Okta to Buy Auth0 for $6.5 Billion

The security firm Okta shook up the identity and access management market Wednesday by announcing a $6.5 billion deal to acquire the customer IAM technology supplier Auth0. Two other cybersecurity M&A deals were also announced this week.

See Also: Case Study: Live Oak Bank Tackles Cloud Security with Orca Security

Todd McKinnon, co-founder and CEO of Okta, says Auth0 initially will operate as an independent business unit inside Okta, with the platforms eventually being integrated. The goal is to combine Auth0’s developer-oriented solution with the Okta Identity Cloud, he says.

In a note to clients Thursday, JPMorgan analysts say the deal will have a short-term impact on Okta’s bottom line but will make the company more competitive in the long run. Okta’s primary focus has been on identity and access management solutions for use with internal employees as well as external customers.

“Auth0 is focused on selling to the developer, different from Okta’s approach of selling at the executive level,” JPMorgan states.

Okta expects the all-stock transaction, subject to regulatory approval, to close during its second fiscal quarter, which ends July 31.

Michael Kelley, senior research director with Gartner, says Okta’s acquisition of Auth0 was a surprise because the companies have similar capabilities.

“Arguably, Okta was already the 800-pound gorilla in the space, but I do think this augments Okta’s offering, in terms of additional strength in both the CIAM space and the developer community,” he says.

Kelley says Okta needs to make more moves to improve its competitive position. “From an access management perspective, in order to expand their reach into large complex environments, they need some additional capabilities for legacy applications, similar to what we see offered with Ping and ForgeRock,” he says. “From an IAM convergence capability, if they are looking for the opportunity to be all things IAM, they will need to augment their capabilities in IGA [internet governance and administration] and PAM [privileged access management].”

Other Deals

In other M&A activity, the private equity firm TPG Capital on Monday announced plans to acquire the cybersecurity firm Thycotic and merge it with Centrify, which TPG purchased earlier this year.

Meanwhile, the cybersecurity education and training company KnowBe4 on Tuesday reported it had acquired the privacy and compliance training company MediaPRO.

Neither TPG Capital nor KnowBe4 released the financial details of their deals.

TPG and Thycotic

Once TPG Capital acquires Thycotic from its majority owner, Insight Partners, it plans to immediately combine Thycotic with the privileged access management firm Centrify that TPG purchased from the private equity firm Thoma Bravo in January.

TPG says bringing Thycotic and Centrify together under one umbrella will help to create a cloud identity security company focusing on privileged access management and carrying out the “zero trust” security model.

“Every company is currently facing sophisticated adversaries who take advantage of the complexity of operating in the cloud and work-from-home [environment]. Thycotic and Centrify together will help companies navigate this new environment,” says James Legg, Thycotic’s CEO.

The two companies, for the time being, will continue to operate under their own brands. A TPG spokesperson says Art Gilliland, CEO of Centrify, will serve as the CEO of the newly combined business and Legg will be named president of the venture.

KnowBe4 and MediaPRO

KnowBe4 CEO Stu Sjouwerman says his company entered the deal to acquire its privately held competitor, MediaPRO, to expand its ability to engage in privacy and compliance training.

MediaPRO, which has about 80 employees, is based in Bothell, Washington, and was founded in 1993.

MediaPRO will operate as part of KnowBe4 and its employees will be integrated into the KnowBe4 structure, says Rob Henley, KnowBe4’s vice president of corporate development

Recent M&A Activity

February was an active month of consolidation with several high-profile companies announcing deals (see: M&A Update: CrowdStrike to Acquire Humio for $400 Million). For example:

• Herjavec Group entered into a definitive agreement to be acquired by the private equity firm Apax Partners for an undisclosed amount of money;
• SentinelOne acquired the cloud analytics company Scalyr for $155 million in equity and cash;
• Tenable plans to buy the Active Directory security firm Alsid SAS for $98 million in cash;
• CrowdStrike has entered into an agreement to buy the cloud log management and observability technology firm Humio for $400 million;
• Palo Alto Networks entered into a definitive agreement to buy the cloud security firm Bridgecrew for $156 million:
• SailPoint plans to acquire the SaaS management company Intello.