Okta more than tripled on the agent boom. Its CEO calls that revenue too small to show up

The gatekeeper outside Okta's door

At Okta's Oktane conference in Las Vegas on 22 September, a Maryland startup named Aembit signed on as a launch partner for Cross App Access, the agent-identity protocol Okta leads ². Days later it was reported as the first third-party enforcement point for XAA↗, now the official Enterprise-Managed Authorization extension to MCP, with early adopters including Anthropic, Zoom, Slack and Microsoft ¹. Aembit's wedge is runtime: it decides what an authenticated agent may actually touch, brokering what it calls blended identity between XAA and the legacy single sign-on and service accounts enterprises still run ¹².

The trade behind the protocol

OKTA closed 2 October at $211.49, just under its 52-week high of $216.59 and more than triple its $62.66 low, at roughly 123 times trailing earnings ³. Morgan Stanley lifted its target to $245 from $200, citing agentic identity↗ ⁴. TD Cowen held at $200 on 2 October ⁵.

The layer that bills is the layer Okta has not priced

Forrester's Oktane recap counts the gaps↗: no full SPIFFE workload-identity implementation, a spec Aembit and Teleport already ship, with SPIFFE support only on Okta's roadmap for Q4 2026; the Auth0 and Okta stacks still ununified; and no pricing for agent identity, which Forrester expects to end up transaction-based ⁶. The protocol itself is an OAuth 2.1-based extension issued by Anthropic inside MCP's extension process, and the base MCP spec still carries a not-yet-finalized draft label ⁶⁷. On the August earnings call↗, Todd McKinnon said Okta for AI Agents closed dozens of deals, several above $1 million, and "it is too small to show up in the numbers right now" ³.

The failure enforcement would catch is live

A flaw in the official MCP Python SDK↗ let a malicious server harvest OAuth client secrets, authorization codes and PKCE verifiers while the victim signed into a genuine Okta, Google or Microsoft Entra page, rated 7.5 for machine-to-machine providers ⁸. The fix shipped 7 September as a behavior change; the advisory followed on 28 September; no attacks are reported ⁹. Only 34% of organizations secure agents with the rigor they apply to people, per a survey Okta cites, and a Gartner figure in Okta's own announcement puts governance confidence at 13% ¹²¹⁰.

Okta ships a gate too, and so does everyone else

Okta launched its own runtime enforcement in July, Agent Gateway, spanning Claude Code, Copilot, Agentforce and any MCP endpoint, and bundled Agent SSO free for its 20,000-plus customers on 24 August ¹². Claude is the first agent to support XAA and 26 SaaS vendors have joined as resources ³. Needham sees two billing models, seat uplift for human-assisted agents and consumption pricing for autonomous ones, and raised its target to $230 ¹³. The Blueprint Alliance, announced with 11 industry partners, runs on a site Okta maintains and legally represents↗ ¹⁰¹¹. And the land is crowded: Cyera re-rated to $12 billion and Island to $6.4 billion selling control planes of their own ¹⁴.

What to watch

The tells are dated: agent pricing, SPIFFE landing in Q4 2026, and the first quarter Okta names a number for agent revenue ⁶³. Until one lands, the premium is a belief, split $200 to $245.