What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-06-01 compared with 2022-12-01 · 93 added, 118 removed, 794 unchanged (21% of the section changed)

12 unchanged sentences

• If we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and customer satisfaction or adequately address competitive challenges.

• The effects of the COVID-19 pandemic have affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.

• We face intense competition, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

4 unchanged sentences

• We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

• The ongoing integration of Auth0 may cause a disruption in our business.

• We may not realize potential benefits from the acquisition of Auth0 because of difficulties related to integration, the achievement of synergies, and other challenges.

• If there are interruptions or performance problems associated with our technology or infrastructure, our existing customers may experience service outages, and our new customers may experience delays in the deployment of our platform.

2 unchanged sentences

• The stock price of our Class A common stock may be volatile or may decline.

• The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our initial public offering (“IPO”), including our directors, executive officers, and their affiliates, who held in the aggregate 41.7% of the voting power of our capital stock as of October 31, 2022.

• The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our initial public offering (“IPO”), including our directors, executive officers, and their affiliates, who held in the aggregate 41.2% of the voting power of our capital stock as of April 30, 2023.

This will limit or preclude your ability to influence corporate matters, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

1 unchanged sentence

We may not have sufficient cash flow from our business to pay our indebtedness.

• We depend on our executive officers and other key employees, and the loss of one or more of these employees or an inability to attract and retain other highly skilled employees could harm our business.

Risks Related to Our Business and Industry

1 unchanged sentence

Our revenue, results of operations and cash flows depend on the overall demand for our products.

Concerns about the inflation and interest rate environment, the COVID-19 pandemic, the systemic impact of a widespread recession (in the United States or internationally), energy costs, geopolitical issues, such as Russia’s invasion of Ukraine, or the availability and cost of credit have and could continue to lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S.

economy and abroad, which in

turn could result in reductions in workforce identity and customer identity spending by our existing and prospective customers.

Concerns about the inflation and interest rate environment, the instability of financial institutions, COVID-19, the systemic impact of a widespread recession (in the United States or internationally), energy costs, geopolitical issues, such as Russia’s invasion of Ukraine, or the availability and cost of credit have and could continue to lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S.

economy and abroad, which in turn could result in reductions in workforce identity and customer identity spending by our existing and prospective customers.

These economic conditions can occur abruptly.

16 unchanged sentences

In future periods, we may not be able to sustain revenue growth consistent with recent history, or at all.

We believe our revenue growth depends on a number of factors, such as macroeconomic conditions including the inflation and interest rate environment, budget constraints and the economic impact of the COVID-19 pandemic, as well as, but not limited to, our ability to:

We believe our revenue growth depends on a number of factors, such as macroeconomic conditions including the inflation and interest rate environment, budget constraints and the economic impact of COVID-19, as well as, but not limited to, our ability to:

• price our platform effectively so that we are able to attract and retain customers without compromising our profitability;

22 unchanged sentences

We have experienced, and may continue to experience, rapid growth and organizational change, which has placed, and may continue to place, significant demands on our management and our operational and financial resources.

For example, our headcount has grown from 4,584 employees as of October 31, 2021 to 6,037 employees as of October 31, 2022.

For example, our headcount has grown from 5,342 employees as of April 30, 2022 to 5,683 employees as of April 30, 2023.

We have also experienced significant growth in the number of customers, users and logins and in the amount of data that our Software-as-a-Service (“SaaS”) infrastructure supports.

6 unchanged sentences

In addition, as we expand our business, it is important that we continue to maintain a high level of customer service and satisfaction.

As our customer base continues to grow, we will need to expand our account management, customer service and other personnel, and our network of ISVs, system integrators and other channel partners, to provide personalized account management and customer service.

As our customer base continues to grow, we will need to expand our account management, customer service and other personnel, and our network of ISVs, system integrators and other channel partners, to

provide personalized account management and customer service.

If we are not able to continue to provide high levels of customer service, our reputation, as well as our business, results of operations and financial condition, could be harmed.

The effects of the COVID-19 pandemic have materially affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.

The extent of the impact of COVID-19 on our future operational and financial performance remains uncertain and will depend on certain developments, including the duration and spread of COVID-19 and variants of concern, the manufacture, distribution, efficacy and public acceptance of COVID-19 treatments and vaccines, related public health measures, including vaccine mandates, and their impact on the global economy, our customers, employees and vendors.

While some governments around the world have lifted restrictions and distributed vaccines, there remains significant uncertainty around the recovery due to the challenging logistics of distributing the vaccines globally, as well as the unknown impact of emerging variants of COVID-19.

This pandemic has resulted in a widespread health crisis that is adversely affecting broader economies and financial markets.

The conditions caused by the COVID-19 pandemic have and may continue to affect the rate of IT spending and have and could adversely affect our current and potential customers’ ability or willingness to purchase our offerings.

It has and could continue to delay current and prospective customers’ purchasing decisions, adversely impact our ability to provide professional services to our customers, delay the provisioning of our offerings, lengthen payment terms, reduce the value or duration of our subscription contracts, or affect customer attrition rates, all of which could adversely affect our future sales, operating results and overall financial performance.

Our operations have been and may continue to be affected by a range of external factors related to the COVID-19 pandemic that are not within our control.

For example, many cities, counties, states and countries imposed or may impose a wide range of restrictions on our employees’, partners’, customers’ and potential customers’ physical movement to limit the spread of COVID-19.

If the COVID-19 pandemic has a substantial impact on our employees’, partners’, customers’ or potential customers’ attendance or productivity, our results of operations and overall financial performance may be harmed.

The duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time, such as the efficacy, global availability and acceptance of COVID-19 vaccines, the severity and transmission rate of the virus and emerging variants of concern, the extent and effectiveness of containment actions and the impact of these and other factors on our employees, customers, partners and vendors as well as the global economy.

Although global economic conditions have generally improved with the rollout of COVID-19 vaccines, business activity may not recover as quickly as anticipated, including as a result of inflationary pressures and the responses by central banking authorities to control such inflation, rising interest rates, debt and equity market fluctuations, diminished liquidity and credit availability, increased unemployment rates, decreased investor and consumer confidence, political turmoil and supply chain challenges.

Despite our best efforts to manage the impact of such events effectively, our business still may be harmed.

We face intense competition, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

10 unchanged sentences

Our competitors vary in size and in the breadth and scope of the products and services offered.

However, many of our competitors have substantial competitive advantages such as significantly greater financial, technical, sales and marketing, distribution, customer support or other resources, larger intellectual property portfolios, longer operating

histories, greater resources to make strategic acquisitions and greater name recognition than we do.

Our principal competitor is Microsoft.

27 unchanged sentences

In the past, some of our customers have elected not to renew their agreements with us, and it is difficult to accurately predict long-term customer retention and expansion rates.

Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products, our product support, our prices and pricing plans, particularly in light of COVID-19-related economic conditions, the inflation and interest rate environment and increased costs, the prices of competing software products, reductions in our customers’ spending levels, user adoption of our platform, deployment success, utilization rates by our customers, new product releases and changes to the packaging of our product offerings.

Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products, our product support, our prices and pricing plans, particularly in light of macroeconomic conditions, the inflation and interest rate environment and increased costs, the prices of competing software products, reductions in our customers’ spending levels, user adoption of our platform, deployment success, utilization rates by our customers, new product releases and changes to the packaging of our product offerings.

If our customers do not purchase additional subscriptions or renew their subscriptions, renew on less favorable terms or fail to add more users, our revenue may decline or grow less quickly than anticipated, which would harm our future results of operations.

6 unchanged sentences

If we fail to meet or exceed such expectations for these or any other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

Health epidemics, such as COVID-19, have affected and in the future could affect how we and our customers and partners operate our businesses.

Our and our customers’ and partners’ businesses and operations have been, and could in the future be, adversely affected by health epidemics, such as COVID-19.

COVID-19 and efforts to control its spread curtailed the

movement of people, goods and services worldwide, including in the regions in which we and our customers and partners operate, and significantly impacted economic activity and financial markets.

The economic uncertainty caused by COVID-19 has made, and COVID-19 or future health epidemics may continue to make it difficult for us to forecast revenue and results of operations and to make decisions regarding operational cost structures and investments.

While the World Health Organization recently recommended that COVID-19 no longer be considered a public health emergency of international concern, the duration and extent of the impact from COVID-19 and potential future health epidemics cannot be accurately predicted at this time and could negatively impact, our revenue and results of operations.

We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

4 unchanged sentences

• the timing and success of new product introductions by us or our competitors or any other change in the competitive landscape of our market;

• pricing pressure as a result of competition, the inflation and interest rate environment and increased costs, COVID-19 or otherwise;

• pricing pressure as a result of competition, the inflation and interest rate environment and increased costs;

• seasonal buying patterns for IT spending;

29 unchanged sentences

In addition, we have limited experience in acquiring other businesses.

If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel, integrate the acquired operations and technologies, adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”), or effectively manage the combined business following the acquisition.

If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel, integrate the acquired operations and technologies, and adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”), or effectively manage the combined business following the acquisition.

For example, we have experienced aspects of such challenges in connection with our May 2021 acquisition of Auth0.

We may not be able to find and identify desirable acquisition targets or we may not be successful in entering into an agreement with any particular target.

14 unchanged sentences

In addition, if an acquired business fails to meet our expectations, our business, results of operations and financial condition could suffer.

For further risks related to our acquisition of Auth0, please see below under “Risks Related to the Acquisition of Auth0.”

Because our long-term success depends, in part, on our ability to expand the sales of our products to customers located outside of the United States, our business will be susceptible to risks associated with international operations.

5 unchanged sentences

• health epidemics, such as COVID-19, influenza and other highly communicable diseases or viruses;

• macroeconomic conditions, including the inflation and interest rate environment and the economic impact of the COVID-19 pandemic;

• macroeconomic conditions, including the inflation and interest rate environment and the economic impact of COVID-19;

• unexpected costs and errors in the localization of our products, including translation into foreign languages and adaptation for local practices and regulatory requirements;

2 unchanged sentences

• costs and liabilities related to compliance with the numerous and ever-growing landscape of U.S.

and international data privacy and cybersecurity regimes, many of which involve disparate standards and enforcement approaches, including implementation of the recently-announced agreement in principle between the European Union and United States to implement a successor framework to the EU-U.S.

and international data privacy and cybersecurity regimes, many of which involve disparate standards and enforcement approaches, including implementation of the agreement in principle between the European Union and United States to implement a successor framework to the EU-U.S.

Privacy Shield, to address cross-border data flows;

9 unchanged sentences

• political, economic and social instability, war, terrorist activities or armed conflict, including Russia's invasion of Ukraine;

• global economic uncertainty caused by global political events, including the United Kingdom's exit from the European Union, and similar geopolitical developments;

• global economic uncertainty caused by global political events;

• fluctuations in exchange rates that may increase the volatility of our foreign-based revenue and expense;

17 unchanged sentences

These assumptions are based upon historical trends for sales cycles and conversion rates associated with our existing customers.

As we continue to focus on sales to larger organizations and in light of the current COVID-19 environment, our sales cycles are lengthening in certain circumstances and becoming less predictable, which may harm our financial results.

As we continue to focus on sales to larger organizations and in light of the current macroeconomic environment, our sales cycles are lengthening in certain circumstances and becoming less predictable, which may harm our financial results.

Other factors that may influence the length and variability of our sales cycle include, among other things:

73 unchanged sentences

Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

Risks Related to the Acquisition of Auth0

The ongoing integration of Auth0 may cause a disruption in our business.

The ongoing integration following the acquisition of Auth0 (the “Acquisition”) could cause disruptions to our business or business relationships, which could have an adverse impact on results of operations.

Parties with which we have business relationships may experience uncertainty as to the future of such relationships and may delay or defer certain business decisions, seek alternative relationships with third parties or seek to alter their present business relationships with us.

Parties with whom we otherwise may have sought to establish business relationships may seek alternative relationships with third parties.

The ongoing integration of Auth0 may place a significant burden on our management and internal resources.

The diversion of management’s attention away from day-to-day business concerns and any difficulties encountered in the integration process could adversely affect our financial results.

We have incurred and expect to continue to incur significant costs, expenses and fees for professional services and other transaction costs in connection with the Acquisition.

We may also incur unanticipated costs in the integration of Auth0’s business with our business.

The substantial majority of these costs will be non-recurring expenses relating to the Acquisition.

We also have been and may become subject to further litigation related to the Acquisition, as discussed in Item 1, “Legal Proceedings” above, which could result in significant costs and expenses.

We may not realize potential benefits from the Acquisition because of difficulties related to integration, the achievement of synergies, and other challenges.

Prior to the consummation of the Acquisition, we and Auth0 operated independently, and there can be no assurances that our businesses can be combined in a manner that allows for the achievement of substantial benefits.

The ongoing integration process may require significant time and resources, and we may not be able to manage the process successfully as our ability to acquire and integrate larger or more complex companies, products or technologies in a successful manner is unproven.

For example, our business was impacted by short-term execution challenges related to the integration of our Auth0 and Okta sales organization earlier this year.

While we are refining the go-to-market strategy for the combined Auth0 and Okta sales organization, we may not achieve expected synergies and growth projections.

If we are not able to successfully integrate Auth0’s businesses with ours or pursue our customer and product strategy successfully, the anticipated benefits of the Acquisition may not be realized fully or may take longer than expected to be realized.

Further, it is possible that there could be a loss of our and/or Auth0’s key employees and customers, disruption of either company’s or both companies’ ongoing businesses or unexpected issues, higher than expected costs and an overall post‑completion process that takes longer than originally anticipated.

Specifically, the following issues, among others, must be addressed in combining Auth0’s operations with ours in order to realize the anticipated benefits of the Acquisition:

• combining the companies’ corporate functions;

• combining Auth0’s business with our business in a manner that permits us to achieve the synergies anticipated to result from the Acquisition, the failure of which would result in the anticipated benefits of the Acquisition not being realized in the timeframe currently anticipated or at all;

• maintaining existing agreements with customers, distributors, providers, talent and vendors and avoiding delays in entering into new agreements with prospective customers, distributors, providers, talent and vendors;

• determining whether and how to address possible differences in corporate cultures and management philosophies;

• integrating the companies’ administrative and information technology infrastructure;

• developing products and technology that allow value to be unlocked in the future;

• evaluating and forecasting the financial impact of the Acquisition transaction.

In addition, at times the attention of certain members of our management and resources may be focused on integration of the businesses of the two companies and diverted from day‑to‑day business operations, which may disrupt our ongoing business and the business of the combined company.

We may incur significant, non‑recurring costs in connection with the Acquisition and integrating the operations of Okta and Auth0, including costs to maintain employee morale and to retain key employees.

Management cannot ensure that the elimination of duplicative costs or the realization of other efficiencies will offset the transaction and integration costs in the long term or at all.

Actions that we are taking to restructure our business to improve profitability may not be as effective as anticipated.

During the first quarter of fiscal 2024, we announced a world-wide restructuring plan intended to reduce operating expenses and improve profitability.

We may encounter challenges in the execution of these efforts, and these challenges could impact our ability to execute on our business initiatives and could impact our financial results.

If we are unable to realize the expected outcomes from our restructuring efforts, our business and results of operations may be harmed.

Increased and complex scrutiny of environmental, social and governance (“ESG”) matters may require us to incur additional costs or otherwise adversely impact our business.

Increased attention to climate change;

diversity, equity and inclusion;

and other ESG issues, as well as societal expectations regarding voluntary ESG initiatives and disclosures, may result in increased costs (including but not limited to increased costs related to compliance, stakeholder engagement and contracting), impact our reputation, or otherwise affect our business performance.

In addition, organizations that provide information to investors on corporate governance and related matters have developed ratings processes for evaluating companies on ESG matters.

Such ratings are used by some investors to inform their investment or voting decisions.

Unfavorable ESG ratings could lead to negative investor sentiment toward us and/or our industry, which could have a negative impact on our access to and costs of capital.

To the extent ESG matters negatively impact our reputation, we may also not be able to compete as effectively to recruit or retain employees.

We may take certain actions, including the establishment of ESG-related goals or targets, to improve our ESG profile and/or respond to stakeholder demand;

however, such actions may be costly or be subject to numerous conditions that are outside our control, and we cannot guarantee that such actions will have the desired effect.

Moreover, while we may create and publish voluntary disclosures regarding ESG matters from time to time, many of the statements in those voluntary disclosures are based on hypothetical expectations and assumptions that may or may not be representative of current or actual risks or events or forecasts of expected risks or events, including the costs associated therewith.

Such expectations and assumptions are necessarily uncertain and may be prone to error or subject to misinterpretation given the long timelines involved and the lack of an established single approach to identifying, measuring and reporting on many ESG matters.

Such disclosures may also be at least partially reliant on third-party information that we have not independently verified or cannot be independently verified.

In addition, we expect there will likely be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters, and increased regulation will likely lead to increased compliance costs as well as

scrutiny that could heighten all of the risks identified in this risk factor.

Such ESG matters may also impact our customers, which may adversely impact our business, financial condition, or results of operations.

Risks Related to Intellectual Property, Infrastructure Technology, Data Privacy and Security

23 unchanged sentences

In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time and generally are not recognized until launched against a target.

As a result, we and our third-party service providers may be unable to anticipate these techniques or implement adequate preventative measures quickly enough to prevent either an electronic intrusion into our systems or services or a compromise of customer data, employee data or other protected information.

As a result, we and our third-

party service providers may be unable to anticipate these techniques or implement adequate preventative measures quickly enough to prevent either an electronic intrusion into our systems or services or a compromise of customer data, employee data or other protected information.

Our customers’ use of Okta to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform, which stores, transmits and processes customers’ proprietary information and users’ personal data.

14 unchanged sentences

Any of these negative outcomes could adversely impact market acceptance of our products and could harm our business, results of operations and financial condition.

Third parties have induced and may continue to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our applications, internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platform, interruptions or malfunctions in our operations, account lock outs, and, ultimately, harm to our future business prospects and revenue.

We may be required to expend significant capital and financial resources to protect against such threats or to alleviate problems caused by breaches in security.

Third parties have induced and may continue to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our applications, internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platform, interruptions or malfunctions in our operations, account lockouts, and, ultimately, harm to our future business prospects and revenue.

required to expend significant capital and financial resources to protect against such threats or to alleviate problems caused by breaches in security.

Any actual or perceived failure by us to comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements could result in proceedings, actions or penalties against us.

8 unchanged sentences

We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection and information security in the United States, China, the European Union, India and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.

For example, the California Consumer Privacy Act (“CCPA”), which took effect on January 1, 2020, and soon the California Privacy Rights Act (“CPRA”), which will take effect on January 1, 2023 and will significantly modify the CCPA, broadly define personal information and give California residents expanded privacy rights and protections and provide for civil penalties for violations and a private right of action for data breaches.

The CPRA will also create a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.

Since the CPRA passed, Virginia, Colorado, Utah and Connecticut have each passed their own comprehensive privacy statutes that share similarities with the CCPA and CPRA and will take effect in 2023.

For example, the California Consumer Privacy Act (“CCPA”), which took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which took effect on January 1, 2023 and significantly modifies the CCPA, broadly define personal information and give California residents expanded privacy rights and protections and provide for civil penalties for violations and a private right of action for data breaches.

The CPRA also created a new state agency that is vested with authority to implement and enforce the CCPA and the CPRA.

Since the CPRA passed, a number of states have passed their own comprehensive privacy statutes that share similarities with the CCPA and CPRA and, depending on the jurisdiction, will take effect in 2023 or thereafter.

Some observers see this influx of state privacy regimes as a trend toward more stringent privacy legislation in the United States, including a potential federal privacy law, all of which could increase our potential liability and adversely affect our business.

3 unchanged sentences

With respect to cybersecurity in the United States, we are closely monitoring the development of rules and guidance pursuant to various executive orders that may apply to us, including, for example, pursuant to Executive Order 14028 for “critical software.” While the rules and guidance coming from the Order are still being developed, we could be categorized as a provider of critical software, which may increase our compliance costs and delay or prevent our ability to execute contracts with customers, including in particular with government entities.

Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks that Okta has contractually committed to comply with, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

committed to comply with, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

We publicly post our privacy policies and practices concerning our processing, use and disclosure of the personal data provided to us by our website visitors and by our customers, and other individuals with whom we interact.

7 unchanged sentences

We have attained multiple privacy certifications, such as the Asia-Pacific Economic Cooperation Privacy Recognition for Processors, and the European Union Cloud Code of Conduct, Level 2.

If we fail to maintain our privacy certifications, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.

If we fail to maintain our privacy certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed products, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.

We may face particular privacy, data security and data protection risks in Europe due to stringent data protection and privacy laws, including the European General Data Protection Regulation, and increased scrutiny over EU-U.S.

19 unchanged sentences

In June 2021, the European Commission issued new SCCs that account for the CJEU’s “Schrems II” decision.

The new SCCs must be used for relevant new data transfers, and existing SCCs arrangements must be migrated to the new SCCs by December 27, 2022.

The new SCCs must be used for relevant new data transfers, and existing SCCs arrangements were required to be migrated to the new SCCs by December 27, 2022.

These new SCCs only apply to the transfer of personal data outside the EEA, and not the United Kingdom.

3 unchanged sentences

and European Commission announced that they had agreed in principle to a new “Trans-Atlantic Data Privacy Framework” to enable trans-Atlantic data flows and address the concerns raised in the Schrems II decision.

There is no clear timeline for the enactment of this new framework.

Moreover, once enacted, the new framework is likely to be subject to legal challenges and may be struck down by the CJEU.

This new EU-U.S.

Data Privacy Framework (“DPF”) has not been implemented beyond an executive order signed by President Biden on October 7, 2022 on Enhancing Safeguards for United States Signals Intelligence Activities.

On February 28, 2023, the European Data Protection Board (“EDPB”) issued its Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the DPF, noting that certain aspects of the DPF still needed to be clarified or developed further.

On April 13, 2023, the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (“LIBE”) also voted in favor of a resolution urging the CJEU not to approve the current draft of the DPF.

While neither the LIBE resolution nor the EDPB opinion are binding on the CJEU, if enacted, the new framework is likely to be subject to further legal challenges and may be struck down by the CJEU.

Although we believe we continue to satisfy regulatory requirements through our use of SCCs, these latest developments may require major changes to our data transfer policy, including the need to conduct legal, technical, and security assessments for each data transfer from the EEA and UK to a country outside of the EEA and UK.

5 unchanged sentences

These recent developments will require us to review and may require us to amend the legal mechanisms by which we make and/or receive personal data transfers to/in the United States.

The regulatory environment applicable to the handling of EEA and UK residents' personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, operating results and financial condition being harmed.

The regulatory environment applicable to the handling of EEA and UK residents' personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, results of operations and financial condition being harmed.

We and our customers may face a risk of enforcement actions by data protection authorities in the EEA and UK relating to personal data transfers to us and by us from the EEA and UK.

Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition.

Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, results of operations and financial condition.

We also continue to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information to be stored in the jurisdiction of origin.

2 unchanged sentences

Any investigation or charges by EEA and UK data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new customers.

We may find it necessary to establish systems to maintain EEA and UK personal data within the EEA and UK, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.

We may find it necessary to establish systems to maintain EEA and UK personal data within

the EEA and UK, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.

We function as a HIPAA Business Associate for certain of our customers and, as such, are subject to strict privacy and data security requirements.

8 unchanged sentences

In addition, many state laws govern the privacy and security of health information in certain circumstances, many of which differ from HIPAA and each other in significant ways and may not have the same effect.

In addition, the U.S.

Department of Health & Human Services recently proposed modifications to the HIPAA privacy regulations (“Privacy Rule”), including certain changes designed to strengthen individuals’ right to access their own health information, improve information sharing for care coordination and case management, and reduce administrative burdens on HIPAA covered entities, while continuing to protect individuals’ health information privacy interests.

The proposed rulemaking has not yet been finalized.

We will continue to monitor whether any final modifications to the Privacy Rule may obligate us to change our practices.

Significant changes to HIPAA, including interpretation and application of HIPAA, could negatively impact our business.

Further, certain modifications have been proposed to the HIPAA privacy regulations, and we expect that there will continue to be changes to health information privacy laws in the United States, including HIPAA, and we cannot yet determine the impact such changes to existing laws, regulations and standards may have on our business.

If we fail to maintain our security attestations and certifications, our business, results of operations and financial condition may suffer.

Security is a mission-critical issue for Okta and for our customers.

We have attained multiple certifications, including SOC 2 Type II certifications, CSA Star Level 2 Attestation, ISO/IEC 27001:2013, ISO/IEC 27018:2019 certifications, and agency FedRAMP Moderate Authorities to Operate.

We also support FIPS 140-2 encryption requirements.

If we fail to maintain our security attestations and certifications, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.

If we fail to maintain our security attestations and certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed products, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.

We provide service level commitments under our customer contracts.

35 unchanged sentences

We may experience occasional system interruptions that make some or all systems or data unavailable or prevent us from efficiently providing access to our platform.

We also rely on third-party computer systems, broadband and other communications systems and service providers in connection with providing access to our platform generally.

We also rely on third-party information technology systems, broadband and other communications systems and service providers in connection with providing access to our platform generally.

Any interruptions, outages or delays in our systems and infrastructure, our business and/or third parties, or deterioration in the performance of these systems and infrastructure, could impair our ability to provide access to our platform.

85 unchanged sentences

Our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from new customers is generally recognized over the applicable service period.

Additionally, due to the complexity of certain of our customer contracts, the actual revenue recognition treatment required under Accounting Standards Update No.

2014-09, Revenue from Contracts with Customers (Topic 606), will depend on contract-specific terms and may result in greater variability in revenue from period to period.

Additionally, due to the complexity of certain of our customer contracts, the actual revenue recognition treatment required under relevant accounting principles generally accepted in the United States (“GAAP”) will depend on contract-specific terms and may result in greater variability in revenue from period to period.

In addition, a decrease in new subscriptions or renewals in a reporting period may not have an immediate impact on billings for that period.

18 unchanged sentences

In addition, we use channel partners to sell our products and conduct business on our behalf abroad.

We or such partners may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and under certain circumstances we could be held liable for the corrupt or other illegal activities of such partners, and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.

activities of such partners, and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.

We have implemented an anti-corruption compliance program but cannot ensure that all our employees and agents, as well as those companies to which we outsource certain of our business operations, will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.

23 unchanged sentences

Changes in tax laws or regulations in the various tax jurisdictions we are subject to that are applied adversely to us or our customers could increase the costs of our products and harm our business.

New income, sales, use, value-added or other taxes, tax laws, statutes, rules, regulations or ordinances could be enacted at any time.

Those enactments could harm our domestic and international business operations, and our business and financial performance.

New income, sales, use, value-added or other transaction level taxes, tax laws, statutes, rules, regulations or ordinances could be enacted at any time.

Those enactments could adversely impact our domestic and international business operations, and our business and financial performance.

Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us.

1 unchanged sentence

If we raise our prices to offset the costs of these additional taxes, existing and potential future customers may elect not to purchase our products in the future.

Additionally, new, changed, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products.

Additionally, new, changed, modified or newly interpreted or applied tax laws could

increase our customers’ and our compliance, operating and other costs, as well as the costs of our products.

Further, these events could decrease the capital we have available to operate our business.

23 unchanged sentences

federal taxable income may be subject to limitations, which could potentially result in increased future tax liability to us.

On March 27, 2020, the U.S.

government enacted the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”), which included temporary relief from the net operating loss limitations imposed by the Tax Cuts and Jobs Act for tax years beginning after December 31, 2017 and before January 1, 2021, and made certain technical corrections to applying the net operating loss utilization limitations for tax years beginning after January 1, 2021.

Our ability to use our net operating losses is conditioned upon generating future U.S.

1 unchanged sentence

Since we do not know whether or when we will generate the U.S.

federal taxable income necessary to use our remaining net operating losses, these net operating loss carryforwards generated prior to our tax year ended January 31, 2018 could expire unused.

federal taxable income necessary to use our remaining net operating losses, these net operating loss carryforwards generated prior to our fiscal 2018 could expire unused.

If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired.

15 unchanged sentences

Further, such changes could potentially affect our reporting of transactions completed before such changes are effective.

Accounting principles generally accepted in the United States (“GAAP”) are subject to interpretation by the Financial Accounting Standards Board (“FASB”), the SEC and various bodies formed to promulgate and interpret appropriate accounting principles.

GAAP are subject to interpretation by the Financial Accounting Standards Board (“FASB”), the SEC and various bodies formed to promulgate and interpret appropriate accounting principles.

A change in these principles or interpretations could have a significant effect on our reported financial results, and could affect the reporting of transactions completed before the announcement of a change.

3 unchanged sentences

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity, and the amount of revenue and expenses that are not readily apparent from other sources.

Significant assumptions and estimates used in preparing our condensed consolidated financial statements include, but are not limited to those related to the valuation of goodwill and purchased intangible assets arising from business combinations, revenue recognition, period of benefit for deferred commissions, incremental borrowing rates for operating leases, effective interest rates for convertible notes, valuation of deferred income taxes and valuation of certain equity awards assumed.

Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A common stock.

Significant assumptions and estimates used in preparing our condensed consolidated financial statements include, but are not limited to those referenced in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A common stock.

Risks Related to Ownership of Our Class A Common Stock

1 unchanged sentence

The trading price of our Class A common stock has been, and in the future, may be, subject to substantial volatility and wide fluctuations.

For example, from November 1, 2021 through October 31, 2022, the trading price of our Class A common stock has ranged from $47.54 per share to $272.27 per share.

For example, from May 2, 2022 through April 30, 2023, the trading price of our Class A common stock has ranged from $44.12 per share to $125.30 per share.

The market price of our Class A common stock may fluctuate significantly in response to numerous factors, many of which are beyond our control, including, but not limited to:

19 unchanged sentences

Our involvement in securities litigation could subject us to substantial costs, divert resources and the attention of management from our business, and harm our business.

The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 41.7% of the voting power of our capital stock as of October 31, 2022.

The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 41.2% of the voting power of our capital stock as of April 30, 2023.

Our Class B common stock has ten votes per share and our Class A common stock has one vote per share.

As of October 31, 2022, our directors, executive officers, and their affiliates, held in the aggregate 41.7% of the voting power of our capital stock.

As of April 30, 2023, our directors, executive officers and their affiliates held in the aggregate 41.2% of the voting power of our capital stock.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively could continue to control nearly a majority of the combined voting power of our common stock and be able to effectively control all matters submitted to our stockholders for approval until April 12, 2027, the date that is the ten-year anniversary of the closing of our IPO.

9 unchanged sentences

Accordingly, these shares will be able to be freely sold in the public market upon issuance, subject to applicable vesting requirements.

Furthermore, a substantial number of shares of our Class A common stock is reserved for issuance upon the exercise of the Notes (as defined below) and the Warrants (as defined below) issued at the time of the issuance of the 2023 Notes (as defined below).

Furthermore, a substantial number of shares of our Class A common stock is reserved for issuance upon the exercise of the Notes (as defined below) and the Warrants (as defined below).

If we elect to satisfy our conversion obligation on the Notes solely in shares of our Class A common stock upon conversion of the Notes, we will be required to deliver the shares of our Class A common stock, together with cash for any fractional share, on the second business day following the relevant conversion date.

61 unchanged sentences

The conversion features of the Notes, if triggered, may adversely affect our financial condition and results of operations.

As disclosed in Note 9 to our condensed consolidated financial statements, the 2023 Notes are currently convertible at the option of the holders, in whole or in part, as of October 15, 2022 until the close of business on the second scheduled trading day immediately preceding the maturity date, regardless of the conversion conditions.

In the event the conditional conversion features of the 2025 Notes and the 2026 Notes are triggered, holders of the Notes will be entitled to convert the Notes, as applicable, at any time during specified periods at their option.

1 unchanged sentence

The conditional conversion features of the 2025 Notes were triggered as of January 31, 2021 and the 2025 Notes were convertible at the option of the holders between February 1, 2021 and April 30, 2021;

however, as of October 31, 2022, the conditions allowing holders of the 2025 Notes to convert were not met.

From the date of issuance through October 31, 2022, the conditions allowing holders of the 2026 Notes to convert were not met.

however, as of April 30, 2023, the conditions allowing holders of the 2025 Notes to convert were not met.

From the date of issuance through April 30, 2023, the conditions allowing holders of the 2026 Notes to convert were not met.

In addition, even if holders do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital and could limit our ability to raise future capital.

The 2023 Notes were classified as current liabilities on the condensed consolidated balance sheet as of October 31, 2022.

Transactions relating to our Notes may affect the value of our Class A common stock.

The conversion of some or all of the Notes would dilute the ownership interests of existing stockholders to the extent we satisfy our conversion obligation by delivering shares of our Class A common stock upon any conversion of such Notes.

Our 2023 Notes are currently convertible at the option of their holders and our 2025 Notes and 2026 Notes may become in the future convertible at the option of their holders under certain circumstances.

Our 2025 Notes and 2026 Notes may become in the future convertible at the option of their holders under certain circumstances.

If holders of our Notes elect to convert their notes, we may settle our conversion obligation by delivering to them a significant number of shares of our Class A common stock, which would cause dilution to our existing stockholders.

In addition, in connection with the issuance of the 2023 Notes, we entered into convertible note hedges (“Note Hedges”) with certain financial institutions (the “2023 Notes Option Counterparties”).

We also entered into warrant transactions with the 2023 Notes Option Counterparties pursuant to which we sold warrants for the purchase of our Class A common stock (“Warrants”).

The Note Hedges are expected generally to reduce the potential dilution to our Class A common stock upon any conversion or settlement of the 2023 Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted 2023 Notes, as the case may be.

The Warrant transactions could separately have a dilutive effect to the extent that the market price per share of our Class A common stock exceeds the strike price of any Warrants unless, subject to the terms of the Warrant transactions, we elect to cash settle the Warrants.

Through October 31, 2022, Note Hedges corresponding to approximately 7.0 million shares have been terminated or settled.

As of October 31, 2022, Note Hedges giving us the option to purchase approximately 0.1 million shares (subject to adjustment) remained outstanding.

Through October 31, 2022, we have terminated Warrants corresponding to approximately 6.1 million shares.

As of October 31, 2022, Warrants to acquire up to approximately 1.0 million shares (subject to adjustment) remained outstanding.

In addition, in connection with the issuance of the 2023 Notes, we entered into warrant transactions with certain financial institutions (the “2023 Notes Option Counterparties”) pursuant to which we sold warrants for the purchase of our Class A common stock (“Warrants”).

Subject to the terms of the Warrants, we have elected to cash settle the Warrants.

Through April 30, 2023, we have terminated Warrants corresponding to approximately 6.1 million shares.

As of April 30, 2023, Warrants to acquire up to approximately 1.0 million shares (subject to adjustment) remained outstanding.

In addition, in connection with the issuance of the 2025 Notes and 2026 Notes, we entered into capped call transactions (“Capped Calls”) with certain financial institutions (the 2025 Notes and 2026 Notes Capped Call Counterparties and together with the 2023 Notes Option Counterparties, the “Option Counterparties”).

7 unchanged sentences

From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives.

For example, we recently announced the upcoming retirement of our President, Worldwide Field Operations at the end of our fiscal year, we appointed a new Chief Accounting Officer effective in August 2022 and our Executive Vice Chairman, Chief Operating Officer and co-founder is on sabbatical from November 2022 through October 2023.

For example, our General Counsel retired and a new Chief Legal Officer was appointed in March 2023.

Such changes in our executive management team may be disruptive to our business.

5 unchanged sentences

We have from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and may not be able to fill positions in the desired regions, or at all.

Our efforts to attract new personnel may be compounded by intensified restriction on travel (including during the COVID-19 pandemic), changes to immigration policy or the availability of work visas.

Our efforts to attract new personnel may be compounded by intensified restriction on travel, changes to immigration policy or the availability of work visas.

Many of the companies with which we compete for experienced personnel have greater resources than we have.

13 unchanged sentences

Incorporated by Reference from

Sabbatical Letter Agreement dated August 26, 2022, between J.

Frederic Kerrest and Okta, Inc.

Exhibit 99.2 to Form 8-K filed on August 31, 2022

Transition Agreement dated February 27, 2023, between Jonathan Runyan and Okta, Inc.

Filed herewith

31.1 Certification of the Chief Executive Officer pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

17 unchanged sentences

Pursuant to the requirements of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.

November 30, 2022 /s/ Brett Tighe

May 31, 2023 /s/ Brett Tighe

Chief Financial Officer

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors