Businesses at Work

The platform effect

Apps secure a solid foothold at the top

Some of the apps Okta connects to serve as platforms in their own right: moving beyond specific functionality, companies can build on top of these platforms, integrating their functionality into other systems, and even baking the platform’s underlying technology into the company’s own app stack. These platforms become a core, integral part of the company’s operating technology and would be expensive and cumbersome to replace. They have long-term staying power because they are so intertwined with how business gets done.

How do platforms rank among our customers’ app usage? Since our first report in 2015, Microsoft 365, Salesforce, and Google Workspace have held three of our top four spots. They may have rebranded once or twice, but they are embedded in our desktops and our work lives. Since 2015, AWS has improved its global rank by number of customers from #6 to #2. And Atlassian, ranked #6 globally by number of customers, has built a pervasive platform for developers. Network effects amplify the staying power of these platforms, making it easier to adopt and integrate new pieces of technology to solve evolving problems.

This year has been an anomaly for so many reasons, and that’s reflected in the record-setting turnover in our fastest growing apps and integrations. For the first time, 90% of our fastest growing apps are brand new to the top 10. 

While we always expect frequent turnover — it’s tough to maintain explosive rates of growth over multiple years — we see a shift in the type of apps that customers are adopting. Last year we noted that collaboration apps were being replaced by data- or security-focused tools. This year companies needed to enable remote work, which meant supporting at-home workspaces and virtual collaboration, as well as helping employees thrive as they work apart from one another. 

While collaboration tools have rejoined the fastest growing ranks, companies continue to invest in security tools as well: for the first time, security tools claim four out of the top ten spots.

The average number of apps deployed per customer has risen steadily across all industries and company sizes, for a combined growth of 22% over the past four years. This year, the average number of apps per customer remains at 88.

We broke that out by customer size and found that our largest customers are adopting more apps than our smaller customers. Our larger customers, with 2,000 or more employees, deploy an average of 175 apps per customer, while our smaller customers, with 1,999 or fewer employees, deploy an average of 73 apps per customer.

New customers tend to initially deploy fewer apps through the OIN, then add more over time. Customers who have been with Okta for less than a year adopt an average of 23 apps. That number increases to 55 apps between one to two years, and 101 apps between two to four years. This year we see that customers who have been with Okta for four years or more deploy an average of 207 apps, an increase of 9% over the previous year. At the high end of the app deployment scale, 10% of our customers deploy 199 apps or more.

When we break out app deployment by industry, it makes sense to see technology companies at the high end of the spectrum. These organizations live, breathe, and even build the tools they are using. In the past three years, their average number of apps has increased 57% from 99 to 155, with 17% growth in the past year.

Other sectors have seen significant growth in app adoption as well. Over the past four years, the government sector has had the largest increase in average app deployment at 140%, which includes a 43% jump in the past year alone — the largest increase in any sector in the past year. Remote work has driven governments to deploy a wide range of apps and tools that were previously a much lower priority, if not completely unnecessary. The U.S. Bureau of Labor Statistics monthly Current Population Survey consistently found public-sector employees working remotely at a higher-than-average rate: 57% of government employees worked remotely in May, which dropped steadily to 34% in September, compared to the entire economy, where 35% worked remotely in May, dropping to 23% in September.

The education sector ranks high in app deployment, with more tempered growth. While their average app deployment trend line has increased over the past few years, they did see a dip down to an average of 119 apps per customer in 2019. However, in 2020 the education sector’s average number of apps rose 6% year over year, possibly as they ramped up to provide remote learning.

Some of the other industries seeing large increases in average app adoption this year include professional services (36% increase), healthcare and pharmaceuticals (19% increase), and finance and banking (18% increase). Retail average app deployment grew 7% in the past year, but 58% over the past four years.

Best of breed rules, incumbents drool

As employees settle into remote work, it’s critical they have the best tools to keep them connected and working productively. When it comes to interacting with co-workers, customers, partners, vendors, and others on a common platform, we see that for many companies, a “good enough” solution isn’t actually good enough. We’re seeing that “one size fits all” is not fitting, at all.

Over the past few years, we have looked at whether companies that invest in the Microsoft 365 suite — the most popular app in our network — are finding it meets all their needs. We also wonder if deploying Microsoft 365 means customers commit to an exclusively Microsoft environment. The answer to both questions is decisively “no.” While the Microsoft 365 suite offers basic personal productivity, communication, collaboration, and content management tools, Okta’s Microsoft 365 customers continue to invest in many other best-of-breed apps. And when they need CRM software, project management tools, data visualization software, or cloud platforms, they look for bestof- breed options as well. Over the past five years, the number of Okta’s Microsoft 365 customers deploying at least one bestof- breed app has increased by seven percentage points.

Like the strictly-controlled French designations of “champagne” or “cognac,” “best of breed” is a distinction we don’t take lightly. Best-of-breed apps dominate their category for the standalone functionality they provide. This year, best-of-breed tools Salesforce, AWS, Box, Slack, and Zoom are joined by project management tool Smartsheet and data visualization tool Tableau, which compete against Microsoft Project and Power BI, respectively.

Microsoft Teams comes standard with the Microsoft 365 Business Basic subscription, but during a global shift to video meetings, video classes, and video cocktail hours, companies increasingly dialed in to Zoom. Over 42% of Okta’s Microsoft 365 customers now also deploy Zoom, a jump of more than 10 percentage points over the previous year. (This number has increased nearly 35 percentage points in the past four years.) And when it comes to chatting, Slack is also part of the conversation. The rate of increase has slowed, but this year nearly 32% of Okta’s Microsoft 365 customers also deploy Slack. And, while they most certainly have access to OneDrive, a standard feature in even the most basic Microsoft 365 bundle, 26% also deploy Box.

In April, Goldman Sachs predicted that companies would slash spending by 33% in 2020. By fall, JP Morgan found that global corporate profits had “tanked” by 33%. While companies may splurge on a few best-of-breed apps, we might expect they would tighten their belts where they see clear redundancy.

However, 36% of Okta’s Microsoft 365 customers now also deploy Google Workspace, the largest jump in the past three years. Top collaboration tools have never been more important for productivity.

The concept of a company choosing to lock in as a “Microsoft shop” continues to fall out of favor, too. 44% of Okta’s Microsoft 365 customers deploy Salesforce, 41% deploy AWS, 15% deploy Smartsheet, and 14% deploy Tableau.

This year, with eight apps featured, we see that 81% of organizations are supplementing their Microsoft 365 suite with one or more best-of-breed tools. Nearly 10% of customers are deploying six or more. These numbers have grown steadily year over year. Even in a difficult year — or perhaps specifically because of it — customers are prioritizing functionality over established software suites.

With security attacks on the rise, CIAM customers turn to easily deployable factors

Forrester reports that after software vulnerabilities and web applications, the use of stolen logins and encryption keys known as credential stuffing is the top attack vector for applications in 2020, accounting for 27% of external attacks.⁴ Many of our CIAM customers add additional security protections for their end users via Multi-Factor Authentication (MFA).

Okta’s CIAM customers have different use cases, which affect their choice in factors. For B2C relationships, companies typically choose more familiar factors, such as email and SMS, which are inherently weaker factors. On the other hand, B2B relationships warrant a higher level of security.

We see that SMS continues to be the most popular choice because it is one of the easiest and most familiar factors to deploy for B2C end users. Across CIAM customers, use of SMS has grown nine percentage points in the past two years. Looking at the total volume of MFA authentications, SMS is by far the most popular choice, with eight times more authentications than second-place Okta Verify. We see a 226% increase in the use of SMS year over year.

The second most popular factor for our CIAM customers is Okta Verify (including Okta Verify with Push Notifications), whose usage has increased by 15 percentage points over the past two years. The total volume of MFA authentications with Okta Verify (including Okta Verify with Push notifications) has grown by 266% year over year. This stronger factor is more popular with B2B customers.

_{[4] Forrester, “The State of Application Security, 2020,” May 4, 2020.}

While this year gave remote work a dramatic boost, we think the future of work is dynamic. This translates to a global workforce, in widely distributed locations, working wherever, whenever, and however they want. Gartner predicts "48% of employees at large enterprises will work remotely at least some of the time after the pandemic, a significant increase over the 30% of employees who worked remotely at least some of the time prior to the pandemic.”⁵ Now more than ever, HR departments need a robust set of tools to keep managers and teams connected, support distributed workers, and ensure every employee feels valued.

While HR tools have grown again across the board, employee engagement tools have made especially large gains. With 75% growth in the past year, Culture Amp jumped two spots to pass SAP SuccessFactors and claim fourth place. Lattice, our sixth fastest growing app overall with 109% year-over-year growth, joined the top HR tools for the first time and rose quickly to seventh place.

Large, end-to-end human resources tools continue to attract new customers. Reigning top app Workday has held a solid lead among HR tools with 23% year-over-year growth. Second-place BambooHR has seen more substantial growth, at 38%.

_{[5] Gartner, “9 Predictions for the Post-COVID Future of Work,” May 14, 2020.}

There's been a rapid rise in the need to accommodate a distributed workforce, and we're seeing businesses tackle it in a few ways — secure remote access solutions, like Palo Alto Networks GlobalProtect, VPNs like the many listed here, as well as standalone zero trust network access (ZTNA) solutions like Zscaler. As organizations move past the initial “firefighting” and get into long-term strategy, we’ll be watching to see which wins out next year.

Palo Alto Networks GlobalProtect provides enterprise security protection to mobile users. It has seen consistently strong adoption, growing a remarkable 1983% over the past three years. Since the pandemic began and companies needed to support remote workforces, GlobalProtect, which provides encrypted tunnel access to Palo Alto Networks next-generation firewalls and Prisma Access products, has been one of our fastest growing secure remote access applications with 50% growth since the end of February.

Cisco AnyConnect, which provides secure endpoint access, has grown 1130% in the past three years, and 46% just since the end of February. Netskope, which provides contextual security and mitigates cloud-enabled threats as part of a modern secure access service edge (SASE) architecture, has grown 74% in the past year. AWS Client VPN, which allows companies to easily deploy a scalable client VPN solution, burst onto our radar in May and has quickly passed many tools to take seventh place. And open source option OpenVPN has seen 43% growth in the past year.

Some remote workforces are best served with virtual desktop infrastructure, known as VDI. Desktop environments are hosted on a central server and desktop images are delivered to end clients over a network. We also saw a noticeable jump in VDI tools as workers became remote.

Between February 29 and April 30, 2020, our most popular VDI provider, Citrix, saw 11% growth. Also during this time, Amazon WorkSpaces grew 33%, and VMware Horizon View grew 13%.

The balancing act of life and work: corporate + personal app adoption

By the end of 2020, we were marveling at the layer of dust on our passports and the length of time between our trips to the gas station. Our “big outings” had become dog walks in new parts of town. Most people weren’t getting on a plane unless they absolutely had to. It’s no surprise that the number of airline passengers tanked year over year. Compared to the same month the prior year, there was a -51% change in March, and a whopping -96% change in April, with only small upticks by summer. Our lives seemed frozen in place, and corporate and personal adoption of travel apps generally froze as well. In fact, the ranked order of our hotel and lodging apps stayed exactly the same as last year.

For most of our top hotel and lodging apps, growth was measured in the fractions of percentages, or negative numbers. Bonvoy (the combined rewards program which includes Marriott and Starwood hotels) measured -1% year over year, Hilton Hotels grew 3%, and Hyatt Hotels gained less than 1%.

There was one standout exception in this field. For travelers who ventured out, the option of a private living room won out over a chic hotel lobby, and a private kitchen was more appealing than the all-you-care-to-eat breakfast buffet. Use of popular travel alternative Airbnb saw nearly 11% growth year over year, including 3% growth since the end of February.

In a difficult year, companies embrace Apps for Good

According to Giving USA, Americans gave $450 billion in 2019, reflecting a 5% increase from 2018. But the pandemic and quarantine left tens of millions of people unemployed or underemployed, and sent communities reeling. The need is greater than ever.

Apps for Good helps Okta customers support their employees’ charitable spirits. These unique tools enable companies to simply and securely deploy world-class “giving apps” to their workforces, so employees can donate time, money, expertise, and more. With Apps for Good, companies can select the tools that fit their corporate giving culture and goals, deploy them directly to employees’ Okta dashboards, and start giving back immediately. It’s a nearly frictionless way to make a positive impact.

We’re proud to report that over 930,000 users have been assigned to Apps for Good. Which apps do they use most? More than 50% of Okta customers who have deployed an App for Good are deploying CareerVillage, which connects students with real-life professionals for free personalized career advice; the number of organizations adopting the app (for personal and non-personal use) has grown 91% year over year. The number of companies deploying Kiva, an app that allows people to lend money via the Internet to low-income entrepreneurs and students around the world, has grown 12% year over year. And Benevity, which provides companies a robust giving and volunteering management platform, grew 29% year over year.

Most popular factors

This past year, like never before, we have lived the concept of collective responsibility for our shared well-being. In our physical world, that has meant mask wearing, hand washing, and deciding whether or not we saw our family and friends over the holidays. In our work lives, as many people moved to remote work for the first time, that has meant adopting security measures to protect employees, and critical company data.

Proofpoint’s State of the Phish report, released in January 2020, makes it clear that IT managers had quite the job ahead of them as employees moved to remote work.While 95% of survey respondents said they use a smartphone, 10% had no lock on their device. 95% of global workers surveyed had home Wi-Fi networks, yet only 49% password-protect their network, and 11% said they find Wi-Fi security measures too time-consuming and/or inconvenient to implement.⁷ (IT managers, please take a moment to breathe…)

Of course, hackers never let a good crisis go to waste. F5’s 2020 Phishing and Fraud Report saw a 220% increase in phishing attacks during the pandemic compared to the yearly average, with large spikes in phishing activities that closely coincided with lockdown rules and used “covid” or “coronavirus” in their subject lines. And where are employees most vulnerable? F5 warns that the login page of our most popular app, Microsoft 365, is one of the most popular targets for generic phishing because “attackers know that stealing Office 365 credentials can grant them access not only to email but also corporate documents, finance, HR, and many other critical business functions.”⁸

Okta customers are stepping up to the challenge. They are deploying multiple factors in addition to, or instead of, passwords, and they are choosing stronger factors.

_{[7] Proofpoint, “2020 State of the Phish Report,” January 23, 2020.}

_{[8] F5, "2020 Phishing and Fraud Report,” November 11, 2020.}

Digging into MFA, we see that, compared to traditional brittle forms of authentication (i.e., simple two-factor methods), higher assurance factors are on the rise. Consumers and services are moving to adaptive forms of authentication, such as Okta Verify. Of customers authenticating to Okta with a factor in addition to, or instead of a password, we see that use of Okta Verify (including Okta Verify with Push notifications) is on the rise, from 78% last year to 82% today.

Once again we see weaker factors such as SMS and security questions on the decline. SMS as a factor has dropped from 53% two years ago to 49% today. Security questions have dropped from 18% two years ago to 15% today.

In March, 2019, W3C made a recommendation for Web Authentication (FIDO 2.0) as a simpler, stronger authentication. In October 2019, the new MacOS Catalina 10.15 included Safari 13 by default; it was the first version of Safari to support WebAuthentication (WebAuthn). From that point on, any new Mac sales or OS upgrades supported WebAuthn. WebAuthn has been maturing quickly as overall security awareness improves. Since the fall of 2019, we have seen a steady increase in WebAuthn, matched by a proportionate decrease in U2F (FIDO 1.0).

When Fortinet conducted a global survey of IT decision makers in June 2020 for their Remote Workforce Cybersecurity Report, they asked respondents where they were planning to make new investments. The largest group (30%) chose MFA.⁹ Companies have their sights set on protecting their workforces.

_{[9] Fortinet, “2020 Remote Workforce Cybersecurity Report: Enterprises Must Adapt to Address Telework Security Challenges,” August 19, 2020.}

With identity-related attacks increasing, organizations are continuously evaluating how to optimize the security policies in their environment. In late 2019, Okta ThreatInsight — a baseline security feature which helps organizations secure themselves against large scale identity attacks, especially attacks which target passwords — became generally available. ThreatInsight is a component of Okta’s risk engine and security intelligence, in which login patterns are analyzed to enable secure access decisions. When Okta identifies password spray and brute force across all customers, those IPs are added to the ThreatInsight database. Organizations can then choose to block access from those IP addresses. ThreatInsight allows organizations to secure their business before becoming the victim of an identity attack.

Not every organization experiences a large volume of attacks. ThreatInsight protection is like insurance. With the average cost of a data breach now estimated at $3.86 million in IBM’s 2020 Cost of a Data Breach Report, this is an insurance policy well worth enabling.¹⁰

Detected threats include password spray and login failures. Password spraying is a variant of a brute force attack, where an attacker gets past the usual security measures by “spraying” the same password across many accounts before trying another one. Login failures are flagged when too many failures happen within a short period of time. When we see password spray or numerous login failures coming from an IP address, we flag that IP address as suspicious.

The number of authentications has risen steadily over the past six months; meanwhile the overall growth of detected threats have been less consistent, but the trend line shows a significant increase in the late summer and fall.

_{[10] IBM, “2020 Cost of a Data Breach Report,” July 2020.}