Invest Like the Best with Patrick O'Shaughnessy - Todd McKinnon - Creating and Defining a New Market Category - [Founder’s Field Guide, EP.7]

Episode Date: November 12, 2020

My guest today is Todd McKinnon, co-founder and CEO of Okta, the leading provider of identity management for enterprises. Todd started Okta in 2009 after realizing that enterprises would need a robust solution for identity management in a world where everything was quickly moving to the cloud and today counts over 7,000 enterprises as customers. Our conversation focuses on how Todd decided to leave Salesforce to start Okta, the painful early years of growing the business, how companies can create and define a new market, the different roles he's had to play as the company grew and went public, and the frameworks he's put in place to continue to innovate and test new things as public business. I hope you enjoy our conversation.  This episode is brought to you by Microsoft for Startups. Microsoft for Startups is a global program dedicated to helping “enterprise-ready” B2B startups successfully scale their companies. If you’re a founder running a B2B company targeting the enterprise, you should definitely check them out.  For more episodes go to InvestorFieldGuide.com/podcast. Sign up for the book club and new email newsletter called “Inside the Episode” at InvestorFieldGuide.com/bookclub. Follow Patrick on Twitter at @patrick_oshag   Show Notes (2:19) – (First question) – Best slide in his presentation for starting Okta (5:21) – The early days of Okta and what they were trying to do (8:36) – Challenge of building the company from an engineering perspective (10:32) – First version of the Okta product (11:03) – An overview on identify management (13:55) – The major innovation in the early days of the product (16:11) – The early struggles of starting a company (18:49) – Becoming a default mode solution (20:39) – Most interesting ways the company has grown its services (22:10) – Future of platform businesses (24:24) – Expanding into an infrastructure business (25:59) – Important shifts that they are paying attention (28:21) – Future of our digital identity and Okta’s potential role (32:20) – The chapters of Okta’s story so far (35:03) – Challenges they had to overcome in growing the company (37:31) – Recruiting the right talent and fostering it early on (39:12) – Biggest mistakes he’s made with the business (41:06) – Benefits of extreme focus vs having a broader view of the problems (43:35) – Innovating within Okta (46:02) – How software businesses define cost of revenue and cost of goods (48:23) – Lessons they’ve learned about selling the services of a small company into the largest company (49:54) – Lessons from working with bad clients/customers (51:06) – Their inside view into the future of business today             (51:10) – Jeff Lawson podcast Episode (52:36) – Best way to maintain the growth of Okta over the long term (53:30) – Lessons he would give to business students today (54:51) – Being scared as a founder (55:27) – Kindest thing anyone has done for him   Learn More For more episodes go to InvestorFieldGuide.com/podcast. Sign up for the book club and new email newsletter called “Inside the Episode” at InvestorFieldGuide.com/bookclub. Follow Patrick on Twitter at @patrick_oshag  

This episode of Founders Field Guide is brought to you by Microsoft for Startups. Microsoft for Startups is a global program dedicated to helping enterprise-ready B-to-B startups successfully scale their companies. The program has been around for a couple of years, but I recently became intrigued when former Invest Like the Best Guest, Jeff Ma, took over. Microsoft for Startups provides companies access to technology, including Azure, Cloud, and GitHub, coupled with a streamlined path to selling alongside Microsoft and their global partner ecosystem.

Microsoft for Startups has a very compelling approach to working with startups and driving their long-term business value. If you're a founder running a B-to-B company targeting the enterprise, you should definitely check them out at startups. com. To hear more about the program, stay tuned at the end of the episode to hear from me, Jeff Ma, and Greylock partner, Sam Motamity. Hello and welcome, everyone. I'm Patrick O'Shaughnessy and this is Founders Field Guide. Founders Field Guide is a series of conversations with founders, CEOs, and operators building great businesses. I believe we are all builders in our own way, and this series is dedicated to stories and lessons from builders of all types. You can find more episodes at investorfieldguide.com.

Patrick O'Shaughnessy is the CEO of O'Shaughnessy Asset Management. All opinions expressed by Patrick and podcast guests are solely their own opinions and do not reflect the opinion of O'Shaunsi Asheno Sasset Management. This podcast is for informational purposes only and should not be relied upon as a basis for investment decisions. Clients of O'Shaunosate Asset Management may maintain positions and the securities discussed in this podcast. My guest today is Todd McKinnett, co-founder and CEO of AQa, the leading provider of identity management for enterprises. Todd started Ocda in 2009 after realizing that enterprises would need a robust solution for identity management in a world where everything was quickly moving to the cloud.

And today counts over 7,000 enterprises as customers. Our conversation focuses on how Todd decided to leave sales for it to start Octa, the painful early years of growing the business, how companies can create and define a new market, the different roles he's had to play as the company grew and went public, and the frameworks he's put in place to continue to innovate and test new things as a public business. I hope you enjoy our conversation.

So Todd, I always try to come up with a clever way to start these conversations and for you, I thought a neat entry point would be to ask what the best slide in the PowerPoint deck that you presented to your wife about starting Octa was. There's a lot of competition there for that title. I wrote this slide deck in 2008 for context for folks listening. It was a reaction to when I came home from my job at Salesforce one day, I was running engineering at Salesforce. And at the time, that was really the preeminent still is today, but at the time it was really the preeminent. cloud company. Also, we just had a baby. So we had a six-month-old daughter. My wife was at home with the baby. I was busy at work, and I came home one day. I'd been thinking a lot about it in

the transition to the cloud, and I've thought a lot about this, and I'm going to quit my job. She'd been at home with the baby all day, and she'd been watching the news about the financial crisis. It's like that never-ending stream of news about Lehman Brothers is collapsing and will the financial system uphold, and it's the worst financial crisis and the worst economy. the Great Depression. And I came home and said, I want to quit my job. She looked at me. I remember it like it was yesterday. She said, what are you crazy? But she used some more colorful language than that. It's funny now because it kind of worked out okay, but it was really scary for her and for me at the time. We wanted to talk it through and make sure we were making the right

decision. So I did anything a logical engineer would do as, well, maybe not anyone, but I wrote a PowerPoint. I did a presentation for her. The title of it was, my proposal to quit my job and start a new company subtitled why I'm not crazy. So it was probably like 13 slides long or something like that. And part of it is if you look back on it now, you can link to it in the show notes is online. Part of it sounds pretty forward looking. It's cloud computing is going to change the world and all the big companies in the next 10 years will be built on top of cloud computing and about the recession. You know, Microsoft and Oracle were started in a recession. So it's actually an okay time to start a company. So I sound pretty

forward-looking, but then I'm not that with forward-looking because if you look at the next 12 slides, they were all basically C-Y-A for when it didn't work out. You know, I can get a new job. We have enough money saved up. Back to your question, I think that the best slide in it has to be where I predict that the wild upside scenario for my entrepreneurial plan would be Octago's public and is worth $100 to $150 million. Mission accomplished. Yeah, yeah. Hindsight's 2020, but it's a scary thing to quit your job, especially when it was such a good job

and with family situations and economy situations and so forth. But you could see at the time working at Salesforce that cloud was a big deal. It was going to have an impact on every layer of the technology stack. It's no guarantee that you'll be successful starting a new company in those times. but there's no more fertile environment to start new companies when there's a time of transition. Talk to me a little bit about those very early days and what you sought out to do at the very beginning. I know obviously Acta has changed a lot from day one until now. What did day one look like? What were you in the founding team thinking about and trying to tackle?

The original idea was to take advantage of the shift to the cloud. So at Salesforce, we were very successful and very disruptive and it was very hard for people to compete with us and we were delivering a ton of value to customers. But also at that time, Salesforce is an application company, right? But also at the time, you saw Google released Google apps for domains. So you could see it wasn't just going to be business apps in the cloud. It was also going to be collaboration apps email. And at the same time, around that time, about 2006, Amazon came out with Amazon Web Services. And then you could see that, hey, now it's the infrastructure layer. So if you take collaboration apps, you take business apps, you take infrastructure, it was going to be the whole stack was going to move to the cloud.

So I got really excited about when that shift happened over the next decade or so, what are the inevitable next set of things that are going to be required? What are the inevitable tools and other platforms and other systems that are going to be required because of all that shift to the cloud? And so the original idea was actually to build a system that was a monitoring system for other cloud. application. So if you were IT in a company, this product would tell you if all of your other systems were up and running because the products that did that at the time were all predicated that the company was running the software. In the new architecture, they weren't running the software, but they still needed a way to monitor it. So that was the original idea. In fact, the original name for the company was called Sassure. Your SaaS applications assure that they're up.

But then my wife and my co-founder told me that that sounded like a French perfume. That name was not long for this world. We talked to a bunch of prospective IT people that would buy this service, and while they were excited about the cloud, they were kind of lukewarm on the monitoring idea. Their thing was like, hey, we get this from the cloud because we just want it to work. Maybe some big companies would be into it. But what kept coming up over and over again was just basic problem of we can't log into these things. When they were all in our data center, or these applications, we would just hook them up to Microsoft Windows, login or active directory, and it would be easy.

But now Salesforce comes from the cloud, box comes from the cloud, workday comes from the cloud. It doesn't work as well. Can you solve that basic problem for me? That was like gold because that was something people had a pain at that moment and they would pay for at that time. And also, I knew enough about the architecture and the broad things you would have to implement to make that really easy was a company that really could evolve into a platform on its own. Pretty early on, we pivoted to identity management into the, if you look at the mockups that we drew

really a couple months into the company when we pivoted from Sashur to Octa, the mockups look strikingly similar to the product today. Obviously, it's evolved, as you said, but it's identity management. It's a complete solution. It has people data and application data and policy between the two. So it was a pivot, but it was early, which is the best time to pivot. It's often very hard to imagine the scope of the challenges in the early days when we look back now from a successful outcome. But I'd love you to describe what it felt like, what the challenge itself of building that early mock felt like from an engineering and company building perspective back then. A bunch of emotions I remember. But one of them was that it was

striking in that if I didn't do something, nothing happened. It sounds strange, but coming from a big company, you could really put your kind of shoulder to the wheel and work really hard for a couple of days. But then a couple days after that, if you kind of maybe didn't work as hard, things would still happen and decisions were being made and things were moving forward. When I started, Octa, I just remember thinking, like, if I don't do everything today, there's nothing happening. And we're not making any progress. And that was a very different feeling. and I had to get used to that. You had to get used to the frenetic energy of doing everything

and make brick by brick trying to build it every day. So that was a big difference. The other thing I remember, too, is that starting a company felt to me for the first time in my career that it was the situation where, no matter how hard I worked or how smart I was about my decision or how well I did my job, there was just a decent chance that it wouldn't work. It was just out of my control. And that was hard, too, because before that,

was if I worked hard, I would be successful, most likely. The companies were established. The industries were defined. But with Octa, in this, like with all new initiatives, whether whenever you're trying to do something new and create something new, there's always an element of timing and luck and the chance that it just won't work out. And people that can be successful in that environment have to be able to just, I came up to the same. They have to be able to just believe even when they don't believe. You have to believe even when you don't believe because you have to get used to that doubt and keep pushing forward. Even when deep down inside, you know there's a chance it might not work. What did the very first functional meaning used by customers' version of the

Octa product look like? It accomplished a very tactical purpose, which was it made it super easy to log into your cloud applications with your Windows password. So you come to work and you type in your Windows, everyone had Windows PCs. So you'd type in your Windows password into your computer and it would get you into Salesforce or box or workday, any of these cloud applications that weren't on your own network. Obviously, everyone listening has experienced logging into stuff. It's like this core action of the digital world. I don't want to take for granted that anyone, myself included, really knows much about what's going on behind the scenes here. So I'd love you to just give us sort of a crash course in identity management, which is sort of the category that I think of

ACTA as leading. Talk to us about what the history of that has been for computers, why cloud made it different, and why it's so generally important. Identity management is systems and processes and technologies that identify who users are and then what applications they can access or what computers they can access. It's something that's existed since the first mainframe. IBM mainframes used to have identity management systems inside of them, but it was all very proprietary to that system. It was the system was the mainframe and the applications were the applications on the mainframe and the users were the users that would submit jobs on the punch cards or later in the terminals. As it's evolved over the years, the main changes have been, like with a lot of

computing, there's been more computers and more users. And if you look at the big arc of what's happened. Over the years, you had mainframes with few computers and relatively few number of users, a few number of applications. And then you got to many computers and all those dimensions increased, obviously. Then you got to client server where you really started to get an explosion of the number of computers, obviously, and by association, the number of users and the number of applications. And then in the client server era is when you really first started to see identity management systems that were prevalent, whether it was the most prevalent being Microsoft Windows had a system called Active Directory, which is basically the user database for your company's

IT teams list of who could log into which Windows servers. But what really happened between client server, internet, and then cloud was that if you drew it on a graph, just saw exponential explosion in all of the dimensions I talked about. You saw an exponential explosion in the number of computers, the number of applications, and the number of users, especially when you get the mobile, it's just through the roof. And so all of a sudden, this, what was really a sleepy industry, this identity management industry, it was really kind of something that was embedded in other platforms like Oracle or Microsoft and was important for those platforms, but not important enough to be its own standalone platform or company. You saw such an explosion that when we came along,

it was the perfect time to pull that system out of all the other platforms and have it be its own platform. There are so many applications and so many users and so many computers that you had to manage it as its own primary thing because it unlocked the choice and the flexibility to get to all those computers, to unlock all those applications and to do it all simply and securely. How does that literally work on the back end? As you're describing the sort of transition from the early days to today, I don't think I'd have a good guess for what literally is happening on your service or platform versus what used to happen, let's say, just locally. What was the major innovation in the early product?

I'll tell you when it doesn't happen. When it doesn't happen is the experience, everyone has experienced when every system you use throughout the day, every computer, every phone, every application doesn't know who you are. I mean, you have to re-authenticate to it. You have to type in your password again. You have to maybe do a new six-digit code. to get into it, you have to pull up your account independently. That identity management is not

happening in the big picture. It's happening at each individual application. That application is checking your password, checking your user record, looking you up in a database that's local to that system, and then doing its thing. But when ACTA is involved, it's basically all that is done centrally. So there's one system that has kind of a meta map of all of the applications that you should access and all of the and your one credential that you can use to authenticate yourself. The authentication happens with ACTA and then it's an integration challenge at that point. It's an integration challenge of ACTA handing off that authentication to all of those disparate computers and applications. And then even not at the time when you actually log in, but even

before that, ACTA keeps the different user records and directories in sync across the different systems so that based on the policy of your company, it says who are the right people that can access this application from this device. It's really moving from a distributed system to a centralized system that is integrated to all the distributed systems. That's what makes it difficult to do and valuable. In the early days of ACTA, the biggest pushback we got was there's never been a company that's done this before. There's never been a company that's been successful in this market. And that was because it wasn't, like I mentioned before, the technology trends hadn't driven to it being a big enough problem. And then what we did is we made it really

easy to integrate these things. We built this system that was easy to build an integration to every application in your environment. I love thinking back to the early days and I found this interesting Ben Horowitz quote, which I'd love your reaction to. He said, I was excited, but the first couple of years were tough times, so tough that they'd made most people want to quit. Sales were slow and money was running low, faced with the prospect of running out of cash and no raise, it would have been easy to hide from the problems, make excuses, or give up. Todd and Freddie felt the pressure, but they did not succumb to it. Reworked their strategy, improved the team, and found a way out. What does that make you think of most tangibly in the early days of ACTA?

It brings me back to that time. It's physically painful. I think as an entrepreneur, you get these things burned in your psyche. And yeah, it was a tough time. And I think for all new endeavors. I mentioned earlier about believing when you don't believe. I think for all new creative endeavors, you have to take a risk and put something out in the world that the timing may not be right. And it might be a timing thing or it may just be something that will never work. So you have to thread the needle between building something before everyone else knows it's obviously needed, but you have to build it not so early that it kind of falls on a world that doesn't need it. So you have to thread that needle. And I think for us, cloud was being a

adopted, but we were selling cloud security and cloud identity, which is the later parts of cloud to be adopted because they were adopting cloud systems, but they weren't totally sure about putting their security on the cloud. The first couple of years, we built the product and it worked, but the market was still not quite there. We weren't quite to the point where there was enough cloud or enough confidence in it for Octa to be successful broadly. So we had a tough, particularly like 2011. It was a tough year and it had been outlines there. We were trying to, sell the product, sales weren't going very well. We were trying to close our series B round. And I remember we had the target for the quarter was we wanted to get $250,000 of new bookings for that quarter.

And we had a term sheet signed for the series B that basically we committed the sales plan. We said we're going to hit 250,000. And the actual number we delivered was like 100,000, so quite a bit lower. And to his credit, David Wyden from Coastal Ventures, didn't pull the term sheet. He stayed with us and he did take a quick trip up to San Francisco to see what the heck was going on. But we were able to convince the team and the investors that we needed more time, product needed to get a little bit better, the market needed to approve. And I think the biggest thing was the market caught up to us. More applications, more devices, more applications made the problem really painful enough. And the product got well enough by 2012.

We were kind of off to the races. I'd love to hear the progression in the early days towards something that I call default mode. I think the technical term is like you become a cognitive referent like Kleenex or something that sort of is the thing that people think of when they think of a category or vertical. And I think Oct has achieved that in its vertical and in authentication and identity management. It's just sort of almost like Stripe and payments or something. It's just sort of the one that people go use by default. Obviously at the beginning, that wasn't the case. So to what do you attribute that transition from not being a default solution to being that default mode solution? I think it's part of the pain or the apprehension we've talked about as necessary in that

to achieve that position, you have to define the category, so to speak. You have to create the category. And as I mentioned, the first several years of ACTA, it was there's never been a big independent identity company, not a big enough problem. By us being out there, just being the one that prove that wrong, being the one that made it clear that if you really did make it easy to integrate all these applications and you made it easy to roll out and you built these parts around the core platform, you could make something out of a market people thought weren't there. And I think you have to go through that pain. You have to go through that uncertainty to define the market, which leads to being that default choice. I was telling someone the other day that someone was asking

me about what the name octa meant. I said it's a real word. It means. It means. It means. It means it's a scale for cloud cover. Eight octa is full cloud cover and four octas half cloud cover. It's a scale pilots use. Then I said to myself, when we picked it, it was very early and we thought it would be cute and funny to have this name with the tie-in. But now it's just a company that does identity management, which is kind of cool. It kind of, it's like no one really knows what it means anymore. It's just the company that does what this category that we defined is. In what ways has that most expanded? So early use case being one, thing now, Octa doing a lot of things. What are the most interesting ways that what you can do for

customers has grown? There's a few of them. The biggest one probably is we originally started as, and you can tell by the way I talked about the early thinking and so forth, as it was for employees. It was we sell it to companies and their IT teams install it and then employees log into it to get their work done. The biggest change was that about three or four years into selling the product, we had our customers started to use it for their customers. They would come to us and say, you know, we're using this for our own employees, log in for other applications, but we have this system that we're building for our customers. I remember there was a big pharmaceutical company called Allergan, and it was, they were using it for their employees. But then they came to us and said,

we have this new app where we have all these doctors around the world that are prescribing some of our medications, and we want to make this system where they log into that. So we want to use Octa for that. And we looked at each other and said, I think, I mean, technically it would work, but it's not really how we intended it to happen. So there was a bunch of customers that wanted to do that. And that led to our second big part of our business, which is customer identity. So now about 24% of our revenue is our customers providing login for their customers, be it on their support site or on their, maybe their mobile app or their regular website, we're the login for that. So for example, major league baseball.com, if you log into the MLB at bat app, that login, is through ACTA. We were talking a bit about platforms versus applications. And I wonder if those are the

two probably primary taxonomies that you would place technology companies in. If there are others, let us know. But I'd love to pick kind of each apart and hear what you think about the future of these kind of different business types or business models in the technology space, starting maybe with platforms. I think there's definitely a concept of platform, which is just basic infrastructure for a wide a range of applications. And the best examples, of course, are operating systems, Windows, iOS. And I think that when we look at what all these organizations are doing as they transition to the cloud, there's this new concept of what the operating system will be. And it's independent of any one computer or any one application. They're looking for all of their providers and all of

their services be the basis or foundation for multiple types of multiple pieces of functionality. That might manifest itself in the simplest way as an application vendor just trying to add more modules. There's also another dimension where companies want to move from the infrastructure up into the application layers or the solution layers. Probably the most successful company ever in the history doing this is Microsoft where they started from programming languages and operating systems and then moved up to have arguably what is the core of the company today, which is the office business with the office suite and then later exchange and collaboration moving from the infrastructure up. When I look at companies out there in Octa included,

I think about how we can broaden on both dimensions. So providing just broader functionality, whether it's workforce identity and customer identity, but also how can we move up the stack into solutions or even down the stack into infrastructure. So I think it's really exciting to think about all of these emerging companies and all the established companies, who's going to be most successful, most quickly in all those dimensions, broadening out functionality, moving up into solutions and moving down into infrastructure. And I think one of the most exciting things to watch is going to be who can do that the best and the most effective going forward.

With so much to potentially do, how do you make the decision with, even as a company now still a limited set of resources on where to focus next. And I want to make sure I understand both directions. I think going up more closer to applications or solutions is pretty clear. Everyone uses applications all the time. I know what that means. I don't know if I follow what it means for you specifically to go down into infrastructure. Can you just say a little bit more clarifying the difference between kind of what you do now and what the infrastructure version of Octa would look like? A couple ways to think about it. One way is if every authentication involving technology in the world. It's far beyond the websites everyone uses or the mobile apps everyone

uses. It extends to things like how machines interact with each other and how machines on the network identify themselves. It extends to how with some of the ambient computing things, Alexa and Google Home, when we walk into these rooms, how we're identified in that environment. The requirement for identity and the requirement for authentication and security goes far beyond the interactions between people and applications that we cover today. If you define that as workforce, people at work, logging into applications or people with customer websites, logging into those websites and mobile apps. So us extending into infrastructure would mean APIs and SDKs and capabilities to facilitate login and identity across everything, every interaction between

machine to machine and people to machines in every scenario, which is pretty broad. I mean, it's pretty broad and expansive compared to what we do today. You mentioned the core, maybe insight or motivating factor that you had to leave Salesforce was this massive shift to the cloud. I think there's an argument to be made that there's plenty of room left to run in that transition. But I'm also curious whether, since you see kind of so much and you're connected to so many other things in the technology ecosystem, if you see any other signs of a similar size shift

or maybe not as big, but an important or notable shift that might represent the sort of opportunity to build that the shift to cloud did represented in 2008. One area that is interesting, I think, the way people consume information and the move from television and linear television to streaming and web and the migration of various media, whether it's radio or TV to audio format of podcasting, whether it's from publications to substack and people writing newsletters. Media transitions are always, there's a lot of money to be made and there's also a lot of impact they have on politics and culture and society. So they're always impactful. But this one is given how connected we all are and how the potential for

value creation and the right ideas to spread. I think the whole transition going on in media is going to be incredibly impactful and profound. I'm curious both in that transition through two lenses, is kind of what you think. First is opportunity and second is implications. So starting with opportunity, what opportunities do you think that this media format shift represents? I guess there's optimistic and there's pessimistic views on it. I think the optimistic view, which I tend to take is that it's going to provide a lot more accuracy and clarity and satisfaction for people as they get information and they get entertainment that's more tailored to them and what they enjoy. And I think that that's the fundamental difference, I think, between media where we're coming from and media

where we're going to is just how personalized it is and how targeted it is. And it's something that we're not, just as media consumers, we're still not totally used to it. Right. We're at least people of a certain age are used to looking at a web page or looking at a movie or looking at a podcast that's produced generically for a mass audience, not something that's targeted specifically for them. So I think that that's pretty exciting and interesting and could lead to a lot of good outcomes. I'm curious what you think about the future of, I'll call it our own digital identity and sort of the degree to which I as a person that's always connected to devices and on the internet

and stuff or you owns and has sort of control or sovereignty over that identity. Is that something that you think is important? If so, why? And could Octa be involved in that sort of thing? I think it's absolutely important. It's so important, I think, that technology won't reach its potential. if the industry and I guess society doesn't figure out a better story for it. Right now, the solution is basically everyone does their own.

Every media outlet has their own identity. Every company that you log into as a consumer has their own version of it. Social media definitely has their own. The big device ecosystems, Apple, Google, Microsoft, they have their own. And I think that unless we get a way to simplify the experience for consumers or across all of it, across these well-established platforms. And this is something people don't realize a lot. It's, especially for the smaller companies,

a smaller technology companies, them dealing with the privacy and the security implications of this customer data really hinders their ability to innovate and to deliver services. And in ways, it puts the big platforms at an unfair advantage. So if you think about something like GDPR in Europe, which is a privacy regulation that really was not directly, but really in a lot of ways came down because of the big social media companies and what they do with data.

GDPR in a lot of ways has hurt the small providers because they're the ones that don't have the resources to comply with handling this data and doing it in a secure and scalable way. GDPR in a lot of ways has hurt some of the businesses that ostensibly it was supposed to help. So anyways, I think it's very, very important. I am very much focused on over the long term having OCT to help with this. And I think one of the getting back to something we were talking about earlier is that for us to be most effective, we have to get to a big scale in terms of our business, users, companies, integrations. Because the more scale we get, the more we can help set this standard in the world to make it more uniform, more controlled by the end user, more representing both the big companies and the small companies. And that's why when I talked about earlier, I was focusing on some of these network effects and these positive returns to scale.

That's why we're focused on that. I think it's unrealistic to think that technically, physically, everyone will connect to everything through ACTA. But it's not unrealistic. I think that we can help set a standard that then will be adopted by everyone because so many people follow it, that then will solve a lot of these issues, these issues of complexity for the end user, privacy and security issues for the providers. And the end result of it is to accelerate the adoption of technology in a positive direction, which is kind of our core vision.

Our core vision of Octa is to enable everyone to use technology in a safe and secure way. Do you think that the way that we are as people digitally will be a lot different in 20 years along simple dimensions like, well, we still use passwords? How portable will our value and our sort of settings and our identity be across the internet. And how do you think it'll all look in 20 years? The things that are very clear are that there will be more technology. There'll be more applications. There'll be more specialized types of devices. All of these trends are continuing. We have to make it better. We have to make it easier. You're always going to have passwords. There will always be a fallback and a way to do something if you need to get in the back door or get

in the emergency hatch for some situation. But we have to make it simpler and easier because the ease of use and the security concerns are too much of a drag on the technology. So I'm confident we'll figure it out and make it a much more portable and seamless experience over the next several years. I'd love to abstract away from exactly what Octa does and focus now more on how it does it. Sort of the company building aspect of this that you've experienced from. I love the way you described it were at the beginning. If you didn't do something, nothing got done to obviously a much different scenario now. If you had to segment Octa into chapters thus far, how many would you pick and what would those chapters be? The first chapter would be

founding to that summer of 2011. I remember that, I mentioned that in that summer we had, Target was 250,000 ARR and we did 150, and that was not good. The third quarter of that year, I remember like it was yesterday, the target was about 320,000 in ARR, and we did close to 400 and relatively small amounts now compared to what we do now. But, I mean, at the time, it felt like we just won the World Series, the World Cup, and a gold medal all in one. It was like, I remember that joy like it was yesterday. And from then on, it felt like we had something working and we could scale the business up.

That's the first chapter. The second chapter would be another time. I remember real clearly is 2014 when we, on one day, Microsoft announced a competing product. So they basically announced like the Octa Killer. And that was pretty scary. But the reason it was a chapter mark is because it really changed the game and the world from a company that was maybe couldn't build a company in this space and maybe couldn't build, maybe it wasn't a big enough category for an independent company to the biggest

software company in the world wants to do it, it must be pretty good. Besides the fact they had a competing product, it also, they were pushing everyone to the cloud with Office 365 and Azure. So they were pushing everyone into the cloud. And the next few years after 2014 were really good for the company. And then the chapter we're in now is really started at the IPO. We went public in 2017. And we talked about it as obviously was a big accomplishment, but we didn't want to be satisfied with just going public. We knew that we had the shot to build this iconic long. term technology company. So we actually talked about the IPO like a high school graduation. We said high school graduation is great, but you're kind of expected to graduate. So you don't want

to be that person that your best days were the day you graduated from high school. We've moved everyone on past that. And we're really focused on creating this broad platform, helping customers at scale, keeping the team as fired up and motivated and hungry for the future as they were, as they've been all along. And it's an interesting exercise to build a company. me at scale. A lot of the challenges are the same and a lot of them are different and it's definitely a once in a lifetime opportunity. Can you describe in each of those three chapters the most common nature of the challenges and sort of the role that you as a leader of the business had to play? I'll start from the current chapter. And I think that a lot of my job now and has been for the last few

years, it sounds kind of obvious, but it's not doing a lot of the hands on work. I have great people all around me and every function doing amazing things. So a lot of my job is thinking about how to make sure that everyone stays hungry and stays ambitious and doesn't believe the hype. Like they don't look at the stock price. They don't look at the accolades to the degree we've gotten them from the industry. They really think about more about the potential of what we can do and how what they're doing can contribute to it versus what we've accomplished. Like when I talk to new people that I interview, one of my favorite questions is like, what do you want to accomplish and what is your ambition and kind of get into why are you joining. And something I really like to hear is anything

along the lines of, I want to accomplish XYZ. I think this is an interesting potential. And I think this is why Octa might be a good environment for me. The not great example of an answer would be, well, you guys have grown really well. And I think it's probably a successful company. So it's everything we can do to try to keep people hungry, keep them fired up. And part of that is probably the most important part of that is outlining this clear, exciting vision for the future. What's two or three steps ahead that will keep people hungry and motivated. I think that's the current chapter. I think that if I go back to the period from Microsoft's competitive announcement to the IPO,

that was really about everyone knew the market was the first product, the workforce identity. The market was big enough for that to be a sizable market. Those years were about trying to make sure we had a second product or this customer identity establishing this is our second product and proving as getting ready to go public that we weren't a one-trick pony. We weren't this company that was going to have some good growth, sub-a-100 million in revenue and then get to 100 million or 200 million to hit a wall with a narrow product focus, which happens, unfortunately, to some companies. So that was, I would say, broadening the product portfolio. Before that, it was a lot of the first chapter was just

convincing people in a world where this wasn't a defined category. It was far from a known thing that this would be a successful market or opportunity, just convincing them to believe, convincing them to get on board and take this leap with us and try to contribute to it. And it's a different kind of person that you can attract to do that. I'm lucky we got some of those kind of people back in the early days. What are the keys to get in those kinds of people early on? And I guess this is a question that stretches across Octus history, which is what have you learned about effectively recruiting, identifying and winning over great talent

and then fostering that talent internally? For me, it's been close. clarity on what we're trying to accomplish and then an authenticity and a transparency about how we'll get there. What I found is that that really resonates with people. People are okay about the challenges. They're okay with uncertainty, but they just want to know where they stand and where you as the leader stands on these challenges. And then one of the mistakes I made early on was I thought that as the CEO and the leader, I had to have all the answers. Sales aren't going well. We're missing this quarter. I better have an answer for it. And one of the growth areas for

me was I just learned to kind of share it with the team and say, I don't have the answers. Here are my opinions on things. And here's some of the things I think we might want to try, but I don't have all the answers. And I think a lot of times people, especially when they get into new management positions or new leadership positions, their first instinct is to act like people that are experts. And I think ironically, sometimes that's the worst thing you can do because people can see through that the lack of expertise and the lack of experience. And so you lose credibility with them. Where if you just flip that around and say, I have some ideas and some experience that's put me in this position, but here's what I don't know. And here's how we can work together as a team to figure it

out. That's refreshing to people. It's an empowering to people and it's motivating to people. And it's something that I've used and it's worked pretty well for me. What are the biggest mistakes that you've made across any aspect of the business in the entire history of the business? I think early on, there's a really interesting balance between using your past experience as a roadmap for what you're trying to accomplish and taking lessons from the past and using them for your current situation, a balance between that and then thinking from first principles and thinking about how your current experience and your current environment is different and why it's unique and just intellectually figuring out what will work. And so one of my early mistakes was that I'd worked at

Salesforce and Salesforce's go-to-market was largely in the early days around small companies. When I got to Salesforce, they had about 10,000 customers and about 100,000 users. You're talking about 10 users per customer. So the original go-to-market for Octa was similar around that. We wanted to sell the small companies. We wanted to sell to companies with just a few users and kind of work from the bottom of the market up to the larger enterprise. And what we found out, and this is a big part of that dearth of sales in 2011, was that identity management is different than Salesforce automation. Identity management, the more users you have, the bigger the problem is. So it's probably not smart to be selling to the 10-person companies. Although you're a new company with a product that's maybe

not fully there yet, you should be selling to the biggest company you can sell to because they have the biggest number of users with the biggest pain point. That was one mistake we made early on. And I think in general, I think that's a good thing to think through, like when you're making decisions or you're coming up with strategies. It's how am I balancing my past experience with things that have worked in the past with the ability to know uniquely about what's different about this? Like a lot of things in life, it's never totally black and white. But if someone can articulate the tradeoffs there, getting that balance right is a powerful capability to have and making good decisions. Can you talk about the balance between extreme singular focus on one hand

and I guess scattered effort and thinking on the other hand and what you've learned about where to live on that spectrum? And I'm asking the question because of your point about expanding beyond the sort of one-trick pony idea where you had, I'm sure, maniacal focus on the one thing. It seems like focus tends to be rewarded, but I'm curious if there are exceptions to that rule that you've experienced. I think that the focus is rewarded. The problem is that if you zoom out, there's a thousand people that focus on something, especially in new initiatives. Only a small amount of them are going to work. That's kind of the uncertainty, just the chance that goes into or the timing or the chance that goes into any new initiative. If you think with venture back companies, there's thousands

of them that are started. I forgot the number. I think the year Octa was founded, there were 8,000 companies that raised some kind of early companies that raise some kind of venture capital. Of that whole set of companies, hopefully they all focused and hopefully they all executed and hopefully they all did whatever they could do day to day to push forward, but only a small subset of them are going to survive. And so I think it's a little bit kind of depends on where you're viewing the landscape from, to answer that question. One thing we've done is the company has gotten into these chapters we're in now, we've actually made our culture was very much, you can kind of tell on some of these stories I've told.

It was very much customer focused. We listened to the customers. We pivoted our product. It was we listened to the customers to launch the customer identity product. So it's very customer focused and very execution focused. We're very good at getting things done day to day, brick by brick. And that served us well. We were lucky to get the timing right in in terms of the market we were in and that

execution is served as well. But as we've gotten bigger, we've taken explicit steps to try more things. things and try a lot of new initiatives and have a framework for how we can double down on the new initiatives that work and just admit a mistake and move on from the initiatives that didn't. Kind of like what we've moved for is like in the early part of the company, we were zoomed in on this big canvas of innovation going on. And now that we've gotten bigger, we're kind of zooming out and trying to get more of that

innovation going on within Octa and then seeing which of those strongly executed bets pay off doubling down on those and then letting the other ones die and moving on to other innovation. What is the system by which you foster internal innovation? Because it seems as though obviously technology companies have dominated in the U.S. and, I guess, globally, this cycle of the economy and the stock market, but also the ones that have done the best seem to continually disrupt themselves or embrace something. They had Amazon Web Services, something seemingly unrelated to their core business. How do you do that? Is it structured? Is it unstructured? What is the standard for innovation internally at ACTA?

I talk to entrepreneurs and talk to people all the time. And every entrepreneur wants their company to thrive and grow up and be this successful independent company. But then not many of them can name a big successful independent company that's awesome and they don't want to work out. So it's a little bit of a daunting challenge. And you look at the news about IBM recently. Companies kind of investing parts of their business and doing it. acquisitions to stay innovative. And this is IBM, Big Blue, it was the most iconic company ever. So it is pretty daunting. So it's something I, as the company scale in the current chapter, I've thought about a lot. And I think that it's just putting a little bit of a framework in place

for what I've talked about. So I think the first thing is you have to figure out a way to foster ideas that are risky, ideas that might not work out, because the natural rhythm in companies is to put budget dollars behind things that have a very high likelihood of working, right? All things being equal in the budget cycle, you're not going to invest in things that are just a flyer, right? Because you want things that have a high likelihood to work. So you have to have a way, a process internally, to come up with ideas of things that you may be low likelihood of working, but that if they did work, would have a big impact on your company. So we've put that framework in place. You also have, I think, a budget allocated toward funding these things over the long term. You have to be

make sure they're working and making progress. But another downside of the traditional budgeting process is that things that start small and get big are not rewarded by the traditional budgeting process because they don't move the needle enough in the early years. We're doing some work to make sure there's budgeting dollars set aside fund that these set of projects that are going to take a while to reach the scale where they would be relevant to ACTA. But we have budget dollars set aside outside of the traditional budget to make sure we keep funding these things. And if they start to work, double down on them. And if they don't, shut them down and move on.

It raises an interesting question, which is maybe having you explain to people out there that aren't familiar, how a software business like yours works internally. So I talked about the products and you charge customers for those products. You make a lot of revenue, $500 plus million of revenue or more growing fast. Talk us through for a software company where suppliers is like a funny thing. You're hugely dependent. Your background at Salesforce and before it was engineering. So I know engineers internally are sort of like the suppliers in many cases of software companies.

But for a company like yours, what does cost of revenue or cost of goods? What does that mean? Where does that go to? We've talked a lot about cloud and kind of the macro trends around cloud. One of the biggest parts of cloud is that it's a subscription business. It's a recurring revenue subscription. So you're not selling the software as a perpetual license. It's recurring revenue.

What that means for us is that the cost of goods sold is the cost to run the service. So it's the computing infrastructure, the data centers. All of our stuff runs on Amazon. We use cloud for our data center. So our cost of goods sold or subscription costs as well. So we don't have capital allocation. And then there's some cost of people to kind of monitor and manage the service. The way I look at it is first thing you have to have is you have to have high gross margins.

So you have to know the basis of all of this has to be our gross margins have always been 75% plus. You can't be selling dollars for 80 cents. You have to have high gross margins of the foundation. And then above that, you have all of these costs R&D to build the software. You have G&A to run the company. You have sales and marketing to sell and distribute the software. But those costs are paid for by this recurring, accumulating business of customers that are paying you every year. So at a high gross margin.

When I look at the company, I just think about it. We have the total adjustable market for what we have is very big. So we're trying to grow as fast as we can while at the same time making sure that sales and marketing dollars are paid back within a reasonable time in terms of the recurring revenue. So we don't want to be spending a dollar of sales and marketing and have it not make a dollar of recurring revenue or have it make a month of recurring revenue. We want to balance out those recurring revenue costs with the sales of marketing costs. As long as you have a high gross margin and a big tam growth is going to be rewarded. How would you describe what you've learned about? You mentioned earlier this idea that you have to sell into, for you guys, it made sense to sell

into the very largest companies. I deal with a lot of software companies that we've invested in or hope to that will be dependent on that activity, selling the service or product of a young company into a very large older company. What have you learned about the best ways of doing that? Be honest. I think a lot of the tendency for a lot of companies that are selling to big companies is to fake it. Oh, we can do all this. We have perfect functionality. We have all your needs met. So I think be authentic. I think people that work at big companies know that a new company is not going to have all the things solved. But the fact that you're a new company and that you're flexible and agile and you'll listen to them is an advantage. So resist the tendency to kind of be to fake that you're something you're

not and be open and honest with the company. And then the other thing I would say is that also be confident about the value that you're providing to them. And I think a lot of companies make the mistake is that they're so happy to just be invited to the dance with a big company. They're not clear enough about the value and that they don't charge enough. These big companies, you know, you can, if you do your job right, you can contribute a ton of value to them and you should, for the sake of your business, you should make sure you get paid for that. I think that's a mistake that young companies are a lot of times are hesitant to charge or hesitant to really have the confidence that the value that they're delivering is worth what they're asking to be paid, and they should

probably not do that as much. Obviously, without naming any names, I'm curious what you've learned from experiences with what you would call bad clients. Maybe you haven't had some, but most companies of your size have had some bad customers, or maybe just misspecified customers that ultimately was the wrong decision to work together. What have you learned from those experiences? And is there anything in there that you might recommend young companies that are selling into enterprises do to try to avoid those kinds of mistakes? It's always dangerous to blame the customer for a problem. So I've always like really shied away from putting any blame on the customer if something doesn't work out well. But the reality is that sometimes customers can't execute for whatever

reason. They just have a hard time getting projects done. They have a hard time falling up on what they said. They have a hard time being a good partner in getting your technology deployed. My recollection would be too many times we just should have just recognized that and not poured as many resources into those certain customers because it wasn't going to be paid back. They just can't execute on their side and they weren't a good partner there. And I think that's part, especially when you're in the early days, you're scrapping for every customer. It's hard to admit to yourself that maybe this customer's fault. No one ever wants to blame someone else, but sometimes that's kind of where the blame is warranted. When I did this same format with Twilio's Jeff Lawson,

CEO and founder there, one of my favorite questions to ask Kim is when I can ask you too. which is it's almost like an unfair position that you guys get to see the future because you're an integral part or supplier to other people building new stuff. So I'm curious for any observations you have there. If you do think you get to see the future a little bit, what you're seeing in terms of the cutting edge of new technologies being built today. The thing that always strikes me is that how much, I think maybe this is a Silicon Valley perspective, we think the world is further along technologically than it is, there's still a lot of value to be delivered to companies just doing basic things. We have a product that does. It adds another layer of security by doing multi-factor authentication,

so not only password, but also checks a six-digit code or sends you a push notification. For us, it kind of seems like, man, doesn't everyone have that already? Isn't that on every application? But there's just so much out there that doesn't have basic security like that. So I think the thing that keeps hitting me is how much opportunity there is, basic steps to help companies be more secure and help people be more secure. And at the same time, helping them get online. We live on the internet all the time and we think everything's online. But there's still a lot of businesses that have a lot of work to do, just getting online.

And the potential there is tremendous. I mean, some of them probably will never make the migration and they won't persist long term. But the ones that do, I think they can have a great future. What question broadly speaking are you trying to answer most right now? What is the best way over the long term to persist the growth of ACTA? That gets to so many core things about my job, which is it comes into picking the right markets, picking the right time to expand the whole conversation we had around innovation and fostering innovation, competitively how to focus on that and what markets can we dominate.

and what markets will be harder to dominate. One of the great things about building a company that's becoming a platform and that is so central to so many things is that there's a lot of options, but it's kind of a blessing and a curse because there's so many options. Sometimes I wish I would have just started a expense management company and just could work on an expense reporter. Either that or a video meeting software company. That would have been a good investment.

So let's imagine we were somehow able to convene over Zoom, I guess, these days, a thousand person classroom and those thousand people are the equivalent of you in 2008, having just started Octa, having just begun what they probably think is their life's work. And you get an hour guest lecture to teach them. What presentation would you give? The first thing I would say probably is if you're successful in this, you're going to be working on it and talking about it a lot for a long time. So make sure you're into it. A little bit in just, but that is something that is very true. The other thing I would say is that there is an advantage to just accept the fact, by definition, you should be doing something new and unknown and scary. And while your instinct is

going to be to gravitate toward things that are more known and less scary and maybe not as new, resist that instinct. You need something that's new and unknown and scary and you just got to get used to that feeling because that's the only way you can really innovate. And that's the only way that you can define the category for yourself. That's the only way that you can come out the other end being the thing that is the marquee name in that space. And it happens fast. Like you keep working. And one day you go from convincing people that what you're doing is not been done or it's not relevant or not a big enough problem to being everyone obviously sees you as the standard in that space. And that's a very powerful position to be in. Can you say more about that word scary?

What does it feel like to be scared in the context that you mean it? For me, it was this. I might be wasting my time. We only get so much time. In the early day, of Octa, the biggest fear I had and the most scared I was is that it's all going to be for not and it's going to be four or five years and nothing came of it and I could have done something else. That's what I meant by scared. I'm very lucky like in terms of the financial position I was in when I started Octa and just health and so forth. People have real fears and real trepidation in life. But for me it was like the fear of not being successful and the fear of not spending my time wisely. Well, I have the same traditional closing question for everybody and I'll ask you, which is for

the kindest thing that anyone's ever done for you? I remember I was a senior in high school and I grew up in the Bay Area. So we were about four hours drive from the ski slopes. I really wanted to drive my dad's truck and take my buddy and go skiing. I was really into skiing and I was starting to like it and I wanted to go and he wouldn't let me. He wouldn't let me take his truck. He's like, Todd, it's not safe. And I got really mad at him and but he said, I'll drive you. I'll get up early. I'll drive you. I'll drive you up there and he didn't ski, so he'll just sit there and wait for me all day while I skied, and he did it. That just is one example of a million things my parents have done for me, but they just provided me with an incredibly rock-solid foundation and many acts of kindness. That being the one that pops into

my mind. Well, one thing I'll really remember about this conversation is just the amount of work that there seems to still be to do. I love your point around people's assumption that everything's kind of built and we're all using these tools. And so the game is over. but really cool perspective on even though you've grown quite big, how much white or green space there still is even for your company. So thanks for all the lessons and great stories. It's been a pleasure getting to know you and learning a lot about ACTA. Yeah, thanks a lot, Patrick.

I tell the team that enjoy it and observe because in five or 10 years, you're going to look back and think that that was the cute little ACTA from 2020. I love it. A great place to end. Thanks so much for your time. This episode was brought to you by Microsoft for Startups. Microsoft for Startups is a global program, dedicated to helping enterprise-ready B-to-B startups successfully scale their companies.

In this five-part mini-series, we talked to Greylock partner, Sam Motamity, and Microsoft for Startups, about why companies should partner with Microsoft for startups. In this week's episode, we talked with Sam Motamity, a partner at Greylock, about what founders should consider when picking software partners for their growing business. Since you were invested before the thing itself was built, it's an interesting time in a company's life cycle because they had tons of choices to make around. what toolkits to use, what partners to build on top of, how do you guide companies like abnormal security that are at the start of their building phase and guide them on what's important when

selecting partners, you know, an infrastructure provider and any other suppliers is what I would call it as they build out their solution. Part of why it's such a good time to start a company in 2020 is the availability of tooling in the ecosystem that you can build on top of, whether that tooling and infrastructure is provided by a major cloud provider or found in open source or provided by a smaller company, it's never been easier to get new product to market quickly by leveraging tooling that's already out there. So the first thing we push founders on is to be judicious around what's going to be core competency and core IP for your company versus what's not. And then for the things that are not going to be, which should be most things in your software stack,

go leverage what's out there. And so that you future proof yourself by building against someone else's infrastructure who does view it as their core competency. and is going to continue to invest. So I think that's the first piece. Then when it comes to actually picking who to work with, there are really two dimensions we encourage companies to consider. I think the first is the technology side. And if you just take cloud platforms,

there's actually a lot of differentiation across these cloud platforms. And they each have strengths and weaknesses in their product portfolios. Some of the cloud platforms have invested more in building AI services that next generation AI startups can build against. others have stronger focus on ensuring privacy and security in their underlying services. So understanding what are the set of service product and technology services that are most important to you as a new startup and which cloud has the strongest offering in those areas, that's one piece. But then the second piece, and this is emerging as an important consideration, is on the go-to-market side,

which is if you're a new company and you want to target large enterprise from day one, Fortune 500, a global 2,000 accounts, you're going to need to need to, as much help as you can get. And so if you can work with an underlying technology provider, cloud provider, that has relationships with those types of customers and has the ability and programs to help bring you into those accounts early on, that can make an absolutely, you know, absolutely dramatic difference in your speed to market in the enterprise. What other advice do you have for young founders that are building or new founders that are building a new enterprise solution and, let's say, partnered with someone like Microsoft, and how

they navigate and use that ecosystem to their advantage? Absolutely. So the first is focus on the enterprise accounts from day one. Your entire DNA and muscle as a company gets built for the customer segment you focus on. So if you want to build for the enterprise, you should build for them on day one. We've seen companies that start in the SMB and then say, hey, we'll move up market. But then the challenge they began to realize is that product market fit they had established was established with a very different customer segment that had different characteristics than what the enterprise is looking for. Then the second piece is pick the right enterprises to focus on. And I think this is where having partners like Microsoft can really accelerate things because there's a range of enterprises out there

and there's a range in their approach to innovation and partnering with young companies early on and then setting up programs to actually make those young companies successful. And so how do you leverage different partners you're working with to identify and get access to those companies. To find more episodes or sign up for our weekly summary, visit investor field guide.com. Thanks for listening to Founders Field Guide.