UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

_____________________________________

FORM 10-Q

_____________________________________

(Mark One)


☒			QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the quarterly period ended ~~July~~October 31, 2025


☐			TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from to

Commission File Number: 001-38044

_____________________________________

Okta, Inc.

(Exact Name of Registrant as Specified in its Charter)

_____________________________________

Delaware

100 First Street, Suite 600

26-4175727

(State or Other Jurisdiction of

Incorporation or Organization)

San Francisco

(I.R.S. Employer

Identification Number)

California

94105

(Address of Principal Executive Offices)

Registrant’s telephone number, including area code: (888) 722-7871

___________________________________________________

Securities registered pursuant to Section 12(b) of the Act:

Title of each class

Trading Symbol(s)

Name of each exchange on which registered

Class A common stock, par value $0.0001 per share

OKTA

The Nasdaq Stock Market LLC

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files) Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer”, “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer

☒

Accelerated filer

☐

Non-accelerated filer

☐

Smaller reporting company

☐

Emerging growth company

☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

As of ~~August~~November 2228, 2025, the number of shares of registrant’s Class A common stock outstanding was ~~168~~169,459,~~019~~250 and the number of shares of the registrant’s Class B common stock outstanding was 7,~~826~~770,~~862~~971.

Okta, Inc.

Table of Contents

		Page No.
PART I. FINANCIAL INFORMATION
Item 1.	Financial Statements (unaudited)	4
	Condensed Consolidated Balance Sheets as of July 31, 2025 and January 31, 2025	4
	Condensed Consolidated Balance Sheets as of October 31, 2025 and January 31, 2025	4
	Condensed Consolidated Statements of Operations for the Three and Six Months Ended July 31, 2025 and 2024	5
	Condensed Consolidated Statements of Operations for the Three and Nine Months Ended October 31, 2025 and 2024	5
	Condensed Consolidated Statements of Comprehensive Income (Loss) for the Three and Six Months Ended July 31, 2025 and 2024	6
	Condensed Consolidated Statements of Comprehensive Income for the Three and Nine Months Ended October 31, 2025 and 2024	6
	Condensed Consolidated Statements of Stockholders’ Equity for the Three and Six Months Ended July 31, 2025 and 2024	7
	Condensed Consolidated Statements of Stockholders’ Equity for the Three and Nine Months Ended October 31, 2025 and 2024	7
	Condensed Consolidated Statements of Cash Flows for the Six Months Ended July 31, 2025 and 2024	8
	Condensed Consolidated Statements of Cash Flows for the Nine Months Ended October 31, 2025 and 2024	9
	Notes to Condensed Consolidated Financial Statements	910
Item 2.	Management’s Discussion and Analysis of Financial Condition and Results of Operations	1819
Item 3.	Quantitative and Qualitative Disclosures about Market Risk	3233
Item 4.	Controls and Procedures	3334
PART II. OTHER INFORMATION
Item 1.	Legal Proceedings	3435
Item 1A.	Risk Factors	3435
Item 5.	Other Information	6061
Item 6.	Exhibits	61
	Signatures	63

FORWARD-LOOKING STATEMENTS

This Quarterly Report on Form 10-Q contains “forward-looking statements” within the meaning of the “safe harbor” provisions of the Private Securities Litigation Reform Act of 1995. Words such as “expect,” “anticipate,” “should,” “believe,” “hope,” “target,” “project,” “goals,” “estimate,” “potential,” “predict,” “may,” “will,” “might,” “could,” “intend,” “shall” and similar expressions are intended to identify these forward-looking statements. These statements include, but are not limited to, statements about: our future financial performance, including our revenue, costs of revenue, gross profits, margins and operating expenses; the impact of general economic, business and market conditions, including geopolitical events, economic downturns or recessions, market volatility, inflation and interest rates and foreign currency fluctuations; trends in our key business metrics; our growth strategy and ability to compete; the sufficiency of our cash and cash equivalents, investments and cash provided by sales of our solutions to meet our liquidity needs; potential impacts of cybersecurity incidents to our reputation, customer relations and financial results; our ability to detect, minimize or prevent security breaches to our internal systems and our platforms; our ability to maintain the security and service performance of our and our third-party service providers’ systems or data or our customers’ data; our ability to retain and sell additional solutions to existing customers; our ability to successfully expand our existing marketing and sales capabilities, including further specializing our go-to-market organization; our ability to effectively sustain or manage our revenue growth and profitability; our ability to expand our product sales by promoting our brand and engaging channel partners; our ability to partner with third-party software vendors and system integrators; the ability of our solutions to effectively integrate with third-party systems and technologies; our ability to adequately fund research and development, and introduce new solutions, enhance existing solutions and address new use cases; our ability to expand our international business operations and product sales; our ability to maintain and protect our proprietary rights and intellectual property; our ability to comply with modified or new laws, regulations and industry standards; our intent to pay off our convertible senior notes at maturity; the attraction and retention of qualified employees and key personnel; the impact of recent accounting pronouncements on our financial statements; our ability to successfully defend litigation or other claims brought against us; and our ability to successfully identify, integrate and/or realize the benefits of strategic acquisitions or investments. These forward-looking statements are made as of the date they were first issued and are based on current expectations and assumptions that are subject to a number of risks and uncertainties, which could cause our actual results to differ materially from those anticipated or implied by any forward-looking statements. Factors that could cause or contribute to such differences include, but not limited to, those discussed in “Risk Factors” in this Quarterly Report on Form 10-Q as well as other documents that may be filed by us from time to time with the Securities and Exchange Commission. We undertake no obligation to revise or publicly release the results of any revision to these forward-looking statements, except as required by law. Given these risks and uncertainties, readers are cautioned not to place undue reliance on such forward-looking statements.

PART I

Item. 1. Financial Statements

OKTA, INC.

CONDENSED CONSOLIDATED BALANCE SHEETS

(dollars in millions, shares in thousands, except per share data)

	July 31,2025		January 31,2025
	October 31,2025		January 31,2025
	(unaudited)
Assets
Current assets:
Cash and cash equivalents	$	~~876~~645	$	409
Short-term investments	1,~~982~~818		2,114
Accounts receivable, net of allowances of $8 and $4, respectively	417		621
Accounts receivable, net of allowances of $6 and $4, respectively	463		621
Deferred commissions	~~150~~155		140
Prepaid expenses and other current assets	~~141~~120		132
Total current assets	3,~~566~~201		3,416
Property and equipment, net	3940		43
Operating lease right-of-use assets	6864		74
Deferred commissions, noncurrent	~~268~~280		267
Intangible assets, net	~~104~~106		138
Goodwill	5,~~448~~487		5,448
Other assets	5751		51
Total assets	$	9,~~550~~229	$	9,437
Liabilities and stockholders' equity
Current liabilities:
Accounts payable	$	1213	$	13
Accrued expenses and other current liabilities	9091		103
Accrued compensation	~~136~~173		207
Convertible senior notes, net	~~859~~350		509
Deferred revenue	1,~~550~~557		1,691
Total current liabilities	2,~~647~~184		2,523
Convertible senior notes, net, noncurrent	—		349
Operating lease liabilities, noncurrent	8173		94
Deferred revenue, noncurrent	2429		27
Other liabilities, noncurrent	4450		39
Total liabilities	2,~~796~~336		3,032
Commitments and contingencies (Note 8)
Commitments and contingencies (Note 7)
Stockholders’ equity:
Preferred stock, par value $0.0001 per share; 100,000 shares authorized; no shares issued and outstanding as of July 31, 2025 and January 31, 2025	—		—
Preferred stock, par value $0.0001 per share; 100,000 shares authorized; no shares issued and outstanding as of October 31, 2025 and January 31, 2025	—		—
Class A common stock, par value $0.0001 per share; 1,000,000 shares authorized; 168,437 and 165,650 shares issued and outstanding as of July 31, 2025 and January 31, 2025, respectively	—		—
Class A common stock, par value $0.0001 per share; 1,000,000 shares authorized; 169,457 and 165,650 shares issued and outstanding as of October 31, 2025 and January 31, 2025, respectively	—		—
Class B common stock, par value $0.0001 per share; 120,000 shares authorized; 7,827 and 7,809 shares issued and outstanding as of July 31, 2025 and January 31, 2025, respectively	—		—
Class B common stock, par value $0.0001 per share; 120,000 shares authorized; 7,771 and 7,809 shares issued and outstanding as of October 31, 2025 and January 31, 2025, respectively	—		—
Additional paid-in capital	9,~~426~~519		9,219
Accumulated other comprehensive income (loss)	14		(12)
Accumulated deficit	(2,~~673~~630)		(2,802)
Total stockholders’ equity	6,~~754~~893		6,405
Total liabilities and stockholders' equity	$	9,~~550~~229	$	9,437

See Notes to Condensed Consolidated Financial Statements.

OKTA, INC.

CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS

(dollars in millions, shares in thousands, except per share data)

(unaudited)

	Three Months EndedJuly 31,				Six Months EndedJuly 31,
	Three Months EndedOctober 31,				Nine Months EndedOctober 31,
	2025		2024		2025		2024
Revenue:
Subscription	$	~~711~~724	$	~~632~~651	$	12,~~384~~108	$	1,~~235~~886
Professional services and other	1718		14		3250		2842
Total revenue	~~728~~742		~~646~~665		12,~~416~~158		1,~~263~~928
Cost of revenue:
Subscription	147		~~137~~140		~~283~~430		~~267~~407
Professional services and other	2123		1817		4063		3653
Total cost of revenue	~~168~~170		~~155~~157		~~323~~493		~~303~~460
Gross profit	~~560~~572		~~491~~508		1,~~093~~665		~~960~~1,468
Operating expenses:
Research and development	160		~~164~~158		~~314~~474		~~327~~485
Sales and marketing	~~246~~271		~~238~~256		~~483~~754		~~474~~730
General and administrative	~~113~~118		~~108~~110		~~216~~334		~~225~~335
Total operating expenses	~~519~~549		~~510~~524		1,~~013~~562		1,~~026~~550
Operating income (loss)	4123		(1916)		80103		(6682)
Interest expense	(1)		(1)		(23)		(34)
Interest income and other, net	2728		2926		5785		5682
Gain on early extinguishment of debt	—		316		—		319
Interest and other, net	2627		3141		5582		5697
Income (loss) before provision for (benefit from) income taxes	67		12		135		(10)
Income before provision for income taxes	50		25		185		15
Provision for (benefit from) income taxes	—		(17)		6		1
Provision for income taxes	7		9		13		10
Net income (loss)	$	67	$	29	$	129	$	(11)
Net income	$	43	$	16	$	172	$	5
Net income (loss) per share, basic	$	0.38	$	0.18	$	0.74	$	(0.06)
Net income per share, basic	$	0.24	$	0.09	$	0.98	$	0.03
Net income (loss) per share, diluted	$	0.3724	$	0.1500	$	0.7296	$	(0.0608)
Weighted-average shares used to compute net income (loss) per share, basic	175,460		168,612		174,827		168,045
Weighted-average shares used to compute net income per share, basic	176,524		170,217		175,399		168,775
Weighted-average shares used to compute net income (loss) per share, diluted	~~180~~178,~~966~~402		~~174~~170,~~443~~673		~~181~~179,~~356~~393		~~168~~169,~~045~~768

See Notes to Condensed Consolidated Financial Statements.

OKTA, INC.

CONDENSED CONSOLIDATED STATEMENTS OF COMPREHENSIVE INCOME ~~(LOSS)~~

(in millions)

(unaudited)

	Three Months EndedJuly 31,				Six Months EndedJuly 31,
	Three Months EndedOctober 31,				Nine Months EndedOctober 31,
	2025		2024		2025		2024
Net income (loss)	$	67	$	29	$	129	$	(11)
Net income	$	43	$	16	$	172	$	5
Other comprehensive income (loss):
Other comprehensive income:
Net change in unrealized gains or losses on available-for-sale securities	~~(4)~~2		72		~~(2)~~—		(1)
Foreign currency translation adjustments	—1		32		1516		—2
Other comprehensive income (loss)	(4)		10		13		(1)
Other comprehensive income	3		4		16		3
Comprehensive income (loss)	$	63	$	39	$	142	$	(12)
Comprehensive income	$	46	$	20	$	188	$	8

See Notes to Condensed Consolidated Financial Statements.

OKTA, INC.

CONDENSED CONSOLIDATED STATEMENTS OF STOCKHOLDERS’ EQUITY

(dollars in millions, shares in thousands)

(unaudited)

	Three and Six Months Ended July 31, 2025
	Three and Nine Months Ended October 31, 2025
	Class A Common Stock			Class B Common Stock			Additional Paid-in Capital		Accumulated Other Comprehensive Income (Loss)		Accumulated Deficit		Total Stockholders’ Equity
	Shares	Amount		Shares	Amount
Balances as of January 31, 2025	165,650	$—	—	7,809	$—	—	$	9,219	$	(12)	$	(2,802)	$	6,405
Issuance of common stock	1,446	—		166	—		9		—		—		9
Taxes withheld related to net share settlement of equity awards	—	—		—	—		(54)		—		—		(54)
Conversion of Class B common stock to Class A common stock	65	—		(65)	—		—		—		—		—
Stock-based compensation	—	—		—	—		128		—		—		128
Other comprehensive income	—	—		—	—		—		17		—		17
Net income	—	—		—	—		—		—		62		62
Balances as of April 30, 2025	167,161	$—	—	7,910	$—	—	$	9,302	$	5	$	(2,740)	$	6,567
Issuance of common stock	1,146	—		47	—		24		—		—		24
Taxes withheld related to net share settlement of equity awards	—	—		—	—		(49)		—		—		(49)
Conversion of Class B common stock to Class A common stock	130	—		(130)	—		—		—		—		—
Settlement of capped calls related to convertible senior notes	—	—		—	—		2		—		—		2
Stock-based compensation	—	—		—	—		147		—		—		147
Other comprehensive loss	—	—		—	—		—		(4)		—		(4)
Net income	—	—		—	—		—		—		67		67
Balances as of July 31, 2025	168,437	—		7,827	—		$	9,426	$	1	$	(2,673)	$	6,754
Issuance of common stock	947	—		17	—		1		—		—		1
Taxes withheld related to net share settlement of equity awards	—	—		—	—		(46)		—		—		(46)
Conversion of Class B common stock to Class A common stock	73	—		(73)	—		—		—		—		—
Stock-based compensation	—	—		—	—		138		—		—		138
Other comprehensive income	—	—		—	—		—		3		—		3
Net income	—	—		—	—		—		—		43		43
Balances as of October 31, 2025	169,457	—		7,771	—		$	9,519	$	4	$	(2,630)	$	6,893

	Three and Six Months Ended July 31, 2024
	Class A Common Stock			Class B Common Stock			Additional Paid-in Capital		Accumulated Other Comprehensive Income (Loss)		Accumulated Deficit		Total Stockholders’ Equity
	Shares	Amount		Shares	Amount
Balances as of January 31, 2024	159,835	$	—	7,291	$	—	$	8,724	$	(6)	$	(2,830)	$	5,888
Issuance of common stock	1,077	—		—	—		6		—		—		6
Taxes withheld related to net share settlement of equity awards	—	—		—	—		(42)		—		—		(42)
Stock-based compensation	—	—		—	—		152		—		—		152
Other comprehensive loss	—	—		—	—		—		(11)		—		(11)
Net loss	—	—		—	—		—		—		(40)		(40)
Balances as of April 30, 2024	160,912	$	—	7,291	$	—	$	8,840	$	(17)	$	(2,870)	$	5,953
Issuance of common stock	1,470	—		172	—		31		—		—		31
Taxes withheld related to net share settlement of equity awards	—	—		—	—		(40)		—		—		(40)
Conversion of Class B common stock to Class A common stock	15	—		(15)	—		—		—		—		—
Stock-based compensation	—	—		—	—		150		—		—		150
Other comprehensive income	—	—		—	—		—		10		—		10
Net income	—	—		—	—		—		—		29		29
Balances as of July 31, 2024	162,397	—		7,448	—		$	8,981	$	(7)	$	(2,841)	$	6,133

See Notes to Condensed Consolidated Financial Statements.


	Three and Nine Months Ended October 31, 2024
	Class A Common Stock		Class B Common Stock		Additional Paid-in Capital		Accumulated Other Comprehensive Income (Loss)		Accumulated Deficit		Total Stockholders’ Equity
	Shares	Amount	Shares	Amount
Balances as of January 31, 2024	159,835	—	7,291	—	$	8,724	$	(6)	$	(2,830)	$	5,888
Issuance of common stock	1,077	—	—	—	6		—		—		6
Taxes withheld related to net share settlement of equity awards	—	—	—	—	(42)		—		—		(42)

Stock-based compensation	—	—	—	—	152		—		—		152
Other comprehensive loss	—	—	—	—	—		(11)		—		(11)
Net loss	—	—	—	—	—		—		(40)		(40)
Balances as of April 30, 2024	160,912	—	7,291	—	$	8,840	$	(17)	$	(2,870)	$	5,953
Issuance of common stock	1,470	—	172	—	31		—		—		31
Taxes withheld related to net share settlement of equity awards	—	—	—	—	(40)		—		—		(40)
Conversion of Class B common stock to Class A common stock	15	—	(15)	—	—		—		—		—
Stock-based compensation	—	—	—	—	150		—		—		150
Other comprehensive income	—	—	—	—	—		10		—		10
Net income	—	—	—	—	—		—		29		29
Balances as of July 31, 2024	162,397	—	7,448	—	$	8,981	$	(7)	$	(2,841)	$	6,133
Issuance of common stock	1,205	—	302	—	9		—		—		9
Taxes withheld related to net share settlement of equity awards	—	—	—	—	(32)		—		—		(32)

Stock-based compensation	—	—	—	—	135		—		—		135
Other comprehensive income	—	—	—	—	—		4		—		4
Net income	—	—	—	—	—		—		16		16
Balances as of October 31, 2024	163,602	—	7,750	—	$	9,093	$	(3)	$	(2,825)	$	6,265

See Notes to Condensed Consolidated Financial Statements.

OKTA, INC.

CONDENSED CONSOLIDATED STATEMENTS OF CASH FLOWS

(in millions)

(unaudited)

	Six Months EndedJuly 31,
	Nine Months EndedOctober 31,
	2025		2024
Cash flows from operating activities:
Net income (loss)	$	129	$	(11)
Net income	$	172	$	5
Adjustments to reconcile net income (loss) to net cash provided by operating activities:
Adjustments to reconcile net income to net cash provided by operating activities:
Stock-based compensation	~~272~~410		~~299~~434
Depreciation and amortization	4872		5073
Amortization of deferred commissions	76117		6295
Deferred income taxes	37		(42)
Gain on early extinguishment of debt	—		(319)
Other, net	43		(1)
Changes in operating assets and liabilities:
Accounts receivable	~~201~~154		~~181~~94
Deferred commissions	(80138)		(5997)
Prepaid expenses and other assets	~~(9)~~17		(8260)
Operating lease right-of-use assets	914		1016
Accounts payable	(21)		(1)
Accrued compensation	(7538)		(5521)
Accrued expenses and other liabilities	(119)		3344
Operating lease liabilities	(1422)		(1826)
Deferred revenue	(~~143~~132)		(9670)
Net cash provided by operating activities	~~408~~626		~~305~~464
Cash flows from investing activities:
Capitalized software	(58)		(711)
Purchases of property and equipment	(37)		(67)
Purchases of securities available-for-sale and other	(~~720~~1,056)		(~~779~~1,253)
Proceeds from maturities and redemption of securities available-for-sale	~~848~~1,347		~~808~~1,187
Proceeds from sales of securities available-for-sale and other	13		23
Payments for business acquisitions, net of cash acquired	(356)		(56)
Net cash provided by (used in) investing activities	~~118~~223		(38137)
Cash flows from financing activities:
Payments for repurchases of convertible senior notes	—		(40)
Payments upon maturity and repurchases of convertible senior notes	(510)		(280)
Taxes paid related to net share settlement of equity awards	(~~102~~148)		(80113)
Proceeds from settlement of capped calls related to convertible senior notes	2		—
Proceeds from stock option exercises	1011		917
Proceeds from shares issued in connection with employee stock purchase plan	23		24
Net cash used in financing activities	(67622)		(87352)
Effects of changes in foreign currency exchange rates on cash, cash equivalents and restricted cash	109		—1
Net increase in cash, cash equivalents and restricted cash	469		180
Net increase (decrease) in cash, cash equivalents and restricted cash	236		(24)
Cash, cash equivalents and restricted cash at beginning of period	415		342
Cash, cash equivalents and restricted cash at end of period	$	~~884~~651	$	~~522~~318
Supplementary cash flow disclosure:
Cash paid during the period for:
Operating leases	$	1828	$	2231
Non-cash activities:
Operating lease right-of-use assets exchanged for lease liabilities	23		9
Reconciliation of cash, cash equivalents and restricted cash within the condensed consolidated balance sheets to the amounts shown in the condensed consolidated statements of cash flows above:
Cash and cash equivalents	$	~~876~~645	$	~~515~~310
Restricted cash, current included in prepaid expenses and other current assets	2—		12
Restricted cash, noncurrent included in other assets	6		6
Total cash, cash equivalents and restricted cash	$	~~884~~651	$	~~522~~318

See Notes to Condensed Consolidated Financial Statements.

OKTA, INC.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS

(unaudited)

1. Overview and Basis of Presentation

Description of Business

Okta, Inc. (the “Company”) is the leading independent identity partner. The Company’s Okta Platform and Auth0 Platform enable customers to securely connect the right people to the right technologies and services at the right time. Employees and contractors sign into the Okta Platform to seamlessly and securely access the applications they need to do their most important work with more modern and secure experiences in the cloud and via mobile devices. Developers leverage the Okta Platform and Auth0 Platform to securely and efficiently embed identity into the software they build, allowing them to innovate and focus on their core mission. The Company is headquartered in San Francisco, California.

Basis of Presentation and Principles of Consolidation

The accompanying unaudited condensed consolidated financial statements, which include the accounts of the Company and its wholly owned subsidiaries, have been prepared in conformity with accounting principles generally accepted in the United States of America (“GAAP”) for interim periods. Accordingly, they do not include all of the financial information and footnotes required by GAAP for complete financial statements. All intercompany balances and transactions have been eliminated in consolidation.

The condensed consolidated balance sheet as of January 31, 2025, included herein, was derived from the audited financial statements as of that date. In the opinion of the Company’s management, the unaudited condensed consolidated financial statements reflect all normal recurring adjustments necessary for a fair statement of the results of operations for the interim periods presented but are not necessarily indicative of the results of operations to be anticipated for the full fiscal year ending January 31, 2026 or any future period.

The Company’s fiscal year ends on January 31. References to fiscal 2026, for example, refer to the fiscal year ending January 31, 2026.

Certain prior period amounts have been reclassified to conform to the current period presentation.

The condensed consolidated financial statements should be read in conjunction with the audited consolidated financial statements and notes included in the Company’s Annual Report on Form 10-K filed with the Securities and Exchange Commission (“SEC”) on March 5, 2025.

Segments

The Company conducts business globally and is managed, operated and organized by major functional departments that operate on a consolidated basis. As a result, the Company operates as one reportable segment. The Company employs a SaaS business model and generates revenue primarily by selling multi-year subscriptions to its cloud-based offerings.

The Company’s chief operating decision maker ("CODM") is the chief executive officer. The CODM utilizes consolidated GAAP and non-GAAP measures of profit and loss to evaluate the Company's overall performance and inform resource allocation to support strategic priorities and capital allocation needs. The profit and loss measure most consistent with GAAP used by the CODM is consolidated net income ~~(loss)~~.

The CODM is regularly provided with budgeted expense information and consolidated expense data. Accordingly, significant segment expenses are inherently reflected in the condensed consolidated financial statements and related notes.

Use of Estimates

The preparation of condensed consolidated financial statements in conformity with GAAP requires estimates, judgments and assumptions that affect the reported amounts of assets and liabilities, disclosure of contingent assets and liabilities at the date of the condensed consolidated financial statements and the reported amounts of revenue and expenses during the reporting period. Estimates are based on historical experience and on other assumptions that management believes are reasonable under the circumstances. Actual results could vary from those estimates. The Company’s most significant estimates include the valuation of deferred income tax assets,

910

OKTA, INC.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS

(unaudited)

uncertain tax positions, assets and liabilities acquired in business combinations and loss contingencies related to litigation.

2. Accounting Standards and Significant Accounting Policies

Significant Accounting Policies

For a summary of the Company’s significant accounting policies refer to “Note 2. Summary of Significant Accounting Policies” of its Annual Report on Form 10-K for the fiscal year ended January 31, 2025.

Recent Accounting Pronouncements Not Yet Adopted

In December 2023, the FASB issued guidance to provide disaggregated income tax disclosures on the rate reconciliation and income taxes paid. This guidance is effective for annual periods beginning after December 15, 2024, with early adoption permitted. The Company intends to adopt this guidance in its Annual Report on Form 10-K for the year ended January 31, 2026 and expects the adoption of the updated guidance to result in disclosure of additional disaggregated tax information.

In November 2024, the FASB issued guidance requiring the disclosure, in the notes to financial statements, of specified disaggregated income statement expense information. This guidance is effective for annual periods beginning after December 15, 2026, and interim reporting periods beginning after December 15, 2027, with early adoption permitted. The Company is currently evaluating the impact of this guidance.

3In September 2025, the FASB issued guidance to modernize the accounting for internal-use software costs to current development practices, clarifying when to begin capitalizing costs, and enhancing disclosure requirements. ~~Restructuring~~This guidance is effective for annual periods beginning after December 15, 2027, and ~~Other~~interim ~~Charges~~reporting periods within those annual periods, with early adoption permitted. Entities can adopt the new standard using a prospective, modified, or retrospective transition approach. The Company is currently evaluating the impact of adopting this guidance, including the timing of adoption (early or standard) and the selection of an appropriate transition method.

~~During the fourth quarter of fiscal 2025, the Company approved a restructuring plan (the “2025 Restructuring Plan”) intended to reallocate resources toward priorities to drive growth~~3. ~~The~~Cash ~~2025~~Equivalents Restructuring Plan involved a reduction of the Company’s workforce by approximately 180 full-time employees. The 2025 Restructuring Plan was substantially complete by the first quarter of fiscal 2026 and ~~the~~Investments ~~Company recognized aggregate restructuring costs of $11 million in the fourth quarter of fiscal 2025.~~

The following table summarizes the Company’s restructuring liability related to the 2025 Restructuring Plan that is included in Accrued expenses and other current liabilities on the condensed consolidated balance sheets:

	Severance and termination benefit costs
	(dollars in millions)
Balance as of January 31, 2025	$	11
Restructuring charges	—
Cash payments	(11)
Balance as of July 31, 2025	$	—

4. Cash Equivalents and Investments

Cash Equivalents and Short-term Investments

In estimating fair value, the Company uses a three-tier fair value hierarchy as follows:

•Level 1 — Valuations based on observable inputs that reflect quoted prices for identical assets or liabilities in active markets.

•Level 2 — Valuations based on other inputs that are directly or indirectly observable in the marketplace.

•Level 3 — Valuations based on unobservable inputs that are supported by little or no market activity.

OKTA, INC.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS (continued)

(unaudited)

The following tables present the estimated fair value of cash equivalents and short-term investments:

	As of July 31, 2025		As of January 31, 2025
	As of October 31, 2025		As of January 31, 2025
	(dollars in millions)
Cash equivalents:
Money market funds (Level 1)	$	~~654~~422	$	225
Certificates of deposit (Level 2)	34—		23
U.S. treasury securities (Level 2)	6		—
Total cash equivalents	422		248
Total cash equivalents	694		248
Level 2:
Short-term investments (Available-for-sale):
U.S. treasury securities	1,~~680~~517		1,788
Corporate debt securities	~~249~~239		281
Certificates of deposit	5362		45
Total short-term investments	1,~~982~~818		2,114
Total	$	2,~~676~~240	$	2,362

	As of July 31, 2025
	Estimated Fair Value
	(dollars in millions)
Due within one year	$	1,608
Due between one to five years	374
Total	$	1,982

Interest receivable of $24 million is included in Prepaid expenses and other current assets on the condensed consolidated balance sheets as of July 31, 2025 and January 31, 2025.

There were no material differences between the estimated fair value and amortized cost of our cash equivalents and short-term investments as of July 31, 2025 and January 31, 2025.

For available-for-sale debt securities that have unrealized losses, there were no material credit or non-credit related impairments for short-term investments as of July 31, 2025 and January 31, 2025.

Strategic Investments

Strategic investments primarily include equity investments in privately-held companies, which do not have a readily determinable fair value. Strategic investments are classified as Level 3 in the fair value hierarchy as nonrecurring fair value measurements may include observable and unobservable inputs. As of July 31, 2025 and January 31, 2025, the balance of strategic investments was $33 million and $30 million, respectively.

5. Deferred Commissions

Sales commissions capitalized as contract costs totaled $48 million and $33 million for the three months ended July 31, 2025 and 2024, respectively, and $80 million and $59 million for the six months ended July 31, 2025 and 2024, respectively.

Amortization of contract costs totaled $40 million and $32 million for the three months ended July 31, 2025 and 2024, respectively, and $76 million and $62 million for the six months ended July 31, 2025 and 2024, respectively.

OKTA, INC.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS (continued)

(unaudited)

The following table presents the contractual maturities of the Company’s short-term investments:

6. Deferred Revenue and Performance Obligations


	As of October 31, 2025
	Estimated Fair Value
	(dollars in millions)
Due within one year	$	1,511
Due between one to five years	307
Total	$	1,818

Interest receivable of $22 million and $24 million is included in Prepaid expenses and other current assets on the condensed consolidated balance sheets as of October 31, 2025 and January 31, 2025, respectively.

There were no material differences between the estimated fair value and amortized cost of our cash equivalents and short-term investments as of October 31, 2025 and January 31, 2025.

For available-for-sale debt securities that have unrealized losses, there were no material credit or non-credit related impairments for short-term investments as of October 31, 2025 and January 31, 2025.

Strategic Investments

Strategic investments primarily include equity investments in privately-held companies, which do not have a readily determinable fair value. Strategic investments are classified as Level 3 in the fair value hierarchy as nonrecurring fair value measurements may include observable and unobservable inputs. As of October 31, 2025 and January 31, 2025, the balance of strategic investments was $32 million and $30 million, respectively.

4. Deferred Commissions

Sales commissions capitalized as contract costs totaled $58 million and $37 million for the three months ended October 31, 2025 and 2024, respectively, and $138 million and $97 million for the nine months ended October 31, 2025 and 2024, respectively.

Amortization of contract costs totaled $41 million and $33 million for the three months ended October 31, 2025 and 2024, respectively, and $117 million and $95 million for the nine months ended October 31, 2025 and 2024, respectively.

5. Deferred Revenue and Performance Obligations

Deferred Revenue

Deferred revenue, which is a contract liability, consists primarily of payments received and accounts receivable recorded in advance of revenue recognition under the Company’s contracts with customers and is recognized as the revenue recognition criteria are met.

Subscription revenue recognized during the three months ended ~~July~~October 31, 2025 and 2024 that was included in the deferred revenue balances at the beginning of the respective periods was $~~651~~665 million and $~~578~~597 million, respectively, and $1,~~144~~495 million and $1,~~008~~312 million in the ~~six~~nine months ended ~~July~~October 31, 2025 and 2024, respectively.

Transaction Price Allocated to the Remaining Performance Obligations

Transaction price allocated to the remaining performance obligations (“RPO”) represents all future, non-cancelable contracted revenue that has not yet been recognized, inclusive of deferred revenue that has been invoiced and non-cancelable amounts that will be invoiced and recognized as revenue in future periods.

Total remaining non-cancelable performance obligations under subscription contracts with customers was approximately $4,~~152~~292 million as of ~~July~~October 31, 2025. Of this amount, the Company expects to recognize revenue of approximately $2,~~265~~328 million, or 5554%, over the next 12 months, with the balance to be recognized as revenue thereafter.

7. Convertible Senior Notes, Net

Convertible Senior Notes

The 2025 convertible senior notes (“2025 Notes”) and the 2026 convertible senior notes (“2026 Notes” and together with the 2025 Notes, the “Notes”) are recorded at face value less unamortized debt issuance costs. As of July 31, 2025, the 2025 Notes and 2026 Notes are classified as current liabilities due to their upcoming maturities on September 1, 2025 and June 15, 2026, respectively.

The net carrying amount of the Notes consisted of the following:

	As of July 31, 2025		As of January 31, 2025
	(dollars in millions)
2025 Notes:
Principal	$	510	$	510
Less: unamortized debt issuance costs	—		(1)
Net carrying amount	$	510	$	509
2026 Notes:
Principal	$	350	$	350
Less: unamortized debt issuance costs	(1)		(1)
Net carrying amount	$	349	$	349

OKTA, INC.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS (continued)

(unaudited)

6. Convertible Senior Notes, Net

Convertible Senior Notes

The 2025 convertible senior notes (“2025 Notes”) and the 2026 convertible senior notes (“2026 Notes” and together with the 2025 Notes, the “Notes”) are recorded at face value less unamortized debt issuance costs. As of October 31, 2025, the 2026 Notes are classified as current liabilities due to their upcoming maturity on June 15, 2026. The 2025 Notes matured on September 1, 2025, and the Company settled the full remaining $510 million principal amount outstanding in cash.

Fair Value Measurements

~~The~~As ~~following~~of ~~table~~October ~~presents~~31, 2025, the ~~principal amounts and~~ estimated fair ~~values~~value of the 2026 Notes, which are not recorded at fair value on the condensed consolidated balance sheets:, was $341 million.

	As of July 31, 2025
	Principal Amount		Estimated Fair Value
	(dollars in millions)
2025 Notes	$	510	$	508
2026 Notes	$	350	$	336

The estimated fair value of the 2026 Notes, which are Level 2 financial instruments, was determined based on the quoted bid prices of the 2026 Notes in an over-the-counter market on the last available trading day of the reporting period.

~~The~~7. ~~estimated~~Commitments ~~fair~~and ~~values~~Contingencies of the Notes, which are Level 2 financial instruments, were determined based on the quoted bid prices of the Notes in an over-the-counter market on the last available trading day of the reporting period.

8. Commitments and Contingencies

Letters of Credit

In conjunction with the execution of certain office space operating leases, letters of credit in the aggregate amount of $5 million and $6 million were issued and outstanding as of ~~July~~October 31, 2025 and January 31, 2025, respectively. No draws have been made under such letters of credit.

Legal Matters

From time to time in the normal course of business, the Company may be subject to various legal matters such as threatened or pending claims or proceedings.

On May 20, 2022, a purported shareholder filed a putative class action lawsuit in the United States District Court for the Northern District of California against the Company and certain of its executive officers, captioned In re Okta, Inc. Securities Litigation, No. 3:22-cv-02990. The lawsuit asserted claims under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, alleging that the defendants made false or misleading statements or omissions concerning the Company’s cybersecurity controls, vulnerability to data breaches and the Company’s integration of Auth0, Inc. (“Auth0”). The lawsuit sought an order certifying the lawsuit as a class action and unspecified damages. The defendants moved to dismiss the amended complaint. On March 31, 2023, the court dismissed in full the claims based on the plaintiff’s allegations related to the Company’s cybersecurity controls and vulnerability to data breaches, and dismissed in part and denied in part the claims based on allegations related to the Auth0 integration. On May 28, 2024, the parties entered into a stipulation of settlement (the “Stipulation”) where, in exchange for the release and dismissal with prejudice of all claims, the Company agreed to pay and/or to cause its insurance carriers to pay a total of $60 million, which is covered through a combination of the Company’s Director & Officer (“D&O”) insurance and the balance of the Company’s $10 million retention on the primary D&O policy. The Stipulation does not constitute an admission of fault or wrongdoing by the Company or its executives. On November 19, 2024, the court granted final approval of the Stipulation and dismissed the lawsuit in its entirety, with prejudice.

Additionally, two purported shareholders filed derivative lawsuits on behalf of the Company in the United States District Court for the Northern District of California against certain of its current and former executive officers and directors, captioned O’Dell v. McKinnon et al., No. 3:22-cv-07480 (filed Nov. 28, 2022) and LR Trust v. McKinnon et al., No. 3:22-cv-08627 (filed Dec. 13, 2022) (together, the “California Federal Derivative Actions”). The California Federal Derivative Actions allege, among other things, that the defendants breached their fiduciary duties by making false or misleading statements or omissions concerning the Company’s cybersecurity controls, vulnerability to data breaches and the Company’s integration of Auth0. The California Federal Derivative Actions seek orders permitting the plaintiffs to maintain the actions derivatively on behalf of the Company, awarding unspecified damages allegedly sustained by the Company, awarding restitution from the individual defendants and requiring the Company to make certain reforms to its corporate governance and controls. On February 22, 2023, the court entered a stipulated order consolidating the California Federal Derivative Actions, appointing co-lead counsel for plaintiffs and staying the consolidated California Federal Derivative Actions during the pendency of the motion to dismiss in the securities class action lawsuit. The consolidated California Federal Derivative Actions are captioned

OKTA, INC.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS (continued)

(unaudited)

for plaintiffs and staying the consolidated California Federal Derivative Actions during the pendency of the motion to dismiss in the securities class action lawsuit. The consolidated California Federal Derivative Actions are captioned In re Okta, Inc. Stockholder Derivative Litigation, No. 3:22-cv-07480. On May 9, 2023, the court entered a stipulated order continuing the stay through the close of discovery in the securities class action lawsuit and, on January 27, 2025, the court entered an order continuing the stay.

On April 14, 2023, another shareholder filed a substantially similar derivative lawsuit in the United States District Court for the District of Delaware against certain of the Company’s current and former executive officers and directors, captioned Buono v. McKinnon et al., No. 1:23-cv-00413 (the “Buono Action”). On May 31, 2023, the court entered a stipulated order whereby the defendants agreed to accept service and stay the Buono Action through the close of discovery in the securities class action lawsuit.

On January 25, 2024, another shareholder filed a substantially similar derivative lawsuit in the United States District Court for the District of Delaware against certain of the Company’s current and former executive officers and directors, captioned Nasr v. McKinnon, et al., No. 1:24-cv-00106 (together with the Buono Action, the “Delaware Federal Derivative Actions”). On March 18, 2024, the court entered a stipulated order whereby the defendants agreed to accept service and stay the derivative action through the close of discovery in the securities class action lawsuit.

On July 1, 2024, another shareholder filed a substantially similar derivative lawsuit in the Court of Chancery for the State of Delaware (the “Delaware Chancery Court”) against certain of the Company’s current and former executive officers and directors, captioned Grimaldi v. McKinnon, et al., C.A. No. 2024-0685-PAF (the “Grimaldi Action”). On July 19, 2024, the Delaware Chancery Court entered a stipulated order whereby the defendants agreed to accept service and to stay the derivative action through final approval of the settlement in the securities class action lawsuit.

On October 18, 2024, another shareholder filed a substantially similar derivative lawsuit in the Delaware Chancery Court against certain of the Company’s current and former executive officers and directors, captioned Duprat v. McKinnon, et al., C.A. No. 2024-1072-PAF (the “Duprat Action”). On November 8, 2024, the Delaware Chancery Court entered a stipulated order where the defendants agreed to accept service in the Duprat Action; the Grimaldi Action and the Duprat Action were consolidated (the “Delaware Chancery Actions”); and the Delaware Chancery Actions were stayed pursuant to the terms previously entered in the Grimaldi Action.

On January 10, 2025, the Company and defendants agreed in principle to the non-monetary terms of a global resolution of the California Federal Derivative Actions, the Delaware Federal Derivative Actions and the Delaware Chancery Actions (collectively, the “Derivative Actions”), and executed a Memorandum of Understanding in connection therewith containing the agreed-upon material, non-monetary terms of the proposed settlement. The parties in the Derivative Actions subsequently agreed that the Company would not oppose a fee award to plaintiffs’ counsel of $2.25 million, which the Company, as part of the final settlement documentation, will agree to cause its D&O insurers to pay. The parties in the Derivative Actions executed a Stipulation of Settlement on June 26, 2025, and the plaintiffs in the consolidated California Federal Derivative Actions filed a motion for preliminary approval of the proposed settlement on July 1, 2025. On August 18, 2025, the court in the consolidated California Federal Derivative Actions granted preliminary approval of the proposed settlement. ~~The~~On ~~proposed~~October ~~settlement~~22, ~~remains~~2025, ~~subject~~the tocourt in the consolidated California Federal Derivative Actions granted final approval, ~~and~~of the ~~court~~settlement inand entered a judgment dismissing the consolidated California Federal Derivative Actions ~~has~~with ~~set~~prejudice. aOn ~~final~~November ~~settlement~~24, ~~approval~~2025, ~~hearing~~the ~~for~~court ~~October~~in the Delaware Federal Derivative Actions entered orders dismissing those actions with prejudice pursuant to the terms of the settlement. On November 24, 2025, the plaintiffs in the Delaware Chancery Actions filed a notice of voluntary dismissal, requesting that the action be dismissed with prejudice pursuant to the terms of the settlement.

Warranties and Indemnification

To date, the Company has not incurred significant costs and has not accrued any material liabilities in the accompanying condensed consolidated financial statements as a result of its warranty and indemnification obligations.

9. Employee Incentive Plans

The Company’s equity incentive plans provide for granting stock options, restricted stock units (“RSUs”), restricted stock awards (“RSAs”) to employees, consultants, officers and directors and RSUs with market-based vesting conditions to certain executives. In addition, the Company offers an Employee Stock Purchase Plan (“ESPP”) to eligible employees.

OKTA, INC.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS (continued)

(unaudited)

8. Employee Incentive Plans

Stock-based compensation expense was recorded in the following cost and expense categories in the Company’s condensed consolidated statements of operations:

	Three Months EndedJuly 31,				Six Months EndedJuly 31,
	Three Months EndedOctober 31,				Nine Months EndedOctober 31,
	2025		2024		2025		2024
	(dollars in millions)
Cost of revenue
Subscription	$	2119	$	2220	$	3857	$	4161
Professional services and other	23		3		58		69
Research and development	5149		5649		98147		~~119~~168
Sales and marketing	3533		3633		67100		6699
General and administrative	3534		3130		6498		6797
Total	$	~~144~~138	$	~~148~~135	$	~~272~~410	$	~~299~~434

The following table presents total unrecognized stock-based compensation expense related to outstanding equity awards as of October 31, 2025:

Unrecognized Stock-based Compensation Expense(in millions)

Weighted-average remaining period (in years)

Unvested RSUs

~~781~~664

1.98 years

Unvested RSAs

1222

12.61 years

ESPP

0.53 years

Total

~~800~~689

Market-based Restricted Stock Units

In March 2025, the Company granted market-based RSUs to certain members of management. The target number of market-based RSUs granted was 322,599. One-third of these market-based RSUs vest over each of a one-, two- and three-year performance period, each starting on February 1, 2025. The number of shares that can be earned ranges from 0% to 200% of the target number of shares based on the relative performance of the per share price of the Company’s common stock as compared to the Nasdaq Composite Index over the respective performance periods and subject to continuous employment through the vesting dates. The $196.20 average grant date fair value per target market-based RSU was determined using a Monte Carlo simulation approach. Compensation expense for awards with market conditions is recognized over the service period using the accelerated attribution method and is not reversed if the market condition is not met.

109. Income Taxes

For the three and nine months ended ~~July~~October 31, 2025, the Company recorded ana ~~insignificant~~ provision for income taxes ~~on pretax income~~ of $677 million. ~~For~~and ~~the~~$13 ~~six~~million ~~months~~on ~~ended~~pretax ~~July 31, 2025, the Company recorded a provision for~~ income ~~taxes~~ of $650 million onand ~~pretax income of~~ $~~135~~185 million, respectively. The effective tax rate for the three and ~~six~~nine months ended ~~July~~October 31, 2025 was approximately 014.50% and 47.61%, respectively. The effective tax rate differs from the statutory rate primarily as a result of a full valuation allowance against the U.S. deferred tax assets, the favorable tax impact of the “One Big Beautiful Bill Act” (the “Act”), the tax effect of foreign operations, and ~~other~~ U.S. federal and state taxes.

The Act was enacted on July 4, 2025. The Act, among other provisions, maintains the U.S. federal 21% corporate tax rate, makes permanent the immediate expensing of domestic research and development expenditures, allows for 100% bonus depreciation for qualified assets, and modifies the U.S. taxation of profits ~~derived from foreign operations. The provisions of the Act have staggered effective dates beginning in 2025 and continuing through 2027.~~

In accordance with U.S. GAAP, the effects of changes in tax laws are recognized in the period of enactment. As a result, the Company evaluated the impact of the Act on its condensed consolidated financial statements.

OKTA, INC.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS (continued)

(unaudited)

~~Consequently,~~derived ~~the~~from ~~Company’s~~foreign ~~provision~~operations. ~~for~~The ~~income~~provisions ~~tax was computed to reflect the enactment~~ of the Act ~~resulting~~have instaggered aeffective ~~cumulative~~dates ~~decrease~~beginning toin ~~income~~2025 ~~tax~~and ~~expense~~continuing ofthrough $52027. ~~million~~The ~~recorded~~Company ~~during~~revised ~~the~~its ~~three~~estimated ~~months~~annual ~~ended~~effective ~~July~~tax ~~31,~~rate ~~2025.~~upon ~~This~~enactment ~~decrease~~of ~~is primarily attributable to~~ the ~~provision,~~changes ~~under~~in the Act~~, for immediate expensing of domestic research and development expenditures~~.

For the three and ~~six~~nine months ended ~~July~~October 31, 2024, the Company recorded a provision for ~~(benefit from)~~ income taxes of $~~(17)~~9 million and $110 million on a pretax income of $1225 million and ~~pretax loss of~~ $1015 million, respectively. The effective tax rate for the three and ~~six~~nine months ended ~~July~~October 31, 2024 was approximately ~~(158~~40.8)4% and (269.5)6%, respectively. The effective tax rate differs from the statutory rate primarily as a result of a full valuation allowance against the U.S. deferred tax assets, the tax effect of foreign operations, the tax impacts of the Spera Cybersecurity, Inc. and its subsidiary (collectively, “Spera”) integration, and U.S. federal and state taxes.

1110. Net Income (Loss) Per Share

The following tables present the calculation of basic and diluted net income (loss) per share. Net income (loss) is reported in millions and rounded from amounts in thousands; as a result, net income (loss) per share may not recalculate exactly due to rounding.

	Three Months Ended July 31,
	Three Months Ended October 31,
	2025				2024
	Class A		Class B			Class A		Class B
	(dollars in millions, shares in thousands, except per share data)
Basic net income per share:
Numerator:
Net income, basic	$	6441	$	32		$	2815	$	1
Denominator:
Weighted-average shares outstanding, basic	~~167~~168,~~615~~720		7,~~845~~804			~~161~~162,~~310~~681		7,~~302~~536
Net income per share, basic	$	0.3824	$	0.3824		$	0.1809	$	0.1809
Diluted net income per share:
Numerator:
Net income	$	6441	$	32		$	2815	$	1
Interest and other1	—		—			(315)		—(1)
Reallocation of net income as a result of assumed conversion of Class B to Class A common shares	32		—			1—		—
Net income, diluted	$	6743	$	32		$	26—	$	1—
Denominator:
Number of shares used in basic calculation	~~167~~168,~~615~~720		7,~~845~~804			~~161~~162,~~310~~681		7,~~302~~536
Weighted-average effect of diluted securities related to:
Employee share-based awards	21,~~642~~529		~~456~~349			~~2,289~~—		~~3,436~~—
Convertible senior notes	~~2,408~~—		—			~~106~~456		—
Assumed conversion of Class B to Class A common shares	8,~~301~~153		—			~~10,738~~—		—
Number of shares used in diluted calculation	~~180~~178,~~966~~402		8,~~301~~153			~~174~~163,~~443~~137		107,~~738~~536
Net income per share, diluted	$	0.3724	$	0.3724		$	0.1500	$	0.1200
1 Under the if-converted method, net income is adjusted to reflect the assumption that the convertible senior notes were converted at the beginning of the period.

OKTA, INC.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS (continued)

(unaudited)

	Six Months EndedJuly 31,
	Nine Months EndedOctober 31,
	2025				2024
	Class A		Class B			Class A		Class B
	(dollars in millions, shares in thousands, except per share data)
Basic net income (loss) per share:
Basic net income per share:
Numerator:
Net income (loss), basic	$	123	$	6		$	(10)	$	(1)
Net income, basic	$	164	$	8		$	5	$	—
Denominator:
Weighted-average shares outstanding, basic	~~166~~167,~~934~~513		7,~~893~~886			~~160~~161,~~749~~398		7,~~296~~377
Net income (loss) per share, basic	$	0.74	$	0.74		$	(0.06)	$	(0.06)
Net income per share, basic	$	0.98	$	0.98		$	0.03	$	0.03
Diluted net income (loss) per share:
Numerator:
Net income (loss)	$	123	$	6		$	(10)	$	(1)
Net income	$	164	$	8		$	5	$	—
Interest and other1	21		—			—(17)		—(1)
Reallocation of net income as a result of assumed conversion of Class B to Class A common shares	68		—			—		—
Net income (loss), diluted	$	~~131~~173	$	68		$	(1012)	$	(1)
Denominator:
Number of shares used in basic calculation	~~166~~167,~~934~~513		7,~~893~~886			~~160~~161,~~749~~398		7,~~296~~377
Weighted-average effect of diluted securities related to:
Employee share-based awards	2,~~634~~265		~~621~~531			—		—
Convertible senior notes	31,~~274~~198		—			—993		—
Assumed conversion of Class B to Class A common shares	8,~~514~~417		—			—		—
Number of shares used in diluted calculation	~~181~~179,~~356~~393		8,~~514~~417			~~160~~162,~~749~~391		7,~~296~~377
Net income (loss) per share, diluted	$	0.7296	$	0.7296		$	(0.0608)	$	(0.0608)
1 Under the if-converted method, net income is adjusted to reflect the assumption that the convertible senior notes were converted at the beginning of the period.

Potentially dilutive securities excluded because they would be anti-dilutive were as follows:

Three Months Ended July 31,

Six Months EndedJuly 31,

Three Months Ended October 31,

Nine Months EndedOctober 31,

2025

2024

2025

2024

(shares in thousands)

Employee share-based awards

13,~~227~~623

313,~~021~~444

23,~~835~~098

1513,~~506~~444

Convertible senior notes

—1,468

54,~~292~~170

—1,468

54,~~292~~170

Total

15,~~227~~091

817,~~313~~614

24,~~835~~566

2017,~~798~~614

The Company entered into capped call transactions in connection with the issuance of the convertible senior notes. The effect of the capped calls was also excluded from the calculation of diluted net income per share as the effect of the capped calls would have been anti-dilutive.

12. Subsequent Events

On August 25, 2025, the Company entered into a definitive agreement to acquire Axiom Security Ltd, a privately held company specializing in privileged access management solutions. The acquisition is expected to broaden the Company's privileged access management capabilities. The transaction is expected to close in the third quarter of fiscal 2026, subject to the satisfaction of customary closing conditions and will be financed with cash on hand. The acquisition is not expected to have a material impact to the Company's fiscal 2026 financial results.

OKTA, INC.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS (continued)

(unaudited)

11. Business Combinations

On September 4, 2025, the Company acquired all of the outstanding equity of Axiom Security Ltd (“Axiom”), a privately held company specializing in privileged access management solutions. The acquisition of Axiom is expected to broaden the Company's privileged access management capabilities. The acquisition date fair value of purchase consideration of $54 million was paid in cash. The Axiom acquisition was accounted for as a business combination.

The Company preliminarily recorded $16 million for developed technology intangible assets with an estimated useful life of 3 years and preliminarily recorded $40 million of goodwill which is primarily attributed to the assembled workforce as well as the integration of Axiom’s technology and the Company’s technology. None of the goodwill is expected to be deductible for U.S. federal income tax purposes. The Company may continue to adjust the preliminary purchase price allocation after obtaining more information regarding asset valuations, liabilities assumed and revisions of preliminary estimates through the measurement period.

This acquisition did not have a material impact on the Company’s condensed consolidated financial statements; therefore, historical and pro forma disclosures have not been presented.

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS

Item 2. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our condensed consolidated financial statements and related notes appearing elsewhere in this Quarterly Report on Form 10-Q and our Annual Report on Form 10-K. Amounts reported in millions are rounded based on the amounts in thousands. As a result, the sum of the components reported in millions may not equal the total amount reported in millions due to rounding. In addition, percentages presented may not add to their respective totals or recalculate due to rounding. In addition to historical financial information, the following discussion contains forward-looking statements that are based upon current plans, expectations and beliefs that involve risks and uncertainties. Our actual results may differ materially from those anticipated in these forward-looking statements as a result of various factors, including those set forth under the section titled “Risk Factors” under Part II, Item 1A of this Quarterly Report on Form 10-Q and Part I, Item 1A of our Annual Report on Form 10-K. Our fiscal year ends January 31. References to fiscal 2026, for example, refer to the fiscal year ended January 31, 2026.

Overview

Okta, Inc. is the leading independent identity partner. Our Okta Platform and Auth0 Platform enable our customers to securely connect the right people to the right technologies and services at the right time. Every day, thousands of organizations and millions of people use our platforms to securely access a wide range of cloud, mobile, web and Software-as-a-Service ("SaaS") applications, on-premises servers, application programming interfaces, IT infrastructure providers and services from a multitude of devices. Employees and contractors sign into the Okta Platform to seamlessly and securely access the applications they need to do their most important work with more modern and secure experiences in the cloud and via mobile devices. Developers leverage our Okta Platform and Auth0 Platform to securely and efficiently embed identity into the software they build, allowing them to innovate and focus on their core mission.

Given the growth trends in cloud adoption and the number of applications customers use and the movement to remote and hybrid workforces, identity is becoming the most critical layer of an organization’s security. As organizations shift from network-based security models to a Zero Trust security model focusing on adaptive and context-aware controls, identity has become the most reliable way to manage user access and protect digital assets. Our approach to identity allows our customers to simplify and efficiently scale their security infrastructures across internal IT systems and external customer facing applications.

Our customers consist of leading global organizations ranging from the largest enterprises, to small and medium-sized businesses, universities, non-profits and government agencies. We also partner with leading application, IT infrastructure and security vendors through our Okta Integration Network. As of ~~July~~October 31, 2025, we had over 7,000 integrations with these cloud, mobile and web applications and IT infrastructure and security vendors.

We employ a SaaS business model and generate revenue primarily by selling multi-year subscriptions to our cloud-based offerings. We focus on attracting and retaining our customers and increasing the value we provide to them over time. By retaining customers and increasing value, we increase their spending with us through expanding the number of users who access our Okta Platform and Auth0 Platform, and by selling additional product offerings. We sell our product offerings directly through our field and inside sales teams, as well as indirectly through our network of channel partners, including resellers, system integrators and other distribution partners. Our subscription fees include the use of our service and our technical support and management of our platforms. We base subscription fees primarily on the solutions used and the number of users on our platforms. We typically invoice customers in advance in annual installments for subscriptions to our platforms.

Our revenue is relatively predictable as a result of our subscription-based business model, which constituted approximately 98% of total revenue for the ~~six~~nine months ended ~~July~~October 31, 2025. Future growth may be impacted by longer sales cycles, which we have experienced, which in turn, could result in delays in deals closing, creating near-term headwinds for cash flow, RPO and billings growth as well as potential future impacts on revenue growth and other key metrics on a trailing basis.

1819

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

Impact of Cybersecurity Incidents

In the past we have experienced cybersecurity incidents, such as the January 2022 incident involving one of our third-party service providers and the October 2023 incident where a threat actor gained unauthorized access to and stole information from our third-party customer support system, that harmed our reputation and customer relations and adversely impacted our financial results. While we expect the impact of these security incidents to adversely affect our future financial performance, we cannot predict the extent of such impact with certainty. Due to the nature of our business, the announcement of any security incidents, even if not significant, could have these impacts.

Impact of Current Economic Conditions

Worldwide economic and political uncertainties and negative trends, including financial and credit market fluctuations, tariffs and increasing trade protectionism, changes in government spending levels, uncertainty in the banking sector, ~~rising~~changing interest rates, inflation and other impacts from the macroeconomic environment have, and could continue to, adversely affect our business operations or financial results. As we continue to monitor the direct and indirect impacts of these circumstances, the broader implications of these macroeconomic and political events on our business, results of operations and overall financial position remain uncertain. See the section titled “Risk Factors'' included under Part II, Item 1A below for further discussion of the possible impact of these factors and other risks on our business.

Components of Results of Operations

Revenue

Subscription Revenue. Subscription revenue primarily consists of fees for access to and usage of our cloud-based platforms and related support. Subscription revenue is driven primarily by the number of customers, the number of users per customer and the solutions used. We typically invoice customers in advance in annual installments for subscriptions to our platforms.

Professional Services and Other. Professional services revenue includes fees from assisting customers in implementing and optimizing the use of our solutions. These services include application configuration, system integration and training services.

We generally invoice customers as the work is performed for time-and-materials arrangements, and up front for fixed fee arrangements. Professional services revenue is recognized as the services are performed.

Overhead Allocation and Employee Compensation Costs

We allocate shared costs, such as facilities costs (including rent, utilities and depreciation on assets shared by all departments), certain information technology costs, security costs and recruiting costs to all departments based on headcount. As such, allocated shared costs are reflected in each of the cost of revenue and operating expense categories. Employee compensation costs reflected in each of the cost of revenue and operating expense categories include salaries, bonuses, compensation related taxes, benefits and stock-based compensation. Additionally included in the sales and marketing expense category are sales commissions and related taxes.

Cost of Revenue and Gross Margin

Cost of Subscription. Cost of subscription primarily consists of expenses related to hosting our services and providing support. These expenses include employee-related costs associated with our cloud-based infrastructure, our product security organization and our customer support organization, third-party hosting fees, software and maintenance costs, outside services associated with the delivery of our subscription services, amortization expense associated with capitalized internal-use software and acquired developed technology and allocated overhead.

We intend to continue to invest additional resources in our platform infrastructure, our platforms support organizations and security posture. We will continue to invest in technology innovation and we anticipate that costs qualifying for capitalization of internal-use software costs and related amortization may fluctuate over time. We expect our investment in technology to expand the capability of our platforms enabling us to improve our gross

1920

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

margin over time. The level and timing of investment in these areas could affect our cost of subscription revenue in the future.

Cost of Professional Services and Other. Cost of professional services consists primarily of employee-related costs for our professional services delivery team, travel-related costs, allocated overhead and costs of outside services associated with supplementing our professional services delivery team. The cost of providing professional services has historically been higher than the associated revenue we generate.

Gross Margin. Gross margin is gross profit expressed as a percentage of total revenue. Our gross margin may fluctuate from period to period as a result of the timing and amount of investments to expand our hosting capacity and our continued efforts to build platform support and professional services teams.

Operating Expenses

Research and Development. Research and development expenses consist primarily of employee compensation costs and allocated overhead. We believe that continued investment in our platforms is important for our growth.

Sales and Marketing. Sales and marketing expenses consist primarily of employee compensation costs, costs of general marketing and promotional activities, travel-related expenses, amortization expense associated with acquired customer relationships and trade names and allocated overhead. Commissions earned by our sales force that are considered incremental and recoverable costs of obtaining a contract with a customer are deferred and then amortized on a straight-line basis over a period of benefit that we have determined to be generally five years.

General and Administrative. General and administrative expenses consist primarily of employee compensation costs for finance, accounting, legal, information technology and human resources personnel. In addition, general and administrative expenses include acquisition and integration-related costs, non-personnel costs, such as legal, accounting and other professional fees, charitable contributions, allocated overhead and all other supporting corporate expenses.

Restructuring and Other Charges. Restructuring and other charges consist primarily of personnel costs, such as notice period, employee severance payments and termination benefits. In addition, restructuring and other charges include certain lease impairment charges.

Interest and Other, Net

Interest and other, net consists of interest expense, which primarily includes amortization of debt issuance costs and contractual interest expense for our convertible senior notes, interest income from our investment holdings, gains on early extinguishment of debt and gains and losses from our strategic investments.

Provision for ~~(Benefit from)~~ Income Taxes

Our provision for ~~(benefit from)~~ income taxes consists of federal and state income taxes in the United States and income taxes in certain foreign jurisdictions where we operate. We evaluate and update our estimated annual effective income tax rate on a quarterly basis based on current and forecasted operating results and enacted tax laws. The timing and mix of actual results compared to forecasted results may impact the timing of recognition of our provision for ~~(benefit from)~~ income taxes.

2021

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

Results of Operations

The following table sets forth our results of operations for the periods presented:

	Three Months Ended July 31,				Six Months EndedJuly 31,
	Three Months Ended October 31,				Nine Months EndedOctober 31,
	2025		2024		2025		2024
	(dollars in millions)
Revenue:
Subscription	$	~~711~~724	$	~~632~~651	$	12,~~384~~108	$	1,~~235~~886
Professional services and other	1718		14		3250		2842
Total revenue	~~728~~742		~~646~~665		12,~~416~~158		1,~~263~~928
Cost of revenue:
Subscription(1)	147		~~137~~140		~~283~~430		~~267~~407
Professional services and other(1)	2123		1817		4063		3653
Total cost of revenue	~~168~~170		~~155~~157		~~323~~493		~~303~~460
Gross profit	~~560~~572		~~491~~508		1,~~093~~665		~~960~~1,468
Operating expenses:
Research and development(1)	160		~~164~~158		~~314~~474		~~327~~485
Sales and marketing(1)	~~246~~271		~~238~~256		~~483~~754		~~474~~730
General and administrative(1)	~~113~~118		~~108~~110		~~216~~334		~~225~~335
Total operating expenses	~~519~~549		~~510~~524		1,~~013~~562		1,~~026~~550
Operating income (loss)	4123		(1916)		80103		(6682)
Interest expense	(1)		(1)		(23)		(34)
Interest income and other, net	2728		2926		5785		5682
Gain on early extinguishment of debt	—		316		—		319
Interest and other, net	2627		3141		5582		5697
Income (loss) before provision for (benefit from) income taxes	67		12		135		(10)
Income before provision for income taxes	50		25		185		15
Provision for (benefit from) income taxes	—		(17)		6		1
Provision for income taxes	7		9		13		10
Net income (loss)	$	67	$	29	$	129	$	(11)
Net income	$	43	$	16	$	172	$	5

(1) Includes stock-based compensation expense as follows:

	Three Months Ended July 31,				Six Months EndedJuly 31,
	Three Months Ended October 31,				Nine Months EndedOctober 31,
	2025		2024		2025		2024
	(dollars in millions)
Cost of subscription revenue	$	2119	$	2220	$	3857	$	4161
Cost of professional services and other revenue	23		3		58		69
Research and development	5149		5649		98147		~~119~~168
Sales and marketing	3533		3633		67100		6699
General and administrative	3534		3130		6498		6797
Total stock-based compensation expense	$	~~144~~138	$	~~148~~135	$	~~272~~410	$	~~299~~434

2122

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

The following table sets forth our results of operations for the periods presented as a percentage of our total revenue:

	Three Months Ended July 31,				Six Months EndedJuly 31,
	Three Months Ended October 31,				Nine Months EndedOctober 31,
	2025		2024		2025		2024
Revenue
Subscription	98	%	98	%	98	%	98	%
Professional services and other	2		2		2		2
Total revenue	100		100		100		100
Cost of revenue
Subscription	20		21		20		21
Professional services and other	3		3		3		3
Total cost of revenue	23		24		23		24
Gross profit	77		76		77		76
Operating expenses
Research and development	22		2523		22		25
Sales and marketing	3436		3738		3435		38
General and administrative	1516		17		15		1817
Total operating expenses	7174		7978		7172		8180
Operating income (loss)	63		(32)		65		(54)
Interest expense	—		—		—		—
Interest income and other, net	34		4		4		4
Gain on early extinguishment of debt	—		12		—		—1
Interest and other, net	34		56		4		45
Income (loss) before provision for (benefit from) income taxes	9		2		10		(1)
Income before provision for income taxes	7		4		9		1
Provision for (benefit from) income taxes	—		(3)		1		—
Provision for income taxes	1		2		1		1
Net income (loss)	9	%	5	%	9	%	(1)	%
Net income	6	%	2	%	8	%	—	%

2223

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

Comparison of the Three and ~~Six~~Nine Months Ended ~~July~~October 31, 2025 and 2024

Revenue

	Three Months Ended July 31,
	Three Months Ended October 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
Revenue:
Subscription	$	~~711~~724		$	~~632~~651		$	7973	1211	%
Professional services and other	1718			14			34		2431
Total revenue	$	~~728~~742		$	~~646~~665		$	8277	1312
Percentage of revenue:
Subscription	98		%	98		%
Professional services and other	2			2
Total	100		%	100		%
	Six Months EndedJuly 31,
	Nine Months EndedOctober 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
Revenue:
Subscription	$	12,~~384~~108		$	1,~~235~~886		$	~~149~~222	12	%
Professional services and other	3250			2842			48		1621
Total revenue	$	12,~~416~~158		$	1,~~263~~928		$	~~153~~230	12
Percentage of revenue:
Subscription	98		%	98		%
Professional services and other	2			2
Total	100		%	100		%

Three and ~~six~~nine months ended

For the three and ~~six~~nine months ended ~~July~~October 31, 2025, the increase in subscription revenue was primarily caused by volume-driven increases from new business, which includes new customers and sales of additional solutions to existing customers as reflected in our 106% dollar-based net retention rate as of ~~July~~October 31, 2025 and a 7% increase in customers with annual contract value above $100,000 as detailed in our Key Business Metrics.

For the three and ~~six~~nine months ended ~~July~~October 31, 2025, the increase in professional services and other revenue was due to higher bookings associated with professional services.

2324

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

Cost of Revenue, Gross Profit and Gross Margin

	Three Months Ended July 31,
	Three Months Ended October 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
Cost of revenue:
Subscription	$	147		$	~~137~~140		$	107	6	%
Professional services and other	2123			1817			36		1730
Total cost of revenue	$	~~168~~170		$	~~155~~157		$	13	78
Gross profit	$	~~560~~572		$	~~491~~508		$	6964	1413
Gross margin:
Subscription	80		%	78		%
Professional services and other	(2422)			(3123)
Total gross margin	77			76
	Six Months EndedJuly 31,
	Nine Months EndedOctober 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
Cost of revenue:
Subscription	$	~~283~~430		$	~~267~~407		$	1623	56	%
Professional services and other	4063			3653			410		1419
Total cost of revenue	$	~~323~~493		$	~~303~~460		$	2033	67
Gross profit	$	1,~~093~~665		$	~~960~~1,468		$	~~133~~197	1413
Gross margin:
Subscription	80		%	78		%
Professional services and other	(2524)			(2826)
Total gross margin	77			76

Three months ended

For the three months ended ~~July~~October 31, 2025, cost of subscription revenue increased primarily due to an increase in labor costs of $64 million and hosting fees of $43 million.

Our gross margin for subscription revenue improved to 80% for the three months ended ~~July~~October 31, 2025 compared to 78% for the three months ended ~~July~~October 31, 2024. The improvement was primarily driven by improved spend efficiency resulting in lower relative cost of subscription revenue.

For the three months ended ~~July~~October 31, 2025, cost of professional services and other revenue increased due to an increase in labor costs.

Our gross margin for professional services and other revenue improved to (2422)% for the three months ended ~~July~~October 31, 2025 compared to (3123)% for the three months ended ~~July~~October 31, 2024 due to an increase in professional services and other revenue.

~~Six~~Nine months ended

For the ~~six~~nine months ended ~~July~~October 31, 2025, cost of subscription revenue increased primarily due to an increase in labor costs of $1216 million, ~~and~~ hosting fees of $69 million, and software costs of $7 million offset by adecreases ~~decrease~~ in consulting costs of $6 million and stock-based compensation expense of $34 million.

2425

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

Our gross margin for subscription revenue improved to 80% for the ~~six~~nine months ended ~~July~~October 31, 2025 compared to 78% for the ~~six~~nine months ended ~~July~~October 31, 2024. The improvement was primarily driven by improved spend efficiency resulting in lower relative cost of subscription revenue.

For the ~~six~~nine months ended ~~July~~October 31, 2025, cost of professional services and other revenue increased due to an increase in labor costs.

Our gross margin for professional services and other revenue improved to (2524)% for the ~~six~~nine months ended ~~July~~October 31, 2025 compared to (2826)% for the ~~six~~nine months ended ~~July~~October 31, 2024 due to an increase in professional services and other revenue.

Operating Expenses

Research and Development Expenses

	Three Months Ended July 31,
	Three Months Ended October 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
Research and development	$	160		$	~~164~~158		$	~~(4)~~2	(2)	%
Percentage of revenue	22		%	2523		%
	Six Months EndedJuly 31,
	Nine Months EndedOctober 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
Research and development	$	~~314~~474		$	~~327~~485		$	(1311)	(42)	%
Percentage of revenue	22		%	25		%

Three months ended

For the three months ended ~~July~~October 31, 2025, research and development expenses ~~decreased~~increased due to aan ~~reduction~~increase in ~~stock-based~~labor ~~compensation expense of $5 million~~costs. The decrease in research and development as a percentage of total revenue was primarily driven by improved spend efficiency.

~~Six~~Nine months ended

For the ~~six~~nine months ended ~~July~~October 31, 2025, research and development expenses decreased due to a reduction in stock-based compensation expense of $21 million, offset by an increase in labor costs of $710 million. The decrease in research and development as a percentage of total revenue was primarily driven by improved spend efficiency.

~~Sales and Marketing Expenses~~ 26

	Three Months Ended July 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
Sales and marketing	$	246		$	238		$	8	4	%
Percentage of revenue	34		%	37		%
	Six Months EndedJuly 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
Sales and marketing	$	483		$	474		$	9	2	%
Percentage of revenue	34		%	38		%

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

Sales and Marketing Expenses


	Three Months Ended October 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
Sales and marketing	$	271		$	256		$	15	6	%
Percentage of revenue	36		%	38		%

	Nine Months Ended October 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
Sales and marketing	$	754		$	730		$	24	3	%
Percentage of revenue	35		%	38		%

Three months ended

For the three months ended ~~July~~October 31, 2025, sales and marketing expenses increased primarily due to anincreases ~~increase~~ in labor costs of $8 million and travel costs of $3 million. The decrease in sales and marketing as a percentage of total revenue was primarily driven by improved spend efficiency.

~~Six~~Nine months ended

For the ~~six~~nine months ended ~~July~~October 31, 2025, sales and marketing expenses increased primarily due to anincreases ~~increase~~ in labor costs of $311 million, travel costs of $6 million and ~~travel~~marketing costs of $3 million. The decrease in sales and marketing as a percentage of total revenue was primarily driven by improved spend efficiency.

We expect our sales and marketing expenses will continue to be our largest operating expense category for the foreseeable future. We expect sales and marketing expenses as a percentage of total revenue to decrease as our total revenue grows.

General and Administrative Expenses

	Three Months Ended July 31,
	Three Months Ended October 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
General and administrative	$	~~113~~118		$	~~108~~110		$	58	48	%
Percentage of revenue	1516		%	17		%
	Six Months EndedJuly 31,
	Nine Months EndedOctober 31,
	2025			2024			$ Change		% Change
	(dollars in millions)
General and administrative	$	~~216~~334		$	~~225~~335		$	(91)	~~(4)~~—	%
Percentage of revenue	15		%	1817		%

Three months ended

For the three months ended ~~July~~October 31, 2025, general and administrative expenses increased primarily due to an increase in stock-based compensation expense of $4 million and travel costs of $2 million. We expect general and administrative expenses as a percentage of total revenue to decrease as our total revenue grows.

~~Six~~Nine months ended

For the ~~six~~nine months ended ~~July~~October 31, 2025, general and administrative expenses decreased primarily due to reductions in consulting costs of $6 million and stock-based compensation expense of $3 million. We expect general and administrative expenses as a percentage of total revenue to decrease as our total revenue grows.

2627

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

to reductions in consulting costs of $7 million offset by an increase in labor costs of $9 million. We expect general and administrative expenses as a percentage of total revenue to decrease as our total revenue grows.

Interest and Other, Net

	Three Months Ended July 31,
	Three Months Ended October 31,
	2025		2024		$ Change		% Change
	(dollars in millions)
Interest expense	$	(1)	$	(1)	$	—	(2534)	%
Interest income and other, net	2728		2926		(2)		~~(7)~~2
Gain on early extinguishment of debt	—		316		(316)		(100)
Interest and other, net	$	2627	$	3141	$	(514)	(1735)
	Six Months EndedJuly 31,
	Nine Months EndedOctober 31,
	2025		2024		$ Change		% Change
	(dollars in millions)
Interest expense	$	(23)	$	(34)	$	1	(1823)	%
Interest income and other, net	5785		5682		13		43
Gain on early extinguishment of debt	—		319		(319)		(100)
Interest and other, net	$	5582	$	5697	$	(115)	(216)

Three and ~~six~~nine months ended

For the three and ~~six~~nine months ended ~~July~~October 31, 2025, interest and other, net decreased primarily due to the gains on early extinguishment of debt from our repurchases of the convertible senior notes in fiscal 2025.

Provision for ~~(Benefit from)~~ Income Taxes

	Three Months Ended July 31,
	Three Months Ended October 31,
	2025		2024		$ Change		% Change
	(dollars in millions)
Provision for (benefit from) income taxes	$	—	$	(17)	$	17	(102)	%
Provision for income taxes	$	7	$	9	$	(2)	(33)	%
	Six Months EndedJuly 31,
	Nine Months EndedOctober 31,
	2025		2024		$ Change		% Change
	(dollars in millions)
Provision for (benefit from) income taxes	$	6	$	1	$	5	2,324	%
Provision for income taxes	$	13	$	10	$	3	24	%

Three and ~~six~~nine months ended

For the three and ~~six~~nine months ended ~~July~~October 31, 2025, our provision for ~~(benefit from)~~ income taxes ~~increased~~decreased by $172 million and increased by $53 million, respectively. These ~~increases~~changes are related to the proportion of pre-tax income recognized in the three and ~~six~~nine months ended ~~July~~October 31, 2025 relative to the proportion of pre-tax ~~income~~results recognized in the three and ~~six~~nine months ended ~~July~~October 31, 2024.

On July 4, 2025, the “One Big Beautiful Bill Act” (the “Act”) was enacted. The Act, among other provisions, maintains the U.S. federal 21% corporate tax rate, makes permanent the immediate expensing of domestic research and development expenditures, allows for 100% bonus depreciation for qualified assets, and modifies the U.S. taxation of profits derived from foreign operations. The provisions of the Act have staggered effective dates beginning in 2025 and continuing through 2027.

We revised our estimated annual effective tax rate to reflect the changes in the Act. As a result, income tax expense reported for the six months ended July 31, 2025 was computed to reflect the effects of the change in the tax law and resulted in a cumulative decrease to income tax expense of $5 million recorded during the three months 28

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

~~ended~~We ~~July 31,~~revised ~~2025~~our estimated annual effective tax rate upon enactment of the Act. ~~This~~As ~~decrease~~a isresult, ~~largely~~income ~~due~~tax toexpense reported for the ~~impact~~periods ofpresented ~~immediate~~was ~~expensing~~computed ofto ~~domestic~~reflect ~~research~~the ~~and~~effects ~~development~~of ~~expenditures~~the ~~under~~change in the ~~Act~~tax law. We expect the immediate expensing of domestic R&D expenditures to be the most significant impact of the Act, resulting in a reduction in federal and state cash tax payments and income tax expense for the remainder of fiscal year 2026 and future periods.

In addition, certain provisions of the Act, particularly those related to international taxation, are effective beginning in the fiscal period ending January 31, 2027. We are currently evaluating the impact of these provisions on our financial statements and tax positions.

We periodically evaluate the realizability of our deferred tax assets based on all available evidence, both positive and negative. The realization of the net deferred tax assets is dependent on our ability to generate sufficient future taxable income during the periods prior to the expiration of tax attributes to fully utilize these assets. Given our current and anticipated future earnings, we may release a significant portion of our valuation allowance in the foreseeable future if there is sufficient positive evidence that outweighs the negative evidence. The release of the valuation allowance would result in the recognition of certain deferred tax assets and a corresponding decrease to income tax expense for the period the release is recorded. However, the exact timing and amount of any potential valuation allowance release remains uncertain and is subject to change on the basis of the level of profitability that we are able to actually achieve. As of ~~July~~October 31, 2025 we continue to maintain a full valuation allowance on our deferred tax assets in the United States.

Key Business Metrics

We review a number of operating and financial metrics, including the following key metrics, to evaluate our business, measure our performance, identify trends affecting our business, formulate business plans and make strategic decisions.

	As of July 31,
	As of October 31,
	2025			2024
	(dollars in millions)
Customers with annual contract value ("ACV") above $100,000	45,~~945~~030			4,~~620~~705
Dollar-based net retention rate for the trailing 12 months ended	106		%	~~110~~108		%
Current remaining performance obligations	$	2,~~265~~328		$	12,~~995~~062
Remaining performance obligations	$	4,~~152~~292		$	3,~~505~~659

Number of Customers with Annual Contract Value Above $100,000

The number of customers who have greater than $100,000 in annual contract value ("ACV") with us was 45,~~945~~030 and 4,~~620~~705 as of ~~July~~October 31, 2025 and 2024, respectively. We expect this trend to continue as larger enterprises recognize the value of our platforms and replace their legacy identity access management infrastructure. We define a customer as a separate and distinct buying entity, such as a company, an educational or government institution, or a distinct business unit of a large company that has an active contract with us or one of our partners to access our platforms. For purposes of determining our customer count, we do not include customers that use our platforms under self-service arrangements only.

Dollar-Based Net Retention Rate

Part of our ability to generate revenue is dependent upon our ability to maintain our relationships with our customers and to increase their utilization of our platforms. We believe we can achieve these goals by focusing on delivering value and functionality that enables us to both retain our existing customers and expand the number of users and solutions used within an existing customer. One way that we assess our performance in this area by measuring our Dollar-Based Net Retention Rate. Our Dollar-Based Net Retention Rate measures our ability to increase revenue across our existing customer base through expansion of users and solutions associated with a customer as offset by churn and contraction in the number of users and/or solutions associated with a customer.

Our Dollar-Based Net Retention Rate is based upon our ACV which is calculated based on the terms of that customer’s contract and represents the total contracted annual subscription amount as of that period end. We ~~calculate our Dollar-Based Net Retention Rate as of a period end by starting with the ACV from all customers as of~~

2829

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

calculate our Dollar-Based Net Retention Rate as of a period end by starting with the ACV from all customers as of twelve months prior to such period end ("Prior Period ACV"). We then calculate the ACV from these same customers as of the current period end ("Current Period ACV"). Current Period ACV includes any upsells and is net of contraction or churn over the trailing twelve months but excludes ACV from new customers in the current period. We then divide the Current Period ACV by the Prior Period ACV to arrive at our Dollar-Based Net Retention Rate. Our Dollar-Based Net Retention Rate is inclusive of ACV from self-service customers.

Our Dollar-Based Net Retention Rate is primarily attributable to our healthy gross retention, an expansion of users and upselling additional solutions within our existing customers. Larger enterprises often implement a limited initial deployment of our platforms before increasing their deployment on a broader scale. The decrease in our Dollar-Based Net Retention Rate as of ~~July~~October 31, 2025, compared to ~~July~~October 31, 2024, was primarily a result of the macroeconomic environment, with overall ACV from existing customers increasing at a slower rate in the current period.

Remaining Performance Obligations ("RPO")

RPO represent all future, non-cancelable, contracted revenue under our subscription contracts with customers that has not yet been recognized, inclusive of deferred revenue that has been invoiced and non-cancelable amounts that will be invoiced and recognized as revenue in future periods. Current RPO represents the portion of RPO expected to be recognized during the next 12 months. RPO fluctuates due to a number of factors, including the timing, duration and dollar amount of customer contracts and fluctuations in foreign currency exchange rates.

Liquidity and Capital Resources

As of ~~July~~October 31, 2025, our principal sources of liquidity were cash, cash equivalents and short-term investments totaling $2,~~858~~463 million, which were held for working capital and general corporate purposes, including potential future acquisition activity. Our cash equivalents and investments consisted primarily of U.S. treasury securities, money market funds, corporate debt securities and certificates of deposit.

Recent macroeconomic events, including ~~rising~~changes in interest rates, global inflation and bank failures, have led to further economic uncertainty in the global economy. To mitigate risk, our cash and cash equivalents are distributed across large financial institutions. In addition, we have policy restrictions in place on the types of securities that can be purchased as part of our available-for-sale securities portfolio. These restrictions take credit quality, liquidity and diversification into consideration among other criteria. We continue to monitor the impacts of this situation; however, there can be no assurances that conditions in the banking sector and in global financial markets will not worsen and/or adversely affect us.

In September 2019, we completed our private offering of the 2025 Notes due on September 1, 2025 and received aggregate gross proceeds of $1,060 million. The interest rate on the 2025 Notes is fixed at 0.125% per year and is payable semi-annually in arrears on March 1 and September 1 of each year, beginning on March 1, 2020. In connection with the 2025 Notes, we used a portion of the proceeds to enter into capped call transactions ("2025 Capped Calls") with respect to our Class A common stock. AsThe ~~of July 31,~~ 2025, ~~the 2025~~ Notes ~~are~~matured ~~classified as current liabilities due to their upcoming maturity~~ on September 1, 2025, and we ~~have~~settled ~~elected~~in tofull ~~settle~~ the principal amount ofoutstanding in cash and the associated remaining outstanding 2025 ~~Notes~~Capped inCalls ~~cash~~expired unexercised.

In June 2020, we completed our private offering of the 2026 Notes due on June 15, 2026 and received aggregate gross proceeds of $1,150 million. The interest rate on the 2026 Notes is fixed at 0.375% per year and is payable semi-annually in arrears on June 15 and December 15 of each year, beginning on December 15, 2020. In connection with the 2026 Notes, we used a portion of the proceeds to enter into capped call transactions ("2026 Capped Calls") with respect to our Class A common stock. As of ~~July~~October 31, 2025, the 2026 Notes are classified as current liabilities due to their upcoming maturity on June 15, 2026.

In the ordinary course of our business, we may, at any time and from time to time, seek to extinguish our outstanding Notes through cash purchases and/or exchanges for equity, in open-market purchases, privately negotiated transactions or otherwise. Such extinguishments, if any, will be conducted on such terms and at such prices as we may determine, and will depend on our evaluation of the prevailing market conditions, trading price of the Notes, our liquidity requirements, legal and contractual restrictions and other factors. During fiscal 2025, we ~~repurchased $42 million principal amount of the 2025 Notes for $40 million in cash, and $258 million principal~~

2930

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

repurchased $42 million principal amount of the 2025 Notes for $40 million in cash, and $258 million principal amount of the 2026 Notes for $240 million in cash, which resulted in an aggregate gain on early extinguishment of debt of $19 million. During fiscal 2024, we repurchased $508 million principal amount of the 2025 Notes for $462 million in cash, and $542 million principal amount of the 2026 Notes for $475 million in cash, which resulted in an aggregate gain on early extinguishment of debt of $106 million. During the ~~three~~nine ~~and six~~ months ended ~~July~~October 31, 2025, we unwound and settled in cash a portion of the 2025 and 2026 Capped Calls corresponding to the previously repurchased Notes.

We believe our existing cash and cash equivalents, our investments and cash provided by sales of our solutions will be sufficient to meet our short-term and long-term projected working capital and capital expenditure needs for the foreseeable future. Our future capital requirements will depend on many factors, including our subscription growth rate, subscription renewal activity, billing frequency, the timing and extent of spending to support development efforts, the expansion of sales and marketing activities, the expansion of our international operations, the introduction of new and enhanced product offerings and the continuing market adoption of our platforms. We continue to assess our capital structure and evaluate the merits of deploying available cash. We may in the future enter into arrangements to acquire or invest in complementary businesses, services and technologies, including intellectual property rights. We may be required to seek additional equity or debt financing. In the event that additional financing is required from outside sources, we may not be able to raise it on terms acceptable to us or at all. If we are unable to raise additional capital or generate cash flows necessary to expand our operations and invest in new technologies this could reduce our ability to compete successfully and harm our results of operations.

A significant majority of our customers pay in advance for annual subscriptions. Therefore, a substantial source of our cash is from our deferred revenue, which is included on our condensed consolidated balance sheet as a liability. Deferred revenue consists of the unearned portion of billed fees for our subscriptions, which is recognized as revenue in accordance with our revenue recognition policy. As of ~~July~~October 31, 2025, we had deferred revenue of $1,~~574~~586 million, of which $1,~~550~~557 million was recorded as a current liability and is expected to be recorded as revenue in the next 12 months, provided all other revenue recognition criteria have been met.

Cash Flows

The following table summarizes our cash flows for the periods indicated:

	Six Months EndedJuly 31,
	Nine Months EndedOctober 31,
	2025		2024
	(dollars in millions)
Net cash provided by operating activities	$	~~408~~626	$	~~305~~464
Net cash provided by (used) in investing activities	~~118~~223		(38137)
Net cash used in financing activities	(67622)		(87352)
Effects of changes in foreign currency exchange rates on cash, cash equivalents and restricted cash	109		—1
Net increase in cash, cash equivalents and restricted cash	$	469	$	180
Net increase (decrease) in cash, cash equivalents and restricted cash	$	236	$	(24)

Operating Activities

Our largest source of operating cash is cash collections from our customers for subscription and professional services. Our primary uses of cash from operating activities are for employee-related expenditures, marketing expenses and third-party hosting costs.

During the ~~six~~nine months ended ~~July~~October 31, 2025, cash provided by operating activities was $~~408~~626 million, an increase of $~~103~~162 million compared to the ~~six~~nine months ended ~~July~~October 31, 2024. The increase was primarily attributable to an increase in cash received from customers and improved spend efficiency.

Investing Activities

During the ~~six~~nine months ended ~~July~~October 31, 2025, cash provided by investing activities was $~~118~~223 million compared to cash used in investing activities of $38137 million during the ~~six~~nine months ended ~~July~~October 31, 2024. The change was primarily driven by higher proceeds from maturities and sales of available-for-sale securities, a decrease in purchases of available-for-sale and other securities and a decrease in payments for business acquisitions.

3031

OKTA, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF

FINANCIAL CONDITION AND RESULTS OF OPERATIONS (continued)

change was primarily driven by higher proceeds from maturities and redemption of available-for-sale securities and a decrease in purchases of available-for-sale and other securities.

Financing Activities

During the ~~six~~nine months ended ~~July~~October 31, 2025, cash used in financing activities was $67622 million, aan ~~decrease~~increase of $20270 million compared to the ~~six~~nine months ended ~~July~~October 31, 2024. The ~~decrease~~increase was primarily attributable to an increase in payments ~~for~~upon maturity and repurchase of convertible senior notes ~~during~~and ~~the six months ended July 31, 2024, offset by~~ an increase in taxes paid related to net share settlement of equity awards ~~during the six months ended July 31, 2025~~. The amount of taxes paid on net share settlement of equity awards are generally predicated on the closing price of our stock on the date of settlement.

Material Cash Requirements

Except for the maturity and cash settlement of the 2025 Notes and the classification of 2026 Notes as a current liability as discussed in Note 76 to our condensed consolidated financial statements included in Part I, Item 1 of this report, there were no significant changes outside the ordinary course of business to our material cash requirements disclosed in our Annual Report on Form 10-K for the fiscal year ended January 31, 2025.

Indemnification Agreements

In the ordinary course of business, we enter into agreements of varying scope and terms pursuant to which we agree to indemnify customers, vendors, lessors, business partners and other parties with respect to certain matters, including, but not limited to, losses arising out of the breach of such agreements, services to be provided by us or from intellectual property infringement claims made by third parties. In addition, we have entered into indemnification agreements with our directors and certain officers and employees that will require us, among other things, to indemnify them against certain liabilities that may arise by reason of their status or service as directors, officers or employees. No material demands have been made upon us to provide indemnification under such agreements and there are no claims that we are aware of that could have a material effect on our condensed consolidated balance sheets, condensed consolidated statements of operations and comprehensive income (loss), or condensed consolidated statements of cash flows.

Critical Accounting Estimates

There have been no significant changes to our critical accounting estimates for the ~~six~~nine months ended ~~July~~October 31, 2025 from those discussed in our Annual Report on Form 10-K for the fiscal year ended January 31, 2025.

3132

Item 3. Quantitative and Qualitative Disclosures about Market Risk

Foreign Currency Exchange Risk

The functional currencies of our foreign subsidiaries are the respective local currencies. Most of our sales are denominated in U.S. dollars, and therefore our revenue is not currently subject to significant foreign currency risk. Our operating expenses are denominated in the currencies of the countries in which our operations are located, which are primarily in the United States, Canada, United Kingdom and Australia. Our condensed consolidated results of operations and cash flows are, therefore, subject to fluctuations due to changes in foreign currency exchange rates and may be adversely affected in the future due to changes in foreign exchange rates. To date, we have not entered into any hedging arrangements with respect to foreign currency risk or other derivative financial instruments. During the ~~six~~nine months ended ~~July~~October 31, 2025 and 2024, a hypothetical 10% change in foreign currency exchange rates applicable to our business would not have had a material impact on our condensed consolidated financial statements.

Interest Rate Risk

We had cash, cash equivalents and short-term investments totaling $2,~~858~~463 million as of ~~July~~October 31, 2025, of which $2,~~676~~240 million was invested in U.S. treasury securities, money market funds, corporate debt securities and certificates of deposit. Our cash and cash equivalents are held for working capital and general corporate purposes, including potential future acquisition activity. Our short-term investments are made for capital preservation purposes. We do not enter into investments for trading or speculative purposes.

Our cash equivalents and our investment portfolio are subject to market risk due to changes in interest rates. Fixed rate securities may have their market value adversely affected due to a rise in interest rates. Due in part to these factors, our future investment income may fall short of our expectations due to changes in interest rates or we may suffer losses in principal if we are forced to sell securities that decline in market value due to changes in interest rates. However, because we classify our short-term investments as “available-for-sale,” no gains are recognized due to changes in interest rates. As losses due to changes in interest rates are generally not considered to be credit related changes, no losses in such securities are recognized due to changes in interest rates unless we intend to sell, it is more likely than not that we will be required to sell, we sell prior to maturity, or we otherwise determine that all or a portion of the decline in fair value are due to credit related factors.

As of ~~July~~October 31, 2025, a hypothetical 10% relative change in interest rates would not have had a material impact on the value of our cash equivalents or investment portfolio. Fluctuations in the value of our cash equivalents and investment portfolio caused by a change in interest rates (gains or losses on the carrying value) are recorded in other comprehensive income (loss), and are realized only if we sell the underlying securities prior to maturity.

Convertible Senior Notes

In September 2019, we issued the 2025 Notes due September 1, 2025 with a principal amount of $1,060 million. Concurrently with the issuance of the 2025 Notes, we entered into separate capped call transactions. The 2025 Capped Calls were completed to reduce the potential dilution from the conversion of the 2025 Notes. AsThe ~~of July 31,~~ 2025, ~~$510~~Notes ~~million~~matured ~~principal~~on ~~amount~~September of1, ~~the~~ 2025 ~~Notes~~and ~~remain~~we ~~outstanding.~~settled Asin offull ~~July 31, 2025,~~ the ~~2025~~outstanding ~~Notes~~principal ~~are~~amount ~~classified~~in ascash ~~current~~and ~~liabilities~~the ~~due~~remaining tooutstanding ~~their~~2025 ~~upcoming~~Capped ~~maturity~~Calls onexpired ~~September 1, 2025~~unexercised.

In June 2020, we issued the 2026 Notes due June 15, 2026 with a principal amount of $1,150 million. Concurrently with the issuance of the 2026 Notes, we entered into separate capped call transactions. The 2026 Capped Calls were completed to reduce the potential dilution from the conversion of the 2026 Notes. As of ~~July~~October 31, 2025, $350 million principal amount of the 2026 Notes remain outstanding. As of ~~July~~October 31, 2025, the 2026 Notes are classified as current liabilities due to their upcoming maturity on June 15, 2026.

The ~~2025 Notes and~~ 2026 Notes have a fixed annual interest rate of 0.~~125% and 0.~~375%~~, respectively~~; accordingly, we do not have economic interest rate exposure on the 2026 Notes. However, the fair value of the 2026 Notes is exposed to interest rate risk. Generally, the fair market value of the 2026 Notes will increase as interest rates fall and decrease as interest rates rise. In addition, the fair value of the 2026 Notes fluctuates when the market price of our common stock fluctuates. The fair value was determined based on the quoted bid price of the 2026 Notes in an over-the-counter market on the last available trading day of the reporting period. See Note 76 to our condensed consolidated financial statements “Convertible Senior Notes, Net” for additional information. Changes in the interest rate environment upon maturity of this fixed rate debt could have an effect on our future cash flows and earnings, depending on whether the debt is replaced with other fixed rate debt, variable rate debt or equity.

3233

Item 4. Controls and Procedures

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our principal executive officer and principal financial officer, has evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”)), as of the end of the period covered by this Quarterly Report on Form 10-Q. Based on such evaluation, our principal executive officer and principal financial officer have concluded that, as of such date, our disclosure controls and procedures were effective at a reasonable assurance level.

Changes in Internal Control Over Financial Reporting

There were no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during the period covered by this Quarterly Report on Form 10-Q that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Inherent Limitations on Effectiveness of Controls

Our management, including our principal executive officer and principal financial officer, does not expect that our disclosure controls or our internal control over financial reporting will prevent all errors and all fraud. A control system, no matter how well-conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, have been detected. These inherent limitations include the realities that judgments in decision-making can be faulty, and that breakdowns can occur because of a simple error or mistake. Additionally, controls can be circumvented by the individual acts of some persons, by collusion of two or more people or by management override of the controls. The design of any system of controls is also based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions; over time, controls may become inadequate because of changes in conditions, or the degree of compliance with policies or procedures may deteriorate. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected.

3334

Part II. OTHER INFORMATION

Item 1. Legal Proceedings

The information set forth under “Legal Matters” in Note 87 to our condensed consolidated financial statements, “Commitments and Contingencies” is incorporated by reference herein.

Item 1A. Risk Factors

A description of the risks and uncertainties associated with our business is set forth below. You should carefully consider the risks and uncertainties described below, as well as the other information in this Quarterly Report on Form 10-Q, including our condensed consolidated financial statements and the related notes and “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The occurrence of any of the events or developments described below, or of additional risks and uncertainties not presently known to us or that we currently deem immaterial, could materially and adversely affect our business, results of operations, financial condition and growth prospects. In such an event, the market price of our Class A common stock could decline, and you could lose all or part of your investment.

Risk Factor Summary

This risk factor summary contains a high-level summary of risks associated with our business. It does not contain all of the information that may be important to you, and you should read this risk factor summary together with the more detailed discussion of risks and uncertainties set forth following this summary. A summary of our risks includes, but is not limited to, the following:

•Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending have, in the past and may, in the future, reduce demand for our solutions, which could harm our revenue, results of operations and cash flows.

•We have experienced rapid growth in prior periods, and any failure to effectively manage future growth could harm our business and future prospects.

•If we fail to manage our growth effectively or fail to execute our business plan, we may not be able to maintain high levels of service and customer satisfaction or adequately address competitive challenges.

•We face intense competition, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

•We have a history of losses, and we may not be consistently profitable in the future.

•Our business depends on our ability to retain existing customers, and our revenues and results of operations could be adversely impacted if they do not renew their subscriptions or purchase additional licenses or subscriptions with us.

•If we are unable to grow our customer base, our revenue growth and profitability could be harmed.

•We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

•Interruptions or performance problems that impact the functionality of our technology, systems or infrastructure could result in delays in the deployment of our platforms.

•In the past, we have experienced cybersecurity incidents that allowed unauthorized access to our systems or data or our customers’ data, harmed our reputation, created additional liability and adversely impacted our financial results. We and our third-party service providers may experience similar incidents in the future which may also include disabling access to our service.

•We and our third-party service providers have, in the past, failed or been perceived to have failed to fully comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements, which could result in proceedings, actions or penalties against us. We may experience similar incidents in the future.

3435

•If we are unable to ensure that our solutions integrate or interoperate with a variety of operating systems, platforms, services, software applications devices, mobile phones and other hardware form factors that are developed by others, our platforms may become less competitive and our results of operations may be harmed.

•Real or perceived errors, failures, vulnerabilities or bugs in our solutions, including deployment complexity, have in the past and could, in the future, harm our business and results of operations.

•Because we generally recognize revenue from our subscriptions and support services over the term of the relevant service period, a decrease in sales during a reporting period may not be immediately reflected in our results of operations for that period.

•The stock price of our Class A common stock may be volatile or may decline.

•The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 32.52% of the voting power of our capital stock as of ~~July~~October 31, 2025. This will limit or preclude your ability to influence corporate matters, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets or other major corporate transaction requiring stockholder approval.

•Transactions relating to our convertible notes may affect the value of our Class A common stock.

•We depend on our executive officers and other key employees, and the loss of one or more of these employees or an inability to attract and retain other highly skilled employees could harm our business.

Risks Related to Our Business and Industry

Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending have, in the past and may, in the future, reduce demand for our solutions, which could harm our revenue, results of operations and cash flows.

Our revenue, results of operations and cash flows depend on the overall demand for our solutions. Concerns about the inflation and interest rate environment; the instability of financial institutions; health epidemics; energy costs; geopolitical events, such as Russia’s invasion of Ukraine; international and regional economic conditions, including instability or security concerns abroad, such as widespread downturns and recessions; changes in trade policies, trade restrictions, economic sanctions or the threat of such actions; or the availability and cost of credit have and could continue to lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S. economy and abroad, which in turn could result in reductions in spending on our platforms by our existing and prospective customers. These economic conditions can occur abruptly. Prolonged economic slowdowns may result in customers requesting us to renegotiate existing contracts on less advantageous terms to us than those currently in place or defaulting on payments due on existing contracts or not renewing at the end of the contract term. For example, rising interest rates in the United States have affected businesses across many industries, including ours, by increasing the costs of labor, employee healthcare and other components, which may further constrain our, our customers’ and prospective customers’ budgets. To the extent there is a sustained general economic downturn, and our platforms and services are perceived by customers or potential customers as costly, or too difficult to deploy or migrate to, our revenue may be disproportionately affected by delays or reductions in spending.

We have experienced rapid growth in prior periods, and any failure to effectively manage future growth could harm our business and future prospects.

Our prior revenue growth rates may not be indicative of our future growth or performance. We have experienced revenue growth rates of 43%, 22% and 15% during fiscal 2023, 2024 and 2025, respectively. Our revenue for any quarterly or annual period should not be relied upon as an indication of our future revenue or revenue growth for any future period, as we may not be able to sustain revenue growth consistent with recent history or at all. Revenue growth depends on several factors, including pricing our platforms to attract new and retain existing customers; managing demand for our solutions; competing against larger companies and new market entrants; capitalizing on new acquisitions, technologies or growth opportunities; and other conditions described in these risk factors. If we are unable to grow our revenue, it will be difficult to maintain our profitability, or maintain or increase our cash flow on a consistent basis. We expect our operating expenses to increase in future periods as we

3536

continue to expand our business. If our revenue growth does not increase to offset these anticipated increases in our operating expenses, our business, financial position and results of operations will be harmed, and we may not be able to achieve or consistently maintain profitability. Additionally, the sales cycle for the evaluation and implementation of our platforms, which typically extends for multiple months for enterprise deals, may also cause us to experience a delay between increasing operating expenses and generating corresponding revenue, if any. We may not be able to prepare accurate internal financial forecasts or replace anticipated revenue that we lost as a result of such delays, and our results of operations in future reporting periods could differ materially from our estimates and forecasts, or may not meet the expectations of our investors, which could cause our business to suffer and our stock price to decline.

If we fail to manage our growth effectively or fail to execute our business plan, we may not be able to maintain high levels of service and customer satisfaction or adequately address competitive challenges.

We have experienced rapid growth and organizational change, which has placed and may continue to place, significant demands on our management and our operational and financial resources. In order to manage future growth and better align our organizational structure and resources with our business priorities, we may undertake restructuring plans from time to time. For example, in recent years we have announced restructuring plans intended to reduce operating expenses and improve profitability that involved reductions of our workforce. We have in the past encountered and may in the future encounter challenges in the execution of these restructuring efforts, such as adverse impacts on employee morale or attrition beyond the intended reductions, and these challenges could impact our ability to execute on our business initiatives, which could cause our restructuring efforts to not be as effective as anticipated and harm our financial results.

In addition, as we expand our business, it is important that we continue to maintain a high level of customer service and satisfaction. As our customer base continues to grow, we will need to expand our account management, customer service and other personnel, and our network of independent software vendors (“ISVs”), system integrators and other channel partners, to provide personalized account management and customer service. If we are not able to continue to provide high levels of customer service, our reputation, as well as our business, results of operations and financial condition, could be harmed.

We face intense competition, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

The markets for our solutions are rapidly evolving, highly competitive and subject to shifting customer needs and frequent introductions of new technologies. As the markets in which we operate continue to mature and new technologies and competitors enter such markets, we expect competition to intensify. We compete with both cloud-based and on-premise enterprise application software providers including, but not limited to: authentication providers; access and lifecycle management providers; multi-factor authentication providers; infrastructure-as-a-service providers; other customer identity and access management providers; and solutions developed in-house by our potential customers. Our principal competitor is Microsoft.

Many of our competitors have significantly greater financial, technical, sales and marketing, distribution, customer support or other resources, larger intellectual property portfolios, longer operating histories, greater resources to make strategic acquisitions, more established relationships with third-party service providers and greater name recognition than we do. They may also have a larger customer base, many of which may prefer to purchase from the same competitor rather than replace their existing infrastructure with our solutions.

Some of our larger competitors have substantially broader product offerings, or greater resources to acquire new offerings or repurpose existing offerings to provide identity solutions with subscription models. As a result, they can leverage their relationships based on other solutions, or incorporate functionality into existing solutions, to gain business in a manner that discourages users from purchasing our solutions, including selling at zero or negative margins, bundling products or maintaining closed technology platforms. In addition, larger competitors, as well as new start-up companies that innovate, make significant investments in research and development and may invent similar or superior solutions that compete with our solutions. These competitive pressures or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, increased net losses and loss of market share, which could harm our business, results of operations and financial condition.

We have a history of losses, and we may not be consistently profitable in the future.

While we achieved profitability in fiscal 2025, we have incurred net losses of $355 million and $815 million in fiscal 2024 and 2023, respectively. We will need to generate and sustain increased revenue levels in future periods

3637

in order to become consistently profitable, and even if we do, we may not be able to maintain or increase our level of profitability. We may incur losses in the future for a number of reasons, including the risks described in these risk factors, an increase in operating expense and other unknown risks. Any failure by us to sustain profitability on a consistent basis could cause the value of our common stock to decline.

Our business depends on our ability to retain existing customers, and our revenues and results of operations could be adversely impacted if they do not renew their subscriptions or purchase additional licenses or subscriptions with us.

Our ability to increase and maintain revenue growth depends, in part, on our ability to retain and expand our commercial relationships with our existing customers. This requires that our existing customers continue to use our platforms, either by purchasing additional subscriptions or by renewing their subscriptions when existing contract terms expire. Our customers have no obligation to renew their subscriptions after the expiration of their subscription period. They may decide not to renew their subscriptions with a similar contract period, at the same prices and terms or with the same or a greater number of users. In the past, some of our customers have elected not to renew their agreements with us, and it is difficult to accurately predict long-term customer retention and expansion rates. Customer retention and expansion has, in the past and may, in the future, decline or fluctuate as a result of a number of factors, such as customers’ satisfaction with our solutions; our prices and pricing plans, including as compared to those of competing software solutions; unfavorable macroeconomic and geopolitical conditions; reductions in customer spending levels; negative sentiment stemming from cybersecurity incidents; customer utilization rates; new offerings; and changes to the packaging of our product offerings. If existing customers do not purchase additional subscriptions or renew their subscriptions, renew on less favorable terms or fail to add more users, our revenue may decline or grow less quickly than anticipated, which would harm our future results of operations.

If we are unable to grow our customer base, our revenue growth and profitability could be harmed.

We aim to increase our revenue and achieve and maintain profitability by growing our customer base, particularly through sales to larger organizations. As our market matures and product offerings evolve, we believe that competitors will introduce lower cost or differentiated solutions that compete, or are perceived to compete, with our solutions. If prospective customers view the cost or features of competitors’ solutions as preferable to ours, or do not perceive our solutions to be of sufficiently high value and quality, we could fail to attract the number and types of new customers we are seeking. Prospective customers’ decisions to purchase our solutions depends on a variety of other factors, including those specified under the risk factor titled “Our business depends on our ability to retain existing customers, and our revenues and results of operations could be adversely impacted if they do not renew their subscriptions or purchase additional licenses or subscriptions with us,” and described elsewhere in these risk factors. Any failure to attract new customers could impede our success in selling new subscriptions and adversely impact our business, financial condition and results of operations.

We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

Our results of operations fluctuate from quarter to quarter as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including, but not limited to:

•fluctuations in demand for, or pricing of, our platforms, including as a result of macroeconomic conditions or competition;

•our ability to retain and increase sales to existing customers, attract new customers or otherwise increase the use of our platforms;

•the timing and success of introductions of new solutions by us or our competitors, or any other change in the competitive landscape of our market;

•security breaches of, technical difficulties with, or interruptions to, the delivery and use of our solutions, and any negative market perception or customer reactions related to, or arising from the disclosure of, such breaches, difficulties or interruptions;

•seasonal buying patterns for IT spending;

3738

•the mix of revenue attributable to larger transactions as opposed to smaller transactions, and the associated volatility and timing of our transactions;

•changes in remaining performance obligations (“RPO”) due to seasonality, the timing of and compounding effects of renewals, invoice duration, size and timing, new business linearity between quarters and within a quarter, average contract term or fluctuations due to foreign currency movements, all of which may impact implied growth rates;

•errors in our forecasting of the demand for our solutions, which could lead to lower revenue, increased costs or both;

•increases in and timing of sales and marketing and other operating expenses that we may incur to grow our brand, expand our operations and remain competitive;

•our ability to comply with applicable laws and requirements, including data privacy and cybersecurity regimes;

•costs related to the acquisition of businesses, talent, technologies or intellectual property, including potentially significant amortization costs and possible write-downs;

•credit or other difficulties confronting our third-party service providers, including channel partners;

•costs related to litigation, including adverse judgments, settlements and other disputes;

•the impact of new accounting pronouncements and associated system implementations;

•changes in the legislative or regulatory environment;

•fluctuations in foreign currency exchange rates;

•expenses related to real estate, including our office leases and other fixed expenses;

•changes in government spending and budgetary priorities, workforce reduction and other policy shifts;

•general economic, market and industry conditions in domestic or international markets, including the inflation and interest rate environment, geopolitical uncertainty and instability; and

•changes in trade policies, trade restrictions or the threat of such actions.

Any one or more of the factors above may result in significant fluctuations in our results of operations. You should not rely on our past results as an indicator of our future performance.

The variability and unpredictability of our quarterly results of operations or other operating metrics could result in our failure to meet our expectations or those of analysts that cover us or investors with respect to revenue or other metrics for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

Our ability to introduce new solutions is dependent on adequate research and development resources and, in part, on our ability to successfully complete acquisitions. If we do not adequately fund our research and development efforts or complete acquisitions successfully, we may not be able to compete effectively and our business and results of operations may be harmed.

To remain competitive, we must continue to develop new solutions, applications and enhancements to our existing portfolio. This is particularly true as we further expand and diversify our capabilities. Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential. If we elect not to or are unable to develop solutions internally, we may choose to expand into a certain market or strategy via an acquisition for which we could potentially pay too much or fail to successfully integrate into our operations. Further, many of our competitors expend a considerably greater amount of funds on their respective research and development programs, and those that do not have, in some cases, been acquired by larger companies that allocate greater resources to our competitors’ research and development programs. Our failure to maintain adequate research and development resources or to compete effectively with the

3839

research and development programs of our competitors would give an advantage to such competitors and may harm our business, results of operations and financial condition.

Even if we maintain adequate research and development resources, we may be unable to monetize newly developed solutions or features such that we can recoup our research and development expenditures. For example, if we develop a new feature but our competitors give an equivalent feature away for free, we may need to also include our newly developed feature for free as part of an existing product offering to remain competitive in the marketplace. Such a loss of anticipated revenue to offset our research and development expenditures may harm our business, results of operations and financial condition.

Future acquisitions, investments, partnerships or alliances could be difficult to identify and integrate, divert the attention of management personnel, disrupt our business, dilute stockholder value and harm our results of operations and financial condition.

We have in the past acquired and we may, in the future, seek to acquire or invest in, businesses, products, teams or technologies that we believe could complement or expand our current platforms, enhance our technical capabilities or otherwise offer growth opportunities. The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated. If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel; integrate the acquired operations and technologies; adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”); or effectively manage the combined business. We may also be required to assume liabilities or incur unforeseen costs, such as those arising from the acquired company’s failure to comply with legal or regulatory requirements and litigation matters.

Any acquisition or strategic transaction we do consummate could fail to produce the benefits we hope to achieve, which could disrupt our own business or those of our partners and customers or result in future impairment charges. In particular, from time to time we invest in private growth stage companies for strategic reasons and to support key business initiatives. All of our venture investments are subject to a risk of partial or total loss of investment capital, and we may not realize a return on these investments.

In addition, we have limited experience in acquiring other businesses. We may not be able to identify desirable acquisition targets, or we may not be successful in entering into an agreement with any particular target. Acquisitions could also result in dilutive issuances of equity securities, use of our available cash or the incurrence of debt, or in adverse tax consequences or unfavorable accounting treatment. If an acquired business fails to meet our expectations, our business, results of operations and financial condition could suffer.

Because our long-term success depends, in part, on our ability to expand the sales of our solutions to customers located outside of the United States, our business will be susceptible to risks associated with international operations.

We currently have sales personnel outside the United States and maintain offices outside the United States in the Americas, Asia-Pacific and Europe, and our international revenue was 21% of our total revenue in fiscal 2024 and fiscal 2025. Any international expansion efforts that we may undertake may not be successful. We may face challenges, including those not generally faced in the United States, such as managing and staffing international operations, and becoming familiar with varying technology standards, local laws and business practices. Conducting international operations also subjects us to, among other risks described in these risk factors:

•general political, economic and social uncertainties, including macroeconomic and geopolitical conditions and financial market conditions;

•unexpected changes in, or costs and liabilities related to, compliance with foreign legal and regulatory requirements, such as data privacy and cybersecurity regimes; intellectual property rights protections; and requirements relating to the localization of our solutions;

•restrictive governmental actions focusing on cross-border trade, including taxes, changes in trade policies, trade restrictions, import and export restrictions or quotas, barriers, sanctions, custom duties or the threat of such actions; and

•difficulties in managing systems integrators and technology partners.

3940

Establishing operations in international markets also requires significant management attention and financial resources and we cannot guarantee that these investments will produce desired levels of revenue or profitability. If we fail to expand our operations successfully and in a timely manner, our business and results of operations will suffer.

If we fail to adapt to rapid technological change, our ability to remain competitive could be impaired.

The industry in which we compete is characterized by rapid technological change, frequent introductions of new solutions and evolving industry standards. Our ability to attract new customers and increase revenue from existing customers will depend in significant part on our ability to anticipate industry standards and trends. We must continue to enhance existing solutions or introduce or acquire new solutions on a timely basis to keep pace with technological developments. The success of any enhancement or new solution depends on several factors, including the timely completion and market acceptance of the enhancement or new solution. Any new solution we develop or acquire might not be introduced in a timely or cost-effective manner and might not achieve the broad market acceptance necessary to generate significant revenue. If any of our competitors implements new technologies before we are able to implement them, those competitors may be able to provide more effective solutions than ours at lower prices. Any delay or failure in the introduction of new or enhanced solutions that gain market acceptance and meet customer requirements could harm our business, results of operations and financial condition.

Our financial results may fluctuate due to increasing variability in our sales cycles.

We plan our expenses based on certain assumptions about the length and variability of our sales cycle. These assumptions are based upon historical trends for sales cycles and conversion rates associated with our existing customers. We are increasingly focused on sales to larger organizations, which often involve lengthy purchasing approval processes and less predictable sales cycles. The length of sales cycles may be further impacted by the current macroeconomic and geopolitical environment and by the discretionary nature of customer spending. Customers may also take prolonged evaluation periods of our platforms, or their features or functionality, as well as those of our competitors. As a result, it is difficult to predict exactly when, or even if, we will make a sale. If we are unable to close one or more of expected significant transactions in a particular period, or if such an expected transaction is delayed until a subsequent period, our results of operations for that period and for any future periods in which revenue from such transaction would otherwise have been recognized, may be harmed.

Our growth depends, in part, on the success of our strategic relationships with third parties.

To grow our business, we expect to continue to depend on relationships with third parties, such as channel partners. Identifying partners, negotiating and maintaining relationships with them requires significant time and resources.

Our ability to compete in the marketplace depends, in part, on whether third parties successfully market, resell, implement or support our solutions for their customers. For example, some of our channel partners sell or provide integration and administration services for our competitors’ solutions. They may choose to devote greater resources to our competitors that are more effective in incentivizing them to favor their solutions over ours. In addition, acquisitions of such partners by our competitors could result in a decrease in the number of our current and potential customers, as these partners may no longer facilitate the adoption of our applications by potential customers. Some of our partners compete with certain of our solutions and may elect to no longer integrate with our platforms or sell our solutions.

Our growth also depends on our ability to incentivize third-party developers to adopt and build their applications using our APIs and solutions. We believe that these applications facilitate greater usage and customization of our solutions. If these third-party developers stop developing on or supporting our platforms, we will lose the benefit of network effects that have contributed to the growth in our number of customers.

If we are unsuccessful in establishing or maintaining our relationships with third parties, our ability to grow our revenue could be impaired, and our results of operations may suffer. Even if we are successful, we cannot ensure that these relationships will result in increased customer usage of our applications or increased revenue.

4041

Various factors may cause implementation of our solutions to be delayed, inefficient or otherwise unsuccessful.

Our business depends upon the successful implementation of our solutions by our customers. Increasingly, we, as well as our customers, rely on our network of partners to deliver implementation services, and there may not be enough qualified implementation partners available to meet customer demand. Various other factors may cause implementations to be delayed, inefficient or otherwise unsuccessful, including significant costs to purchase, implement and enable our solutions; changes in our customers’ functional requirements; timeline delays; or deviation from recommended best practices. These and other circumstances may delay our ability to sell additional solutions or result in customers canceling or failing to renew their subscriptions before our solutions have been fully implemented. Unsuccessful, lengthy or costly customer implementation and integration projects could result in claims from customers, harm to our reputation and opportunities for competitors to displace our solutions, each of which could have an adverse effect on our business and results of operations.

A portion of our revenues are generated by sales to public sector entities, which are subject to a number of challenges and risks.

We rely on partners to resell our services to public sector entities, and we have made and plan to continue to make, investments to support future sales opportunities in the public sector. The sale of our services to public sector entities is tied to budget cycles and there are government requirements and authorizations that we may be required to meet. Changes in fiscal or contracting policies or reductions in government spending or workforce could adversely affect the funding for and purchases of our platforms and, in turn, could negatively impact our revenue and future growth. Further, we may be subject to audits and investigations regarding our role as a subcontractor in government contracts, and violations could result in penalties and sanctions, including contract termination, refunding or forfeiting payments, fines and suspension or debarment from future government business. Selling to these entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense. Public sector entities often require contract terms that differ from our standard arrangements and impose additional compliance requirements, require increased attention to pricing practices or are otherwise time consuming and expensive to satisfy. For example, some of our public sector customers contract with us on the basis of our authorization under FedRAMP, which requires us to undertake additional actions and expenses to ensure compliance. Public sector entities may also have statutory, contractual or other legal rights to terminate contracts with our partners for convenience, for lack of funding or due to a default, and any such termination may adversely impact our future results of operations. If we represent that we meet certain standards, authorizations (such as FedRAMP) or requirements and do not meet them, or if such authorizations are suspended or revoked, we could be subject to increased liability from our customers, investigation by regulators or termination rights. Even if we do meet them, the additional costs associated with providing our service to public sector entities could harm our margins. Moreover, changes in underlying regulatory requirements could be an impediment to our ability to efficiently provide our service to government customers and to grow or maintain our customer base. Any of these risks related to contracting with, or as a subcontractor supporting, public sector entities could adversely impact our future sales and results of operations or make them more difficult to predict.

If we fail to enhance our brand cost-effectively, our ability to expand our customer base will be impaired and our business, results of operations and financial condition may suffer.

We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future solutions, and is an important element in attracting new customers and retaining existing customers. Furthermore, we believe that the importance of brand recognition is likely to increase as competition in our market increases. Successful promotion of our brand will depend largely on the effectiveness of our marketing and sales efforts and on our ability to provide reliable and useful solutions at competitive prices and that align with our customers’ needs. In the past, our efforts to build our brand have involved significant expenses and have not always attracted a sufficient number of new customers to be cost-effective.

In fiscal 2026, we began further specializing our sales force to better align with our customers and evolving market demands, which will require us to invest significant financial and other resources. We may not achieve anticipated revenue growth if we are unable to hire and develop talented sales personnel, if our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time or if we are unable to retain our existing sales personnel. If our marketing and sales efforts are unsuccessful and we fail to enhance our brand we may fail to attract new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business, results of operations and financial condition could suffer.

4142

We may not set optimal prices for our solutions.

In the past, we have at times adjusted our prices either for individual customers in connection with long-term agreements or for a particular solution. We expect that we may need to change our pricing in future periods and potentially in response to increased costs, including as a result of the inflation and interest rate environment, geopolitical considerations, as well as changes in trade policies, trade restrictions or the threat of such actions. Further, as competitors introduce new solutions that compete with ours or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing. As we expand internationally, we also must determine the appropriate price to enable us to compete effectively internationally. In addition, if our mix of solutions sold changes, then we may need to, or choose to, revise our pricing. As a result, we may be required or choose to reduce our prices or change our pricing model, which could harm our business, results of operations and financial condition.

If we are not able to consistently generate cash flows or raise additional capital necessary to expand our operations and invest in new technologies in the future could reduce our ability to compete successfully and harm our results of operations.

We may need to raise additional funds, and we may not be able to obtain additional debt or equity financing on favorable terms, if at all. If we raise additional equity or convertible debt financing, our security holders may experience significant dilution of their ownership interests. If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions. If we need additional capital and cannot raise it on acceptable terms or at all, we may not be able to effectively grow our business or respond to competitive pressures, which could harm our business, results of operations and financial condition.

We may be subject to liability claims if we breach our contracts and our insurance may be inadequate to cover our losses.

We are subject to numerous obligations in our contracts with our customers and partners. Despite the procedures, systems and internal controls we have implemented to comply with our contracts, we may breach these commitments, whether through a weakness in these procedures, systems and internal controls, negligence or the willful act of an employee or contractor. Our insurance policies, including our errors and omissions insurance, may be inadequate to compensate us for the potentially significant losses that may result from claims arising from breaches of our contracts, disruptions in our service, including those caused by cybersecurity incidents, failures or disruptions to our infrastructure, catastrophic events and disasters or otherwise. In addition, such insurance may not be available to us in the future on economically reasonable terms or at all. Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

Evolving and complex scrutiny of sustainability matters may require us to incur additional costs or otherwise adversely impact our business.

Increased attention to environmental sustainability and social issues, as well as societal expectations regarding voluntary sustainability initiatives and disclosures, may result in increased costs (including but not limited to, increased costs related to compliance, stakeholder engagement and contracting), impact our reputation or otherwise affect our business performance. We have undertaken certain sustainability-related initiatives, goals and commitments, which we have communicated on our website, in our SEC filings and elsewhere. We may undertake additional actions, including establishing certain sustainability goals or targets, to improve our sustainability profile and/or respond to demand from investors, regulators, customers and other stakeholders, both U.S.-based and internationally. However, such actions may be costly or subject to numerous conditions that are outside our control and we cannot guarantee that such actions will have the desired effect. Our actual or perceived failure to achieve such goals or targets could negatively impact our reputation and impact our ability to compete as effectively to recruit or retain employees.

Risks Related to Intellectual Property, Infrastructure Technology, Data Privacy and Security

Interruptions or performance problems that impact the functionality of our technology, systems or infrastructure could result in delays in the deployment of our platforms.

Our continued growth depends, in part, on the ability of our existing and potential customers to access our platforms 24 hours a day, seven days a week, without interruption or degradation of performance. System interruption and a lack of integration and redundancy in our information systems and infrastructure may adversely affect our ability to operate websites, process and fulfill transactions, respond to customer inquiries and generally maintain cost-efficient operations. We have experienced in the past and may experience in the future, disruptions, data loss or corruption, outages and other performance problems with our infrastructure or service due to a variety of factors. These factors include, for example, infrastructure and functionality changes, human or software errors, capacity constraints, ransomware attacks that encrypt our data and render it inaccessible or security-related incidents. In some instances, we may not be able to identify the cause or causes of these performance problems immediately, and it could take months, or even years, for such problems to become pronounced enough for us to detect or for our customers to detect and inform us. We may not be able to maintain the level of service uptime and performance required by our customers, especially during peak usage times and as our solutions become more complex and our user traffic increases. If our platforms are unavailable or if our customers are unable to access our solutions or deploy them within a reasonable amount of time, or at all, our business would be harmed. Since our customers rely on our service to access and complete their work, any outage on our platforms would impair the ability of our customers to perform their work, which would negatively impact our brand, reputation and customer satisfaction.

interruption and a lack of integration and redundancy in our information systems and infrastructure may adversely affect our ability to operate websites, process and fulfill transactions, respond to customer inquiries and generally maintain cost-efficient operations. We have experienced in the past and may experience in the future, disruptions, data loss or corruption, outages and other performance problems with our infrastructure or service due to a variety of factors. These factors include, for example, infrastructure and functionality changes, human or software errors, capacity constraints, ransomware attacks that encrypt our data and render it inaccessible or security-related incidents. In some instances, we may not be able to identify the cause or causes of these performance problems immediately, and it could take months, or even years, for such problems to become pronounced enough for us to detect or for our customers to detect and inform us. We may not be able to maintain the level of service uptime and performance required by our customers, especially during peak usage times and as our solutions become more complex and our user traffic increases. If our platforms are unavailable or if our customers are unable to access our solutions or deploy them within a reasonable amount of time, or at all, our business would be harmed. Since our customers rely on our service to access and complete their work, any outage on our platforms would impair the ability of our customers to perform their work, which would negatively impact our brand, reputation and customer satisfaction.

Our platforms are accessed by a large number of customers, often at the same time, and we continue to expand the number of our customers and solutions available to our customers. While we rely on third-party information technology systems, broadband and other communications systems and service providers to assist in providing access to our platforms, maintaining our infrastructure and distributing our solutions via the internet, we may not be able to scale our technology to accommodate increased capacity requirements, which may result in interruptions or delays in service. If a service provider fails to provide sufficient capacity to support our platforms or otherwise experiences service outages, including intentionally blocking our internet traffic or all internet traffic, for example at the request of a national government intending to isolate its country’s network, such failure could interrupt our customers’ access to our service, which could adversely affect their perception of our platforms’ reliability and our revenues. Any disruptions in these services, including as a result of actions outside of our control, would significantly impact the continued performance of our solutions. In the future, these services may not be available to us on commercially reasonable terms or at all. Any loss of the right to use any of these services could result in decreased functionality of our solutions until equivalent technology is either developed by us or, if available from another provider, is identified, obtained and integrated into our infrastructure. If we do not accurately predict our infrastructure capacity requirements, our customers could experience service shortfalls. We may also be unable to effectively address capacity constraints, upgrade our systems as needed and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology.

Any of the above circumstances or events may harm our reputation, cause customers to terminate their agreements with us, impair our ability to obtain subscription renewals from existing customers, impair our ability to grow our customer base, result in the expenditure of significant financial, technical and engineering resources, subject us to financial penalties and liabilities under our service level agreements, and otherwise harm our business, results of operations and financial condition.

In the past, we have experienced cybersecurity incidents that allowed unauthorized access to our systems or data or our customers’ data, harmed our reputation, created additional liability and adversely impacted our financial results. We and our third-party service providers may experience similar incidents in the future which may also include disabling access to our service.

Increasingly, companies, including Okta, Inc., are subject to a wide variety of attacks on their systems and networks on an ongoing basis. In addition to threats from traditional computer “hackers,” malicious code (such as malware, viruses, worms and ransomware), employee or contractor theft or misuse, password spraying, phishing and denial-of-service attacks, we and our third-party service providers now also face threats from sophisticated nation-state actors and organized crime groups who engage in attacks (including advanced persistent threat intrusions) that add to the risks to our systems (including those hosted on AWS’ or other cloud services providers’ systems), internal networks, our customers’ systems and the information that we and they store and process. For example, like other companies, we have experienced an increase in cybersecurity attacks and have had to expend increasing amounts of human and financial capital to respond. We expect that these cybersecurity attacks will continue and that the scope and sophistication of these efforts will increase in future periods. Despite significant efforts to create security barriers to such threats, it is virtually impossible for us to entirely mitigate these risks. As a provider of independent and neutral cloud-based identity solutions that form a part of our customers’ security software supply chain, we pose an attractive target for such attacks. The security measures we have integrated into our internal systems and platforms, which are designed to detect unauthorized activity and prevent or minimize security breaches, may not function as expected and have not in the past been, and may not in the future be,

4344

increasing amounts of human and financial capital to respond. We expect that these cybersecurity attacks will continue and that the scope and sophistication of these efforts will increase in future periods. Despite significant efforts to create security barriers to such threats, it is virtually impossible for us to entirely mitigate these risks. As a provider of independent and neutral cloud-based identity solutions that form a part of our customers’ security software supply chain, we pose an attractive target for such attacks. The security measures we have integrated into our internal systems and platforms, which are designed to detect unauthorized activity and prevent or minimize security breaches, may not function as expected and have not in the past been, and may not in the future be, sufficient to protect our internal networks and platforms against certain attacks. In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time. As a result, we and our third-party service providers have in the past been, and may in the future be, unable to anticipate these techniques or implement adequate preventative measures quickly enough to prevent either an electronic intrusion into our systems or services or a compromise of customer data, employee data or other protected information.

Our customers’ use of our technology to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platforms, which stores, transmits and processes customers’ proprietary information and users’ personal data experienced and likely will in the future experience attacks targeting such customer data. When such breaches occur, as a result of third-party action, technology limitations, employee or contractor error, malfeasance or otherwise, and if the confidentiality, integrity or availability of our customers’ data or systems is disrupted, we could incur significant liability to our customers and to individuals or businesses whose information was being stored by our customers, and our platforms may be perceived as less desirable, which could negatively affect our business and damage our reputation. Techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and generally are not recognized until launched against a target. As a result, we, our third-party service providers and our customers have not in the past been and may not in the future be able to anticipate these techniques or to implement adequate preventive measures. Further, because we do not control our third-party service providers or the processing of data by our third-party service providers, we cannot ensure the integrity or security of measures they take to protect customer information and prevent data loss.

In addition, security breaches impacting our platforms have in certain cases resulted in and could in the future result in a risk of loss or unauthorized disclosure or theft of this information, or the denial of access to this information, which, in turn, could lead to enforcement actions, litigation, regulatory or governmental audits, investigations and possible liability and increased requests by individuals regarding their personal data. Security breaches could also damage our relationships with and ability to attract customers and partners, as well as trigger service availability, indemnification and other contractual obligations. For example, our customers have in the past published public criticisms of our security practices in connection with security incidents, and these postings harm our reputation and brand. Security incidents may also cause us to incur significant investigation, mitigation, remediation, notification and other expenses. Furthermore, as a well-known provider of identity and security solutions that form a part of our customers’ security software supply chain, any such breach, including a breach of our customers’ systems, could compromise systems secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ systems, and the information stored on our or our customers’ systems could be accessed, publicly disclosed, altered, lost or stolen, which could subject us to liability and cause us financial harm. Our disclosures concerning security incidents also may become the subject of litigation, and our disclosures concerning the January 2022 compromise, for example, have become the subject of lawsuits, as discussed in Item 1, “Legal Proceedings” above. While we have taken a number of remediation steps, there is no guarantee that our preventative and mitigation actions with respect to this incident and others like it will fully eliminate the risk of a malicious compromise of our or our customers’ systems.

We have experienced cybersecurity incidents resulting from our use of and oversight over third-party service providers and could experience such incidents in the future. These incidents have, in the past and may, in the future, result from our configuration of such providers’ products or from cybersecurity attacks on such providers of the same type that could affect our own systems. While we have implemented security measures and configuration policies that seek to protect data stored with our third-party service providers, such measures and policies have not in the past been and may not in the future be sufficient to protect our data or our customers’ data. For example, the January 2022 compromise of one of our third-party service providers by a threat actor, even though not material and not a breach of our platforms, nonetheless was widely publicized and focused attention on the security of our systems and the systems of our third-party service providers. In addition, in October 2023, a threat actor gained unauthorized access to and stole information from inside our customer support system, which was hosted by a third-party service provider.

While we maintain cybersecurity insurance, our insurance may be insufficient to cover all liabilities incurred in these incidents and any incidents may result in loss of, or increased costs of, our cybersecurity insurance. These breaches, or any perceived breach, of our systems, our customers’ systems, our service providers’ systems or other systems or networks secured by our platforms, whether or not any such breach is due to a vulnerability in our platforms, may also undermine confidence in our platforms or our industry and result in damage to our reputation and brand, negative publicity, loss of ISVs and other channel partners, customers and sales, increased costs to remedy any problem, costly litigation and other liability. In addition, a breach of the security measures of one of our 45

44While we maintain cybersecurity insurance, our insurance may be insufficient to cover all liabilities incurred in these incidents and any incidents may result in loss of, or increased costs of, our cybersecurity insurance. These breaches, or any perceived breach, of our systems, our customers’ systems, our service providers’ systems or other systems or networks secured by our platforms, whether or not any such breach is due to a vulnerability in our platforms, may also undermine confidence in our platforms or our industry and result in damage to our reputation and brand, negative publicity, loss of ISVs and other channel partners, customers and sales, increased costs to remedy any problem, costly litigation and other liability. In addition, a breach of the security measures of one of our key ISVs or other channel partners or a security software supply chain attack even many levels removed could result in the exfiltration of confidential corporate information or other data that may provide additional avenues of attack. For example, an exploitation in an open source library that is imported and used in another framework that is used by a software product used by Okta, Inc. could introduce an avenue of attack into our platforms. If a high profile security breach occurs with respect to a comparable cloud technology provider, our customers and potential customers may lose trust in the security of the cloud business model generally, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business. Any of these negative outcomes could adversely impact market acceptance of our solutions and could harm our business, results of operations and financial condition.

key ISVs or other channel partners or a security software supply chain attack even many levels removed could result in the exfiltration of confidential corporate information or other data that may provide additional avenues of attack. For example, an exploitation in an open source library that is imported and used in another framework that is used by a software product used by Okta, Inc. could introduce an avenue of attack into our platforms. If a high profile security breach occurs with respect to a comparable cloud technology provider, our customers and potential customers may lose trust in the security of the cloud business model generally, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business. Any of these negative outcomes could adversely impact market acceptance of our solutions and could harm our business, results of operations and financial condition.

Third parties have induced and may continue to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our applications, internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platforms, interruptions or malfunctions in our operations, account lockouts and, ultimately, harm to our future business prospects and revenue. We may be required to expend significant capital and financial resources to protect against such threats or to alleviate problems caused by breaches in security.

We and our third-party service providers have, in the past, failed or been perceived to have failed to fully comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements, which could result in proceedings, actions or penalties against us. We may experience similar incidents in the future.

Our customers’ storage and use of data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platforms. We have implemented various features intended to enable our customers to better comply with applicable privacy and security requirements in their collection and use of data within our online service, but these features have, in the past, not ensured and may, in the future, not ensure our customers’ compliance and may not be effective against all potential privacy or related regulatory concerns.

Many jurisdictions have enacted or are considering enacting or revising privacy and/or data security legislation, including laws and regulations applying to the collection, use, storage, transfer, disclosure and/or processing of personal data. The costs of compliance with, and other burdens imposed by, such laws and regulations that are applicable to the operations of our customers may limit the use and adoption of our service and reduce overall demand for it. These privacy and data security related laws and regulations are evolving and may result in increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. In addition, we are subject to certain contractual obligations regarding the collection, use, storage, transfer, disclosure and/or processing of personal data. Although we are working to comply with those federal, state and foreign laws and regulations, industry standards, contractual obligations and other legal obligations that apply to us, those laws, regulations, standards and obligations are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another and may conflict with one another, other requirements or legal obligations, our practices or the features of our platforms.

We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection, digital services and information security in the United States, the European Union and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. In the United States, the Federal Trade Commission and state regulators enforce a variety of data privacy issues, such as promises made in privacy policies or failures to appropriately protect information about individuals, as unfair or deceptive acts or practices in or affecting commerce in violation of the Federal Trade Commission Act or similar state laws. On the U.S. state level, over a dozen states have adopted new or modified privacy and security laws. These laws create a patchwork of legislation and regulation that impose heightened transparency obligations about data collection, use and sharing practices; add restrictions on the “sale” or “sharing” or transfer of personal information to third parties for purposes such as advertising or analytics; create new data privacy rights for consumers including the ability to limit the use of personal information for advertising; and carry significant enforcement penalties for non-compliance, including monetary and injunctive relief. This patchwork may also give rise to conflicts or differing views of personal privacy rights. For example, certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal data than federal, international or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts. We may expend significant resources attempting to comply with conflicting and overlapping state privacy regulations, and the cost and complexity of complying with such regulations could adversely affect our

4546

new data privacy rights for consumers including the ability to limit the use of personal information for advertising; and carry significant enforcement penalties for non-compliance, including monetary and injunctive relief. This patchwork may also give rise to conflicts or differing views of personal privacy rights. For example, certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal data than federal, international or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts. We may expend significant resources attempting to comply with conflicting and overlapping state privacy regulations, and the cost and complexity of complying with such regulations could adversely affect our business or increase our potential liability if we fail to comply. This influx of state privacy regimes indicates a trend toward more stringent privacy legislation in the United States, including a potential federal privacy law, which could also increase our potential liability and adversely affect our business. In Europe, the General Data Protection Regulation 2016/679 (the “GDPR”) imposes a strict data protection compliance regime in relation to the collection and processing of personal data, and various European and other foreign laws also restrict the use of cookies, tracking technologies and certain marketing activities.

Future laws, regulations, standards and other obligations and changes in the interpretation of existing laws, regulations, standards and other obligations could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our applications, restrict our business operations, or increase our costs and impair our ability to maintain and grow our customer base and increase our revenue. Such laws and regulations may require companies to implement privacy and security policies, permit users to exercise various data rights, inform individuals of security breaches that affect their personal data and, in some cases, obtain individuals’ consent to use personal data for certain purposes. If we, or the third parties on which we rely, fail to comply with federal, state and international data privacy laws and regulations, our ability to successfully operate our business and pursue our business goals could be harmed. Additionally, plaintiffs have become increasingly more active in bringing privacy-related claims against companies. Some of these claims allow for the recovery of statutory damages on a per violation basis and, if viable, carry the potential for significant statutory damages, depending on the volume of data and the number of violations.

With respect to cybersecurity in the United States, the development of rules and guidance pursuant to various executive orders may apply to us, including, for example, pursuant to Executive Order 14028 for “critical software.” While the rules and guidance coming from the Executive Order are still being developed, we are likely to be categorized as a provider of critical software, which may increase our compliance costs and delay or prevent our ability to execute contracts with customers, including in particular with government entities.

Any failure or perceived failure by us or our third-party service providers to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks with which Okta, Inc. has contractually committed to comply, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in investigations and enforcement actions and prosecutions, private litigation (including class action lawsuits), fines, penalties and censure, claims for damages by customers and other affected individuals or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

We publicly post our privacy policies and practices concerning our processing, use and disclosure of the personal data provided to us by our website visitors and by our customers and other individuals with whom we interact. Our publication of our privacy policies and other statements we publish that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be unfair, deceptive or misrepresentative of our practices.

If our platforms are perceived to cause, or are otherwise unfavorably associated with, violations of privacy or data security requirements, it may subject us or our customers to public criticism and potential legal liability. Existing and potential privacy laws and regulations concerning privacy and data security and increasing sensitivity of consumers to unauthorized processing of personal data may create negative public reactions to technologies, solutions and services such as ours. Public concerns regarding personal data processing, privacy and security may cause some of our customers’ end users to be less likely to visit their websites or otherwise interact with them. If enough end users choose not to visit our customers’ websites or otherwise interact with them, our customers could stop using our platforms. This, in turn, may reduce the value of our service, slow or eliminate the growth of our business or cause our business to contract.

Privacy is a key issue for Okta, Inc. and for our customers. We have attained multiple privacy certifications, such as the Data Privacy Network, Privacy Recognition for Processors and the European Union Cloud Code of Conduct, Level 2. If we fail to maintain our privacy certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed solutions, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.

4647

Conduct, Level 2. If we fail to maintain our privacy certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed solutions, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.

We may face particular privacy, data security and data protection risks due to stringent data protection and privacy laws and increased scrutiny over data transfers.

We are subject to global data protection laws and regulations (“Data Protection Laws”) that may impact how we do business with customers. Data Protection Laws, such as those applicable in the European Union, Canada and certain of its provinces, United Kingdom, Asia and certain states in the United States, have enhanced data protection obligations for companies that handle personal data. Obligations include, for example, expanded disclosures about how personal data is to be used, individual rights in relation to personal data, limitations on retention of personal data, mandatory data breach notification requirements and strict obligations on service providers and restrictions on online marketing and the use of cookies and tracking technologies.

In addition, increasing numbers of Data Protection Laws restrict transfers of personal data outside of their country of origin to countries deemed to lack adequate privacy protections. These types of transfers must be supported by a transfer mechanism that we may be required to implement, and in many jurisdictions there is significant legal uncertainty around the validity and sufficiency of data transfer mechanisms, and evolving legal and regulatory expectations could impose additional obligations or require expenditure of additional resources to comply with the Data Protection Laws.

Data Protection Laws are rapidly expanding and evolving, and many have extraterritorial effect, which may increase our compliance costs and expose us to greater enforcement risk. In addition, we may be or become subject to data localization laws, which require personal data, or certain subcategories of personal data, to be stored in the jurisdiction of origin. These regulations may deter customers from using cloud-based services such as ours and may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.

This regulatory environment applicable to the handling of personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, results of operations and financial condition being harmed. We and our customers may face a risk of enforcement actions by an increasing number of global data protection authorities in countries where data protection laws apply to us and with which we may not be able to comply. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, results of operations and financial condition.

Non-compliance with these obligations can trigger significant fines and other penalties. Regulatory bodies can also issue orders to cease or change data processing, enforcement notices and/or assessment notices (for a compulsory audit) and civil claims (including class actions) for compensation or damages. In addition to fines, some U.S. states allow a private right of action. Given the breadth and depth of changes in data protection obligations, complying with these requirements has caused us to expend significant resources, which is likely to continue into the near future as we respond to new interpretations and enforcement actions.

In addition, new laws are continually being passed and new case law and regulatory guidance means Data Protection Laws are constantly evolving. For example, California recently approved new regulations, and other U.S. states continue to enact Data Protection Laws. We cannot yet determine the impact that such future laws, regulations and standards may have on our business. Such laws and regulations are often subject to differing interpretations and may be inconsistent among jurisdictions. We could incur substantial expense in complying with any new obligations, be required to make significant changes to our business operations or to the development of new or existing solutions, and we may not be able to comply with some of these regulatory developments, all of which may adversely affect our revenues and our business overall.

If we fail to maintain our security attestations and certifications, our business, results of operations and financial condition may suffer.

Security is essential for us and for our customers. A number of our Okta Platform product offerings have attained multiple certifications, including SOC 2 Type II Attestations, CSA Star Level 2 Certification, ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019 and comply with many other international frameworks. Certain Okta Platform offerings maintain multiple agency FedRAMP Authorities to Operate and are compliant to operate at Department of Defense Impact Level 4. Certain Okta Platform offerings maintain minimum security requirements in alignment with the Security Rule of HIPAA. The Okta Platform also supports FIPS 140-2 encryption requirements. If we fail to maintain our security attestations and certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed products, we may fail to meet our contractual commitments and we

4748

operate at Department of Defense Impact Level 4. Certain Okta Platform offerings maintain minimum security requirements in alignment with the Security Rule of HIPAA. The Okta Platform also supports FIPS 140-2 encryption requirements. If we fail to maintain our security attestations and certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed products, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.

We provide service level commitments under our customer contracts. If we fail to meet these contractual commitments, we could be obligated to provide credits for future service, which could harm our business, results of operations and financial condition.

Our customer agreements contain service level commitments, under which we guarantee specified availability of our platforms. Any failure of or disruption to our infrastructure could make our platforms unavailable to our customers. If we are unable to meet the stated service level commitments to our customers or suffer extended periods of unavailability of our platforms, we have been, and could in the future be, contractually obligated to provide affected customers with service credits for future subscriptions. Our revenue, other results of operations and financial condition could be harmed if we suffer unscheduled downtime that exceeds the service level commitments under our agreements with our customers, and any extended service outages could adversely affect our business and reputation as customers may elect not to renew and we could lose future sales.

If we are unable to ensure that our solutions integrate or interoperate with a variety of operating systems, platforms, services, software applications devices, mobile phones and other hardware form factors that are developed by others, our platforms may become less competitive and our results of operations may be harmed.

The number of people who access the internet through mobile devices and access cloud-based software applications through mobile devices, including smartphones and handheld tablets or laptop computers, has increased significantly in the past several years and is expected to continue to increase. While we have created mobile applications and mobile versions of our solutions that are accessible on third-party application stores, if these mobile applications and solutions do not perform well, our business may suffer. Third-party application stores may also impose new requirements, including, for example, updates to their terms of access or policies on how we or our channel partners must collect, use and share data. Compliance with any such requirements could be costly or burdensome, and could prevent us from timely updating our current mobile applications or distributing new mobile applications. If we fail to comply with these requirements, we could lose access to, or be required to remove our mobile applications from, third-party application stores.

In addition, our solutions interoperate with servers, mobile devices and software applications predominantly through the use of protocols, many of which are created and maintained by third parties. As a result, we depend on the interoperability of our solutions with such third-party services, mobile devices and mobile operating systems, as well as cloud-enabled hardware, software, networking, browsers, database technologies and protocols that we do not control. Past and future changes in such technologies that degrade the functionality of our solutions or give preferential treatment to competitive services have, in the past and could, in the future, adversely affect adoption and usage of our platforms. Any change in our customers’ preference for cloud-based identity management or any shift towards on-premises systems could also adversely affect adoption and usage of our platforms. Also, we may not be successful in developing or maintaining relationships with key participants in the mobile industry or in developing solutions that operate effectively with a range of operating systems, networks, devices, browsers, protocols and standards. In addition, we may face different fraud, security and regulatory risks from transactions sent from mobile devices than we do from personal computers. If we are unable to effectively anticipate and manage these risks, or if it is difficult for our customers to access and use our platforms, our business, results of operations and financial condition may be harmed.

Our success also depends on the willingness of third-party developers and technology providers to build applications and provide integrations that are complementary to our service. Without the development of these applications and integrations, both current and potential customers may not find our service sufficiently attractive and our business, results of operations and financial condition could suffer.

Interruptions or delays in the services provided by third-party data centers or internet service providers have, in the past and could, in the future, impair the delivery of our platforms and our business could suffer.

We rely on a number of third-party service providers to operate our services. For example, we host our platforms using AWS data centers and other third-party cloud infrastructure services. Our operations depend on protecting the virtual cloud infrastructure hosted in AWS or other cloud services by maintaining its configuration, architecture and interconnection specifications, as well as the information stored in these virtual data centers and which third-party internet service providers transmit. Service interruptions from such infrastructure providers have caused and could in the future cause outages on our platforms. Our solutions use resources operated by us in these locations. Although we have disaster recovery plans that use multiple virtual data center locations, any incident affecting their infrastructure, including events beyond our control, could negatively affect our platforms, harm our reputation and expose us to liability. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party services we use.

caused and could in the future cause outages on our platforms. Our solutions use resources operated by us in these locations. Although we have disaster recovery plans that use multiple virtual data center locations, any incident affecting their infrastructure, including events beyond our control, could negatively affect our platforms, harm our reputation and expose us to liability. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party services we use.

We rely on software and services from other parties. Defects in or the loss of access to software or services from third parties could increase our costs and adversely affect the quality of our solutions.

We rely on technologies from third parties to operate critical functions of our business, including cloud infrastructure services and customer relationship management services. Our business would be disrupted if any of the third-party software or services we use, or functional equivalents, were unavailable due to defects in the software or services from those third parties, or because they are no longer available on commercially reasonable terms or prices. In each case, we would be required to either seek licenses to software or services from other parties and redesign our solutions to function with such software or services or develop substitutes ourselves, which would result in increased costs and could result in delays in launches or releases of new solutions until equivalent technology can be identified, licensed or developed and integrated into our solutions. Furthermore, we might be forced to limit the features available in our current or future solutions. These delays and feature limitations, if they occur, could harm our business, results of operations and financial condition.

Real or perceived errors, failures, vulnerabilities or bugs in our solutions, including deployment complexity, have in the past and could, in the future, harm our business and results of operations.

Errors, failures, vulnerabilities or bugs have, in the past and may, in the future, occur in our solutions, especially when updates are deployed or new solutions are rolled out, maintenance patches are applied or infrastructure, architectural or configuration changes are made. In the past, such issues have caused outages for our customers. Our platforms are often used in connection with large-scale computing environments with different operating systems, system management software, equipment and networking configurations, which may cause errors or failures of our solutions, or other aspects of the computing environment into which our solutions are deployed. In addition, deployment of our solutions into complicated, large-scale computing environments may expose errors, failures, vulnerabilities or bugs in our solutions. Any such errors, failures, vulnerabilities or bugs may not be found until after they are deployed to our customers.

We are committed to increasing our transparency with our customers and the public about our solutions and technology. This transparency, which may be more than is expected of companies in our industry, could lead to us publicly disclosing information that we would not otherwise be legally required to disclose, such as errors, failures, vulnerabilities or bugs in our solutions and technology. As a result, we could experience negative publicity that could harm our business. Any real or perceived errors, failures, vulnerabilities or bugs in our solutions or delays in or difficulties implementing our solutions, could also result in: loss, compromise, corruption or other unavailability of customer data; disruptions to our solutions or our customers’ products, systems, networks and operations; loss of business and new customers; loss of or delay in market acceptance of our solutions; a decrease in customer satisfaction or adoption rates; loss of competitive position; or claims by customers for losses sustained by them, all of which could harm our business, results of operations and financial condition.

Issues in the development and use of artificial intelligence (“AI”), combined with an uncertain regulatory environment, may result in reputational harm, liability or other adverse consequences to our business operations.

We use internally developed and third-party developed machine learning and AI technologies in our offerings and business, and we are making investments in expanding our AI capabilities in our portfolio, including ongoing deployment and improvement of existing machine learning and AI technologies, as well as developing new product features using AI technologies, including, for example, generative AI. AI technologies are complex and rapidly evolving, and we face significant competition from other companies as well as an evolving regulatory landscape. For example, in the European Union, the Artificial Intelligence Act establishes obligations on the use of AI based on the type of AI and its potential risks to society. Additionally, in the United States, federal and state legislatures and agencies have passed and continue to introduce legal frameworks and rules governing AI. The introduction of AI technologies into new or existing solutions may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality or security risks, ethical concerns or other complications that could adversely affect our business, reputation or financial results. For example, even if permitted by our privacy policy and contractual rights, our use of data in novel AI applications may, in time, expand beyond customer expectations. The intellectual

4950

evolving, and we face significant competition from other companies as well as an evolving regulatory landscape. For example, in the European Union, the Artificial Intelligence Act establishes obligations on the use of AI based on the type of AI and its potential risks to society. Additionally, in the United States, federal and state legislatures and agencies have passed and continue to introduce legal frameworks and rules governing AI. The introduction of AI technologies into new or existing solutions may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality or security risks, ethical concerns or other complications that could adversely affect our business, reputation or financial results. For example, even if permitted by our privacy policy and contractual rights, our use of data in novel AI applications may, in time, expand beyond customer expectations. The intellectual property ownership and license rights, including copyright, surrounding AI technologies has not been fully addressed by courts or national or local laws or regulations, and the use or adoption of third-party AI technologies into our solutions may result in exposure to claims of copyright infringement or other intellectual property misappropriation. Uncertainty around new and emerging AI technologies, such as generative AI, may require additional investment in the development and maintenance of proprietary datasets and machine learning models, development of new approaches and processes to provide attribution or remuneration to creators of training data, and development of appropriate protections and safeguards for handling the use of customer data with AI technologies, which may be costly and could impact our expenses as we continue to expand generative AI into our product offerings. If such investments do not deliver anticipated benefits or are not otherwise successful, our business and results of operations may be harmed. Furthermore, AI technologies, including generative AI, may create content that appears correct but is factually inaccurate or flawed. Our customers or others may rely on or use this flawed content to their detriment, which may expose us to brand or reputational harm, competitive harm and/or legal liability. The use of AI technologies presents emerging ethical and social issues, and if we enable or offer solutions that draw scrutiny or controversy due to their perceived or actual impact on customers or on society as a whole, we may experience brand or reputational harm, competitive harm and/or legal liability.

If we fail to adequately protect our proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate less revenue and incur costly litigation to protect our rights.

Our success is dependent, in part, upon protecting our proprietary information and technology. We rely on a combination of patents, copyrights, trademarks, service marks, trade secret laws and contractual restrictions to establish and protect our proprietary rights. However, the steps we take to protect our intellectual property may be inadequate. We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property. Despite our precautions, it may be possible for unauthorized third parties to copy our solutions and use information that we regard as proprietary to create solutions that compete with ours. Some contract provisions protecting against unauthorized use, copying, transfer and disclosure of our solutions may be unenforceable under the laws of certain jurisdictions and foreign countries. Further, the laws of some countries do not protect proprietary rights to the same extent as the laws of the United States, and mechanisms for enforcement of intellectual property rights in some foreign countries may be inadequate. To the extent we expand our international activities, our exposure to unauthorized copying and use of our solutions and proprietary information may increase. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our technology and intellectual property.

We rely in part on trade secrets, proprietary know-how and other confidential information to maintain our competitive position. Although we enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances, no assurance can be given that these agreements will be effective in controlling access to and distribution of our solutions and proprietary information. Further, these agreements do not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our solutions.

To protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could delay further sales or the implementation of our solutions, impair the functionality of our solutions, delay introductions of new solutions, result in our substituting inferior or more costly technologies into our solutions or injure our reputation. In addition, we may be required to license additional technology from third parties to develop and market new solutions, and we cannot ensure that we can license that technology on commercially reasonable terms or at all, and our inability to license this technology could harm our ability to compete.

develop and market new solutions, and we cannot ensure that we can license that technology on commercially reasonable terms or at all, and our inability to license this technology could harm our ability to compete.

We have in the past and may, in the future, be subject to infringement claims, which could result in significant damage awards that could harm our results of operations.

There is considerable patent and other intellectual property development activity in our industry, and we expect that software companies will increasingly be subject to infringement claims as the number of solutions and competitors grows, and the functionality of solutions in different industry segments overlaps. In addition, the patent portfolios of many of our competitors are larger than ours, and this disparity may increase the risk that our competitors may sue us for patent infringement and may limit our ability to counterclaim for patent infringement or settle through patent cross-licenses. Other companies have claimed in the past and may claim in the future, that we infringe upon their intellectual property rights. A claim may also be made relating to technology that we acquire or license from third parties. Further, we may be unaware of the intellectual property rights of others that may cover some or all of our technology.

portfolios of many of our competitors are larger than ours, and this disparity may increase the risk that our competitors may sue us for patent infringement and may limit our ability to counterclaim for patent infringement or settle through patent cross-licenses. Other companies have claimed in the past and may claim in the future, that we infringe upon their intellectual property rights. A claim may also be made relating to technology that we acquire or license from third parties. Further, we may be unaware of the intellectual property rights of others that may cover some or all of our technology.

Any claim of infringement, regardless of its merit or our defenses, could subject us to a number of risks described elsewhere in these risk factors, including those discussed under the title, “If we fail to adequately protect our proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate less revenue and incur costly litigation to protect our rights.”

We use open source software in our platforms, which could negatively affect our ability to offer our solutions and subject us to litigation or other actions.

We use open source software in our solutions and expect to use more open source software in the future. From time to time, there have been claims challenging the ownership of open source software against companies that incorporate open source software into their products. However, the terms of many open source licenses have not been interpreted by U.S. courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our solutions. As a result, we could be subject to lawsuits by parties claiming ownership of what we believe to be open source software. Litigation could be costly for us to defend, have a negative effect on our results of operations and financial condition or require us to devote additional research and development resources to change our solutions. In addition, if we were to combine our proprietary software with open source software in a certain manner, we could, under certain of the open source licenses, be required to release the source code of our proprietary software to the public, which could open security risks as well as risks to exposing some of our trade secrets. This would allow our competitors to create similar solutions with less development effort and time. If we inappropriately use open source software, or if the license terms for open source software that we use change, we may be required to re-engineer our solutions, incur additional costs, discontinue the sale of some or all of our solutions or take other remedial actions. Some open source software may include generative AI software or other software that incorporates or relies on generative AI or other AI technologies. The use of such software may expose us to risks as the intellectual property ownership and license rights, including copyright, of generative AI software and tools, has not been fully interpreted by U.S. courts or been fully addressed by federal or state regulation.

In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or assurance of title or controls on origin of the software. In addition, many of the risks associated with usage of open source software, such as security issues, potential loss of trade secret protection and the lack of warranties or assurances of title, cannot be eliminated, and could, if not properly addressed, negatively affect our business. We have established processes to help alleviate these risks, including a review process for screening requests from our development organizations for the use of open source software, but we cannot be sure that all of our use of open source software is in a manner that is consistent with our current policies and procedures, or will not subject us to liability.

Indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement and other losses.

Our agreements with customers and other third parties include provisions under which we agree to indemnify or otherwise be liable to them for losses suffered or incurred as a result of claims of intellectual property infringement, damages caused by us to property or persons, or other liabilities relating to or arising from the use of our platforms or other acts or omissions. From time to time, customers also require us to indemnify or otherwise be liable to them for breach of confidentiality, violation of applicable law, or failure to implement adequate security measures with respect to their data stored, transmitted or accessed using our platforms. The term of these contractual provisions often survives termination or expiration of the applicable agreement. Although we normally contractually limit our liability with respect to such obligations, the existence of such a dispute may have adverse effects on our customer relationship and reputation and we may still incur substantial liability or large indemnity payments. This could significantly increase our operating expenses, require us to restrict our business activities and limit our ability to deliver certain solutions, all of which could require significant time, effort and expense, harm our reputation and customer relationships and negatively affect our business.

5152

measures with respect to their data stored, transmitted or accessed using our platforms. The term of these contractual provisions often survives termination or expiration of the applicable agreement. Although we normally contractually limit our liability with respect to such obligations, the existence of such a dispute may have adverse effects on our customer relationship and reputation and we may still incur substantial liability or large indemnity payments. This could significantly increase our operating expenses, require us to restrict our business activities and limit our ability to deliver certain solutions, all of which could require significant time, effort and expense, harm our reputation and customer relationships and negatively affect our business.

Risks Related to Legal, Accounting and Tax Matters

Because we generally recognize revenue from our subscriptions and support services over the term of the relevant service period, a decrease in sales during a reporting period may not be immediately reflected in our results of operations for that period.

We generally recognize revenue from subscriptions and related support services revenue ratably over the relevant service period. Net new revenue from new subscriptions, upsells and renewals entered into during a period can generally be expected to generate revenue for the duration of the service period. As a result, most of the revenue we report in each period is derived from the recognition of deferred revenue relating to subscriptions and support services contracts entered into during previous periods. Consequently, a decrease in new or renewed subscriptions in any single reporting period will have a limited impact on our revenue for that period, but will negatively affect our revenue in future periods. In addition, our ability to adjust our cost structure in the event of a decrease in new or renewed subscriptions may be limited.

Our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from customers is generally recognized over the applicable service period. Additionally, due to the complexity of certain of our customer contracts, the actual revenue recognition treatment required under relevant accounting principles generally accepted in the United States (“GAAP”) will depend on contract-specific terms and may result in greater variability in revenue from period to period.

In addition, a decrease in new subscriptions or renewals in a reporting period may not have an immediate impact on billings for that period.

We face exposure to foreign currency exchange rate fluctuations.

Today, a vast majority of our customer contracts are denominated in U.S. dollars. Over time, however, an increasing portion of our international customer contracts may be denominated in local currencies. In addition, the majority of our international costs are denominated in local currencies. As a result, fluctuations in the value of the U.S. dollar and foreign currencies, including as a result of, for example, geopolitical events, changes in trade policies, trade restrictions and economic sanctions, or the threat of such actions, and market volatility, may affect our results of operations when translated into U.S. dollars. We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations. However, in the future, we may use derivative instruments, such as foreign currency forward and option contracts, to hedge certain exposures to fluctuations in foreign currency exchange rates. The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place. Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments.

We are subject to anti-corruption, anti-bribery and similar laws, and non-compliance with such laws can subject us to criminal penalties or significant fines and harm our business and reputation.

We are subject to anti-corruption and anti-bribery and similar laws, such as the U.S. Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the U.S. domestic bribery statute contained in 18 U.S.C. § 201, U.S. Travel Act, the USA PATRIOT Act, the U.K. Bribery Act 2010 and other anti-corruption, anti-bribery and anti-money laundering laws in countries in which we conduct activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly and prohibit companies and their employees and agents from promising, authorizing, making or offering improper payments or other benefits to government officials and others in the private sector. As we increase our international sales and business, our risks under these laws may increase.

In addition, we use channel partners to sell our solutions and conduct business on our behalf. We or such partners may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and under certain circumstances we could be held liable for the corrupt or other illegal activities of such partners and our employees, representatives, contractors, partners and agents, even if we do not explicitly authorize such activities.

owned or affiliated entities and under certain circumstances we could be held liable for the corrupt or other illegal activities of such partners and our employees, representatives, contractors, partners and agents, even if we do not explicitly authorize such activities.

Noncompliance with the FCPA, other applicable anti-corruption laws or anti-money laundering laws could subject us to investigations, whistleblower complaints, sanctions, settlements, prosecution and other enforcement actions within the U.S. and internationally, which could have a material adverse effect on our reputation, business, results of operations and financial condition.

We are subject to governmental export controls and economic sanctions laws that could impair our ability to compete in international markets and subject us to liability if we are not in full compliance with applicable laws.

Our business activities are subject to various restrictions under U.S. export controls and trade and economic sanctions laws, which include prohibitions on the sale or supply of certain products and services to U.S. embargoed or sanctioned countries, governments, persons and entities and also require authorization for the export of encryption items. In addition, various countries regulate the import of certain encryption technology, including through import and licensing requirements, and have enacted laws that could limit our ability to distribute our service or could limit our customers’ ability to implement our service in those countries. If we fail to comply with these laws and regulations, we and certain of our employees could be subject to civil or criminal penalties, including the possible loss of export privileges and monetary penalties. Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities. Although we take precautions to prevent our solutions from being provided in violation of such laws, our solutions may have been in the past, and could in the future be, provided inadvertently in violation of such laws, despite the precautions we take. This could result in negative consequences to us, including government investigations, penalties and harm to our reputation.

Our international operations may give rise to potentially adverse tax consequences.

We are expanding our international operations and staff to better support our growth into certain international markets. Our corporate structure and associated transfer pricing policies anticipate future growth into certain international markets. The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of the various jurisdictions, including the United States, to our international business activities, changes in tax rates, new or revised tax laws or interpretations of existing tax laws and policies and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements. The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions, which are generally required to be computed on an arm’s-length basis pursuant to intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a challenge or disagreement were to occur and our position was not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced net cash flows and lower overall profitability of our operations. Our financial statements could fail to reflect adequate reserves to cover such a contingency.

Changes in tax laws or regulations in the various tax jurisdictions we are subject to that are applied adversely to us or our customers could increase the costs of our solutions and harm our business.

New income, sales, use, value-added or other transaction level taxes, tax laws, statutes, rules, regulations or ordinances could be enacted at any time. Those enactments could adversely impact our domestic and international business operations and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. These events could require us or our customers to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our customers to pay fines and/or penalties and interest for past amounts deemed to be due. If we raise our prices to offset the costs of these additional taxes, existing and potential future customers may elect not to purchase our solutions in the future. Additionally, new, changed, modified or newly interpreted or applied tax laws could increase our compliance, operating and other costs, as well as the costs of our solutions to our customers. Further, these events could decrease the capital we have available to operate our business. Any or all of these events could harm our business and financial performance. For example, various legislative and regulatory actions and proposals, such as in the United States, the Organisation for Economic Co-operation and Development and the EU, have increasingly focused on future tax reform and contemplate changes to long-standing tax principles, which could adversely affect our liquidity and results of operations.

As a multinational organization, we may be subject to taxation in certain jurisdictions around the world with increasingly complex tax laws, the application of which can be uncertain. The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles, including increased tax rates, new tax laws or revised interpretations of existing tax laws and precedents, which could harm our liquidity and results of operations. In addition, the authorities in these jurisdictions could review our tax returns and impose additional tax, interest and penalties, and the authorities could claim that various withholding requirements apply to us or our subsidiaries or assert that benefits of tax treaties are not available to us or our subsidiaries, any of which could harm us and our results of operations.

Our business may be subject to additional obligations to collect and remit sales tax and other taxes, and we may be subject to tax liability for past sales. Any successful action by state, foreign or other authorities to collect additional or past sales tax could harm our business.

State, foreign and local taxing jurisdictions have differing rules and regulations governing sales, use and other indirect taxes (including digital services taxes), and these rules and regulations are subject to varying interpretations that may change over time. In particular, the applicability of certain sales, value-added and digital services taxes to our platforms in various jurisdictions is unclear. It is possible that we could face tax audits and that our liability for these taxes could exceed our estimates as tax authorities could still assert that we are obligated to collect additional amounts as taxes from our customers and remit those taxes to those authorities. We could also be subject to audits in states and international jurisdictions for which we have not accrued tax liabilities. A successful assertion that we should be collecting additional sales or other taxes on our solutions and services in jurisdictions where we have not historically done so and do not accrue for such taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our solutions or otherwise harm our business, results of operations and financial condition.

We file sales tax returns in certain states within the United States as required by law and certain customer contracts for a portion of the solutions that we provide. We do not collect sales or other similar taxes in other states and many of such states do not apply sales or similar taxes to the vast majority of the solutions that we provide. However, one or more states or foreign authorities could seek to impose additional sales, use or other tax collection and record-keeping obligations on us or may determine that such taxes should have, but have not been, paid by us. Liability for past taxes may also include substantial interest and penalty charges. Any successful action by state, foreign or other authorities to compel us to collect and remit sales tax, use tax or other taxes, either retroactively, prospectively or both, could harm our business, results of operations and financial condition.

Our ability to use our U.S. net operating loss carry-forwards and certain other tax attributes may be limited.

Under Section 382 of the Internal Revenue Code of 1986, as amended, if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in its equity ownership over a three-year period, the corporation’s ability to use its pre-change net operating loss carry-forwards and other pre-change tax attributes, such as research tax credits and distributed interest deduction carryover, to offset its post-change income may be limited. We have experienced ownership changes in the past and any such ownership change in the future could result in increased future tax liability. In addition, we may experience ownership changes in the future as a result of subsequent shifts in our stock ownership. As a result, if we earn net taxable income, our ability to use our pre-change net operating loss carry-forwards to offset U.S. federal taxable income may be subject to limitations, which could potentially result in increased future tax liability to us.

If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired.

The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. To satisfy this obligation, we expend significant resources, including accounting-related costs and significant management oversight. If any of these controls and systems do not perform as expected, we may experience material weaknesses or significant deficiencies in our controls. Our controls may also become inadequate because of changes in conditions in our business. We may discover any such weaknesses or deficiencies in the future and be required to restate our financial statements for prior periods.

Ineffective internal controls over financial reporting could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that are filed with the SEC. For example, investors could lose confidence in our reported financial and other information; we could fail to satisfy our SEC, Nasdaq or other reporting obligations, or become subject to sanctions or investigations by regulators; and the price of our Class A common stock could decline.

the SEC. For example, investors could lose confidence in our reported financial and other information; we could fail to satisfy our SEC, Nasdaq or other reporting obligations, or become subject to sanctions or investigations by regulators; and the price of our Class A common stock could decline.

Changes in existing financial accounting standards or practices, or taxation rules or practices, may harm our results of operations.

Changes in existing accounting or taxation rules or practices, new accounting pronouncements or taxation rules, or varying interpretations of current accounting pronouncements or taxation practice could harm our results of operations or the manner in which we conduct our business. Further, such changes could potentially affect our reporting of transactions completed before such changes are effective.

operations or the manner in which we conduct our business. Further, such changes could potentially affect our reporting of transactions completed before such changes are effective.

GAAP are subject to interpretation by the Financial Accounting Standards Board (“FASB”), the SEC and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our reported financial results and could affect the reporting of transactions completed before the announcement of a change. Adoption of such new standards and any difficulties in implementation of changes in accounting principles, including the ability to modify our accounting systems, could cause us to fail to meet our financial reporting obligations, which could result in regulatory discipline and harm investors’ confidence in us.

If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our results of operations could be adversely affected.

The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the amounts reported in our condensed consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity and the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates used in preparing our condensed consolidated financial statements include, but are not limited to those referenced in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A common stock.

Risks Related to Ownership of Our Class A Common Stock

The stock price of our Class A common stock may be volatile or may decline.

The trading price of our Class A common stock has been, and in the future may be, subject to substantial volatility and wide fluctuations. For example, from ~~August~~November 1, 2024 through ~~July~~October 31, 2025, the trading price of our Class A common stock has ranged from $70.5692 per share to $127.57 per share. The market price of our Class A common stock fluctuates significantly in response to numerous factors, many of which are beyond our control, including, but not limited to, the factors described elsewhere in these risk factors as well as:

•overall performance of the equity markets and/or publicly-listed technology companies;

•volatility in the market prices and trading volumes of technology and high-growth companies generally, or those in our industry in particular;

•actual or anticipated fluctuations in our revenue or other financial or operating metrics;

•our ability to meet or exceed forward-looking guidance we have given, our ability to give forward-looking guidance consistent with past practices, and changes to or withdrawal of previous guidance or long-range targets;

•failure of securities analysts to initiate or maintain coverage of us, changes in financial estimates and/or recommendations by any securities analysts who follow our company;

•our failure to meet the estimates or the expectations of securities analysts or investors;

•actions and investment positions taken by institutional and other stockholders, including activist investors;

•recruitment or departure of key personnel;

•rumors and market speculation involving us or other companies in our industry;

•announcements by us or our competitors of significant innovations, acquisitions, strategic partnerships, joint ventures or capital commitments; and

•sales of additional shares of our Class A common stock by us, our directors, our officers or our stockholders.

In addition, stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies. Stock prices of many companies, including technology companies and high-growth, unprofitable companies in particular, have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. In the past, stockholders have instituted securities class action litigation following periods of market volatility. Our involvement in securities litigation has, in the past and could, in the future, subject us to substantial costs, divert resources and the attention of management from our business and harm our business.

The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 32.52% of the voting power of our capital stock as of ~~July~~October 31, 2025. This will limit or preclude your ability to influence corporate matters, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets or other major corporate transaction requiring stockholder approval.

Our Class B common stock has ten votes per share and our Class A common stock has one vote per share. As of ~~July~~October 31, 2025, our directors, executive officers and their affiliates held in the aggregate 32.52% of the voting power of our capital stock, taking into account shares of our common stock subject to options that are currently exercisable or exercisable within 60 days of ~~July~~October 31, 2025 and RSUs that are releasable within 60 days of ~~July~~October 31, 2025. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively could continue to control nearly a majority of the combined voting power of our common stock and be able to effectively control all matters submitted to our stockholders for approval until April 12, 2027, the date that is the ten-year anniversary of the closing of our IPO. This concentrated control may limit or preclude your ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets or other major corporate transaction requiring stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that you may feel are in your best interest as one of our stockholders.

Future transfers by holders of Class B common stock will generally result in those shares converting to Class A common stock, subject to limited exceptions, such as certain transfers effected for estate planning purposes. The conversion of Class B common stock to Class A common stock will have the effect, over time, of increasing the relative voting power of those holders of Class B common stock who have retained their shares.

Sales of a substantial number of shares of our Class A common stock in the public markets, or the perception that sales might occur, could cause the market price of our Class A common stock to decline.

Sales of a substantial number of shares of our Class A common stock into the public market, particularly sales by our directors, executive officers and principal stockholders, or the perception that these sales might occur, could cause the market price of our Class A common stock to decline.

In addition, we have options outstanding that, if fully exercised, would result in the issuance of shares of our Class A and Class B common stock. We also have restricted stock units (“RSUs”) outstanding that, if vested and settled, would result in the issuance of shares of Class A common stock. All of the shares of Class A and Class B common stock issuable upon the exercise of stock options and vesting of RSUs and the shares reserved for future issuance under our equity incentive plans, are registered for public resale under the Securities Act of 1933, as amended (“Securities Act”). Accordingly, these shares will be able to be freely sold in the public market upon issuance, subject to applicable vesting requirements.

Furthermore, a substantial number of shares of our Class A common stock is reserved for issuance upon the exercise of the Notes (as defined below). If we elect to satisfy our conversion obligation on the Notes solely in shares of our Class A common stock upon conversion of the Notes, we will be required to deliver the shares of our Class A common stock, together with cash for any fractional share, on the second business day following the relevant conversion date.57

56Furthermore, a substantial number of shares of our Class A common stock is reserved for issuance upon the exercise of the 2026 Notes (as defined below). If we elect to satisfy our conversion obligation on the 2026 Notes solely in shares of our Class A common stock upon conversion of the 2026 Notes, we will be required to deliver the shares of our Class A common stock, together with cash for any fractional share, on the second business day following the relevant conversion date.

If securities or industry analysts do not publish or cease publishing research, or publish inaccurate or unfavorable research, about our business, the price of our Class A common stock and trading volume could decline.

The trading market for our Class A common stock will depend in part on the research and reports that securities or industry analysts publish about us or our business. If industry analysts do not publish or cease publishing research on our company, the trading price for our Class A common stock would be negatively affected. If one or more of the analysts who cover us downgrade our Class A common stock or publish inaccurate or unfavorable research about our business, our Class A common stock price would likely decline. If one or more of these analysts cease coverage of us or fail to publish reports on us on a regular basis, demand for our Class A common stock could decrease, which might cause our Class A common stock price and trading volume to decline.

We do not intend to pay dividends for the foreseeable future.

We have never declared or paid any cash dividends on our common stock and do not intend to pay any cash dividends in the foreseeable future. We anticipate that we will retain all of our future earnings for use in the operation of our business and for general corporate purposes. Any determination to pay dividends in the future will be at the discretion of our board of directors. Accordingly, investors must rely on sales of their Class A common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

Provisions in our charter documents and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove our current board of directors and limit the market price of our Class A common stock.

Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change of control or changes in our management. Our amended and restated certificate of incorporation and amended and restated bylaws include provisions that:

•provide that our board is classified into three classes of directors with staggered three-year terms;

•permit our board to establish the number of directors and fill any vacancies and newly-created directorships;

•require super-majority voting to amend some provisions in our amended and restated certificate of incorporation and amended and restated bylaws;

•authorize the issuance of “blank check” preferred stock that our board of directors could use to implement a stockholder rights plan;

•provide that only the Chairperson of our board, our Chief Executive Officer or a majority of our board of directors are authorized to call a special meeting of stockholders;

•provide for a dual class common stock structure in which holders of our Class B common stock have the ability to effectively control the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the outstanding shares of our Class A and Class B common stock, including the election of directors and significant corporate transactions, such as a merger or other sale of our company or its assets;

•prohibit stockholder action by written consent, which requires all stockholder actions to be taken at a meeting of our stockholders;

•provide that our board is expressly authorized to make, alter or repeal our bylaws; and

•advance notice requirements for nominations for election to our board or for proposing matters that can be acted upon by stockholders at annual stockholder meetings.

Moreover, Section 203 of the Delaware General Corporation Law may discourage, delay or prevent a change in control of our company. Section 203 imposes certain restrictions on mergers, business combinations and other transactions between us and holders of 15% or more of our common stock.

Our amended and restated bylaws designate a state or federal court located within the State of Delaware as the exclusive forum for certain litigation that may be initiated by our stockholders, which could limit stockholders’ ability to obtain a favorable judicial forum for disputes with us.

Our amended and restated bylaws provide that the Court of Chancery of the State of Delaware will be the exclusive forum for:

•any derivative action or proceeding brought on our behalf;

•any action asserting a breach of fiduciary duty;

•any action asserting a claim against us arising pursuant to the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws; or

•any action asserting a claim against us that is governed by the internal affairs doctrine.

This choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or any of our directors, officers or other employees, which may discourage lawsuits with respect to such claims. Alternatively, if a court were to find the choice of forum provision contained in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our business, results of operations and financial condition.

Risks Related to our Outstanding Convertible Notes

Servicing our debt may require a significant amount of cash. We may not have sufficient cash flow from our business to pay our indebtedness.

We have issued convertible notes due in ~~2025 (“2025 Notes”) and~~ 2026 (“2026 Notes” ~~and together with the 2025 Notes, the “Notes”~~). Our ability to make scheduled payments of the principal of, to pay interest on or to refinance our indebtedness, including the 2026 Notes, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control. Our business may not generate cash flow from operations in the future sufficient to service our debt and make necessary capital expenditures. If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive. Our ability to refinance or raise any future indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations. In addition, any of our future debt agreements may contain restrictive covenants that may prohibit us from adopting any of these alternatives. Our failure to comply with these covenants could result in an event of default which, if not cured or waived, could result in the acceleration of our debt.

We may not have the ability to raise the funds necessary for cash settlement upon conversion of the 2026 Notes or to repurchase ~~the~~them ~~Notes~~ for cash upon a fundamental change, and our future debt may contain limitations on our ability to pay cash upon conversion of the 2026 Notes or to repurchase the 2026 Notes.

Holders of the 2026 Notes have the right to require us to repurchase their 2026 Notes upon the occurrence of a fundamental change (as defined in the indentures governing their respective Notes) at a repurchase price equal to 100% of the principal amount of the 2026 Notes to be repurchased, plus accrued and unpaid interest, if any. Upon conversion of the 2026 Notes, unless we elect to deliver solely shares of our Class A common stock to settle such conversion (other than paying cash in lieu of delivering any fractional share), we will be required to make cash payments in respect of the 2026 Notes being converted. We may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of 2026 Notes surrendered or ~~Notes~~those being converted. In addition, our ability to repurchase the 2026 Notes or to pay cash upon conversions of the 2026 Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness. Our failure to repurchase 2026 Notes at a time when the repurchase is required by the indenture governing such notes or to pay any cash payable on future conversions of the 2026 Notes as required by such indenture would constitute a default under such indenture. A default under the indenture governing the 2026 Notes or the fundamental change itself could also lead to a default under agreements governing our future indebtedness. If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Notes or make cash payments upon conversions.

5859

could also lead to a default under agreements governing our future indebtedness. If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the 2026 Notes or make cash payments upon conversions.

In addition, our indebtedness, combined with our other financial obligations and contractual commitments, could have other important consequences. For example, it could:

•make us more vulnerable to adverse changes in general U.S. and worldwide economic, industry and competitive conditions and adverse changes in government regulation;

•limit our flexibility in planning for, or reacting to, changes in our business and our industry;

•place us at a disadvantage compared to our competitors who have less debt;

•limit our ability to borrow additional amounts to fund acquisitions, for working capital and for other general corporate purposes; and

•make an acquisition of our company less attractive or more difficult.

Any of these factors could harm our business, results of operations and financial condition. In addition, if we incur additional indebtedness, the risks related to our business and our ability to service or repay our indebtedness would increase.

The conversion features of the 2026 Notes, if triggered, may adversely affect our financial condition and results of operations.

In the event the conditional conversion features of the ~~2025 Notes and the~~ 2026 Notes are triggered, holders of the 2026 Notes will be entitled to convert ~~the~~them ~~Notes, as applicable,~~ at any time during specified periods at their option. If one or more holders elect to convert their 2026 Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our Class A common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity. ~~The~~From ~~conditional conversion features of~~ the ~~2025~~date ~~Notes were triggered as~~ of ~~January~~issuance ~~31,~~through ~~2021 and the 2025 Notes were convertible at the option of the holders between February 1, 2021 and April 30, 2021; however, as of July~~October 31, 2025, the conditions allowing holders of the ~~2025~~2026 Notes to convert were not met. ~~From~~As ~~the date~~ of ~~issuance through July~~October 31, 2025, the ~~conditions~~2026 ~~allowing~~Notes ~~holders~~are ofclassified ~~the~~as ~~2026~~a ~~Notes~~current liability due to ~~convert~~their ~~were~~upcoming ~~not~~maturity ~~met~~on June 15, 2026.

InTransactions ~~addition,~~relating ~~even if holders do not elect~~ to ~~convert~~the ~~their~~2026 Notes, wemay ~~could~~affect ~~be required under applicable accounting rules to reclassify all or a portion of~~ the ~~outstanding~~value ~~principal~~ of ~~the Notes as a current rather than long-term liability, which would result in a material reduction of~~ our ~~net~~Class ~~working~~A ~~capital~~common ~~and could limit our ability to raise future capital~~stock. ~~As of July 31, 2025, the 2025 Notes and 2026 Notes are classified as current liabilities due to their upcoming maturities on September 1, 2025 and June 15, 2026, respectively.~~

~~Transactions~~The ~~relating~~conversion of some or all of the 2026 Notes would dilute the ownership interests of existing stockholders to the extent we satisfy our conversion obligation by delivering shares of our Class A common stock upon any conversion of such notes. Our 2026 Notes may ~~affect~~become in the ~~value~~future convertible at the option of their holders under certain circumstances. If holders of the 2026 Notes elect to convert their notes, we may settle our conversion obligation by delivering to them a significant number of shares of our Class A common stock, which would cause dilution to our existing stockholders. We have in the past and may in the future, engage in exchanges, repurchase or induce conversions of the 2026 Notes. Holders of the 2026 Notes that participate in any of these exchanges, repurchases or induced conversions may enter into or unwind various derivatives with respect to our Class A common stock or sell shares of our Class A common stock in the open market to hedge their exposure in connection with these transactions. These activities could decrease (or reduce the size of any increase in) the market price of our Class A common stock or the 2026 Notes, or dilute the ownership interests of our stockholders. In addition, the market price of our Class A common stock is likely to be affected by short sales of our Class A common stock or the entry into or unwind of economically equivalent derivative transactions with respect to our Class A common stock by investors that do not participate in the exchange transactions and by the hedging activity of the counterparties to our capped call transactions ("Capped Calls") or their respective affiliates.

~~The~~In ~~conversion~~addition, ofin ~~some~~connection orwith ~~all of~~ the ~~Notes~~issuance ~~would dilute the ownership interests~~ of ~~existing stockholders to~~ the ~~extent~~2026 ~~we satisfy our conversion obligation by delivering shares of our Class A common stock upon any conversion of such~~ Notes., ~~Our~~we ~~2025~~entered ~~Notes~~into ~~and~~Capped ~~2026~~Calls ~~Notes~~with ~~may~~certain ~~become~~financial ininstitutions (the ~~future~~“Option ~~convertible at the option of their holders under certain circumstances~~Counterparties”). IfThe ~~holders~~Capped ofCalls ~~our~~are ~~Notes~~generally ~~elect~~expected to ~~convert~~reduce ~~their~~potential ~~notes,~~dilution ~~we may settle our conversion obligation by delivering~~ to ~~them a significant number of shares of~~ our Class A common stock, ~~which~~upon ~~would~~any ~~cause~~conversion ~~dilution to our existing stockholders. We have in the past and may in the future, engage in exchanges, repurchase~~ or ~~induce~~settlement ~~conversions~~ of the ~~Notes.~~2026 ~~Holders of the~~ Notes ~~that~~and/or ~~participate~~offset in any ofcash ~~these~~payments ~~exchanges,~~we ~~repurchases~~are orrequired ~~induced conversions may enter into or unwind various derivatives with respect~~ to ~~our~~make ~~Class A common stock or sell shares of our Class A common stock~~ in ~~the~~excess ~~open market to hedge their exposure in connection with these transactions. These activities could decrease (or reduce the size~~ of ~~any increase in)~~ the ~~market~~principal ~~price~~amount of ~~our~~converted ~~Class~~2026 ~~A common stock or the~~ Notes, oras ~~dilute~~ the ~~ownership~~case ~~interests~~may ~~of our stockholders. In addition~~be, ~~the~~with ~~market~~such ~~price~~reduction ofand/or ~~our~~offset ~~Class~~subject ~~A common stock is likely~~ to bea ~~affected~~cap. byIf ~~short~~we ~~sales~~unwind ~~of our Class A common stock or~~ the ~~entry~~Capped ~~into~~Calls orin ~~unwind~~connection ~~of economically equivalent derivative transactions~~ with ~~respect~~2026 toNotes ~~our~~repurchases ~~Class~~or Aotherwise, ~~common~~we ~~stock~~would bylose ~~investors that do not participate in~~ the ~~exchange~~anti-dilutive ~~transactions~~impact ~~and by the hedging activity~~ of ~~the~~any ~~counterparties~~unwound ~~to our capped call transactions ("~~Capped Calls~~") or their respective affiliates~~.

InFrom ~~addition,~~time into ~~connection~~time, ~~with~~ the ~~issuance~~Option ofCounterparties ~~the~~or ~~2025~~their ~~Notes~~respective ~~and~~affiliates ~~2026~~may ~~Notes,~~modify wetheir ~~entered~~hedge ~~into~~positions ~~Capped~~by ~~Calls~~entering ~~with~~into ~~certain~~or ~~financial~~unwinding ~~institutions~~various ~~(the~~derivative ~~“Option~~transactions ~~Counterparties”).~~with ~~The~~respect ~~Capped Calls are generally expected~~ to ~~reduce potential dilution to~~ our Class A common stock ~~upon any conversion or settlement of the 2025 Notes~~ and ~~2026 Notes and~~/or offset any cash payments we are required to make in excess of the principal amount of converted 2025 Notes and 2026 Notes, as the case may be, with such reduction and/or offset subject to a cap. If we unwind

5960

~~the~~purchasing ~~Capped~~or ~~Calls~~selling inour ~~connection~~Class ~~with~~A ~~Note~~common ~~repurchases~~stock or ~~otherwise,~~other wesecurities ~~would~~of ~~lose~~ours in secondary market transactions prior to the ~~anti-dilutive~~maturity ~~impact~~of the 2026 Notes. This activity could cause a decrease in the market price of ~~any~~our ~~unwound~~Class ~~Capped~~A ~~Calls~~common stock.

From time to time, the Option Counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivative transactions with respect to our Class A common stock and/or purchasing or selling our Class A common stock or other securities of ours in secondary market transactions prior to the maturity of the Notes. This activity could cause a decrease in the market price of our Class A common stock.

General Risk Factors

We depend on our executive officers and other key employees, and the loss of one or more of these employees or an inability to attract and retain other highly skilled employees could harm our business.

Our success depends largely upon the continued services of our executive officers and other key employees. From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives. We do not have employment agreements with our executive officers or other key personnel that require them to continue to work for us for any specified period and they could terminate their employment with us at any time. The loss of one or more of our executive officers or key employees, and any failure to have in place and execute an effective succession plan for key executives, could harm our business. In addition, to execute our growth plan, we must attract and retain highly qualified personnel. Competition for these personnel in the San Francisco Bay Area, where our headquarters is located, and in other locations where we maintain offices, is intense, especially for engineers experienced in designing and developing software and SaaS applications and experienced sales professionals. We have from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and may not be able to fill positions in the desired regions or at all. Our efforts to attract new personnel may be compounded by intensified restriction on travel, changes to immigration policy or the availability of work visas. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be harmed.

Catastrophic events may disrupt our business.

Natural disasters or other catastrophic events may cause damage or disruption to our operations, international commerce and the global economy, and thus could harm our business. We have a large employee presence in San Francisco, California, and the west coast of the United States contains active earthquake and wildfire zones which have the potential to disrupt our business. Communications systems and infrastructure could be damaged or interrupted at any time due to a major catastrophic event such as an earthquake, hurricane, fire or flood; power loss or a telecommunications failure; an unauthorized or malicious act such as a cyber-attack, war or terrorist attack; a health epidemic; or similar events or disruptions. Such events could result in reputational harm, delays in our application development, breaches of data security and loss of critical data. While we have backup systems for certain aspects of our operations, disaster recovery planning by its nature cannot be sufficient for all eventualities. In addition, the insurance we maintain may be insufficient to compensate for losses from a major interruption.

Item 5. Other Information

Rule 10b5-1 Trading Arrangements

~~During~~On ~~the~~October ~~three months ended July 31~~14, 2025, ~~the~~Shibu ~~following~~Ninan, ~~executive~~Chief ~~officers~~Accounting Officer, adopted a Rule 10b5-1 trading ~~arrangements~~arrangement that ~~are~~is intended to satisfy the affirmative defense of Rule 10b5-1(c) of the Exchange Act (each, a “10b5-1 Plan”):. The 10b5-1 Plan provides for the sale of up to 5,016 shares of our Class A common stock from January 13, 2026 until all shares are sold or April 15, 2026, whichever occurs first.

•Larissa Schwartz, Chief Legal Officer and Corporate Secretary, adopted a 10b5-1 Plan on July 3, 2025 that provides for the sale of up to 14,163 shares of our Class A common stock, plus an indeterminable number of shares to be acquired upon the future vesting of RSUs. The 10b5-1 Plan provides for sales from October 8, 2025 until all shares are sold or September 30, 2026, whichever occurs first.

•Brett Tighe, Chief Financial Officer, adopted a 10b5-1 Plan on July 15, 2025 that provides for the sale of up to 40,000 shares of our Class A common stock. The 10b5-1 Plan provides for sales from December 8, 2025 until all shares are sold or January 27, 2026, whichever occurs first.

Item 6. Exhibits

We have filed the exhibits listed on the accompanying Exhibit Index, which is incorporated herein by reference.

EXHIBIT INDEX

Exhibit
Number

Exhibit Description

Incorporated by Reference from Form

3.1

Amended and Restated Certificate of Incorporation.

Exhibit 3.2 to Form S-1 filed on March 13, 2017

3.2

Amended and Restated Bylaws, as adopted on June 20, 2024.

Exhibit 3.1 to Form 8-K filed on June 24, 2024

31.1

Certification of the Chief Executive Officer pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

Filed herewith

31.2

Certification of the Chief Financial Officer pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

Filed herewith

32.1*

Certification of the Chief Executive Officer and Chief Financial Officer pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002.

Furnished herewith

101.INS

XBRL Instance Document - the instance document does not appear in the Interactive Data File because its IBRL tags are embedded within the Inline XBRL document.

Filed herewith

101.SCH

Inline XBRL Taxonomy Extension Schema Document

Filed herewith

101.CAL

Inline XBRL Taxonomy Extension Calculation Linkbase Document

Filed herewith

101.LAB

Inline XBRL Taxonomy Extension Label Linkbase Document

Filed herewith

101.PRE

Inline XBRL Taxonomy Extension Presentation Linkbase Document

Filed herewith

101.DEF

Inline XBRL Taxonomy Extension Definition Linkbase Document

Filed herewith

104

Cover Page Interactive Data File (formatted as inline XBRL with applicable taxonomy extension information contained in Exhibits 101.*)

Filed herewith

_______________________________________

* The certifications furnished in Exhibit 32.1 hereto are deemed to accompany this Quarterly Report on Form 10-Q and will not be deemed “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended, except to the extent that the registrant specifically incorporates it by reference.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.

	Okta, Inc.
August 26, 2025		/s/	Brett Tighe
December 2, 2025		/s/	Brett Tighe
			Brett Tighe
			Chief Financial Officer

Filing Compare · Okta, Inc.