Okta Review — Identity Security for People and AI Agents

As cloud services multiply, the starting point for security moves from the network perimeter to identity. Employees access dozens of SaaS products, customers move between websites and apps, and servers and automation bots use far more tokens than people do. AI agents now read documents, request payments, and deploy code on a user's behalf. Verifying who logged in is no longer enough. An organization must continually decide which principal may perform which action in a particular context.

This Okta company review asks whether the company's position as an independent identity provider can expand from people and customers to non-human identities. Workforce Identity and Auth0 provide two credible foundations, the AI agent authorization opportunity is real, and fiscal 2026 marked a meaningful profitability transition. The competition from platform vendors such as Microsoft, the trust cost left by past security incidents, and the complexity of integrating products still demand a clear-eyed assessment.

This is not investment advice. It evaluates technology, the business model, leadership, financial performance, and risk using official product documentation, earnings releases, and SEC filings. Fiscal years and dollar figures follow the company's reporting.

<Example image of a security operation reviewing human and machine identities together 1.1>

The two worlds joined by Okta Identity Security

Okta's first pillar is Workforce Identity for employees and partners. Single Sign-On consolidates access to many applications into one authentication flow, while Adaptive Multi-Factor Authentication can demand stronger proof based on device, location, behavior, and other signals. Universal Directory organizes users and groups. Lifecycle Management creates and removes accounts as people join, change roles, or leave. When Identity Governance and Privileged Access are added, the system manages not merely login but access requests, approvals, periodic certification, and access to high-risk servers.

The second pillar is Auth0, acquired in 2021. Auth0 is strong in Customer Identity, where developers add authentication and authorization to consumer and partner applications. The core Okta business began with enterprise IT buyers and workforce accounts; Auth0 began with APIs, SDKs, and developer experience. Forcing the two product families into one system too quickly could disrupt migration and development. Sharing policy, threat signals, and administration, however, could create an independent platform spanning workforce and customer identity.

Layer	Representative capabilities	Customer value	Expansion challenge
Workforce	SSO, MFA, directory, lifecycle	Simpler login and account provisioning	Differentiate from Microsoft bundles
Governance	Access requests, certifications, privileged access	Least privilege and audit evidence	Normalize complex entitlements
Customer	Auth0 authentication, API authorization, SDKs	Add login to products quickly	Unify Auth0 and Okta experiences
AI and non-human	Service accounts, tokens, agent authorization	Put non-human principals under policy	Establish standards, pricing, and responsibility

An identity platform becomes more useful as the number of integrations grows. Combining application connectors, device state, risk signals, and user attributes in one policy engine reduces the cost of writing separate rules in every SaaS product. This connects with the Zero Trust argument in our Cloudflare company review. The distinction is that Okta does not carry the traffic as a network provider; it concentrates on authorization decisions and identity lifecycle.

The new authorization problem targeted by Auth0 for AI Agents

An AI agent resembles a traditional service account but creates a wider risk. A fixed script calls predetermined APIs; an agent interprets a goal, chooses tools, and constructs a sequence of actions. When a user says, “Organize this month's supplier invoices,” an agent may move across email, document storage, an ERP system, and payments. Copying the user's full access is excessive. Giving the agent an unrelated administrator account breaks accountability.

Auth0's 2026 product update describes MCP and autonomous agents as first-class identities with token storage, granular controls, and auditing. Delegation is the key idea. An agent is neither identical to its user nor a completely independent service. It should be recorded as a principal receiving a limited portion of a person's or business process's authority for a bounded purpose and time.

<Example image of reviewing delegation and approval paths for AI agents 2.1>

A defensible agent authorization system needs five stages:

1. Issue distinct identities to people, workloads, and agents.
2. Replace long-lived secrets with short-lived tokens constrained by purpose, audience, and scope.
3. Require human approval or a strong policy check immediately before a high-risk action.
4. Record the agent's plan, tool calls, and actual outcome in one audit trail.
5. Revoke related sessions and delegations when behavior becomes abnormal or the sponsoring user leaves.

Okta's AI agent governance explanation similarly centers identity, authorization, monitoring, and policy controls. A product does not assume responsibility for the outcome, however. Prompt injection may cause an agent to choose an unintended tool, or the agent may approve the wrong amount while remaining inside its formal permissions. Identity controls must therefore work with model evaluation, data-loss prevention, and execution sandboxes. If the agent can change and deploy code, the organization also needs a structure like the GitLab DevSecOps platform that traces code changes and approvals.

Reading Okta's transition through people and numbers

Todd McKinnon and Frederic Kerrest co-founded Okta in 2009. McKinnon had led engineering at Salesforce and concluded that as enterprise software moved to the cloud, login and account management would become an independent layer. He remains co-founder and CEO, providing continuity in product direction. The operating challenge has nevertheless grown since the Auth0 acquisition: Okta must integrate two product structures and customer groups while improving the efficiency of enterprise sales.

According to the fiscal 2026 earnings release, annual revenue rose 12% to $2.919 billion, including $2.855 billion of subscription revenue. GAAP operating income was $149 million, reversing a $74 million operating loss in fiscal 2025, and GAAP net income was $235 million. Operating cash flow of $884 million and free cash flow of $863 million show that although growth is slower than in Okta's earlier years, the business is generating much more cash.

Metric	Latest official figure	What it indicates
FY2026 revenue	$2.919 billion	12% year-over-year growth
FY2026 subscription revenue	$2.855 billion	Recurring subscriptions are nearly the whole business
FY2026 GAAP operating income	$149 million	A swing from the prior year's loss
FY2026 free cash flow	$863 million	Roughly 30% of revenue
Q4 FY2026 RPO	$4.827 billion	Contracted revenue to be recognized later

The more recent first-quarter fiscal 2027 release reported 11% growth in both revenue and subscription revenue and $56 million of GAAP operating income. Profitability is improving, but growth is not explosive. The next test is whether AI-agent security produces real new contracts and cross-selling, and whether existing Workforce and Customer Identity users adopt governance and privileged access.

Independence, trust cost, and the final assessment

Okta's largest opportunity is neutrality. Enterprises commonly use Microsoft 365, AWS, Google Cloud, Salesforce, and custom applications at the same time. A policy layer not controlled by one cloud provider is attractive during mergers, multi-cloud deployments, and partner access. The value of the identity graph and integration ecosystem also rises as APIs, workloads, and AI agents join human users.

The risks are equally concrete. Microsoft Entra is sold with enterprise collaboration and endpoint contracts. CyberArk, Ping Identity, SailPoint, and cloud providers compete in privileged access, governance, and customer identity. An identity provider is also an exceptionally valuable target. Okta's fiscal 2026 Form 10-K identifies security incidents, outages, privacy regulation, Auth0 integration, long enterprise sales cycles, and competition as material risks. Because of earlier breaches involving support systems, Okta must keep proving internal separation of privilege and transparent customer notification, not only product functionality.

Deploying SSO does not complete Zero Trust. Emergency administrator accounts, session theft, stale service accounts, and incorrect group rules can turn centralization into a single point of failure. Organizations still need staged rollout, an independent recovery path, external log retention, and recurring access reviews.

The final assessment is conditionally positive. Okta has a logical base for extending from people to AI agents through Workforce Identity, Auth0, governance, and privileged access. Fiscal 2026 GAAP profitability and strong cash flow show that its shift from growth at any cost toward efficiency is producing results. Connecting identity events to AI observability can also show the operational impact of risky sessions and privilege changes, not merely login success.

Long-term success will depend on three proofs rather than the slogan “every identity”: whether the Auth0 and Okta experiences become genuinely coherent, whether agent delegation takes root in standards and customer operations, and whether an identity provider entrusted with the most important control plane can repeatedly preserve trust. Okta is a strong candidate for organizations requiring multi-cloud neutrality and fine-grained policy. A Microsoft-centered environment or a company with only basic SSO needs should still compare bundle economics and operating complexity directly.