Identity & Security
ToddMcKinnon
The man who decided your password was everyone's problem - and built a $10 billion answer to it.
18K+
Customers
$2B+
Annual Revenue
2009
Founded
The man who decided your password was everyone's problem - and built a $10 billion answer to it.
In 2009, Todd McKinnon had a six-month-old daughter, a type 1 diabetes diagnosis, and a spreadsheet named "Proposal to move to a new job starting a company (Why I'm Not Crazy)." The financial crisis had just gutted the economy. And yet, he showed the slide deck to his wife Roxanne and told her he wanted to quit one of the best engineering jobs in Silicon Valley.
She said yes - with one condition. He had to promise to come home for dinner every night. He has kept that promise for 15 years. He still leaves the office by 7pm.
That combination - the audacity to make a huge bet and the discipline to hold a line - explains most of what Todd McKinnon built afterward. Okta is now the world's leading independent identity platform. More than 18,000 organizations trust it to manage who gets access to what, from Fortune 500 boardrooms to government agencies. It is, without exaggeration, a foundational layer of the modern internet.
McKinnon didn't stumble into identity. At Salesforce, where he served as Senior Vice President of Engineering from 2003 to 2009, he watched the cloud transform everything about how software was built and distributed. He saw identity becoming the chokepoint before anyone named it as such. While pundits argued about whether SaaS would stick, McKinnon was quietly convinced that once everything moved to the cloud, the old model of network perimeters wouldn't survive. Identity would become the new border.
He was right, of course. But being right early is its own kind of suffering. For years, Okta's sales team heard the same response: "We have Microsoft." Or: "We have Active Directory." The validation that the category was real came in a form most founders dread - a major competitor entering the space. When Microsoft moved aggressively into identity, McKinnon didn't panic. He told his team: they're proving we were right about the market.
Most people leaving a company after six years take a modest exit. McKinnon left Salesforce at a time when it was one of the most celebrated tech companies in the world, while he was running its engineering operation. The job had made him. It had also - in his own words - stopped teaching him.
He was bored. Not in the way of someone who has stopped caring, but in the way of someone who already knows the next move and is tired of pretending otherwise. The cloud shift was happening. Identity was about to become critical infrastructure. And nobody was building the right thing.
The Slide Deck That Launched Okta. McKinnon didn't just tell his wife he wanted to start a company. He built a Google Slides presentation, titled "Proposal to move to a new job starting a company (Why I'm Not Crazy)." It laid out the case: the cloud shift, the identity gap, the market timing. Her one requirement in return: home for dinner, every night. He agreed. He still hasn't broken that promise.
Okta's early years were not triumphant. The company built a product in a category that didn't officially exist yet. Prospects said they didn't need identity management - they had Microsoft. Investors asked when the market would materialize. Enterprise sales cycles were measured in months, not weeks.
McKinnon's response to the doubt was systematic rather than charismatic. When morale hit a low, he didn't give a rousing speech. He gave his 30-person team a single, concrete objective: sign five paying customers. No worrying about pricing or funding or competition. Five customers. That specificity cut through the noise.
In January 2022, a ransomware group called Lapsus$ claimed to have breached Okta. The story broke publicly. For an identity company - whose entire proposition is that it keeps unauthorized people out - this was a catastrophic irony.
McKinnon responded publicly within hours. He didn't minimize it, didn't delay, didn't lawyer up and say nothing. He acknowledged what happened, explained what Okta was doing about it, and kept talking as the investigation continued. The transparency was jarring in a sector that usually goes silent during security incidents.
Okta lost some customers. It also gained something rarer: a reputation for honesty under pressure. The company's security posture was rebuilt from the ground up. McKinnon later described it as one of the most painful and instructive experiences of his leadership career.
In 2025, McKinnon started talking about AI agents not as a threat to Okta but as its largest opportunity. Every AI agent operating in an enterprise environment - every automated workflow, every LLM with access to internal systems - is an identity that needs to be managed, authenticated, and authorized.
He told investors that AI agent identity could exceed Okta's entire current addressable market over the next five years. Coming from someone who built the identity category the first time, that is not an idle claim.
The Office He Never Had. Since Okta's founding day in 2009, Todd McKinnon has never had a personal office. Not when the company had 10 people. Not after the IPO. Not after the Auth0 acquisition. He sits in the open plan like everyone else. He says it keeps him connected. Everyone who has worked for him seems to believe it.
McKinnon built Okta on a single insight: when the infrastructure shifts, identity becomes the most important thing to get right. He made that call in 2009 about the cloud. He's making the same call now about AI.
Every AI agent that operates inside an enterprise - every automated workflow, every LLM with file access, every autonomous process that talks to your CRM - is an identity. It needs to be authenticated. It needs permissions. It needs to be audited. And the number of those agents is about to multiply by orders of magnitude.
"AI agent identity could exceed our entire current total addressable market over the next five years."
In 2025, Okta acquired Axiom Security, a company building software for AI-powered access management. McKinnon's bet is that Okta becomes the identity layer for machines the same way it became the identity layer for people - by moving early, building the infrastructure, and waiting for the rest of the market to catch up.
He's done it before. The playbook is familiar. The only question is scale.