files uploaded by customers through support cases, which sometimes included sensitive authentication tokens and credential data. The breach was attributed to activity consistent with the Lapsus$ hacking group, which had previously targeted several major technology companies through social engineering of support systems.

The practical impact on Okta's business included extended sales cycles in some enterprise accounts, customer inquiries about the scope of exposure, and competitive use of the incident by Microsoft and others in their sales narratives. A subset of Okta's largest customers disclosed in their own security advisories that their data may have been exposed through the Okta support system breach.

Management response and subsequent security posture

Following the 2023 incident, Okta management commissioned external security assessments, implemented additional controls around the support system and customer data handling, and published transparency reports about the breach's scope and remediation steps. The company hired additional security leadership and made security investment a stated priority in subsequent fiscal years.

Investors evaluating Okta's current competitive position must assess whether the operational improvements since 2023 have restored sufficient customer trust to prevent ongoing attrition from the incident's reputational impact.

2023 to present: Efficiency reset and profitability focus

The broader SaaS industry went through a significant reset in 2022 to 2023 as rising interest rates compressed the valuation multiples applied to high-growth, unprofitable software companies. Investors shifted their expectations from growth-at-any-cost to requiring evidence of a credible path to profitability. Okta responded with a multi-year efficiency initiative that reduced headcount growth, slowed operating expense expansion, and prioritized free cash flow generation over top-line growth at all costs.

The results of this efficiency focus are visible in the financial trajectory: GAAP operating margin improved from deeply negative (consistent with typical early-stage SaaS) to positive 13% as of Q2 FY2027. Free cash flow margin reached 28% to 29%, indicating strong cash generation from the subscription base. The company moved from burning cash to generating it, and management guided to continued GAAP operating income improvement over the FY2027 full year.

This phase also saw Okta deepen its platform beyond the original SSO and MFA core. Identity Governance, Privileged Access Management, and Identity Threat Protection were developed and brought to market as separate purchasable products that expand revenue per customer. These newer products represent the company's push to make Okta the comprehensive identity security platform for the enterprise rather than a best-of-breed point solution in a crowded market.

Current phase: Identity security platform with AI expansion

As of 2026, Okta operates a subscription identity security platform serving both workforce and customer identity use cases, with a growing set of adjacent security products. The company is in a mature growth phase: revenue growth is in the 11% to 12% range rather than the 40% to 60% range of the hypergrowth years, but the business is generating meaningful free cash flow and improving GAAP profitability.

The emerging strategic theme is AI agent identity: as enterprises deploy AI systems that act autonomously, those systems have identities, need credentials, and require governance. Okta has positioned itself as the provider of identity infrastructure for both human and non-human identities in the enterprise. Whether this positioning creates material new revenue in the next one to three years is uncertain, but it represents a logical extension of the platform into a new and growing use case.

Okta is a component of the S&P MidCap 400 index as of 2026, reflecting its position as a substantial but not mega-cap technology company in the current market environment.

Corporate timeline

Frequently asked questions

Related research

• Okta (OKTA) Investor Overview: business model, moat, risks, and what to watch
• Okta Investment Analysis: platform moat, Microsoft risk, and AI identity opportunity
• Okta Earnings and Financial History: Q2 FY2027 results and financial metrics
• Okta Stock History and Valuation Framework: from the 2017 IPO through the profitability transition

References

• Okta Investor Relations: official corporate history, SEC filings, and earnings releases
• SEC EDGAR: Okta S-1 Registration Statement: original IPO filing containing company history and initial business description