On a scale of One to Ten

Investment Analysis Clubs Saul’s Investing Discussions
1

Saul shouts: “We are missing something with Okta!” in post 72235, https://discussion.fool.com/we-are-missing-something-with-okta-3…

I think I found it and not just for Okta but market wide. It was a circuitous route and I beg your indulgence while I retrace the steps that got me there. Last night I watched the movie “Ten” with Bo Derek that had me salivating when I was much younger but she was just a flash in the pan, never becoming a lasting star. There was a reason. On a scale of One to Ten she was Ten Beautiful but never become a lasting star. Answer that and you have the answer to Saul quandary, “We are missing something with Okta!”

In Living on the Fault Line: Managing for Shareholder Value in the Age of the Internet, Geoffrey Moore segregates company activities into core and context. Core is what the business is about and context is everything else. Apple’s core is the human-machine interface applied to all manner of consumer electronics from watches to PCs and lots of other stuff in between. Shopify is about building Internet stores. The example I like to trot out is that for McDonald’s burgers are core while clean restrooms are context. Except as noted in previous posts, people go to McDonald’s for burgers, none say, “Let’s go to McDonald’s, they have such beautiful restrooms.”

Moore claims that the reason for core-context segregation is that companies should concentrate on what’s core for them and outsource everything else. In the opening scenes of “Ten” we find out that George is 42. 42? That rings a bell… 42 is the answer to everything in the universe except “Ten” is decades older than The Hitchhiker’s Guide to the Galaxy. Our brains have this amazing ability to correlate apparently unrelated ideas and use the correlation to build new ones. I’ve come to believe that the market also recognizes the core - context divide and prices stocks accordingly.

Some might remember a post where I said why I don’t like security stocks and the reason I gave was that security was context for most businesses. it’s a must have but it’s not their core business. How to quantify core vs. context. It’s not an absolute but it might be possible to rate it on a scale of “One to Ten” and, like with beauty, we will often disagree.

After replying to Saul I looked up Okta’s Profile on Yahoo:

Description

Okta, Inc. provides identity management platforms for enterprises… The company offers Okta Identity Cloud, a platform that offers a suite of products to manage and secure identities, such as Universal Directory, a cloud-based system of record to store and secure user, application, and device profiles for an organization; and Single Sign-On that enables users to access their applications in the cloud or on-premise from various devices with a single entry of their user credentials. It also provides Adaptive Multi-Factor Authentication, a product that provides an additional layer of security for cloud, mobile, and Web applications, as well as for data; Lifecycle Management, which enables IT organizations or developers to manage a user’s identity throughout its lifecycle; API Access Management that enables organizations to secure APIs; Advanced Server Access to secure cloud infrastructure; and Access Gateway that enables organizations to extend the Okta Identity Cloud from the cloud to their existing on-premise applications. In addition, the company offers customer support and training, and professional services…

https://finance.yahoo.com/quote/OKTA/profile?p=OKTA

No offense meant, but this sounds like clean restrooms for McDonald’s. Businesses need this but it’s not what they are about. Their core might be document management, it could be teleconferencing, it could be databases.

I believe that the market has a way of sniffing out how core or context oriented business offerings are in relation to the market as a whole. This might sound half baked and it probably is but I do think it affects price multiples. It might be a measure of how “commoditized” the products or services might be.

Denny Schlesinger

Bo Derek, 10 for beauty, 3 or 4 for talent.

57 Likes
2

I have to disagree here. I appreciate the sentiment, but couldn’t you say the same thing about a number of these SaaS companies? They are pick-and-shovel stocks. If OKTA is not core, I don’t think DDOG or ZM are either.

The thing that is especially true about security companies is that they’re not considered core until something bad happens and the core of your business goes offline. While clean restrooms may be context in the McDonald’s case, what about electricity or water supply? That’s the level OKTA + others are operating at. If OKTA’s servers go offline, employees (and even customers) cannot log in to do business. These companies are utilities that businesses cannot run without and removing or replacing them requires some serious remodeling. It may be context, but it’s some pretty important context.

Long OKTA

80 Likes
3

I’m with TrickyD on this. Companies can’t run their business without Okta, Crowdstrike, etc. That’s “mission critical!” There was nothing mission critical about Bo Derek.
Saul

26 Likes
4

“There was nothing mission critical about Bo Derek”

Having to bite my tongue on this one so as not to go off-topic. LOL!

14 Likes
5

Agree - Okta is about as mission critical as it gets not just from a security perspective but from an enterprise sign in productivity perspective.

I recently sold out 50% not because it isn’t core but due to declining growth rates.

I can perfectly believe though that whilst its revenue growth has tailed off it might be at a profitability breakthrough/inflection point that will lead to continued share price uplift going forwards just as the case in Paycom, Hubspot, ServiceNow, SFDC etc - which is why I was happy to keep a trailing 50% invested.

I redistributed 50% into Asana and Docusign (which irritatingly I sold out of @ ~66).
Ant

2 Likes
6

I’m with TrickyD on this. Companies can’t run their business without Okta, Crowdstrike, etc. That’s “mission critical!” There was nothing mission critical about Bo Derek.
Saul

Yes there was they needed her to sell Advertising and tickets

7

While I understand what you are trying to say. Using clean restrooms for mcDonalds is not what Okta is to these other companies. What Okta would be is food safety. If McDonalds doesn’t have clean restrooms, you might still go there because you like the food so much. You find out that they have a huge food borne illness outbreak throughout their company, you aren’t going back. (Chipotle would be a good example)

So if a Company that uses one of the security companies (CRWD, OKTA) has maybe poor service, you might still use them because their product is so good. However, if the Company gets hacked or the business can’t function, chances are you aren’t coming back for a while and will take your money elsewhere. Hope I’m making sense here.

16 Likes
8

I believe Okta is more mission critical than other companies followed here such as DataDog or Zoom.

If the identity solution for an application is not working, the entire system is effectively down since nobody can login.

DataDog recently had a big outage for a number of hours. For an application that would mean you are effectively flying blind, not knowing how the application is performing or what errors could be happening, but you can still run the application under these conditions. Would also mean you probably wouldn’t want to do production deployments since you won’t know if there are errors.

With Zoom, the team could switch over go Google Meet or Slack calls. Only blocker would be if the conference call is over 50 people and Meet/Slack barely work for those.

I think some may have some hindsight bias for Okta who have been in the stock a long time. For those holding for a few years it’s roughly 1000% gains and the business is still doing well, plus paying capital gains. Okta is a more mature company now since IPO and still performing but the growth rate is definitely slowing down at this point.

7 Likes
9

Mission critical is not necessarily core. You might have missed

Some might remember a post where I said why I don’t like security stocks and the reason I gave was that security was context for most businesses. It’s a must have but it’s not their core business.

It’s a must have! Suppose you are making cars, making steel is not core for you, making cars is. But you can’t make the cars without the steel! Steel is mission critical but not core because your business is not selling steel, it’s selling cars made out of steel. Back in the days of Henry Ford he had to make the steel because there was no the value chain to make it for him. Which car manufacturer makes steel today?

Your criticism is based on the misunderstanding of the concepts core and context as used by Geoffrey Moore. Yes, security is mission critical but still context for most of Okta’s clients.

Denny Schlesinger

12 Likes
10

“Mission critical” and “irreplaceable” are two different things.

OKTA, CRWD, DDOG, etc. are all to some extent mission critical in that if they go down or otherwise fail, the entire company could be crippled. One of our hospitals is part of the UHC network. They’re a big old corporation trying to run health care, and from my experience, those companies are terribly slow to adapt to new technologies and extremely cheap, so their IT departments are not exactly run by people at the top of their class. A few weeks ago they were hit by a ransomware attack that reached corporate servers and forced them to shut down the entire network. The hospitals were running with paper charting, even some phone lines were down, imaging was very limited (unable to move images from the machines that acquire them). They’re still working to get things back up and running, and of course, their priority is to get billing up and running (including the process of charging people for food in the cafeteria) rather than fixing the patient care issues. (Kind of sarcastic here, but unfortunately not entirely).

Their response was to blame the attackers and say there was no way to prevent this. But they run outdated antivirus software, probably without any monitoring of servers. I don’t know for sure but I bet they would have had a much better chance of surviving the attack if they were using some of the companies the board follows.

So these companies are certainly mission critical. But that doesn’t mean they can’t be replaced. Any identity management company could displace OKTA by just selling themselves to the corporation and saying they’ll handle the migration. In medical terms, a ventilator is mission critical but you can still migrate from one mission critical device to another. The process of that migration (data, user education, APIs, etc) may be a hindrance, and the difficulty of such a process probably contributes to the perceived “stickiness”, but there aren’t many (or any?) services that are truly irreplaceable. It’s really one of the risks of SaaS versus companies selling goods; Nvidia sells a card and gets all that money upfront, while SaaS companies hopefully earn that money over the life of a customer, but are at risk of being displaced.

MongoDB is probably one of the hardest to displace once integrated, but it’s not impossible. Zoom might be one of the easiest from a technological standpoint. CrowdStrike and DataDog could actually be completely removed and the company will still run albeit in a vulnerable state. Fastly going down would shut down the web site, although presumably, those enterprise customers would have a fallback plan for any extended outages.

As for Okta, I’ll admit I don’t know all of the technological capabilities. Its core business as a single sign-on and identity management service is really just a layer of abstraction. Is there some technical reason why Ping couldn’t just come and migrate all that information to their systems? Or companies could just enable users to log in to each system individually?

12 Likes
11

This is OT, but, perhaps it’s not.

My driver’s license expired last month.

Back in September, I wanted to renew it, but found out I had to go to the DMV by appointment only in a DMV 30 minutes away, not the one close to me.

So, back in late June or early July, I made an appointment for today.

It’s for later this afternoon.

A few hours ago, I log into the DMV site as I want to make sure I take enough ID’s and such to get a Real ID for flying.

I see this message though on the DMV site.

Due to an outage with Virginia’s technology provider, DMV’s websites, Customer Service Centers, and third party providers including DMV Selects are unable to provide transactions.

What in the world? I have waited months. I can’t call to find out if I can go or not. So, I’m driving there soon. If they are closed, how long will I have to wait to get another appointment?

Also, why is their system down? Did they not have OKTA guarding and protecting them? Or, is it something else?

Fool on,

mazske

Long Okta

4 Likes
12

So if a Company that uses one of the security companies (CRWD, OKTA) has maybe poor service, you might still use them because their product is so good. However, if the Company gets hacked or the business can’t function, chances are you aren’t coming back for a while and will take your money elsewhere. Hope I’m making sense here

Or if the utilities are sabotaged, or the food deliveries are diverted or contaminated, or just wrong. It is all security based. Now these may realistically not be issues for McDonalds, but their analogs are certainly real risks for enterprise operations.t

cheers

arnie

13

UHS is not UHC.

OKTA, CRWD, DDOG, etc. are all to some extent mission critical in that if they go down or otherwise fail, the entire company could be crippled. One of our hospitals is part of the UHC network.

Just to be clear UHS owns this hospital network, not UHC. United Health Care has put a lot of energy into clearing this up but this rumor continues to persist.
https://www.businessinsider.com/uhs-cyberattack-hack-derails…

And UHC is a great stock, I don’t own it but my wife does.

1 Like
14

Okta, Inc. provides identity management platforms for enterprises…

…this sounds like clean restrooms for McDonald’s.

Who says a janitorial company is a bad investment? It might be a great one, especially if it’s best in class, growing, and has locked in a big contract with McDonald’s!

Rob

Full disclosure - no position in OKTA, MCD, or any janitorial services

15

Yes sorry that was my mistake. I also own some UHC (I do not own UHS) so UHC shows up on my watch lists and I accidentally put that in. Thanks for correcting it.

16

sorry if this is taking this topic too far down the rabbit hole, but re:

Your criticism is based on the misunderstanding of the concepts core and context as used by Geoffrey Moore. Yes, security is mission critical but still context for most of Okta’s clients.

and

Who says a janitorial company is a bad investment? It might be a great one, especially if it’s best in class, growing, and has locked in a big contract with McDonald’s!

I might be missing the analogy, but I thought this was exactly Moore’s point in the book. He says that “core” is anything that strengthens a company’s competitive advantage (“competitive advantage” in the classic Michael Porter sense). According to Moore, this directly affects the company’s value and thus it’s stock price (makes it go up and to the right).

“Context” is anything a company executes in-house that helps run the business but does not create value.

In the McDonald’s example, their core is selling hamburgers. Bathrooms are important, and customers expect them, but there is no considerable ROI on having clean restrooms. And thus, their competitive advantage is in no way strengthened by having clean bathrooms.

Instead, it makes sense for McDonald’s to hire a company to clean restrooms for them. Cleaning restrooms is “core” for the cleaning company. They do it everyday, are optimized for it, and there is a considerable ROI for them to execute it at a high level.

It makes no sense for McDonald’s to develop “Identity Management” or “End-point Security” in-house because that is just “context” to them. It would be extremely expensive and offers no ROI. But those things are “core” for Okta and CRWD. It’s what they do everyday when they roll out of bed. And they can create a considerable ROI doing it at a high level.

As a further point, the “core” / “context” ratio of a start-up follows the Pareto principle. Where 80% of what a start-up does is “core”. But as companies grow larger and more bureaucratic the ratio inverts so that only 20% of what a company does is “core” and the rest is “context”. In other words, they become less efficient.

I see Okta as something of a case-study out of Moore’s books where they crossed the chasm, entered a tornado, progressed to the extreme on valuation, and are now simply slowing down on growth rate, but are becoming profitable.

7 Likes
17

gmcnatt, that’s a very accurate and succinct explanation of core and context as used by Geoffrey Moore. Thanks.

What I was trying to convey is that maybe the market, the “efficient market?” understands these issues and assigns price multiples accordingly. By definition most B2B is core for the supplier and context for the buyer. On the other hand B2C is delivering core to the ultimate buyer/consumer. In real life nothing is this clear cut but I think we can find a correlation between businesses that deliver core, or more commonly “deliver value” and higher price multiples.

Anyone remember The Sharper Image? That company was bankruptcy bait, it sold nothing that was of real value to customers. By contrast off-price retailer Ross Stores delivers value to lower income and frugal clients. This is the kind of distinction that I believe the market uses to assign price multiples.

I think I’ve said enough on this subject.

Denny Schlesinger

2 Likes
18

Hi gmcnatt-

I might be missing the analogy,…

Yes, my point was simply that what is context for one company is core for another.

So if one is investing in a janitorial company, one would naturally look for the one with the best in class service, best contracts, etc. That might lead one to buy shares WM, for example (yes, I know they don’t clean bathrooms, but imagine they did that in addition to garbage).

If one is investing in fast food restaurants, one would instead look at best in class operators in that space, perhaps MCD.

How does this relate to OKTA? Identity management is their core business. It’s not context from their point of view, or their shareholders. If you are interested in investing in a company that specializes in IM, OKTA would be interesting to you. OTOH, if you prefer to instead invest in the type of enterprise companies that OKTA services, you would look at them instead.

Rob