Form 8-K - Current report

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

___________________________________

FORM 8-K

___________________________________

CURRENT REPORT

Pursuant to Section 13 or 15(d)

of the Securities Exchange Act of 1934

Date of Report (date of earliest event reported)

November 29, 2023

___________________________________

Okta, Inc.

(Exact name of registrant as specified in its charter)

___________________________________


Delaware	001-38044	26-4175727
(State or other jurisdiction of incorporation or organization)	(Commission File Number)	(I.R.S. Employer Identification Number)

100 First Street, Suite 600

San Francisco, California 94105

(Address of principal executive offices)

(888) 722-7871

(Registrant's telephone number, including area code)

___________________________________

(Former name or former address, if changed since last report)

Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions:


☐			Written communications pursuant to Rule 425 under the Securities Act (17 CFR 230.425)
☐			Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12)
☐			Pre-commencement communications pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b))
☐			Pre-commencement communications pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c))

Securities registered pursuant to Section 12(b) of the Act:

Title of each class

Trading Symbol(s)

Name of each exchange on which registered

Class A common stock, par value $0.0001 per share

OKTA

The Nasdaq Stock Market LLC

Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§240.12b-2 of this chapter).

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Item 2.02 - Results of Operations and Financial Condition

On November 29, 2023, Okta, Inc. (the "Company") issued a press release announcing its financial results for the fiscal quarter ended October 31, 2023.

A copy of the press release is attached as Exhibit 99.1.

Item 7.01 - Regulation FD Disclosures

On November 29, 2023, the Company issued a post to its Security Blog website at sec.okta.com (the “Blog Post”) disclosing additional details relating to a security incident that was previously reported on its Security Blog on October 20, 2023 and November 3, 2023. The Blog Post is furnished with this report as Exhibit 99.2 and is incorporated herein by reference.

Also on November 29, 2023, the Company posted supplemental investor materials on its investor.okta.com website.

The Company uses its investor.okta.com website and okta.com/blog websites (including the Security Blog, Okta Developer Blog and Auth0 Developer Blog) as a means of disclosing material non-public information, announcing upcoming investor conferences and for complying with its disclosure obligations under Regulation FD. Accordingly, investors should monitor the Company’s investor relations and okta.com/blog websites in addition to following its press releases, SEC filings and public conference calls and webcasts.

The information furnished in the current report on Form 8-K and in the accompanying Exhibits 99.1 and 99.2 shall not be deemed “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended (the "Exchange Act"), or incorporated by reference in any filing under the Securities Act of 1933, as amended, or the Exchange Act regardless of any general incorporation language in such filings, unless expressly incorporated by specific reference in such filing.

Item 9.01 - Financial Statements and Exhibits

(d) Exhibits



Exhibit Number						Description
99.1						Press release dated November 29, 2023, issued by Okta, Inc.
9 9.2						Okta, Inc. Security Blog post dated November 29, 2023
104						Cover Page Interactive Data File—the cover page XBRL tags are embedded within the Inline XBRL document

SIGNATURE

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized on this 29th day of November 2023.




			Okta, Inc.

			By:			/s/ Brett Tighe
			Name:			Brett Tighe
			Title:			Chief Financial Officer
						(Principal Financial Officer)

Okta Announces Third Quarter Fiscal Year 2024 Financial Results

•Q3 revenue grew 21% year-over-year; subscription revenue grew 22% year-over-year

•Current remaining performance obligations (cRPO) grew 16% year-over-year to $1.83 billion

•Record operating cash flow of $156 million and record free cash flow of $150 million

SAN FRANCISCO – November 29, 2023 – Okta, Inc. (Nasdaq: OKTA), the leading independent identity partner, today announced financial results for its third quarter ended October 31, 2023.

“Our Q3 performance was highlighted by solid top-line growth, record non-GAAP operating profit, and record free cash flow,” said Todd McKinnon, Chief Executive Officer and co-founder of Okta. "We are particularly enthusiastic about the adoption of Okta Identity Governance and the general availability of Okta Privileged Access, which uniquely positions us as the only unified modern identity platform. Over 18,800 leading organizations around the world put their trust in Okta and we are thankful for their continued partnership."

Third Quarter Fiscal 2024 Financial Highlights:

•Revenue: Total revenue was $584 million, an increase of 21% year-over-year. Subscription revenue was $569 million, an increase of 22% year-over-year.

•RPO: RPO, or subscription backlog, was $3.07 billion, an increase of 8% year-over-year. cRPO, which is subscription backlog expected to be recognized over the next 12 months, was $1.83 billion, up 16% compared to the third quarter of fiscal 2023.

•GAAP Operating Loss: GAAP operating loss was $111 million, or (19)% of total revenue, compared to a GAAP operating loss of $207 million, or (43)% of total revenue, in the third quarter of fiscal 2023.

•Non-GAAP Operating Income: Non-GAAP operating income was a record $85 million, or 15% of total revenue, compared to a non-GAAP operating income of $0 million, or 0% of total revenue, in the third quarter of fiscal 2023.

•GAAP Net Loss: GAAP net loss was $81 million, compared to a GAAP net loss of $209 million in the third quarter of fiscal 2023. GAAP net loss per share was $0.49, compared to a GAAP net loss per share of $1.32 in the third quarter of fiscal 2023.

•Non-GAAP Net Income/Loss: Non-GAAP net income was $79 million, compared to a non-GAAP net loss of $0 million in the third quarter of fiscal 2023. Non-GAAP basic and diluted net income per share were $0.48 and $0.44, respectively, compared to non-GAAP basic and diluted net loss per share of $0.00 in the third quarter of fiscal 2023.

•Cash Flow: Net cash provided by operations was a record $156 million, or 27% of total revenue, compared to net cash provided by operations of $10 million, or 2% of total revenue, in the third quarter of fiscal 2023. Free cash flow was a record $150 million, or 26% of total revenue, compared to $6 million, or 1% of total revenue, in the third quarter of fiscal 2023.

•Cash, cash equivalents, and short-term investments were $2.13 billion at October 31, 2023. During the quarter, the company repurchased $150 million principal amount of the convertible senior notes due in 2026, resulting in a gain on early extinguishment of debt of $18 million.

The section titled "Non-GAAP Financial Measures" below contains a description of the non-GAAP financial measures, and reconciliations between GAAP and non-GAAP information are contained in the tables below.

Financial Outlook:

All periods factor in a stable, but still challenging macro environment, as well as the potential impact on our business related to the October 2023 security incident.

For the fourth quarter of fiscal 2024, the Company expects:

•Total revenue of $585 million to $587 million, representing a growth rate of 15% year-over-year;

•Current RPO of $1.875 billion to $1.880 billion, representing a growth rate of 11% to 12% year-over-year;

•Non-GAAP operating income of $102 million to $104 million, which yields a non-GAAP operating margin of 17% to 18%; and

•Non-GAAP diluted net income per share of $0.50 to $0.51, assuming diluted weighted-average shares outstanding of approximately 180 million and a non-GAAP tax rate of 26%.

For the full year fiscal 2024, the Company now expects:

•Total revenue of $2.243 billion to $2.245 billion, representing a growth rate of 21% year-over-year;

•Non-GAAP operating income of $283 million to $285 million, which yields a non-GAAP operating margin of 13%;

•Non-GAAP diluted net income per share of $1.47 to $1.48, assuming diluted weighted-average shares outstanding of approximately 179 million and a non-GAAP tax rate of 26%; and

•Non-GAAP free cash flow margin of 19%.

Preliminary outlook for fiscal 2025:

•Total revenue of $2.460 billion to $2.470 billion, representing a growth rate of 10% year-over-year;

•Non-GAAP operating margin of 17%; and

•Non-GAAP free cash flow margin of at least 19%.

These statements are forward-looking and actual results may differ materially. Refer to the Forward-Looking Statements safe harbor below for information on the factors that could cause our actual results to differ materially from these forward-looking statements.

Okta has not reconciled its forward-looking non-GAAP financial measures to their most directly comparable GAAP measures because certain items are out of Okta’s control or cannot be reasonably predicted. Accordingly, reconciliations for forward-looking non-GAAP financial measures are not available without unreasonable effort.

Webcast Information:

Okta will host a live video webcast at 2:00 p.m. Pacific Time on November 29, 2023 to discuss the results and outlook. The prepared remarks and the news release with the financial results will be accessible from the Company’s website at investor.okta.com prior to the webcast. The live video webcast will be accessible from the Okta investor relations website at investor.okta.com. A replay will be available on the Okta investor relations website following the completion of the event.

Supplemental Financial and Other Information:

Supplemental financial and other information can be accessed through the Company’s investor relations website at investor.okta.com. Okta uses its investor.okta.com website and okta.com/blog websites (including the Security Blog, Okta Developer Blog and Auth0 Developer Blog) as a means of disclosing material non-public information, announcing upcoming investor conferences and for complying with its disclosure obligations under Regulation FD. Accordingly, you should monitor our investor relations and okta.com/blog websites in addition to following our press releases, SEC filings and public conference calls and webcasts.

Non-GAAP Financial Measures:

This press release and the accompanying tables contain the following non-GAAP financial measures: non-GAAP gross profit, non-GAAP gross margin, non-GAAP operating income (loss), non-GAAP operating margin, non-GAAP net income (loss), non-GAAP net margin, non-GAAP net income (loss) per share, basic and diluted, non-GAAP tax rate, free cash flow and free cash flow margin. Certain of these non-GAAP financial measures exclude stock-based compensation, non-cash charitable contributions, amortization of acquired intangibles, acquisition and integration-related expenses, restructuring costs related to severance and termination benefits and lease impairments in connection with the closing of certain leased facilities, amortization of debt issuance costs and (gain) loss on early extinguishment of debt. Acquisition and integration-related expenses include transaction costs and other non-recurring incremental costs incurred through the one-year anniversary of the transaction close.

Stock-based compensation is non-cash in nature and is generally fixed at the time the stock-based instrument is granted and amortized over a period of several years. Although stock-based compensation is an important aspect of the compensation of our employees and executives, the expense for the fair value of the stock-based instruments we utilize may bear little resemblance to the actual value realized upon the vesting or future exercise of the related stock-based awards. We believe excluding stock-based compensation provides meaningful supplemental information regarding the long-term performance of our core business and facilitates comparison of our results to those of peer companies.

We also exclude non-cash charitable contributions, amortization of acquired intangibles, acquisition and integration-related expenses, restructuring costs related to severance and termination benefits and lease impairments in connection with the closing of certain leased facilities, amortization of debt issuance costs and (gain) loss on early extinguishment of debt from the applicable non-GAAP financial measures because these adjustments are considered by management to be outside of our core operating results.

In addition to these exclusions, starting in fiscal 2024, we subtract an assumed provision for income taxes to calculate non-GAAP net income. We utilize a fixed long-term projected tax rate of 26% in our computation of the non-GAAP income tax provision to provide better consistency across the reporting periods. The non-GAAP tax rate could be subject to change for a variety of reasons, including changes in tax laws and regulations, significant changes in our geographic earnings mix, or other changes to our strategy or business operations. We will periodically reevaluate the projected long-term tax rate, as necessary, for significant events, based on our ongoing analysis of relevant tax law changes, material changes in the forecasted geographic earnings mix, and any significant acquisitions.

We define free cash flow, a non-GAAP financial measure, as net cash provided by operating activities, less cash used for purchases of property and equipment, net of sales proceeds, and capitalized software. Free cash flow margin is calculated as free cash flow divided by total revenue. We use free cash flow as a measure of financial progress in our business, as it balances operating results, cash management, and capital efficiency. We believe information regarding free cash flow provides investors and others with an important perspective on the cash available to make strategic acquisitions and investments, to fund ongoing operations, and to fund other capital expenditures. Free cash flow can be volatile and is sensitive to many factors, including changes in working capital and timing of capital expenditures. Working capital at any specific point in time is subject to many variables, including seasonality, the discretionary timing of expense payments, discounts offered by vendors, vendor payment terms, and fluctuations in foreign exchange rates.

We periodically reassess the components of our non-GAAP adjustments for changes in how we evaluate our performance and changes in how we make financial and operational decisions, and consider the use of these measures by our competitors and peers to ensure the adjustments remain relevant and meaningful.

Okta believes that non-GAAP financial information, when taken collectively with GAAP financial measures, may be helpful to investors because it provides consistency and comparability with past financial performance and assists in comparisons with other companies, some of which use similar non-GAAP financial information to supplement their GAAP results. The non-GAAP financial information is presented for supplemental informational purposes only, and should not be considered a substitute for financial information presented in accordance with GAAP, and may be different from similarly-titled non-GAAP measures used by other companies.

The principal limitation of these non-GAAP financial measures is that they exclude significant expenses that are required by GAAP to be recorded in the Company’s financial statements. In addition, they are subject to inherent limitations as they reflect the exercise of judgment by the Company's management about which expenses are excluded or included in determining these non-GAAP financial measures. A reconciliation is provided below for each non-GAAP financial measure to the most directly comparable financial measure stated in accordance with GAAP.

Okta encourages investors to review the related GAAP financial measures and the reconciliation of these non-GAAP financial measures to their most directly comparable GAAP financial measures, which it includes in press releases announcing quarterly financial results, including this press release, and not to rely on any single financial measure to evaluate the Company’s business.

Forward-Looking Statements: This press release contains "forward-looking statements" within the meaning of the "safe harbor" provisions of the Private Securities Litigation Reform Act of 1995, including but not limited to, statements regarding our financial outlook, business strategy and plans, market trends and market size, opportunities and positioning. These forward-looking statements are based on current expectations, estimates, forecasts and projections. Words such as "expect," "anticipate," "should," "believe," "hope," "target," "project," "goals," "estimate," "potential," "predict," "may," "will," "might," "could," "intend," "shall" and variations of these terms and similar expressions are intended to identify these forward-looking statements, although not all forward-looking statements contain these identifying words. Forward-looking statements are subject to a number of risks and uncertainties, many of which involve factors or circumstances that are beyond our control. For example, the market for our products may develop more slowly than expected or than it has in the past; there may be significant fluctuations in our results of operations and cash flows related to our revenue recognition or otherwise; we may not achieve expected synergies and efficiencies of operations between Okta and Auth0, and we may not be able to successfully integrate the companies; global economic conditions could worsen; a prior or future network, data or cybersecurity incident that has allowed or does allow unauthorized access to our network or data or our customers’ data could damage our reputation, cause us to incur significant costs or impact the timing or our ability to land new customers or retain existing customers; we could experience interruptions or performance problems associated with our technology, including a service outage; and we may not be able to pay off our convertible senior notes when due. Further information on potential factors that could affect our financial results is included in our most recent Quarterly Report on Form 10-Q and our other filings with the Securities and Exchange Commission. The forward-looking statements included in this press release represent our views only as of the date of this press release and we assume no obligation and do not intend to update these forward-looking statements.

About Okta

Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digital transformation, thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building a world where Identity belongs to you. Learn more at okta.com.

Investor Contact:

Dave Gennarelli

investor@okta.com

Media Contact:

Kyrk Storer

press@okta.com

OKTA, INC.

CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS

(dollars in millions, shares in thousands, except per share data)

(unaudited)


	Three Months Ended October 31,				Nine Months Ended October 31,
	2023		2022		2023		2022
Revenue:
Subscription	$	569	$	466	$	1,614	$	1,299
Professional services and other	15		15		44		49
Total revenue	584		481		1,658		1,348
Cost of revenue:
Subscription(1)	126		117		376		345
Professional services and other(1)	19		21		60		62
Total cost of revenue	145		138		436		407
Gross profit	439		343		1,222		941
Operating expenses:
Research and development(1)	165		148		500		466
Sales and marketing(1)	270		290		787		807
General and administrative(1)	111		98		340		309
Restructuring and other charges	4		14		28		14
Total operating expenses	550		550		1,655		1,596
Operating loss	(111)		(207)		(433)		(655)
Interest expense	(2)		(3)		(7)		(9)
Interest income and other, net	21		5		56		12
Gain on early extinguishment of debt	18		—		91		—
Interest and other, net	37		2		140		3
Loss before provision for income taxes	(74)		(205)		(293)		(652)
Provision for income taxes	7		4		18		10
Net loss	$	(81)	$	(209)	$	(311)	$	(662)

Net loss per share, basic and diluted	$	(0.49)	$	(1.32)	$	(1.91)	$	(4.21)

Weighted-average shares used to compute net loss per share, basic and diluted	164,381		158,708		162,836		157,344

(1) Amounts include stock-based compensation expense as follows:


	Three Months Ended October 31,				Nine Months Ended October 31,
	2023		2022		2023		2022
Cost of subscription revenue	$	20	$	17	$	57	$	52
Cost of professional services and other	3		4		11		11
Research and development	70		69		212		209
Sales and marketing	40		41		119		119
General and administrative	39		41		124		122
Total stock-based compensation expense	$	172	$	172	$	523	$	513

OKTA, INC.

CONDENSED CONSOLIDATED BALANCE SHEETS

(dollars in millions)

(unaudited)


	October 31,		January 31,
	2023		2023
Assets
Current assets:
Cash and cash equivalents	$	400	$	264
Short-term investments	1,730		2,316
Accounts receivable, net of allowances	418		481
Deferred commissions	104		92
Prepaid expenses and other current assets	75		76
Total current assets	2,727		3,229
Property and equipment, net	50		59
Operating lease right-of-use assets	91		122
Deferred commissions, noncurrent	220		210
Intangible assets, net	197		241
Goodwill	5,406		5,400
Other assets	49		46
Total assets	$	8,740	$	9,307
Liabilities and stockholders' equity
Current liabilities:
Accounts payable	$	11	$	12
Accrued expenses and other current liabilities	108		112
Accrued compensation	168		99

Deferred revenue	1,256		1,242
Total current liabilities	1,543		1,465
Convertible senior notes, net, noncurrent	1,302		2,193

Operating lease liabilities, noncurrent	119		142
Deferred revenue, noncurrent	18		18
Other liabilities, noncurrent	28		23
Total liabilities	3,010		3,841


Stockholders’ equity:
Preferred stock	—		—
Class A common stock	—		—
Class B common stock	—		—
Additional paid-in capital	8,534		7,974
Accumulated other comprehensive loss	(18)		(33)
Accumulated deficit	(2,786)		(2,475)
Total stockholders’ equity	5,730		5,466
Total liabilities and stockholders' equity	$	8,740	$	9,307

OKTA, INC.

SUMMARY OF CONDENSED CONSOLIDATED STATEMENTS OF CASH FLOWS

(dollars in millions)

(unaudited)


	Nine Months Ended October 31,
	2023		2022
Cash flows from operating activities:
Net loss	$	(311)	$	(662)
Adjustments to reconcile net loss to net cash provided by operating activities:
Stock-based compensation	523		513
Depreciation, amortization and accretion	64		89
Amortization of debt issuance costs	3		4
Amortization of deferred commissions	76		61

Deferred income taxes	4		4


Lease impairment charges	25		14
Gain on early extinguishment of debt	(91)		—
Net (gain) loss on strategic investments	1		(2)
Other, net	5		2
Changes in operating assets and liabilities:
Accounts receivable	61		15
Deferred commissions	(102)		(82)
Prepaid expenses and other assets	(1)		(4)
Operating lease right-of-use assets	18		21
Accounts payable	(1)		29
Accrued compensation	70		(30)
Accrued expenses and other liabilities	9		(6)
Operating lease liabilities	(29)		(22)
Deferred revenue	14		66
Net cash provided by operating activities	338		10
Cash flows from investing activities:
Capitalized software	(10)		(8)
Purchases of property and equipment	(5)		(9)

Purchases of securities available-for-sale and other	(1,151)		(872)
Proceeds from maturities and redemption of securities available-for-sale	1,702		848
Proceeds from sales of securities available-for-sale and other	61		—
Purchases of intangible assets	(1)		(2)
Payments for business acquisitions, net of cash acquired	(22)		(4)
Net cash provided by (used in) investing activities	574		(47)
Cash flows from financing activities:


Payments for repurchases of convertible senior notes	(803)		—



Payments for warrants related to convertible senior notes	(7)		—


Proceeds from stock option exercises, net of repurchases	10		15

Proceeds from shares issued in connection with employee stock purchase plan	26		19



Net cash provided by (used in) financing activities	(774)		34
Effects of changes in foreign currency exchange rates on cash, cash equivalents and restricted cash	(1)		(11)
Net increase (decrease) in cash, cash equivalents and restricted cash	137		(14)
Cash, cash equivalents and restricted cash at beginning of period	271		273
Cash, cash equivalents and restricted cash at end of period	$	408	$	259

OKTA, INC.

Reconciliation of GAAP to Non-GAAP Data

(dollars in millions, shares in thousands, except per share data)

(unaudited)

Non-GAAP Gross Profit and Non-GAAP Gross Margin

We define non-GAAP gross profit and non-GAAP gross margin as GAAP gross profit and GAAP gross margin, adjusted for stock-based compensation expense included in cost of revenue, amortization of acquired intangibles and acquisition and integration-related expenses.


	Three Months Ended October 31,						Nine Months Ended October 31,
	2023			2022			2023			2022
Gross profit	$	439		$	343		$	1,222		$	941
Add:
Stock-based compensation expense included in cost of revenue	23			21			68			63
Amortization of acquired intangibles	11			11			35			33
Acquisition and integration-related expenses	—			—			—			1
Non-GAAP gross profit	$	473		$	375		$	1,325		$	1,038
Gross margin	75		%	71		%	74		%	70		%
Non-GAAP gross margin	81		%	78		%	80		%	77		%

Non-GAAP Operating Income (Loss) and Non-GAAP Operating Margin

We define non-GAAP operating income (loss) and non-GAAP operating margin as GAAP operating loss and GAAP operating margin, adjusted for stock-based compensation expense, non-cash charitable contributions, amortization of acquired intangibles, acquisition and integration-related expenses and restructuring costs related to severance and termination benefits and lease impairments in connection with the closing of certain leased facilities.


	Three Months Ended October 31,						Nine Months Ended October 31,
	2023			2022			2023			2022
Operating loss	$	(111)		$	(207)		$	(433)		$	(655)
Add:
Stock-based compensation expense	172			172			523			513
Non-cash charitable contributions	2			—			4			2
Amortization of acquired intangibles	18			21			59			63
Acquisition and integration-related expenses	—			—			—			7
Restructuring costs	4			14			28			14
Non-GAAP operating income (loss)	$	85		$	—		$	181		$	(56)
Operating margin	(19)		%	(43)		%	(26)		%	(49)		%
Non-GAAP operating margin	15		%	—		%	11		%	(4)		%

Non-GAAP Net Income (Loss), Non-GAAP Net Margin and Non-GAAP Net Income (Loss) Per Share, Basic and Diluted

We define non-GAAP net income (loss) and non-GAAP net margin as GAAP net loss and GAAP net margin, adjusted for stock-based compensation expense, non-cash charitable contributions, amortization of acquired intangibles, acquisition and integration-related expenses, amortization of debt issuance costs, gain on early extinguishment of debt and restructuring costs related to severance and termination benefits and lease impairments in connection with the closing of certain leased facilities. In addition, starting in fiscal 2024, we subtract an assumed provision for income taxes to calculate non-GAAP net income. We utilize a fixed long-term projected tax rate of 26% in our computation of the non-GAAP income tax provision to provide better consistency across the reporting periods.

We define non-GAAP net income (loss) per share, basic, as non-GAAP net income (loss) divided by GAAP weighted-average shares used to compute net loss per share, basic and diluted.

We define non-GAAP net income (loss) per share, diluted, as non-GAAP net income (loss) divided by GAAP weighted-average shares used to compute net loss per share, basic and diluted adjusted for the potentially dilutive effect of (i) employee equity incentive plans, excluding the impact of unrecognized stock-based compensation expense, and (ii) convertible senior notes outstanding and related warrants. In addition, non-GAAP net income (loss) per share, diluted, includes the impact of our note hedge and capped call agreements on convertible senior notes outstanding, as applicable. The note hedge and capped call agreements are intended to offset potential dilution to our Class A common stock upon any conversion or settlement of the convertible senior notes under certain circumstances. Accordingly, we did not record any adjustments for the potential impact of the convertible senior notes outstanding under the if-converted method.


	Three Months Ended October 31,						Nine Months Ended October 31,
	2023			2022			2023			2022
Net loss	$	(81)		$	(209)		$	(311)		$	(662)
Add:
Stock-based compensation expense	172			172			523			513
Non-cash charitable contributions	2			—			4			2
Amortization of acquired intangibles	18			21			59			63
Acquisition and integration-related expenses	—			—			—			7
Amortization of debt issuance costs	1			2			3			4
Gain on early extinguishment of debt	(18)			—			(91)			—
Restructuring costs	4			14			28			14
Tax adjustment	(19)			—			(42)			—
Non-GAAP net income (loss)	$	79		$	—		$	173		$	(59)

Net margin	(14)		%	(43)		%	(19)		%	(49)		%
Non-GAAP net margin	13		%	—		%	10		%	(4)		%

Weighted-average shares used to compute net loss per share, basic and diluted	164,381			158,708			162,836			157,344
Non-GAAP weighted-average effect of potentially dilutive securities	14,904			—			15,254			—
Non-GAAP weighted-average shares used to compute non-GAAP net income (loss) per share, diluted	179,285			158,708			178,090			157,344

Net loss per share, basic and diluted	$	(0.49)		$	(1.32)		$	(1.91)		$	(4.21)
Non-GAAP net income (loss) per share, basic	$	0.48		$	—		$	1.06		$	(0.38)
Non-GAAP net income (loss) per share, diluted	$	0.44		$	—		$	0.97		$	(0.38)

OKTA, INC.

Reconciliation of GAAP to Non-GAAP Financial Measures

(dollars in millions)

(unaudited)

Free Cash Flow and Free Cash Flow Margin

In fiscal 2024, we updated our definition of free cash flow to include on-premise software purchases in addition to capitalized internal-use software costs within capitalized software.



	Three Months Ended October 31,						Nine Months Ended October 31,
	2023			2022			2023			2022
Net cash provided by operating activities	$	156		$	10		$	338		$	10
Less:
Purchases of property and equipment	(3)			(2)			(5)			(9)
Capitalized software	(3)			(2)			(10)			(8)

Free cash flow	$	150		$	6		$	323		$	(7)
Net cash provided by (used in) investing activities	$	20		$	22		$	574		$	(47)
Net cash provided by (used in) financing activities	$	(133)		$	6		$	(774)		$	34
Operating cash flow margin	27		%	2		%	20		%	1		%
Free cash flow margin	26		%	1		%	19		%	(1)		%

Exhibit 99.2

Published at https://sec.okta.com/harfiles

October Customer Support Security Incident- Update and Recommended Actions

Date: November 29, 2023

In the wake of the security incident Okta disclosed in October 2023 affecting our customer support management system (also known as the Okta Help Center), Okta Security has continued to review our initial analysis shared on November 3, re-examining the actions that the threat actor performed. This included manually recreating reports the threat actor ran in the system and the files the threat actor downloaded.

Today we are sharing new information that potentially impacts the security of our customers.

We have determined that the threat actor ran and downloaded a report that contained the names and email addresses of all Okta customer support system users. All Okta Workforce Identity Cloud (WIC) and Customer Identity Solution (CIS) customers are impacted except customers in our FedRamp High and DoD IL4 environments (these environments use a separate support system NOT accessed by the threat actor). The Auth0/CIC support case management system was also not impacted by this incident.

The threat actor ran a report on September 28, 2023 at 15:06 UTC that contained the following fields for each user in Okta’s customer support system:

Created Date

Last Login

Full Name

Username

Company Name

User Type

Address

[Date of] Last Password Change or Reset

Role: Name

Role: Description

Phone

Mobile

Time Zone

SAML Federation ID

The majority of the fields in the report are blank and the report does not include user credentials or sensitive personal data. For 99.6% of users in the report, the only contact information recorded is full name and email address.

While we do not have direct knowledge or evidence that this information is being actively exploited, there is a possibility that the threat actor may use this information to target Okta customers via phishing or social engineering attacks. Okta customers sign-in to Okta’s customer support system with the same accounts they use in their own Okta org. Many users of the customer support system are Okta administrators. It is critical that these users have multi-factor authentication (MFA) enrolled to protect not only the customer support system, but also to secure access to their Okta admin console(s).

Given that names and email addresses were downloaded, we assess that there is an increased risk of phishing and social engineering attacks directed at these users. While 94% of Okta customers already require MFA for their administrators, we recommend ALL Okta customers employ MFA and consider the use of phishing resistant authenticators to further enhance their security. Please refer to product documentation to enable MFA for the admin console (Classic or OIE).

How we discovered this

Following the publication of the RCA on November 3, Okta Security reviewed our initial analysis of the actions that the threat actor performed, including manually recreating the reports that the threat actor ran within the customer support system. We identified that the file size of one particular report downloaded by the threat actor was larger than the file generated during our initial investigation. After additional analysis, we concluded that the report contained a list of all customer support system users. The discrepancy in our initial analysis stems from the threat actor running an unfiltered view of the report. Our November review identified that if the filters were removed from the templated report, the downloaded file was considerably larger - and more closely matched the size of the file download logged in our security telemetry.

We also identified additional reports and support cases that the threat actor accessed, which contain contact information of all Okta certified users and some Okta Customer Identity Cloud (CIC) customer contacts, and other information. Some Okta employee information was also included in these reports. This contact information does not include user credentials or sensitive personal data.

We are working with a third-party digital forensics firm to validate our findings and we will be sharing the report with customers upon completion.

Implementing recommended best practices

We recommend all customers immediately take the following actions to defend against potential attacks that target their Okta administrators.

•Multi-Factor Authentication (MFA): We strongly recommend all Okta customers secure admin access using MFA at a minimum. We also strongly encourage customers to enroll administrative users in phishing resistant authenticators (such as Okta Verify FastPass, FIDO2 WebAuthn, or PIV/CAC Smart Cards) and to enforce phishing resistance for access to all administrative applications. Please refer to product documentation to enable MFA for the admin console (Classic or OIE).

•Admin Session Binding: As communicated in the Security Incident RCA, customers can enable an Early Access feature in Okta that requires admins to reauthenticate if their session is reused from an IP address with a different ASN (Autonomous System Number). Okta strongly recommends customers enable this feature to further secure admin sessions.

•Admin Session Timeout: To align with NIST AAL3 guidelines and increase the security posture of every customer, Okta is introducing Admin Console timeouts that will be set to a default of 12-hour session duration and a 15-minute idle time. Customers will have the option to edit these settings. This will be available as an Early Access feature starting November 29th for preview orgs and December 4th for production orgs. The feature will be available for all production orgs by January 8th, 2024. An email was sent to all Super Admins regarding this change on November 27th, and a copy of that communication can be found in the Knowledge Base article: Admin Session Lifetime/Idle Timeout Security Enhancements.

•Phishing Awareness: In addition, Okta customers should be vigilant of phishing attempts that target their employees and especially wary of social engineering attempts that target their IT Help Desks and related service providers. We recommend Okta customers implement our industry-leading, phishing-resistant methods for enrollment, authentication, and recovery. Please see Okta Solutions for Phishing Resistance for more information on protecting your organization from phishing. We also strongly recommend that customers review their IT Help Desk verification processes and ensure that appropriate checks, such as visual verification, are performed before performing high risk actions such as password or factor resets on privileged accounts.

Cover Page	Nov. 29, 2023
Cover [Abstract]
Document Type	8-K
Document Period End Date	Nov. 29, 2023
Entity Registrant Name	Okta, Inc.
Entity Incorporation, State or Country Code	DE
Entity File Number	001-38044
Entity Tax Identification Number	26-4175727
Entity Address, Address Line One	100 First Street, Suite 600
Entity Address, City or Town	San Francisco
Entity Address, State or Province	CA
Entity Address, Postal Zip Code	94105
City Area Code	888
Local Phone Number	722-7871
Written Communications	false
Soliciting Material	false
Pre-commencement Tender Offer	false
Pre-commencement Issuer Tender Offer	false
Title of 12(b) Security	Class A common stock, par value $0.0001 per share
Trading Symbol	OKTA
Security Exchange Name	NASDAQ
Entity Emerging Growth Company	false
Amendment Flag	false
Entity Central Index Key	0001660134