Todd McKinnon learned two things from Salesforce CEO Marc Benioff as the two were building the seminal enterprise SaaS company: the cloud is inevitable, and don't be afraid to dream big.
Now CEO of Okta, which helps companies verify that the employees accessing their corporate networks are the real deal, McKinnon is doubling down on those principles with the biggest acquisition in the 12-year-old company's history, paying $6.5 billion for Auth0. Auth0 is the flip side of Okta's identity-management coin, offering a service that helps third-party software developers build log-in technology into their own applications and services.
Okta investors were skeptical about the size of the deal, sending Okta shares down more than 6% Thursday. But McKinnon thinks that with Auth0, Okta has a big opportunity to turn identity management into as fundamental a part of modern business software as infrastructure services from companies like AWS or customer-relationship management services from companies like, well, Salesforce.
"[Co-founder Frederic Kerrest] and I started Okta 12 years ago because we saw the need for a modern identity solution for a company's workforce that would scale and grow with the burgeoning adoption of cloud applications," McKinnon said on a conference call Wednesday after the deal was announced. "Importantly, it had to be independent and neutral from the big platform companies who want to sell you other applications as well, the opposite of best of breed."
Later, in an interview with Protocol, McKinnon expanded on the thinking behind the Auth0 deal and explained why, despite those comments, many of the so-called "best of breed" enterprise software companies are either looking for acquisitions to build out their product portfolios or joining forces with big platform companies.
This interview has been edited for clarity and brevity.
How did this deal come together?
Ever since Auth0 popped on the scene back in 2013, I've been following the company. I always thought it was super interesting what they were doing because remember, in 2013 identity was not really something that people thought could build a big company. And then these guys left Microsoft as developer evangelists and started building this totally developer-focused platform for identity.
I think in the last year what changed was on both of our sides, customer identity businesses got to be pretty big sizes. Ours is a couple hundred million dollars [a year in revenue], theirs is getting close to that. If you look at what's going to happen over the next 10 years, there's going to be four or five really big, important major clouds in companies. And we need to make sure identity is one of those clouds. Identity can't be subsumed by infrastructure, can't be subsumed by cloud collaboration; it needs to be independent. And the way to do that is to cover a lot of use cases.
When you drill into that business, it became clear that the biggest growth inhibitor in that business are people building their own service. So by offering a complete solution that would satisfy the CIO, the CISO, the CTO and the developer — which is what Auth0 is world-class at — that's how we thought we could catalyze the market.
We've been talking about this whole best of breed versus platform thing in SaaS for a long time now, and it's interesting that you're continuing to talk about that in sort of in the same way you always have, just as you just made the biggest deal in company history to acquire another application provider. It seems like you are also recognizing that you need to offer more than just your core product in order to attract buyers. How do you square that?
You've got to simplify and reduce the variables in some way: You're not going to have 50 versions of everything. So you can still have best of breed while standardizing things like endpoint protection.
That's where this concept of the primary cloud comes in; it's fixing some of the variables or simplifying the problem just enough so you have a chance.
You're still going to have thousands of vendors, but you're not going to have 5,000 vendors. You're going to centralize around these core concepts, whether it's infrastructure, whether it's collaboration, whether it's CRM, and we think that identity is going to be one of those.
Are you more worried about Microsoft or are you more worried about Salesforce?
Identity being an independent cloud is the worry or the focus, right? I think that it's extremely unlikely that any one of these major companies is going to build an independent identity cloud. The risk is that they'll all just do enough, and that no one will build a compelling enough alternative to [a good-enough product and identity] can kind of just be consumed or subsumed conceptually into these other clouds.
I think the bigger riddle is that we don't execute on our vision and broaden the use cases enough and make [identity] strategically compelling for the buyers, and allow it to be this stuff inside of Amazon and the stuff inside of Salesforce and the stuff inside of Google that is good enough. Which would be a travesty, because [those offerings are] not going to be good enough.
What did you learn specifically from Salesforce about not just the way that tech is evolving, but about management and the way companies should be run?
If I were to rank the lessons just in impact, the No. 1 would be just this baptism by fire in SaaS and cloud.
When we started, it was very clear to us that cloud was going to take over the world. And people think that's really prescient right now. It's not, really; we were just at Salesforce.
It was so clear that there was a better way to build tech and the customers had a better experience. And once people got over that reticence that it wasn't on your own server, it was just going to be a better way to do it.
The second management lesson was learning from Marc Benioff specifically: He was so good at painting the long-term vision that seemed a little grandiose and crazy, but had a way of catalyzing people toward it.
I remember when I first met Marc, we were in this meeting together and he was talking about the future and the vision for Salesforce, and how it was going to move from being a contact database to be this operating system in the cloud that was going to let anyone build any application and database. And it sounded crazy. He was very compelling, but it sounded super aggressive and long term.
But then he snapped out of it. He just said, "Now, I know we don't do that today, Todd, but this is where we're going." And so it was this combination of super-compelling, long-term vision and a reality and execution of what's happening in the business. That was a really good lesson for me, because before that, I was pretty practical and tended to see the engineering side of things and the logical reality of where we were, and really learned to dream big at Salesforce.
Needless to say, this past year has seen ridiculous changes in terms of the way that people work, and who knows how quickly we'll all go back to anything resembling what we were doing before. From your perspective into the way that people are accessing corporate resources, have there been a couple of things that might have changed temporarily, and things that might have changed permanently?
Everyone's known that they needed to transform their company to have a better online presence. For a small business owner, that's like, get a store on Shopify, or get on Instagram or something. For a large enterprise, it's really about figuring out how to rethink your value chain: Should you be selling to distributors? Or should you be doing it better online, direct to customers?
I think that pandemic really pushed some of those conversations and made some hard decisions, and I think that's permanent. You're not going to see people just drop off their online presence that they've built up because no one could come to their retail store for a year. Or whether that's a shoe manufacturer or shoe company that is used to selling through mall channels, and now is going much more online: I think those value-chain disruptions or changes are very permanent.
On working in tech, I talked to tons of customers where they kind of thought that VPNs were dead, because they liked the SaaS apps and their people could log into them without a VPN? People's VPNs are falling over during the pandemic. They had these VPN concentrator systems in their data center and they just stopped working, because they had 100 times the employees every day going through the VPN.
I think that it's really been the last nail in the coffin of this network architecture that's, "We're going to put stuff in the data center, and we're going to put stuff in the offices, and then we're gonna build a wall around that and let people in with discretion." I think that's been totally blown up and the [new] world is some stuff in the data center, fewer things in the office, and it's got to be the zero-trust world where you treat everyone that's logging into any of these things as if they're coming in from the internet, and you have to authenticate them and have identity policies.
