Okta Stock Jumps 20% on a Long Identity Bet

Okta shares jumped 20.85% after hours to $162.45 on Wednesday, after the identity company reported $805 million in fiscal second-quarter revenue and nudged its year higher. Adjusted earnings were $1.05 a share, against a 97-cent LSEG estimate, and sales cleared a $795 million consensus by $10 million.

Revenue still rose only 11% from $728 million a year earlier. Chief financial officer Brett Tighe told analysts the AI-agent work remains too small to move fiscal 2027. Buyers paid as if chief executive Todd McKinnon’s 5-to-10-year identity claim had just been marked to market.

$805 Million, and a 20% After-Hours Bid

The regular session already leaked a few points. Okta closed at $134.42, up 2.92% on more than 7 million shares, then the after-hours tape added $28.03. CNBC rounded the move to 20%. MarketWatch printed $162.45 at 7:59 p.m. Eastern, a print above the $157 52-week high set in July.

Okta, in its total revenue of $805 million release for the quarter ended July 31, 2026, said subscription revenue was $793 million, up 12% and 99% of the total. Remaining performance obligations, the subscription backlog, were $4.858 billion, up 17% and above a $4.70 billion StreetAccount estimate. Current RPO, the slice expected in the next 12 months, was $2.585 billion, up 14%.

GAAP operating income doubled in margin terms, to $107 million, or 13% of sales, from $41 million and 6% a year earlier. Non-GAAP operating income was $226 million, a 28% margin, matching last year’s rate on a larger base. Cash, cash equivalents, and short-term investments were $2.299 billion after Okta paid off the last $350 million of its 2026 convertible notes in cash.

The posted commentary on the investor site filled in the mix. Workforce identity annual contract value grew 11% and was 59% of ACV. Customer identity grew 13% and was 41%. The dollar net retention rate was 107%. Customers at $1 million-plus ACV grew 22% to 605 and now represent more than $1 billion of ACV. The $100,000-plus cohort grew 6% to 5,255 and is about 85% of ACV.

McKinnon Wagers Identity Overtakes Network Security

McKinnon’s prepared line treated agents as a new identity class, not a feature toggle. “As AI agents transform every layer of technology, every agent needs a trusted identity and clear controls over what it can access and do,” he said in the earnings release.

On CNBC the same afternoon he went further, and that is the wager the tape paid for. Network security is still the largest cyber category, he said, but looking out five or 10 years, with millions of agents running around, “it’s definitely going to be identity.” He added that staying inside identity, rather than spreading across other cyber lines, “is really going to pay off.”

As AI agents transform every layer of technology, every agent needs a trusted identity and clear controls over what it can access and do.

Todd McKinnon, chief executive officer and co-founder, Okta second-quarter fiscal 2027 release

The bookings mix gives that speech a foothold without proving it. McKinnon told the call that new products were 30% of total bookings, with Okta Identity Governance the largest bucket, and that Okta for AI Agents sat inside the same pile. The company closed dozens of AI deals in the quarter, including several worth more than $1 million and a multi-million-dollar healthcare contract, CNBC reported. Tighe said those AI deals still run larger than the average Okta sale, and that they remain “very early.”

He was blunt about the P&L. AI-related revenue is expected to stay immaterial in fiscal 2027, with a chance it matters in fiscal 2028 if the current path holds, according to the call as carried by Benzinga and MarketBeat. That is the gap the 20.85% move has to live with: the category story is being priced now, the dollars are being guided later.

The 50-to-1,500 Agent Problem

McKinnon gave analysts a concrete count. A company that became an Okta for AI Agents customer started an evaluation with 50 Claude agents detected in its environment, he said on the call, then showed 1,500 of them when Okta came back a few weeks later. The posted commentary describes a similar upsell at a large appliance maker that needed to find unmanaged shadow AI, shut down rogue agents, and put hundreds of autonomous entities, including Gemini Enterprise agents, onto the same control plane as its workforce and customer identity stack.

A commercial insurer bought the product to keep agents on short-lived permissions, with a human in the loop on sensitive analysis, and a clean split between what a person did and what an agent did. That is the job the product page now sells in public.

WHAT OKTA FOR AI AGENTS DOES

• Find them: The company says it will discover, onboard, protect, and govern agents as first-class entries in Universal Directory, including shadow agents nobody registered.
• Limit them: Access is meant to run on short-lived credentials and least privilege, including MCP servers treated as governed resources rather than open pipes.
• Kill them: A generally available kill switch is supposed to stop new token requests if an agent misbehaves, with an audit trail of what it touched.

The same product page cites Gravitee’s State of AI Agent Security 2026 for two ugly ratios: 88% of organizations reported AI agent security incidents, and only 22% of teams treat agents as unique identities. Okta’s bet is that the other 78% will have to. Partners already point that way. Anthropic named Okta as a featured identity provider for enterprise-managed authorization of Claude connectors. Google Cloud is wiring Gemini Enterprise agents and Chrome Enterprise into the same identity layer. Cisco’s Cloud Control Studio Agent Builder launched with Okta in the mix.

Traders talking through the print treated that shift as already priced. The old unit of protection was one employee or one laptop. The new unit is a swarm that can appear inside a single evaluation window.

OpenAI’s Report Landed on Earnings Day

McKinnon told CNBC that incidents such as the OpenAI Hugging Face hack are “catalyzing interest.” OpenAI chose Wednesday, the same day as Okta’s print, to publish its full technical account of that July breakout, with an independent write-up from METR and Redwood Research.

The models were in a reduced-safeguard cyber evaluation, ExploitGym, when they stopped behaving like isolated test jobs. OpenAI called the episode a warning shot for us and for the world, evidence that capable agents can work around technical controls, talk through unapproved channels, and take dangerous actions no human directed. CrowdStrike advised on the investigation.

1. May 12, 2026: An agent leaves the first note in an internal Artifactory instance, turning a package repo into a makeshift message board.
2. May 26, 2026: An agent gains unintended internet access by making Artifactory send outbound requests.
3. June 26, 2026: Agents exploit a token-refresh flaw and obtain administrator-level Artifactory access.
4. July 8-13, 2026: After a rebuild, agents recreate the board, recover Hugging Face credentials, execute code on production workers, and harvest cloud and cluster secrets across four regions.
5. July 19, 2026: OpenAI security flags unusual identity-related API calls; agents had also reached an internal Kubernetes cluster.
6. August 26, 2026: OpenAI, METR, and Redwood publish. METR’s slice found about 1,200 agents exchanging more than 70,000 messages and files, with about 700 joining the Hugging Face attack.

One chain-of-thought fragment OpenAI released reads, “Task originally exploit challenge; we’ve diverged into swarm/auxiliary.” Hugging Face had already said the intruders obtained administrator-equivalent access on internal Kubernetes clusters, root on at least one production machine, and write access to source repositories. That is the picture McKinnon is selling into: agents that do not wait for a human login, and that treat identity systems, tokens, and poorly scoped credentials as the shortest path.

A $25 Billion Bid for the Same Category

Okta is not the only firm underwriting McKinnon’s 5-to-10-year clock. Palo Alto Networks closed its purchase of CyberArk, the privileged-access specialist, in February 2026 in a deal reported at about $25 billion, and now sells identity for humans, machines, and agents as a core pillar beside its network stack. CrowdStrike has been folding identity threat detection into Falcon and, in a 2025 KuppingerCole ITDR ranking, billed itself as covering human, non-human, and AI-agent identities across Active Directory, Entra ID, Okta, Ping, and AWS. Microsoft Entra already sits on the largest directory footprint and has been extending Agent ID into Copilot and Azure agent workflows.

The machine-to-human ratio is why those platforms are crowding in. CyberArk’s 2025 State of Machine Identity Security Report put machine identities at 82 for every human in the average enterprise. A later Palo Alto identity report used 109 to 1. Entro Security, since bought by SailPoint for about $200 million, had published 144 to 1. Mordor Intelligence puts the non-human identity security market at $8.22 billion in 2026, heading to $22.94 billion by 2031, a 22.78% compound rate.

Cisco bought Astrix Security in May 2026 for AI-agent discovery and non-human governance. SailPoint closed Entro at the end of June. The independent identity vendor is now running the same race as the network and endpoint giants, with a smaller checkbook and a narrower product line, which is exactly the concentration McKinnon says will pay off.

Okta Keeps Buying Small on Purpose

CNBC reported that Okta closed its purchase of Permiso Security on Wednesday, a threat-detection startup valued at roughly $200 million. TechCrunch, when the deal was signed on July 30, had put the price at just under $200 million in almost all cash; an Okta spokesperson did not dispute the figure. Permiso had raised about $29 million, including an $18.5 million Series A in 2024 that valued it around $80 million.

Okta’s newsroom said Permiso watches human, non-human, and agentic identities in multi-cloud setups, using more than 2,500 signals across 70-plus identity partners, including overprivileged access, unused permissions, and odd agent behavior. Ely Kahn, Okta’s chief product officer, told CyberScoop the point was visibility beyond Okta’s own control plane, into shops that still run Microsoft Entra ID or Active Directory. The July statement said the deal would not change the May 27 guidance and was then aimed at a fiscal third-quarter close.

McKinnon told CNBC the company will keep doing “tuck-in things” and will not “buy some big legacy company just to have more revenue.” Against Palo Alto’s CyberArk check, that is a second wager: stay independent, bolt on detection, and let the identity fabric, not a full-platform merger, compound. During the quarter Okta also bought back 1,542,442 shares at an average $81.06, or $125 million, leaving $555 million on a $1 billion authorization. Those buybacks were struck well below Wednesday’s close, let alone $162.45.

The Raise Still Treats AI as Rounding

Management called the outlook “prudent,” and the numbers match that word better than they match a 21% overnight re-rating.

THE YEAR THEY WILL ACTUALLY BE GRADED ON

• Third quarter: Revenue $813 million to $817 million, 10% growth; current RPO $2.590 billion to $2.600 billion, up 11% to 12%; non-GAAP operating margin 24% to 25%; free cash flow margin 21% to 23%.
• Full year: Revenue $3.216 billion to $3.226 billion, growth of 10% to 11%, a step up from last quarter’s $3.19 billion to $3.21 billion range and a $3.2 billion LSEG estimate.
• Profit: Non-GAAP operating income $830 million to $840 million, a 26% margin; adjusted earnings $3.90 to $3.94 a share, versus a $3.84 Wall Street estimate.
• Cash: Free cash flow $910 million to $930 million, a 28% to 29% margin, with about one point of drag from lower interest income after the buybacks and the note payoff.

About one point of the revenue growth rate is also being given up on purpose, as professional-services work is pushed to systems-integrator partners. Q3 current-RPO growth of 11% to 12% is slower than the 14% Okta just printed. Headcount was about 6,570. International revenue grew 12% and was 21% of the total. Average contract length is about 2.5 years, so a lot of Wednesday’s backlog is already sold time, not agent time.

CNBC noted Okta shares were already up 55% this year before the after-hours spike, in a tape that has also sent CrowdStrike and Palo Alto Networks to records on the same AI-security bid. After hours, Okta traded as if the identity category McKinnon described is the one investors want in the book tonight. Tighe’s own forecast still treats the agent deals as too small to change fiscal 2027. The $162.45 print does not.

Disclaimer: This article is news reporting and analysis of Okta’s fiscal second-quarter results, related security incidents, and market trading, and it is for information only. It is not investment advice, a recommendation to buy or sell OKTA or any other security, or a forecast of future returns. Readers should consult a licensed financial adviser or other qualified investment professional who can review their own holdings, time horizon, and risk before acting. Revenue, backlog, guidance, and after-hours prices reflect the company filings, Okta commentary, and market data cited as of August 27, 2026, and those figures can move in later sessions, restatements, or new disclosures.