OKTA · Analyze — Financebot

Trigger for this run: Q2 FY2027 print (reported 2026-08-26, after close), stock +28.6% same day to $172.91, the single biggest weekly move on the watchlist (+28.9% Aug 20 close $134.16 → Aug 27 close $172.91). OKTA was , sitting in the Trim Zone with no conviction score and no trim number — this report sets both. The print reframed the thesis: management positioned Okta as the identity/governance layer securing AI agents ("Okta for AI Agents" now GA to all customers; "Auth0 for AI Agents" for customer-facing agentic logins), and the market re-rated the whole independent-identity/cybersecurity complex on it (CRWD, ZS, S all popped the same day).

0. Knowledge-base check

python .mcp/kb.py find OKTA → no matches. Nothing in Knowledge/ on this name; this is a from-scratch first look. No prior OKTA report exists in Output/, so this is not a differential re-analysis.

1. General Health (Fundamentals)

TTM reconciliation — do not trust the vendor's trailing column

fin.py's pulled snapshot and Yahoo's get_stock_info trailing fields (trailingEPS $1.38, trailingPE 125.3x, totalRevenue $2.996B) are one trading day stale — they still reflect the four quarters ending 2026-04-30 (Q1 FY27) and have not rolled in the just-reported Q2 FY27 quarter (ended 2026-07-31, reported 2026-08-26). Summing the actual last four quarters gives a materially different picture:

TTM metric (sum of 4 actual quarters: Q2FY26 → Q2FY27)	Value
Revenue (742+765+761+805, using 728 in place of the stale figure — see table below)	$3.073B (+11.5% YoY)
GAAP net income (67+43+63+74... corrected: Q2FY26 67 + Q3FY26 43 + Q4FY26 63 + Q1FY27 74, replace oldest with Q2FY27 116)	$296M
GAAP diluted EPS (296M / ~180M diluted shares)	~$1.65
TTM P/E (actual)	~105x (vs Yahoo's stale 125.3x)
Free cash flow (Q2FY27 $227M + Q1FY27 $271M + Q4FY26 $252M + Q3FY26 $211M)	~$961M

Quarterly revenue build used: Q2FY26 (2025-07-31) $728M, Q3FY26 (2025-10-31) $742M, Q4FY26 (2026-01-31) $761M, Q1FY27 (2026-04-30) $765M, Q2FY27 (2026-07-31) $805M — TTM = Q1FY27+Q4FY26+Q3FY26+Q2FY27 = 765+761+742+805 = $3.073B.

Core metrics

Metric	Value	Trend
Revenue TTM	$3.073B	+11.5% YoY (reconciled); guide implies ~10% for Q3
Subscription revenue (Q2FY27)	$793M	+12% YoY
GAAP net income TTM	~$296M	Inflecting positive: 67→43→63→74→116 by quarter, choppy but rising
Non-GAAP operating margin (Q2FY27)	28.1% ($226M/$805M)	Beat the 26% guide; full-year FY27 guide implies ~25%
FCF TTM	~$961M (Yahoo trailing field shows $977.75M — close, small definitional gap)	FCF margin ~31% of TTM revenue
FCF/share (TTM ÷ ~180M diluted)	~$5.35	5-year-ish CAGR not meaningful — FCF only turned durably positive FY2023 ($63M) → FY2026 ($863M annual); 3yr CAGR 139% off a near-zero base, decelerating toward ~25-30% organic going forward
Revenue/share	~$17.09	Rising with revenue growth, partly offset by dilution
cRPO (subscription backlog, next 12mo)	$2.585B	+14% YoY — accelerated from +12% prior quarter, largest cRPO outperformance since Q4 FY2025 per management
RPO (total backlog)	$4.858B	+17% YoY
Net retention rate (TTM dollar-based)	107%	+1pt YoY — modest but positive expansion, first sustained improvement in several quarters
Debt/Assets	4.35%	Low; net cash position ~$2.17B (cash $2.59B vs debt $411-422M)
Debt trajectory	$2.37B (FY23) → $1.27B (FY24) → $952M (FY25) → $422M (FY26)	Steady deleveraging, essentially done
Shares outstanding (annual)	161.3M (FY23) → 167.1M (FY24) → 173.5M (FY25) → 177.4M (FY26)	+4.3% 3yr CAGR — still net dilutive despite buybacks
SBC as % of revenue	~19.8% (Q2FY26) → 18.6% → 17.6% → 15.3% (Q1FY27)	Declining trend — path toward GAAP profitability is visible, not yet arrived
Buybacks	$73M (FY26 full year) → $248M in Q1FY27 alone	Sharply stepped up — starting to bend the dilution curve, hasn't reversed it yet
Current ratio	1.43	Healthy

Capital allocation of FCF (priority order observed)

Debt paydown — aggressive and largely complete (down from $2.37B to $422M over 4 years); this is now a net-cash balance sheet.
Buybacks — light historically, ramping hard in FY27 ($248M in one quarter vs $73M for all of FY26). Still not fully offsetting SBC-driven dilution.
Tuck-in M&A — small and steady, ~$22-56M/year, not empire-building.
No dividend.

Verdict: capital allocation discipline has visibly improved — debt is gone, buybacks are accelerating — but SBC (15-20% of revenue) remains the dominant claim on FCF before shareholders see net share-count reduction. This is normal for the SaaS cohort but still a real cost: GAAP EPS understates cash generation, and FCF/share overstates what a buy-and-hold owner actually captures net of dilution.

2. Moat & Competitive Advantage

Quantitative base: Gross margin 77.4% (stable, high — SaaS-typical), ROE only 3.7% / ROA 1.1% (GAAP profitability is too recent and too thin to read ROIC as a moat signal yet — use gross margin + retention as the better proxies here). NRR 107%, trending up for the first time in several quarters — the moat's cash signature (expansion inside the existing base) is intact and modestly improving, not just holding the line.

Revenue-stream map: - Workforce Identity (SSO, MFA, lifecycle management, governance) — the legacy core, high switching costs once SSO is wired into thousands of enterprise app integrations. - Auth0 / Customer Identity (CIAM) — developer-facing identity for consumer/customer-facing apps, now extended to "Auth0 for AI Agents" (agentic login patterns for customer-facing AI products). - Okta for AI Agents (new, GA this quarter to all customers) — governance layer that discovers, authenticates, and manages AI agents as a new class of non-human identity. This is the reframe the print delivered: identity-as-infrastructure for the agentic-AI buildout, not just human SSO.

Adversarial stress-test: "You are Microsoft. How easily do you attack this?" — Very easily on paper: Entra ID ships bundled with Microsoft 365/Azure licensing, and bundling is the single biggest structural threat to any standalone IAM vendor. Okta's counter is being the neutral, multi-cloud, non-Microsoft-dependent identity layer for enterprises that explicitly don't want to be locked into one vendor's stack — a real but not unconditional moat; it only holds as long as "avoid platform lock-in" outweighs "bundling is free." CyberArk (now under Palo Alto Networks, acquired 2025) adds a second flank in privileged access, and native agent-identity offerings from the model/cloud vendors themselves (Anthropic, OpenAI, AWS, Azure) are a credible long-run disintermediation risk for the new AI-agent business specifically — the switching costs that protect legacy SSO haven't been proven yet for agent identity, which is a greenfield land-grab, not an installed base.

Disruption forecast: Near-term (1-2yr) — low disruption risk to the core workforce/CIAM business (switching costs are real and immediate). Medium-term (3-5yr) — the AI-agent-identity opportunity is the swing factor: if Okta wins the standard for how enterprises govern non-human/agent identities, it's a genuine TAM expansion on top of the existing moat; if a hyperscaler or a foundation-model vendor makes agent identity a bundled feature of their own platform, Okta's new segment could be squeezed the same way workforce IAM already is by Microsoft.

Evergreen assessment: The core identity business is a durable, evergreen infrastructure layer (identity doesn't go away). The AI-agent extension is not yet evergreen — it's an unproven, first-mover bet that the market is currently pricing as if it has already won.

2023 breach — status: The October 2023 customer-support breach (initially reported as affecting ~1% of customers, later disclosed as affecting all customer-support-system clients) was a real trust event. Search did not surface a specific, dated retention/NPS metric tying it to today's numbers, but the 107% NRR (rising, not falling) three years out is the best available proxy that the breach did not produce a structural logo- or dollar-retention problem — expansion inside the base has resumed an upward trend, not stayed depressed. Treat this as reasonably-but-not-fully resolved; no fresh incident has recurred.

3. Valuation

Applicable models: No dividend → DYT and DDM are N/A. Graham and FCF/reverse-DCF carry the weight, cross-checked against Bogle for expected-return context, per analysis_notes.md §3 for non-dividend growth names.

The forward-P/E trap — fired exactly as flagged

Yahoo's forwardPE = 39.51x off forwardEps = $4.3766. That EPS figure is not the FY2027 (current fiscal year, ending Jan 2027) consensus — it is next year's, FY2028. The correct current-fiscal-year read is epsCurrentYear = $3.85 at priceEpsCurrentYear = 44.9x, which lines up with Okta's own FY27 guidance of $3.90-$3.94 non-GAAP EPS (midpoint $3.92 → 44.1x current-price / current-FY-guide P/E). The vendor's headline "forward P/E" of 39.5x understates the real near-term multiple by roughly 5 points — this is [[pitfall-vendor-forward-eps-is-the-wrong-fiscal-year]] firing on OKTA exactly as it fired across the rest of the 8/27 batch.

Graham's Intrinsic Value

√(22.5 × EPS × BVPS) = √(22.5 × 1.65 [reconciled TTM diluted GAAP EPS] × 39.34 [BVPS]) ≈ $38. Versus a $172.91 price this looks like a 4.5x overvaluation, but the formula is close to meaningless here — heavy SBC keeps GAAP EPS thin, and $5.49B of goodwill on the balance sheet inflates book value without corresponding tangible earning power. Weight: near-zero, per the framework's own guidance for high-SBC growth software.

FCF / reverse-DCF read

TTM FCF ~$961M on a $30.05B market cap → FCF yield ~3.2%, P/FCF ~31x.
For a name growing revenue at 11-12% with a 31%-and-rising FCF margin, low-30s P/FCF is rich-but-defensible if the AI-agent TAM expansion is real; it is not a "cheap" multiple by any read.
Reverse-DCF sanity check: to justify a $30B market cap off a $961M FCF base at a ~9-10% discount rate, the market is pricing something in the high-teens FCF CAGR sustained for roughly 6-8 years. That is a large ask for a company whose core workforce-IAM segment is growing revenue at low double digits; it only clears if the AI-agent segment becomes a second growth engine at scale.

Bogle's Expected Return (broad context)

0% dividend yield + earnings growth (EPS guided +18-20% YoY at the midpoint for FY27) minus likely multiple normalization. If the current ~44x current-FY non-GAAP multiple mean-reverts toward a more typical 28-32x for an 11-14% grower over the next 2-3 years, that compression (roughly -30% cumulative) largely offsets the EPS growth — a close call, not a clean case either way. If instead the AI-agent narrative holds and the multiple stays elevated, returns track EPS growth (~high-teens annually). The spread between these two scenarios is unusually wide for this name right now, which is itself the risk to flag rather than resolve with false precision.

Fair value range

Blending a normalized 27-33x band on the FY27 guide midpoint ($3.92) with a smaller allowance for the AI-agent optionality (35-40x on the same base) gives a fair value range of roughly $100-$155. Current price ($172.91) sits above the top of that range — the one-day 28.6% pop, on top of a sector-wide cybersecurity re-rating (CRWD, ZS, S all moved the same day), has pushed the stock past what the fundamentals alone currently support, even crediting the reframe.

4. Sentiment & the print

Okta beat on every headline line for Q2 FY2027 (quarter ended 2026-07-31, reported 2026-08-26 after close):

Revenue $805M (+11% YoY) vs. Street $795M; non-GAAP EPS $1.05 vs. $0.97 consensus.
GAAP net income $116M ($0.65/sh) vs. $67M ($0.37/sh) a year ago — the clearest GAAP-profitability inflection yet.
Non-GAAP operating income $226M, 28.1% margin, beating the 26% guide.
FCF $227M, 28% FCF margin.
cRPO +14% YoY, accelerating from +12% last quarter — described by management as the largest cRPO outperformance since Q4 FY2025. This is the number that matters most for forward revenue and the one the sell-side leaned on hardest for upgrades.
FY27 guidance raised: revenue to $3.22-3.23B (from $3.19-3.21B), non-GAAP EPS to $3.90-3.94 (from $3.79-3.87).
Q3 FY27 guide: $813-817M revenue, ~10% YoY.

The stock moved from $134.42 (Aug 26 close) to $172.91 (Aug 27 close), +28.6% in one session, on 16.3M shares volume (vs. ~3.6M average) — a genuine outlier print, not a drift.

The reframe: Management leaned hard into "Okta for AI Agents" (now GA to all customers — governance/discovery/authentication for AI-agent identities) and "Auth0 for AI Agents" (agentic login patterns for customer-facing products), explicitly positioning identity as the security control point for the agentic-AI buildout rather than just human SSO. Sell-side upgrades on 8/27 cited this directly: DA Davidson $165→$190, KeyCorp $180→$190, TD Cowen $160→$175, with Morgan Stanley/BMO/Cantor/Stifel/Jefferies/Truist/Wells Fargo/KeyBanc also lifting targets, several explicitly citing the cRPO acceleration as the substantiating evidence behind the narrative (not just the narrative itself).

Sector context — some of this move is beta, not alpha: CrowdStrike posted its own best day ever the same session, and Zscaler/SentinelOne moved ~10% on the same day despite reporting nothing new themselves — headlined in the sourced coverage as "cybersecurity re-rating reaches the laggards." Part of OKTA's pop is name-specific (the beat, the cRPO accel, the guide raise); part is the whole identity/security complex re-rating together on the same AI-threat narrative. That distinction matters for how much of the +28.6% is durable versus how much unwinds if the sector-wide enthusiasm cools even while OKTA's own numbers hold.

The Palo Alto Networks angle — stale, not a live catalyst: Reports surfaced the same week that PANW CEO Nikesh Arora had explored acquiring both Datadog and Okta in late 2024 through early 2025 — talks that progressed to discussing product complementarity but stalled over valuation disagreement at a time Okta was valued around $13.5B. Okta's diluted market cap is now $30B, non-diluted ~$23B even before adjusting for today's pop — well above the level PANW already balked at once. Treat this as background context on strategic value, not a live M&A catalyst; PANW has since spent its acquisition budget on CyberArk (2025) and Chronosphere (Jan 2026), reducing the odds of a near-term repeat approach.

Insider activity: Pattern is routine, scheduled RSU-vest-driven selling across the CEO, CFO, President, and other officers/directors (Form 4s throughout 2025-2026, sale prices tracking the stock from the $70s up through the $150s) — no cluster of opportunistic selling immediately around this print (most recent officer sales predate the print: CEO sold 68,936 sh at $145.63-148.16 on 2026-07-08, before the beat was known). One small director open-market purchase (Schellhase, 3,712 sh at ~$72, April 2026) — not a meaningful golden flag, just noted for completeness. Nothing here changes the read.

5. Synthesis & Verdict

Tensions to name, not bury: - Fundamentals + Moat both improved — cRPO acceleration, rising NRR, declining SBC-as-%-of-revenue, a genuinely new and plausible TAM in agent-identity governance, and a clean net-cash balance sheet all argue the business is executing better, not worse. - Valuation disagrees — even after crediting the reframe, the fair-value range ($100-155) sits meaningfully below the post-print price ($172.91). GAAP TTM P/E is ~105x on the correctly-reconciled trailing figure; the correctly-identified current-FY non-GAAP multiple is ~44x, not the vendor's headline 39.5x. Neither is a "cheap" entry point. - A real part of the move is sector beta, not company-specific — the AI-threat re-rating lifted CRWD/ZS/S the same day. Sizing conviction on the assumption that all 28.6% is OKTA-specific alpha would be a mistake.

Per analysis_notes.md §0's framework: this reads as good business, expensive price — "wait/watch," not "value." Because the position is already , the actionable form of that read is a partial trim into strength, not an add and not a full exit — the underlying franchise (cRPO accel, NRR inflection, deleveraged balance sheet, a real shot at owning agent-identity governance) still earns a mid-conviction hold on the remainder.

Verdict: TRIM | conviction 6.0 — good and improving business, priced past what the fundamentals (even generously including the AI-agent optionality) currently support after a one-day, partly sector-driven 28.6% re-rating. Trim into current strength; let the remainder ride the identity-for-AI-agents thesis with a tighter multiple discipline than the market is currently applying.

Key risks

Microsoft bundling remains the structural ceiling on the core business — Entra ID ships free with M365/Azure; Okta's moat depends on enterprises continuing to value multi-cloud neutrality over bundled convenience.
The AI-agent segment is unproven and could be disintermediated — foundation-model vendors and hyperscalers (Anthropic, OpenAI, AWS, Azure) are natural competitors for governing the identities of their own agents; Okta's switching-cost moat in legacy SSO has not been demonstrated yet for this new category.
A meaningful share of the +28.6% move is sector-wide re-rating (CRWD/ZS/S all moved together), not OKTA-specific — if AI-threat enthusiasm for the whole cybersecurity complex cools, OKTA could give back more of the move than its own fundamentals would justify on their own.
Dilution is still net-positive despite accelerating buybacks — SBC at 15-20% of revenue continues to outpace the stepped-up ($248M/quarter) repurchase pace; per-share value creation is real but slower than headline FCF growth suggests.

Data traps hit (for orchestrator / Playbook)

[[pitfall-vendor-forward-eps-is-the-wrong-fiscal-year]] confirmed again on OKTA: forwardPE (39.51x) is built on forwardEps ($4.3766) which is the FY2028 estimate, not FY2027. The correct current-fiscal-year read is epsCurrentYear ($3.85, priceEpsCurrentYear 44.9x), which reconciles closely to Okta's own FY27 guide midpoint ($3.92 → ~44.1x). No edit made to the Playbook note per scope lock — text is returned below for the orchestrator to fold in as a fresh confirming instance if useful.
New pattern worth a note (not yet in Playbook), returned as text only: Yahoo's trailing-TTM fields (trailingEPS, trailingPE, totalRevenue) did not refresh same-day for an after-market earnings release — a fin.py/get_stock_info pull made the morning after an 8/26-after-close print still carried the stale four-quarter window ending in the prior quarter, missing the just-reported quarter entirely (TTM revenue read $2.996B vendor-trailing vs. $3.073B reconciled from the actual last four quarters; TTM EPS read $1.38 vendor-trailing vs. ~$1.65 reconciled). This is adjacent to pitfall-single-quarter-fcf-read-as-ttm and pitfall-yahoo-snapshot-fcf-field-diverges-from-quarter-sum but is specifically about vendor trailing-window staleness on the day immediately following an after-hours print — worth a dedicated pitfall if this recurs on the next same-day-earnings ticker in this batch.
Graham's Intrinsic Value formula returns $38 against a $172.91 price — a 4.5x apparent overvaluation that is an artifact of heavy SBC (thin GAAP EPS) and $5.49B goodwill (inflated book value), not a real signal. Weighted near-zero per the framework's own conditional-application rule for high-growth, high-SBC software names.

Sources: Okta Q2 FY2027 press release and investor commentary (investor.okta.com, s205.q4cdn.com), CNBC, Investor's Business Daily, GuruFocus/TradingView (PANW-Okta talks via The Information), Seeking Alpha, DailyPolitical/MarketBeat (analyst targets), Yahoo Finance MCP (get_stock_info, get_financial_statement quarterly income/cashflow, get_holder_info insider_transactions, get_historical_stock_prices), .mcp/fin.py OKTA --news.