Okta is a cloud-native identity broker. It is the grantor of access to a client’s apps and devices. It offers single-sign on (SSO), multi-factor authentication (MFA) and manages minimum permissions for global workforces and consumer bases (principle of least privilege).

Okta splits its business into three subcategories. Access management is by far its largest. Access management serves as a gatekeeper for which identities and credentials are allowed to enter a certain environment.

The other two are Okta Identity Governance (OIG) and privileged access management (PAM). Governance gives clients a birds-eye-view of identities and access across various apps to optimize hygiene and observe any potential vulnerabilities. This has been its most successful product cross-sell to date, as it is essentially an extension of the access management for corporate workforces. PAM is Okta’s zero trust approach to identity. It offers access only as needed, doesn’t offer consistent privileges to any devices, flags unfamiliar usage patterns and demands verification at every turn. Like Zscaler in network security, this prevents free, identity-based access to an entire software stack after penetrating the most vulnerable piece of it.

This isn’t an exhaustive list of its products. It also offers posture management to observe and analyze any misconfigurations and proactively flag issues. It prioritizes these issues by how pressing they are. This fully debuted during the quarter.

Still, the products already mentioned encompass all of the revenue drivers today. And for PAM, as well as all other new products in the works, it’s still in product market fit mode. It wants these all to be best-in-class before getting aggressive on selling. It isn’t there yet.

Within access management, Okta further splits its product buckets into workforce and customer management. Workforce is the access management broker for Okta’s clients; customer is its access management broker for the customers of Okta’s clients.

Okta trades for 30x forward earnings. Earnings are expected to grow by 64% Y/Y this year and by 11% Y/Y next year.

Similar to Zscaler in network security or CrowdStrike in endpoint security, Okta wants to be the de-facto, end-to-end identity security platform. This vision manifests in its pursuit of “freeing everyone to safely use technology from anywhere.” Core access management tools are its bread and butter, but it also offers a plethora of customer and workforce identity use cases spanning, password-less management, OIG, PAM, posture management, threat protection etc.

OIG is the most developed cross-sell opportunity for Okta to date and the only non-access management product driving material traction and momentum. This product’s success is great evidence of Okta being able to extend relevant use cases, grow lifetime value, rev the cross-selling engine and become that identity platform. This quarter, OIG passed 1,000 total customers, is delivering tangible retention benefits and continues to gain considerable momentum. Good step in its “platformization” pursuit. For more evidence, contract length and size noticeably increased Y/Y across its customer base.

Larger contracts show you clients are looking to do more with Okta. That not only supports the platform vision but also offers investors another positive. Okta is only a year removed from its security blunder that jeopardized sensitive information. Not great for a security vendor. Clients looking to trust Okta with more of their security needs is a great sign that it’s somewhat seamlessly recovering from this ugly chapter in its history.

The macro backdrop did not get better or worse for Okta Q/Q. It remains challenging. Existing client up-selling is holding back usage assumptions on the customer side and total seats on the workforce side. That is hurting existing client growth. At the same time, new client wins are being slowed by continued budget scrutiny.

Guidance doesn’t anticipate any macro improvements next quarter. It also adds incremental conservatism from the unknown impact of last year’s security event. The firm saw no material, direct impact from that issue this quarter. Still, it thinks it’s likely that pipeline size and conversion are likely still being hurt to an unknown degree. To me, this sounds like gearing investors up for another quarter of under-promise and over-deliver.

Like every other enterprise software firm, Okta is looking to lace GenAI into its products to uplift utility and breadth of use cases. This quarter, it launched a new Identity Threat Protection Product with Okta AI (its suite of agents and chatbots to automate tasks). This product is trained on an Okta client’s own data and further seasoned by the data network effect Okta has built through years and years of scale. The product boasts constant, real-time threat detection (pre and post initial authorization), "amplifies signal sharing” and instructs remediation.

On the customer ID side, it introduced “Highly Regulated ID.” This caters to clients in industries with especially sensitive data (financial services and healthcare) with “elevated security, privacy and user experience controls.” This is for post log-in use cases.

It also added new bot detection tools for Customer ID. This has reduced credential stuffing (login stealing) by over 90% for some clients. This product ties closely to Okta’s Secure Identity Commitment. This is its initiative and response to the 2023 hack to ensure it doesn’t happen again. It’s about perfecting its architecture and plumbing and establishing needed redundancy. In turn, that is how Okta plans to re-secure client trust and budget. It thinks it has made “significant progress” under this initiative (including the upgraded bot detection tools), which it also thinks is leading to incremental pipeline generation too.

One of Okta’s core operating objectives is to re-accelerate its growth. Reestablishing customer trust and its cross-selling push are two key ingredients… but there’s another to mention.

Okta has been rather slow to embrace channel partners. For others, these partners have not only supported growth engines, but have been the predominant drivers of them. Okta wants a piece of this opportunity and is finding some success in its pursuit of it. This quarter, 80% of its largest deals were procured by Global System Integrators (GSIs). 40% of its total revenue is now generated from partners and average deal size from these partners is 3x larger than direct wins. Good progress.

This was a very good quarter. Okta continues to successfully move beyond its security blunders and rebuild client trust. That was not a given. OIG is becoming its first real cross-selling tool and there seems to be more following in its footsteps (PAM the most exciting in my view). The company is determined to reaccelerate growth while maintaining great operating leverage. If they can continue to pull that off, this valuation looks quite compelling. This is one of my favorite non-holding security names.

Gitlab trades for 100x forward earnings. EPS is expected to grow by 81% Y/Y this year and by 50% Y/Y next year. That multiple will fall (I’d guess to around 90x) and growth estimates will rise following this stellar report.

Zscaler is a large player in network security. It competes with Palo Alto’s next-gen suite, Cloudflare and many others. ZScaler’s Zero Trust Exchange (ZTE) is its latest and greatest cloud security approach. It blazes a trail between users, apps and devices across eligible networks. It also secures data at rest and in motion. Zero Trust is exactly what it sounds like: never trusting a device or end user. The exchange vets and verifies all traffic as it moves within a company’s perimeter. It does not allow bad actors to breach the most vulnerable piece of infrastructure and freely move about it thereafter without any subsequent verification. ZScaler uses risk scores to assess needed levels of security for requests. That makes sure it’s only creating user friction when there’s actual security concern.

This Zero Trust approach routinely cuts infrastructure costs for customers. How? By shrinking the attack surface down to grant permission to one app, one user and one piece of traffic at a time. Permissions are based on client policy. This replaces an antiquated firewall and virtual private network (VPN) based philosophy in which every device & user within a perimeter gets perpetual and unconditional access. So? Zero Trust is safer, cheaper AND allows remote employees to responsibly work from anywhere. Zero Trust is rapidly replacing firewalls and VPNs for these reasons.

General Network Security Definitions:

GenAI Product Definitions: 

Data Product Definitions:

Zscaler’s “emerging products” are all products outside of the Zscaler for Users umbrella.

More Sector-level Definitions:

Zscaler pocketed 60 bps of GPM from extending the useful life of some general compute infrastructure. It’s trying to milk the legacy assets for all they’re worth as it gears up for an accelerated compute infrastructure shift. Data center CapEx was 8% of revenue this year, and will rise to 11% of revenue in 2025 to support this evolution and demand.

Why did EBIT beat while EPS missed? I’m so glad you asked. Zscaler raised its non-GAAP effective tax rate assumption to 23% for fiscal year 2025. This compares to an upper mid-teens % in previous years. Guidance would have beaten estimates and come in around $3.47 without this change. This change stems from a lack of tax credits from losses in previous years and ramping operating profitability. This is a nothing burger.

Zscaler trades for 57x its fiscal year 2025 EPS guidance. EPS is expected to rise by 70% Y/Y this year and by 10% Y/Y next year.

The billings guidance for next year was the main theme of the Q&A. First, analysts wanted to know how much conservatism was baked into the billings guidance. The team continued to reiterate that macro hasn’t improved and they’re operating in an uncertain environment. It’s also worth noting that the guide was roughly in line with Bloomberg Terminal consensus, so it’s not like this was overly weak by any measure. I actually found it strong considering the immense uncertainty still present in the backdrop. Furthermore, it ALWAYS leans conservative on guidance. It was never going to look out 12 months and assume everything went perfectly. Under-promise and over-deliver. I think it’s likely that the guide will be raised throughout the year (barring abrupt macro turmoil). 

My confidence here is despite some sharper billings seasonality expected next year compared to prior periods. Specifically, Zscaler sees 13% Y/Y billings growth during the first half of its fiscal 2025 and 23% during the second half. That made many worry that it was placing too much hope and pressure on 2nd half results. But? This guidance doesn’t stem from hope. It stems from multi-year committed contracts and is entirely appropriate for two reasons (in my mind). First, it’s based on an observed strengthening in pipeline activity currently playing out. Secondly, to make me even more comfortable, the assumed acceleration is based on contracted, scheduled, non-cancelable billings… not billings that it expects to eventually win. Zscaler signs 3-year contracts with scheduled invoices. During the first half of 2022 and 2023, macro headwinds were raging and new contract growth was slower. That reverted during the second half of 2022 and 2023. This means a lower contracted billings contribution during the first half of the year vs. the second half. Specifically, contracted billings will rise 7% Y/Y through Q1 and Q2 before rising 23% Y/Y through Q3 and Q4. All of this context put my mind entirely at ease. A lack of billings guidance beat isn’t based on expected weakness. It’s based on prior weakness working its way through Zscaler’s contract base.

Zscaler enjoyed an acceleration in new business and cross-selling during the quarter. This was not related to improving macro. Macro headwinds remained challenging and stable, with ongoing budget scrutiny not waning. Zscaler simply overcame these headwinds to deliver the exceptional results. That ability, in my view, came from three places this quarter.

First, the structural tailwinds guiding its business are stronger than the macro protuberances temporarily holding it back. Customer demand for its zero trust, attack surface minimizing approach continues to resonate more and more, malware activity rose 19% Y/Y, SEC mandates are making cybersecurity hygiene a more public matter for enterprises. That is a great setup for this firm and business model.

Secondly, it’s becoming an increasingly powerful vendor consolidator and cloud/network security platform play. Through GenAI products like Risk360 and Business Insights, as well as extending its Zscaler for Users product to workloads, apps and IoT, Zscaler is letting customers do more with its platform. Breadth and efficacy are a potent combination for this firm. It means higher lifetime value and margin ceilings while also cutting costs for clients as they shed point solutions and drive better interoperability.

Lastly, it’s making great progress on fixing its go-to-market (GTM) approach. A few quarters ago, Zscaler hired ServiceNow America’s President Mike Rich as its Chief Revenue Officer. Rich was tasked with evolving ZS’s GTM from one that resembled a start-up to one that acknowledges how much scale this business has already built. Zscaler moved away from opportunity-focused selling and pivoted to account-focused selling. It aligned sales team incentives with its key performance indicators and brought on more industry-specific talent. This quarter, sales productivity came in above expectations. Zscaler is highly pleased with progress to date, and will continue to materially grow its personnel here next year (slower growth than 2024 but still brisk growth). As an aside, these salespeople take time to grow familiar enough with ZS’s suite to be highly productive sellers. That’s another smaller reason why Zscaler expects stronger 2H 2025 billings vs. 1H of 2025.

Let’s spend some more time on GTM progress. Sales attrition and productivity both outperformed and helped Zscaler comfortably beat quarterly estimates. It’s also investing more aggressively in global system integrator (GSI) partnerships to nurture that demand channel (just like we saw with Okta from section 1 of this article). For Zscaler, 8 out of 10 of the largest GSIs are already its clients. This makes setting up selling and integration programs much easier, as GSIs can say “we use it too” instead of “trust us this works.” It also helps that Zscaler just secured the business of another top 10 GSI for 300,000 users (largest win here to date) and expects to deliver them a rapid 200% return on investment. That’s powerful. 

Zscaler owns the largest cloud security platform on the planet. It now processes 500 billion transactions daily and provides a massive data network effect to more powerfully train all of its products. More relevant context means smarter protection and vulnerability management algorithms. 

The ZIA and ZPA runways remain long, but ZDX momentum, AI monetization, data protection (DSPM, DLP etc.) and vulnerability management are all emerging as material financial drivers. AI monetization is especially important, as it shows Zscaler is among the first in enterprise software to actually figure it out. Specifically, its AI analytics tools accelerated growth by 3 full points in Q4. Zscaler’s GenAI security tool is the strongest contributor. This lets companies fully embrace GenAI models and apps, without conceding a loss of control over their data or permissions. Generally speaking, emerging products (not Zscaler for Users) were 22% of total new business in FY 2024 vs. 18% Y/Y and close to 0% in FY 2020. That should rise to a mid-20% level in FY 2025. More cross-selling; higher retention; better efficacy; superior margins. This is a platform play obviously emerging before our eyes.

If the commentary on Zscaler becoming more of a platform play is the cause, large customer wins involving several products is a compelling, evidence-based effect. This quarter, Zscaler pounded its chest about several of these wins:

Fortune 500 Industry Machinery firm signed a new 7-figure deal. This includes Zscaler for Users across 100,000 users and its budding data protection suite. The customer was working with a legacy SASE provider, but chose to consolidate firewalls, web gateways and shift its MPLS (defined in 101 section) network budget to SD-Wan (defined in 101 section). Zscaler’s zero trust approach has essentially “made its branches and data centers invisible” to greatly shrink the attack surface and shed client costs.

A Fortune 200 Financial Services Firm extended its ZIA usage to Zscaler for Users (to include ZPA and ZDX) for 68,000 users. It also added ZS’s data protection services. All in all, this client’s annual recurring revenue (ARR) rose to almost $10 million.

A large American healthcare firm signed a new 8-figure contract with Zscaler. It includes ZIA, ZDX and data protection. Data protection is rapidly becoming a routine cross-selling tool for Zscaler and was the reason for this win. Zscaler’s ability to secure unstructured and structured data across channels (in motion or at rest) was the deciding factor.

Finally, Zscaler landed its 13th cabinet-level agency (out of 15). This includes just 5,000 users, with a 20x upsell opportunity down the road.

Zscaler was asked if the CrowdStrike incident is leading to a lower desire to consolidate point solutions. The answer is yes and no. Vendor consolidation is still in high demand, but companies don’t only want one vendor. More and more, it’s looking like most want one network vendor, one endpoint vendor and one identity vendor. Zscaler feels best positioned to be that network platform of choice. CrowdStrike has been debuting products to more directly compete with Zscaler in recent quarters, but Zscaler sees zero competitive pricing pressures and thinks this global outage makes the environment even more favorable for its financial success.

It also thinks it was the best positioned to help during the event. It is the only firm in its space with business continuity service to help clients amid times of chaos and turmoil. This has been quite the tool for Zscaler over the last few weeks. It has helped augment its already sterling reputation and build even deeper loyalty with its base. Its reputation improved. That should lead to more wins down the road and, per the team, larger wins as companies look to do all of their network-level securing with Zscaler.

I see what the stock is doing after-hours and I am not fretting in the least. A few hours of ugly price action does not change anything about how good this quarter and guide both were in my view. The thesis is not only intact… it strengthened once more.

Actual results were outstanding and the guidance will likely be raised throughout the year as long as macro doesn’t fall off of a cliff. There was real risk to guidance materially disappointing, considering its sandbagging tendency and the immense macroeconomic uncertainty facing its world today. It makes all of the sense in the world for them to be overly conservative with guidance like they always are. If this is what conservative looks like for FY 2025, I find that very encouraging.

This company continues to rapidly compound revenue while expanding margins, debuting successful new products, printing cash and carrying a reputation as a best-in-class network platform. There is a very good chance I aggressively accumulate shares here in the near future. I will keep max subs updated in real-time as always.

Last month, the Department of Justice launched an investigation into potentially anti-competitive practices at Nvidia. There were actually two issues brought forth, but one focused on a small acquisition (of “Run”) and isn’t super material. The other is more pressing, and is based on complaints from chipmakers who claim Nvidia is using its market power to dampen competition. They say Nvidia is forcing hyperscalers to sign exclusive agreements with them and inflating networking equipment pricing for shared customers who choose other chips (like AMD’s). There has also been general criticism pertaining to Nvidia using its software suite to drive vendor lock and prevent open integrations with other hardware platforms.

This afternoon, the Department of Justice issued a subpoena to Nvidia in what is seen as an escalation of attention and risk. I don’t think these allegations are alarming or irrelevant (closer to irrelevant). Networking hardware inflation has been broadly reported by several players, almost every hyper-scaler has spoken about needing to find more affordable solutions and AMD is spending billions on M&A targets partially to sharpen its integration abilities. But with all of that said… I still think this is mostly noise.

Do you know why Nvidia can get away with grossly overcharging everyone? Because their chips are that much better. The open, free market would erode its pricing power immediately if its tech lead wasn’t so large. Furthermore, there’s nothing wrong with charging more for standalone networking equipment than you would if the equipment were bundled with large chip orders. That is a routine cliche. They’d be stupid not to do this. I do think there’s more legitimacy to the software layer vendor lock item, but that is not the main focus of this lawsuit.

So what matters for Nvidia as the stock violently chops around? The same two things that mattered last week and the week before.

First, Nvidia must maintain its large tech lead to keep commanding historic pricing power. That’s the only way wildly difficult profit comps will not lead to sharply slowing growth. No competitor has caught up… but many are trying. If any can get to the same ballpark as Nvidia, they could likely stitch together enough compute to emulate Nvidia’s Blackwell chips. These potential competitors would be more than happy to accept far lower price tags; they don’t need Nvidia’s 75% GPM. Regardless of this threat, Nvidia’s lead still seems large and safe. It’s operating on a historic one-year rhythm for new platform launches and continues to deliver crazy performance gains with each new launch.

The second item that matters dearly is GenAI chip cycle longevity. This is the big one in my mind. Semiconductors will always be cyclical. This gigantic cycle is leading some to think unprecedented demand growth will last forever, but it won’t. Hyperscalers all plan to spend more in 2025 on chips, but will that be enough? Expectations for Nvidia are sky high, so if “spending more” means 5% more, that may just not matter. If it means 50% more, it will. Like a waning tech lead, slowing demand growth would also lead to lower pricing power and sharply slowing profit growth. Effectively timing up the end of this cycle is wildly difficult to do and not something I’m even willing to try to do.

As an innocent bystander, these are the two ideas that I think matter for the bear-bull debate. Not what the government is doing.