How VC Views Identity

We literally just had the presentation from a banker perspective. So it's kind of the, the, the thing I was trying to think that was different from what you just saw was that they're looking at perhaps a bit more mature companies and I lead and run Okta Ventures, so I'm investing in companies that are actually quite young in some cases, don't have any revenue at all. So that's the reason to keep you in the room at the end of the day. Hopefully that's the case.

I, I'll flip through this presentation pretty quickly because frankly the folks that came before me from Stevens, they had really nice charts and that was quite clean and crisp and covers a lot of the same major points that I was talking, gonna talk through. But more importantly, I'm here to actually meet with you all. So if you all have questions, just interject and if not, then just come up and find me afterwards. Like this is a more of a dialogue than anything.

So yeah, the, the sort of reasons why venture capitalists are interested to fund identity startups quickly exits funding appetite, we just went through that awareness is really important. And so when you think about venture capitalists, very, very few are focused on identity as a sector, but they are increasingly interested in security. And I'll talk about, you know, just the very basics of why that's becoming more interesting for larger enterprise funds. Customer demand, strong growing. You all probably know that identity is horizontal.

This is another point that people often talk about, especially in Silicon Valley where I'm based, which is that identity is far broader than what people initially think of it as just IDPs and you know, initial software. There's many markets that it attaches to. And then finally one I'll talk about is identity is global. And that's really interesting to see, especially in light of this, this is a slightly older presentation, so I'm skipping over a couple things, including the person who didn't join me today, but XXI and IPOs. So we talked about the Toma Bravo roll up and AU zero acquisition.

So one thing that I'll say that's actually pretty interesting is the charts that were just shown in the presentation before, they showed some very large numbers in the billions in 21 and 22 as a result of Okta acquiring AU zero and Toma Bravo. But if you extract that, the story's actually not anywhere near as attractive as it suddenly looks. And that's often the case when you look at VC funding. If you actually double click, you'll find that it's really consolidated in a few particular transactions.

And so yes, the market is, is shifting and people are interested in identity, but honestly from a funding perspective it's still a relatively small segment. But yeah, in terms of Im market size, the key thing here is that most analysts believe that actually we're still quite underpenetrated just about 25% is the number that McKinsey has. So this is, this is actually the thing I really probably want to touch on the most is when people are out raising venture capital funds, yes there are some specific cybersecurity funds.

I would say they probably represent sub $3 billion of dedicated cyber funds in the world. So that's actually really quite a small segment. There's much more invested capital going into FinTech funds. But if you're a large B2B or enterprise venture fund, you are now starting to get pressure from your limited partner. So the people that back the venture fund on what is going on in cybersecurity, right? And so your limited partners have even less experience as a venture capitalist. They have even less experience than you do on the ground, but they read headlines, they watch the Super Bowl, right?

They see the ads for CrowdStrike and Aura and the Super Bowl. They read books. And so this is the general overall awareness of cybersecurity as an important feature in the market has really gone up in the past few years. I've palpably seen it. And a lot of funds that have a more macro focus, they can invest in a bunch of different industries. They're starting to hire like one cyber specialist, right? So they're starting to say, Hey, we may have a $200 million fund, but we want to dedicate $50 million of it to security. And then identity is obviously a subsegment of that.

But yeah, I mean honestly, when you think of identity as a category, most enterprise B2B funds, they're gonna have one two identity related companies. And if you think about Okta Ventures, which I run, we've done 40 investments over the past five years. We're not looking for necessarily identity companies, but identity enabled comp companies. And that's a important distinction. I'm happy to talk about.

Again, budgets are being allocated to identity. And I'll just touch on one particular point that in the recent survey, so scale Venture partners just put out this chart over here.

They, they saw that identity is the third highest priority for chief security officers. So this is, you know, really serves as a backbone for any security strategy and CISOs are thinking more and more about it. And then the other point I was gonna mention here is really, you know, we think about identity, especially for a lot of the companies that are represented upstairs at this conference. We think of IDPs, think of customer identity, infrastructure, those categories.

But really, you know, I'm interested in areas where you see non-traditional identity players that actually are beginning to think a lot more closely about this as a category. And I think about Stripe in particular and their Dendy focus plaid as well bought an ID verification player. So FinTech players, healthcare players, Pearson, which is a textbook company and a testing company in the United States, bought a company called Credly, which does verifiable credentials a few years back.

And so, you know, dendy really stretches to all sorts of different sectors that may not be initially obvious. And then the final point, I'll, I'll make mention of, and I have personal experience in this because Okta Venture's portfolio is invested in companies around the world, but we really see a lot of innovation happening in the global south.

And so, you know, there's a Ethiopian national ID system and there's, you know, things happening in Indonesia. We're invested in a company called Pian Indonesia, which is the leading customer identity player there in Brazil. There's ID Wall, which is 90 verification company in Africa. There's smile identity. So there are many different companies in the global south that are really starting to gain significant traction. And that's actually where we see a pretty interesting competitive moat as investors when there's particular nuance and understanding on a, on a local market.

And that's my presentation, but I, the reason I wanna fly through quickly is I just wanted, I, I assume if you all are here that you have some questions of some kind and I'm happy to answer any question that may be in the audience. Yeah, I think you might have one now.

Yeah, I'll bring the Mic to you. Is it a, is it a wrong assumption that people coming here would have questions?

I dunno, Actually a question based on like their presentation. So can you expand like how you see Stripe as an identity player? So they did invest in clerk.

Yeah, they invested in clerk and then they, they have an ID verification wrapper as well. Yeah.

So yeah, in, in, in their mind, right, they're, they're want to basically provide the full stack for any customer that comes into a platform. It, one of the, one of the things that's interesting, if you think about this idea of identity as a platform, you actually want to, like, what are the building blocks of a SaaS app? Or what are the building blocks of an e-commerce app, right? Like is it possible to set up an entire e-commerce company in an hour or two?

Well, one thing that you'll have to have is a customer identity platform somewhere there, right? And the more information that you can get at the time of customer onboarding, the better, right? So are they truly, you know, validated, et cetera. And so that's why you see them investing in clerk. Their venture program is a bit different than ours when they invest in companies. It's with the mindset of m and a.

So it's, it's not a surprise. And they take a board seat, they typically take a board seat at Series A. They're much more focused on venture as a tool for m and a than the program that we run at Okta.

So yeah, I absolutely, Stripe has a thought process around this. The other thing that's interesting that's an adjacency that we think a lot about is Stripe Atlas, and that's the entire toolkit that they offer startups to build their companies from the very beginning, including corporation and all the sort of bits and bobs that come with that. So that's also really interesting too that they offer that.

And what it says is that they want to be, for those small e-commerce players, they wanna be a one stop shop and identity plays a very important role in that toolkit that you need to get your startup up and running. So I think, you know, Stripe is one example, plaid is another. So oftentimes we're thinking about, you know, who has the right to win in wallets? Plaid has hundreds of millions of people right, flowing through their system all the time. If they can inject an IDV flow directly into that, they bought Kognito, am I right?

You know, buying that company and allowing them to have an IDV platform in the middle of that flow, then suddenly instantaneously you have a wallet, right? And so that, that fits into plaid sort of mindset as well. So I think it's interesting to see these IDV players, you know, either allying themself with FinTech platforms or you know, the other way around FinTech platforms going to pursue different areas in identity. Stripe is the first example of that, but there'll be many others.

And honestly, even here, like I was, you know, on LinkedIn and connected to a lot of folks there at the conference, you see, I think Capital One is here, right? All the major banks are really focused and all have identity teams and so there's gonna be a lot more interest in this area and in fact actually probably from an m and a perspective too. Fantastic. Okay. Just please Your question.

Yeah, thank you yore, Deloitte, excellent presentation. I'm glad it was very short as a place here in the conference. I was just wondering how you look at evaluation or success rate of these companies. Yeah. Are you say shooting with Hill and hope that one out of maybe 10, 20 companies becomes a success and that covers all your cost? Or is there some other evaluation that you make sure that the companies that you do invest in will become successful?

So what, what constitutes success I guess? Yeah, so we've, I mean this is like kind of venture capital 1 0 1, right? But essentially we've done 40 investments, we've had five exits in five years. So we have a lot of what's called like DPI. So we have a lot of proof points of success that we've had with our investments. To break it down, in its simplest terms, venture capitalists look for at least 1 25 x 30 x 40 x return. That will make up for typically somewhere in the neighborhood of 80% of the total return of the fund.

And so you, you typically need to have one true home run in order to return the capital that you're looking for. Now the, that's just like a heuristic for venture. The thing that's interesting about identity and security is if you look at security exits, so this is like probably what the, the bankers didn't wanna talk about. There's not many over $500 million and there's not that many buyers in this market as well. So obviously you listed Okta to Bravo, CrowdStrike, Palo Alto Networks, Zscaler, and you start to have a pretty big drop off at that point.

What's happened in the Zer environment, the zero interest rate environment in the United States is venture capital got super hot in 21 and 22, and the growing interest in cybersecurity increased. You started to have a lot more startups getting funded. So founders were talking to each other, Hey, I can do that. I'm gonna go out and get, you know, $10 million of seed funding and that's great. We need more founders overall in the ecosystem. It unfortunately, it takes the pie and it splits it eight different ways.

So what's happening is you have many competitors in every single segment, and then you have the same basic fundamentals exist, which is there are basically five major acquirers of cybersecurity startups and they're not buying over $500 million. And in fact, if you really get down into it, the real intricacies, the difficulties of this is that as you scale, the exits become even more difficult.

And so what you'll see is a lot of the cyber acquisitions, and by the way, I think 11, there's statistics somewhere float around in, in a Bessemer research report that I think 11 of the past 13 cybersecurity exits all came from Israel, right? And most of those were very early.

I mean, I could tell you just from knowing the numbers on these companies, even though they're private companies, they were sub $5 million in revenue, annualized revenue, you know, going out for hundreds of millions of dollars in exits. But my point is, is that if you're 10, 20, $30 million in annual recurring revenue and you apply the same multiple, suddenly you're outside of the achi, you know, of an achievable, you know, I'd say like an acquisition ready target. And that's, that's the dynamic that's starting to unfold.

I think a lot of cybersecurity investors and you know, by defacto identity investors in the United States are starting to get a little bit nervous about valuations, about competitiveness. So, you know, in any one segment you're gonna have maybe one to two winners, but there's at least eight companies in each segment. And so that's gonna be a problem moving forward.

But yeah, we we're looking for at least one major home run in order to do that, based on what I just said, you've gotta invest early, right? Because you're, if you're coming into Series A that's valued a hundred million dollars, you're top, you're only gonna get a three x return. And so that's, that's the unfortunate part about having a competitive market is that you're not getting the typical VC returns. Yeah. In the back.

Hey, question follow up on the cybersecurity and identity. So we see a huge hype in cybersecurity and identity, but on the other hand, I think we have not a lot of money that companies spend and not a lot of budgets allocated to identity security in general. How do you see this works together or where do you see from Okta venture perspective the identity security spending goes in the future? So you mean enterprise wide?

Yeah, so enterprise buyer. So I mean, Gartner will say it's a $30 billion market.

I mean, you could choose whether you believe that or not. I think what you're getting at is, is there a market beyond the pings, the Okta's of the world, right? Is there a market for young startups?

You know, if you're talking about workforce identity and you have those major players there, then you have to start thinking about new important niches. So coming out of the RSA security conference, everybody's talking about non-human identities. And if you look at the major identity providers there, that story is relatively nascent.

It's, that's not that clear if any of them have existing product lines that can really capture that market. And so as a result, I think yes, the budget can seem small if you're trying to go head to head with an Okta paying, whatever that may be. But if you pick your own swim lane and have something unique, then you can, you know, basically grow with that market segment.

But yeah, it's, it's, it's, it's, there's honestly not that many major players for that budget. So you're right. And honestly, even if you took a look at identity team, there's probably three or four people, core people in any large enterprise that are running the identity budget. And they may be preoccupied simply with implementation and not actually doing a whole lot of tech scouting in that area. Okay. I have a question actually, if you remember it was the other guy's slides, but you remember the, one of the m and a value market?

No, it wasn't your slides, it was theirs. Oh, The other guys, yeah. But I dunno if you can remember, but it seemed like The m and a valuations. Yeah. Yeah.

So it, it went up right up in Covid times. It's gone down a bit, but it's still way above. It seemed to be way above pre covid. So what's the reason for that? Way above pre, well I don't have the numbers like off The top Of my head, but we've seen huge valuation compression across the board exits and, and even with venture capital as well.

Honestly, I mean to speak in very real time, I was just talking to one of the most prominent cybersecurity investors, pure, pure play cybersecurity fund. And we've noticed in the past three to five months a real uptick in valuations in cybersecurity. I just think people are often looking for sort of rationale and logic. And so they'll look at the m and a slide that was put up and they'll say, well, Okta bought off zero, right? And TOMA Bravo bought these three assets and they bought them at high valuation, whatever you want to call it, right?

This market is big, but it actually, as I'm was trying to say, if you really double click on that, you'll realize the market's not that big. There are not that many exits that warrant that there are not that many zeros out there that are looking for a home. And so as a result, when people anchor on that, it happens all the time. I have other VC investors that will call me up and say, well, what do you think? Is Okta gonna acquire this company? And I'm like, well, you know, it's not the same level of attractiveness as some of the other targets that, you know, obviously we've acquired. Thanks.

So I think, yeah, it's, it's okay. Yeah.

A mixed, mixed map. Okay.

There was, right, yeah. One last question. So my question may be a little off topic, but I work for a standards organization trust over IP, where we are building the standards for a lot of the decentralized stuff. And one of the challenges that all the standards organizations have is that in early engagement, like where startups would be, is those are the people that are inventing that need be, need to be in the working groups that to participate in the standards bodies, but often they're also the organizations that have the least amount of money.

And so they aren't able to fund the standard organization at a level of a, you know, major, major organization. So then the major organizations get dominated at the steering committee level, et cetera. So I was just wondering what VCs have thought about, about being able to support or put a part of the funding that you're giving to a startup towards helping to support the standards organizations where the work is being developed and if there's, if that's ever been something you've thought of.

'cause I know that doesn't give you, it doesn't give direct exit return on investment, but it's where the work's being done. Yeah, That's a super fascinating question.

Actually, I'll follow up with you afterwards. God, I don't really have an answer for it. I've never thought about that. I will say something that's kind of interesting, which is, you know, what is the biggest exit from a founder who is super active in the standards committee?

It's, it's an interesting one, right? It's like, it are, are the founders coming from a place like IIW right? kager conference? Are the founders coming and, and actually being a part of those standards?

Oh, Absolutely. That's, that's who's really in the working Group, right?

I I, there are definitely, and I've been at these conferences, right, especially this season as well. I, you know, there's an argument to be made that actually some of the, the, the best founders in identity have not come from, those groups have not participated in the standards. Okta was not participating in any identity standards before Okta was created, right?

The, so it's, it's interesting to think through. It's like an interesting thought exercise. My prediction is that probably there'll be more founders coming from these standards groups in the next five to 10 years than there was prior. But that's just my hypothesis. And that I think actually, I think the crypto community has some examples that might be interesting proxies for what you're talking about. I'm thinking of like consensus and some of the other foundations have been set up to support, you know, crypto innovation. So yeah.

That's, that's interesting. I hadn't thought of that. Okay. Thanks for your question. Question. Great.

Okay, well I think we'll wrap it up. Thanks a lot, Austin. Thank you all.