All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Okta sells identity and access management, and in August 2026 it bought Permiso Security for about $200 million to watch what happens after a user logs in. It covers employee login, customer and developer authentication, governance, privileged access, and AI agents, for buyers from single developers to the Fortune 100 and federal agencies. The company is large and profitable: independent reporting puts fiscal-2026 revenue at $2.919 billion, up 12 percent, and fiscal-2027 second-quarter net income at $116 million. Microsoft prices identity into subscriptions buyers already hold, including Entra ID with Microsoft 365, and Okta's chief product officer says Okta customers also run Entra ID or Active Directory. A buyer weighing Okta often weighs it against identity it already pays for.
| Description | Okta is an independent identity and access management company. It secures workforce login, customer authentication through Auth0, identity governance, and privileged access for enterprises and governments, and extends the same platform to AI agents. | [f1] |
|---|---|---|
| Founded | 2009 | [f1] |
| HQ | San Francisco, United States | [f1] |
| Subsidiaries | Auth0 (Developer-identity platform acquired by Okta, now operating as Okta Customer Identity Cloud.) , Permiso Security (Identity threat detection and response vendor. Okta closed the acquisition on 2026-08-26; CNBC reported the deal at roughly $200 million.) | |
| Latest funding | IPO, $187M (2017) | [f2] |
| Deployment | SaaS | [f3] |
| Compliance | CSA STAR Level 2, ISO 27001, SOC 2 Type 2 | [f3] |
| Product | What it does |
|---|---|
| Okta Workforce Identity Cloud | Access for employees, contractors, and partners: single sign-on, adaptive MFA, lifecycle management, and threat protection across 8,000+ pre-built integrations. |
| Okta Customer Identity Cloud (Auth0) | Developer-facing authentication and authorization for customer and B2B apps via Auth0, including passwordless login, MFA, and bot detection. |
| Auth0 for AI Agents | Identity and access for AI agents within Auth0: dedicated agent identities, a Token Vault for third-party API tokens, async user authorization, and fine-grained authorization for retrieval. |
| Okta Identity Governance | Access requests, access certifications, and lifecycle automation to enforce least privilege and streamline compliance audits. |
| Okta Privileged Access | Vaults server credentials, enforces zero standing privileges, and records privileged SSH and RDP sessions for on-prem and cloud infrastructure. |
| Okta Identity Threat Protection | Continuously assesses user risk signals and automatically responds to identity threats such as session hijacking across the ecosystem, with Okta AI. |
| Okta for AI Agents | Manages a customer's non-human workforce from one control plane: exposes unmanaged agents, registers each in the directory with a required human owner, and revokes access on suspicious behavior. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Orchestration Tools Agentic orchestration tools, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients on user devices. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Gateways & Routers MCP proxies and gateways, LLM routers, outbound AI-service traffic, shadow AI egress, and model-registry traffic. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, AIBOM, and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Auth0 for AI Agents provides identity and access for AI agents, with dedicated agent identities, a Token Vault for third-party API tokens, async user authorization, and fine-grained authorization for RAG. It is mapped to the AI Defense Matrix. [f4]
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
Identity Security Posture Management finds risky accounts and MFA gaps, Privileged Access vaults server credentials, Identity Threat Protection detects and ends hijacked sessions, and Device Access enforces desktop MFA. These identity products are mapped to the Cyber Defense Matrix. [f5]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Okta names a precise buyer, the enterprise security and IT organization plus the developer adding login through Auth0, and ETR's study of 310 identity decision makers documents that budget is moving in the category. It holds at 3 rather than 4 because the cited record quantifies buyer spending intent rather than the cost of the problem, so the pain itself stays vendor-asserted. [s16, s7, s3] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | Okta documents distinct capability lines for workforce identity, Auth0, governance, privileged access, threat protection, and AI agents on its own pages, and two non-vendor points bear on them: the JsonWebToken library Auth0 publishes on GitHub under an MIT license carries 18.2 thousand stars and 1.3 thousand forks, and ETR's independent study rates Okta above the rest of the identity field on product-leadership perception. It is not a 5 because the cited record carries no independent benchmark of those lines, and the Gartner Leaders placement reaches the record through Okta's own newsroom. [s2, s3, s4, s5, s6, s10, s23, s16, s11] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | Two distinct buyer-side signals are documented within the last year. Forrester analysts, quoted in a December 2025 Register article, wrote that access-management architectures must treat AI agents as a new identity type, which is an analyst category signal. ETR's 2026 study of 310 identity decision makers records Okta among the vendors with the highest increase-minus-decrease spending spreads, which is budget movement rather than an analyst framing. It is not a 5 because no third kind of driver, such as a regulatory mandate, appears in the cited record. [s15, s16] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Todd McKinnon and Frederic Kerrest founded Okta in 2009 and McKinnon still runs it as chief executive, named in that role in the earnings-release remarks a SiliconANGLE article carries and speaking as chief executive in a CNBC article on the fiscal second quarter. That is verifiable in-domain experience on one build, and the cited record carries no prior exit, publication record, or independent recognition of the founders, which is what rung 4 asks for beyond it. [s7, s17, s18, s20] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 5/5 | A SiliconANGLE article reports fiscal-2026 revenue of $2.919 billion, up 12 percent, and a CNBC article reports second-quarter fiscal-2027 net income of $116 million on revenue up 11 percent. Both outlets attribute the figures to Okta's own results, so what corroborates them is two independent publications carrying them, with CNBC weighing the quarter against LSEG analyst estimates. Named references run from Mars, McLaren Racing, Hitachi and FedEx on the homepage to the Centers for Medicare and Medicaid Services in the FedRAMP announcement. [s17, s18, s1, s9] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 4/5 | Independent reporting confirms scale and profit: revenue of $2.919 billion growing 12 percent in fiscal 2026, net income of $116 million in the second quarter of fiscal 2027, and a roughly $200 million acquisition of Permiso Security closed in August 2026. It stops at 4 because the cited record confirms revenue and profit but carries no measure of capital efficiency behind them. [s17, s18] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | Buyers and analysts place Okta without vendor coaching. Gartner evaluated 13 vendors on 15 criteria and put Okta in the Leaders quadrant for access management, and ETR's independent study tracks Okta alongside the fifteen other identity-security vendors the report covers. It is not a 5 because the Gartner placement reaches the record through Okta's own newsroom and ETR names Microsoft's Entra ID as the vendor buyers would rebuild on. [s11, s16] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 4/5 | Workflow embedding: the workforce page documents 8,000+ prebuilt integrations, and Lifecycle Management syncs with a customer's HR system to provision and revoke app access on hire and exit. Procurement position: the FedRAMP Marketplace lists the Government High Cloud package at Class D (High) since March 2023, with nine ATO or ATU letters. Microsoft's bundling is real pressure: its licensing page lists HR-driven provisioning among Entra ID Governance features, included in the Entra Suite and Microsoft 365 E7. A bundle does not transfer a customer's built Okta configuration or those letters. [s2, s14, s22] |
Okta sells identity and access management to the enterprise security and IT organization that has to control how employees, contractors, partners, customers, and now AI agents reach applications and data. Auth0 addresses a second buyer inside the same problem, the developer or application team adding login to a customer-facing product.
The demand is documented outside Okta's own materials. ETR's 2026 identity-security study, drawn from 310 IT decision makers responsible for identity and access management strategy, describes a field in rapid transition and names integration and user experience among the top buyer priorities. Forrester analysts, quoted in a Register article, argue that AI agents are a new identity type that access-management architectures have to absorb.
What the cited record measures is buyer behavior rather than buyer loss. ETR records spending intentions and product perceptions across those decision makers, which establishes that budget is moving, and no cited source puts an independent figure on what identity failures cost the buyer. [s16, s15, s3, s7, s2]
Okta runs its capability lines across two platforms, the Okta Platform and Auth0. Workforce Identity covers single sign-on, adaptive multi-factor authentication, lifecycle management, posture management, and phishing resistance. Auth0 covers customer and developer authentication, with more than thirty software development kits and quickstarts for adding login to any language or framework.
Three lines cover narrower problems. Identity Governance builds access reviews and self-service access requests in one place and draws on more than 600 native integrations to discover application permissions. Privileged Access vaults server credentials, enforces zero standing privileges, and records SSH and RDP sessions to support compliance requirements. Identity Threat Protection combines Okta's identity signals with intelligence from the customer's own SaaS and security tools to detect threats and automate responses.
The agent lines are the newest. Auth0 for AI Agents gives each agent its own identity, scoped permissions, and short-lived access tokens for calling APIs and MCP servers. Okta for AI Agents, which Okta made available to all customers in its fiscal second quarter, works the other side of the problem: it exposes unmanaged agents running in a customer's stack, registers each one in the directory with a mandatory human owner, and revokes access when an agent behaves suspiciously. On the workforce side the connective layer is the Okta Integration Network, which the workforce page puts above 8,000 prebuilt integrations. [s1, s2, s3, s4, s5, s6, s7, s8, s10, s24, s18]
Okta's site copy calls it the neutral and extensible platform that puts identity at the heart of a customer's stack, which is its core stance against the platform incumbents. ETR's study places Okta and Microsoft's Entra ID above the rest of the identity field on spending direction and product-leadership perception.
The pressure comes from how Microsoft prices the same capability. Microsoft's licensing documentation includes Entra ID Free with Microsoft cloud subscriptions such as Microsoft 365, and includes Entra ID P1 with Microsoft 365 Business Premium. Okta's chief product officer told CyberScoop that Okta customers also rely on other identity systems such as Microsoft Entra ID or Active Directory, so a buyer weighing Okta is often weighing it against identity already inside a subscription it pays for.
Okta's counter is the breadth of its integration network and the federal accreditations behind its government offerings. Gartner placed Okta in the Leaders quadrant of its 2025 Magic Quadrant for Access Management, an evaluation of 13 vendors on 15 criteria, which reaches the record through Okta's own newsroom rather than through Gartner. [s1, s16, s22, s19, s11, s13, s14, s2]
Okta's traction is the kind a public company at scale can show and third parties can check. A SiliconANGLE article puts fiscal-2026 revenue at $2.919 billion, up 12 percent year over year. A CNBC article puts revenue up 11 percent from $728 million a year earlier, with net income of $116 million in the second quarter of fiscal 2027 against $67 million a year before.
The named references span commercial and public sector. Okta's homepage carries customer stories for Mars, McLaren Racing, Wyndham Hotels and Resorts, Hitachi, and FedEx, and its FedRAMP announcement describes work with the Centers for Medicare and Medicaid Services. Okta's company page states that two-thirds of the Fortune 100 and major government agencies trust it.
The selling motion runs from self-serve to negotiated. Auth0 invites developers to start building for free and Okta offers a 30-day trial with no commitment, while workforce identity, governance, and privileged access are sold as per-user suites billed annually, with Professional and Enterprise quoted on request. FedRAMP High for Okta for Government High and a Department of Defense Impact Level 4 authorization for Okta for US Military qualify Okta for the high-impact and IL4 workloads those authorizations gate. [s17, s18, s1, s9, s7, s8, s3, s13, s14]
Todd McKinnon and Frederic Kerrest founded Okta in 2009, and the company says the two created a new category with Identity-as-a-Service. That claim appears on Okta's own company page and no cited independent source confirms it, so the durable fact is the company they built rather than the category label.
The founder is still running it. A SiliconANGLE article carries earnings-release remarks naming McKinnon co-founder and chief executive, and a CNBC article records him speaking as chief executive on the fiscal second quarter, so the in-domain experience is verifiable and current rather than historical. What the cited record does not carry is a prior exit, a publication record, or independent recognition of the founders themselves.
Security execution is the counterweight. Okta's chief security officer disclosed in 2023 that an intruder had downloaded the names and email addresses of all Okta customer support system users, with federal customers excepted, and Cloudflare and 1Password both traced intrusions to that breach, though both said the incidents did not affect their customer systems or user data. For a vendor whose product is trust, that history is a cost the leadership carries into every security review. [s7, s17, s18, s20, s21]
Okta publishes its assurance record in one place. Its trust center lists more than thirty compliance entries, among them FedRAMP High and FedRAMP Moderate, FIPS 140-2, GDPR, HIPAA, IRAP, ISO/IEC 27001:2022, ISO/IEC 27017:2015 and ISO/IEC 27018:2019, NIST 800-53 Rev. 5, PCI DSS v4.0.0, and SOC 1, SOC 2 and SOC 3, and it states that Okta's Department of Defense Impact Level 4 authorization permits Okta for US Military in IL4 and IL5 environments.
One of those carries an independent register behind it. The FedRAMP Marketplace lists Okta IDaaS Government High Cloud as FedRAMP Certified at Class D (High), certified since March 2023, with nine authorizations recorded, which is a government record rather than a vendor page.
The incident history is what a security review weighs against it. The 2023 support-system compromise reached every Okta customer support system user outside the federal offerings. A TechCrunch article states that Cloudflare's intrusion, which began on October 18, produced no access to its systems, in large part because Cloudflare used hardware security keys. A reviewer is therefore weighing current certifications against a documented failure. [s13, s14, s20, s21]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Microsoft Entra | competes with | ||
| Ping Identity | competes with | N/AWe scored these companies at different scopes, so the totals measure different things. | |
| SailPoint | competes with | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. | |
| CyberArk | competes with | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
Add analyzed competitors to compare them side by side with Okta.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
press the advantage
A funded rival could rebuild most of what Okta sells. The authentication and authorization is standards-based, the cited record names no regulation that requires Okta specifically, and it names no non-public cross-customer dataset behind the platform. What a rival cannot assemble quickly is Okta's position: an integration network the workforce page puts above 8,000 prebuilt connectors, with governance and privileged access configured on top. That is friction the cited record documents without sizing. FedRAMP High and a DoD Impact Level 4 authorization qualify Okta for the federal and military workloads those authorizations gate. That position is a head start rather than a lock, and Microsoft ships competing identity inside subscriptions buyers already pay for.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Okta delivers software the customer configures and operates: single sign-on, multi-factor authentication, governance, credential vaulting, and threat response, sold as per-user suites billed annually with a self-serve developer tier on Auth0. The customer's own team runs it and owns the outcomes. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | The cited record documents a network the workforce page puts above 8,000 prebuilt integrations, with a customer's own apps, governance and privileged access configured on it, so a departing customer re-points those systems and rebuilds that configuration. The record documents the mechanism and does not size the exit, so this is meaningful friction rather than an expensive migration. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 2/3 | FedRAMP High for Okta for Government High, recorded on the FedRAMP Marketplace as certified since March 2023 with nine authorizations, and a Department of Defense Impact Level 4 authorization for Okta for US Military gate government workloads an unaccredited offering cannot serve. Not a 3 because the cited record documents scoped authorizations rather than a non-transferable mandate or retained liability that blocks replacement. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Single sign-on, adaptive multi-factor authentication, lifecycle and governance automation, privileged-credential vaulting with session recording, and real-time identity threat response across a customer's other security tools is security-critical distributed-systems and authorization engineering that takes years of specialized expertise. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Okta states that two-thirds of the Fortune 100 and major government agencies trust it, and its federal offerings carry FedRAMP High on the FedRAMP Marketplace and a Department of Defense Impact Level 4 authorization. That is the regulated-enterprise and government buyer class the rung describes. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 3/3 | Okta is the identity layer applications authenticate through to reach users and resources, infrastructure other software depends on rather than an end-user tool. Auth0 publishes more than thirty software development kits and quickstarts for integrating authentication into any language or framework, plus a JsonWebToken library on GitHub carrying 18.2 thousand stars under an MIT license. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | The cited record evidences no retained cross-customer asset behind the platform. The Okta Integration Network is distribution and switching friction already counted under switching cost rather than a data or content asset, and Identity Threat Protection draws on the customer's own SaaS and security signals with no non-public corpus named. Permiso's signal library arrives with an August 2026 acquisition, and the cited release describes those signals as research-driven across more than 70 identity partners rather than as a non-public corpus Okta retains on its own. |
Okta sells to two buyers across the Okta and Auth0 platforms. The workforce side serves the enterprise IT and security organization securing employee, contractor, and partner access. The customer side serves the application team adding login to customer-facing apps, with Auth0 as the developer platform beside it and more than thirty software development kits and quickstarts for any language or framework, including enterprise single sign-on and SCIM for B2B software.
Okta now sells into machine and agent identity as well. Auth0 for AI Agents issues each agent its own identity and short-lived tokens for calling APIs and MCP servers, while Okta for AI Agents, available to all customers from its fiscal second quarter, automates the lifecycle of a customer's non-human workforce from one control plane. Forrester analysts, quoted in a Register article, place identity vendors including Okta in position to set the architecture for agent access.
The buyer range runs from an individual developer to a Fortune 100 company or a federal agency. Auth0 offers a developer on-ramp, workforce suites are sold per user and billed annually, Okta's company page states that two-thirds of the Fortune 100 and major government agencies trust it, and its federal offerings carry FedRAMP High and a Department of Defense Impact Level 4 authorization.
Okta documents capability lines across two platforms, the Okta Platform and Auth0. Workforce Identity covers single sign-on, adaptive multi-factor authentication, lifecycle management, posture management, and phishing resistance. Auth0 covers customer and developer authentication. Identity Governance builds access reviews and self-service access requests in a single place. Privileged Access vaults credentials and enforces zero standing privileges with recorded SSH and RDP sessions. Identity Threat Protection detects threats and automates responses.
The connective advantage is the integration network. The workforce page puts the Okta Integration Network above 8,000 prebuilt integrations, and Identity Governance draws on more than 600 native integrations to discover application permissions. Okta documents that network as the connection point for a customer's applications, and no single product feature accounts for it.
The AI claim is reuse rather than a proprietary model. Identity Threat Protection combines Okta's identity signals with intelligence from the customer's own SaaS and security tools, and the cited record names no non-public cross-customer corpus behind it. Okta's August 2026 purchase of Permiso Security adds what Okta describes as more than 2,500 research-driven signals across 70-plus identity partners, which the release says will extend detection across identity types once integrated. Okta for AI Agents covers the same ground from the management side, exposing unmanaged agents in a customer's stack and registering each with a mandatory human owner.
Okta's go-to-market runs at public-company scale, and the scale figures reach the record through independent outlets reporting Okta's own results. A SiliconANGLE article puts fiscal-2026 revenue at $2.919 billion, up 12 percent year over year. A CNBC article puts revenue up 11 percent from $728 million a year earlier, with net income of $116 million in the second quarter of fiscal 2027, and reports that new products accounted for 30% of total bookings.
The federal motion is a distinct distribution advantage. FedRAMP High for Okta for Government High and a Department of Defense Impact Level 4 authorization for Okta for US Military qualify Okta for the high-impact and IL4 workloads those authorizations gate, and the FedRAMP Marketplace records the Government High offering as certified since March 2023 with nine authorizations.
Analyst recognition rounds out the picture. Okta's newsroom announcement states that Gartner recognized it as a Leader in the 2025 Magic Quadrant for Access Management for a ninth consecutive year, and that the report evaluated 13 vendors on 15 criteria. The evaluation is Gartner's and the account of it is Okta's.
Okta prices its workforce platform as per-user suites billed annually. The pricing page lists a $6 Starter suite carrying single sign-on, multi-factor authentication, and Universal Directory, and a $17 Essentials suite that adds Adaptive MFA, Privileged Access, Lifecycle Management, Access Governance, and 50 workflows, with a $14 Core Essentials option in between. Professional and Enterprise are quoted on request.
Capabilities are tiered rather than uniformly bundled or uniformly sold on the side. Adaptive MFA and Privileged Access arrive with Essentials, Device Access and Identity Threat Protection first appear in Professional, and API Access Management and Access Gateway in Enterprise. Any suite can then be extended with add-ons, Okta for AI Agents among them.
Customer identity is priced separately. Okta prices its Customer Identity line from a required Enterprise base product at $3,000 per month billed annually, with add-ons charged on usage such as monthly active users. Auth0 invites developers to start building for free, so a developer's entry cost and an enterprise's committed spend are set on different terms.
Okta describes its offering as cloud-based identity and access management, delivered as a service the customer integrates. Applications connect through prebuilt integrations or standards-based single sign-on, so what the customer operates is configuration and policy.
The operational core is brokered, least-privilege access. Privileged Access vaults server credentials, enforces zero standing privileges, and records SSH and RDP sessions to support compliance requirements. Identity Governance builds access reviews and self-service access requests. Identity Threat Protection combines identity signals with the customer's other security tools to detect threats and automate responses.
The operational risk Okta has itself demonstrated is its own support surface. In 2023 an intruder downloaded a report containing the names and email addresses of all Okta customer support system users, its chief security officer wrote, with federal customers excepted, and Cloudflare traced an intrusion beginning on October 18 to the same breach, reporting no access to its systems in large part because it used hardware security keys. A buyer weighs Okta's service availability alongside the security of the systems Okta's own staff use.
Okta documents its assurance record on its trust center. The listing carries more than thirty compliance entries, among them FedRAMP High and FedRAMP Moderate, FIPS 140-2, GDPR, HIPAA, IRAP, ISO/IEC 27001:2022, ISO/IEC 27017:2015 and ISO/IEC 27018:2019, NIST 800-53 Rev. 5, PCI DSS v4.0.0, and SOC 1, SOC 2 and SOC 3, and it states that Okta's Department of Defense Impact Level 4 authorization permits Okta for US Military in IL4 and IL5 environments.
One of those has an independent register behind it. The FedRAMP Marketplace lists Okta IDaaS Government High Cloud as FedRAMP Certified at Class D (High), certified since March 2023, with nine authorizations recorded, which is a government record rather than a vendor page.
The counterweight is the incident history. The 2023 support-system compromise reached every Okta customer support system user outside the federal offerings, and both Cloudflare and 1Password traced intrusions to it, though both said the incidents did not affect their customer systems or user data. A security review is therefore weighing current certifications against a documented failure.
Okta's site copy calls it the neutral and extensible platform that puts identity at the heart of a customer's stack. Auth0 publishes more than thirty software development kits and quickstarts so a team can add authentication in any language or framework, and the JsonWebToken library Auth0 publishes on GitHub under an MIT license carries 18.2 thousand stars and 1.3 thousand forks.
The integration network is the ecosystem's center of gravity. The workforce page puts the Okta Integration Network above 8,000 prebuilt integrations, and Identity Governance draws on more than 600 native integrations. That network is both the adoption on-ramp and the friction a customer takes on once its apps are wired in, friction the cited record documents without sizing.
Neutrality as a competitive edge is contested. Microsoft's licensing documentation includes Entra ID Free with Microsoft cloud subscriptions such as Microsoft 365 and Entra ID P1 with Microsoft 365 Business Premium, and Okta's chief product officer says Okta customers also run Entra ID or Active Directory, so the neutral layer competes with identity a buyer's existing subscription already includes.
Okta was co-founded in 2009 by Todd McKinnon and Frederic Kerrest, and the company says the two created a new category with Identity-as-a-Service. That claim appears on Okta's own company page and no cited independent source confirms it, so the durable fact is the company they built rather than the category label.
The founder is still running it. A SiliconANGLE article carries earnings-release remarks naming McKinnon co-founder and chief executive, a CNBC article records him speaking as chief executive on the fiscal second quarter, and Okta's chief product officer Ely Kahn speaks for the platform strategy behind the Permiso acquisition.
The hardest part of the record is security execution. Okta's chief security officer disclosed in 2023 that an intruder had downloaded the names and email addresses of all Okta customer support system users outside the federal offerings, and Cloudflare and 1Password both traced intrusions to that breach, though both said the incidents did not affect their customer systems or user data. For a vendor whose product is trust, that history is a cost the leadership carries into every security review.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Okta: company page | official | 2026-08-27 |
| f2 | Okta, Inc. (Wikipedia) | research | 2026-06-14 |
| f3 | AI Defense Matrix Catalog entry | other | 2026-06-13 |
| f4 | AI Defense Matrix Catalog mapping | other | 2026-06-23 |
| f5 | Identity Threat Protection (Okta) | official | 2026-06-12 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Okta: homepage with customer stories “From chocolates to Chihuahuas: Okta helps Mars securely expand their universe of brands.” | official | 2026-08-27 |
| s2 | Okta: Workforce Identity product page “Okta Integration Network (OIN) Access 8,000+ pre-built integrations to seamlessly connect and secure your technology stack.” | official | 2026-08-27 |
| s3 | Auth0: developer platform home page “Integrate auth into any stack in minutes Use our 30+ SDKs and Quickstarts to integrate auth into any language or framework.” | official | 2026-08-27 |
| s4 | Okta: Identity Governance product page “Build access reviews and self-service access requests within a single Identity solution to strengthen security without slowing business.” | official | 2026-08-27 |
| s5 | Okta: Privileged Access product page “Okta Privileged Access provides unified access and governance for privileged resources – whether on-prem or cloud – and increases visibility, compliance and security without compromising user experience.” | official | 2026-08-27 |
| s6 | Okta: Identity Threat Protection product page “Okta seamlessly integrates identity signals with intelligence from your SaaS and security solutions to continuously detect emerging threats and automate responses.” | official | 2026-08-27 |
| s7 | Okta: company page “In 2009, co-founders Todd McKinnon and Frederic Kerrest created a new category with Identity-as-a-Service (IDaaS).” | official | 2026-08-27 |
| s8 | Okta: plans and pricing page “Everything in Starter, plus: Adaptive MFA Privileged Access Lifecycle Management Access Governance 50 Workflows” | official | 2026-08-27 |
| s9 | Okta: blog post announcing FedRAMP High authorization “Today, we reached an exciting new milestone in our ongoing commitment to the Federal government: Okta for Government High, our modern Identity platform built exclusively for the US Federal government and its mission partners, achieved a FedRAMP High Impact level authorization.” | official | 2026-08-27 |
| s10 | Auth0: AI agents product page “Let your AI agents identify users, call APIs, and connect to MCP servers more securely. Get it done with fine-grained controls and just a few lines of code.” | official | 2026-08-27 |
| s11 | Okta: newsroom release on the 2025 Gartner Magic Quadrant for Access Management “Okta, Inc. (NASDAQ:OKTA), the leading independent identity partner, today announced that it has been recognized as a Leader in the 2025 Gartner Magic Quadrant for Access Management for the ninth consecutive year.” | official | 2026-08-27 |
| s12 | Okta: newsroom release on the Permiso Security acquisition “We are excited to announce that today Okta closed its acquisition of Permiso Security.” | official | 2026-08-27 |
| s13 | Okta Security Trust Center: certification listing and product authorizations “Okta’s DoD Impact Level 4 authorization permits Okta for US Military to be used as an on-demand identity and access management services for DoD authorized IL4 and IL5 environments.” | official | 2026-08-27 |
| s14 | FedRAMP Marketplace: Okta IDaaS Government High Cloud listing “Okta IDaaS Government High Cloud (GHC) Package ID FR2131856836” | regulatory | 2026-08-27 |
| s15 | The Register: article on identity vendors and AI agent access “This puts identity access management vendors like Okta, Ping Identity, and Microsoft Entra ID in the driver's seat to establish secure, repeatable architectures, Cser and other Forrester analysts wrote in a research report published in November.” | press | 2026-08-27 |
| s16 | ETR: 2026 Observatory for Identity Security summary “Microsoft’s Entra ID and Okta distinguish themselves above the array of solutions for positive directional spend and perceptions of product leadership, with Entra chosen by users as the top rebuild choice and Okta as the most innovative, compounded by high usage intentions.” | research | 2026-08-27 |
| s17 | SiliconANGLE: article on Okta earnings results “For its full fiscal year 2026, Okta reported adjusted earnings per share of $3.50, up from $2.81 in the fiscal year prior, on revenue of $2.919 billion, up 12% year-over-year.” | press | 2026-08-27 |
| s18 | CNBC: article on Okta earnings results “Revenue rose 11% from $728 million a year ago, Okta said. Net income totalled $116 million, or 65 cents per share, up from $67 million, or 37 cents per share a year ago.” | press | 2026-08-27 |
| s19 | CyberScoop: article on Okta and the Permiso Security deal “A crucial part of the deal, according to Kahn, is that Permiso will bring visibility beyond Okta’s current threat detection products, telling CyberScoop that customers also rely on other identity systems, such as Microsoft Entra ID or Active Directory , that fall outside that view.” | press | 2026-08-27 |
| s20 | The Record: article on the Okta customer support system breach ““We have determined that the threat actor ran and downloaded a report that contained the names and email addresses of all Okta customer support system users,” Okta Chief Security Officer David Bradbury wrote.” | press | 2026-08-27 |
| s21 | TechCrunch: article on Cloudflare and 1Password after the Okta support breach “Both Cloudflare and 1Password said their recent intrusions were linked to the Okta breach, but that the incidents did not affect their customer systems or user data.” | press | 2026-08-27 |
| s22 | Microsoft Learn: Microsoft Entra licensing page “Microsoft Entra ID Free : Included with Microsoft cloud subscriptions such as Microsoft Azure, Microsoft 365, and others.” | official | 2026-08-27 |
| s23 | GitHub: auth0/node-jsonwebtoken repository page “auth0 / node-jsonwebtoken Public” | research | 2026-08-27 |
| s24 | Okta: secure AI solutions page covering Okta for AI Agents “Automate the full lifecycle for your non-human workforce from a single control plane.” | official | 2026-08-27 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Okta: homepage with customer stories “From chocolates to Chihuahuas: Okta helps Mars securely expand their universe of brands.” | official | 2026-08-27 |
| s2 | Okta: Workforce Identity product page “Okta Integration Network (OIN) Access 8,000+ pre-built integrations to seamlessly connect and secure your technology stack.” | official | 2026-08-27 |
| s3 | Auth0: developer platform home page “Integrate auth into any stack in minutes Use our 30+ SDKs and Quickstarts to integrate auth into any language or framework.” | official | 2026-08-27 |
| s4 | Okta: Identity Governance product page “Build access reviews and self-service access requests within a single Identity solution to strengthen security without slowing business.” | official | 2026-08-27 |
| s5 | Okta: Privileged Access product page “Okta Privileged Access provides unified access and governance for privileged resources – whether on-prem or cloud – and increases visibility, compliance and security without compromising user experience.” | official | 2026-08-27 |
| s6 | Okta: Identity Threat Protection product page “Okta seamlessly integrates identity signals with intelligence from your SaaS and security solutions to continuously detect emerging threats and automate responses.” | official | 2026-08-27 |
| s7 | Okta: company page “In 2009, co-founders Todd McKinnon and Frederic Kerrest created a new category with Identity-as-a-Service (IDaaS).” | official | 2026-08-27 |
| s8 | Okta: plans and pricing page “Everything in Starter, plus: Adaptive MFA Privileged Access Lifecycle Management Access Governance 50 Workflows” | official | 2026-08-27 |
| s9 | Okta: blog post announcing FedRAMP High authorization “Today, we reached an exciting new milestone in our ongoing commitment to the Federal government: Okta for Government High, our modern Identity platform built exclusively for the US Federal government and its mission partners, achieved a FedRAMP High Impact level authorization.” | official | 2026-08-27 |
| s10 | Auth0: AI agents product page “Let your AI agents identify users, call APIs, and connect to MCP servers more securely. Get it done with fine-grained controls and just a few lines of code.” | official | 2026-08-27 |
| s11 | Okta: newsroom release on the 2025 Gartner Magic Quadrant for Access Management “Okta, Inc. (NASDAQ:OKTA), the leading independent identity partner, today announced that it has been recognized as a Leader in the 2025 Gartner Magic Quadrant for Access Management for the ninth consecutive year.” | official | 2026-08-27 |
| s12 | Okta: newsroom release on the Permiso Security acquisition “We are excited to announce that today Okta closed its acquisition of Permiso Security.” | official | 2026-08-27 |
| s13 | Okta Security Trust Center: certification listing and product authorizations “Okta’s DoD Impact Level 4 authorization permits Okta for US Military to be used as an on-demand identity and access management services for DoD authorized IL4 and IL5 environments.” | official | 2026-08-27 |
| s14 | FedRAMP Marketplace: Okta IDaaS Government High Cloud listing “Okta IDaaS Government High Cloud (GHC) Package ID FR2131856836” | regulatory | 2026-08-27 |
| s15 | The Register: article on identity vendors and AI agent access “This puts identity access management vendors like Okta, Ping Identity, and Microsoft Entra ID in the driver's seat to establish secure, repeatable architectures, Cser and other Forrester analysts wrote in a research report published in November.” | press | 2026-08-27 |
| s16 | ETR: 2026 Observatory for Identity Security summary “Microsoft’s Entra ID and Okta distinguish themselves above the array of solutions for positive directional spend and perceptions of product leadership, with Entra chosen by users as the top rebuild choice and Okta as the most innovative, compounded by high usage intentions.” | research | 2026-08-27 |
| s17 | SiliconANGLE: article on Okta earnings results “For its full fiscal year 2026, Okta reported adjusted earnings per share of $3.50, up from $2.81 in the fiscal year prior, on revenue of $2.919 billion, up 12% year-over-year.” | press | 2026-08-27 |
| s18 | CNBC: article on Okta earnings results “Revenue rose 11% from $728 million a year ago, Okta said. Net income totalled $116 million, or 65 cents per share, up from $67 million, or 37 cents per share a year ago.” | press | 2026-08-27 |
| s19 | CyberScoop: article on Okta and the Permiso Security deal “A crucial part of the deal, according to Kahn, is that Permiso will bring visibility beyond Okta’s current threat detection products, telling CyberScoop that customers also rely on other identity systems, such as Microsoft Entra ID or Active Directory , that fall outside that view.” | press | 2026-08-27 |
| s20 | The Record: article on the Okta customer support system breach ““We have determined that the threat actor ran and downloaded a report that contained the names and email addresses of all Okta customer support system users,” Okta Chief Security Officer David Bradbury wrote.” | press | 2026-08-27 |
| s21 | TechCrunch: article on Cloudflare and 1Password after the Okta support breach “Both Cloudflare and 1Password said their recent intrusions were linked to the Okta breach, but that the incidents did not affect their customer systems or user data.” | press | 2026-08-27 |
| s22 | Microsoft Learn: Microsoft Entra licensing page “Microsoft Entra ID Free : Included with Microsoft cloud subscriptions such as Microsoft Azure, Microsoft 365, and others.” | official | 2026-08-27 |
| s23 | GitHub: auth0/node-jsonwebtoken repository page “auth0 / node-jsonwebtoken Public” | research | 2026-08-27 |
| s24 | Okta: secure AI solutions page covering Okta for AI Agents “Automate the full lifecycle for your non-human workforce from a single control plane.” | official | 2026-08-27 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.