Businesses @ Work

Looking at the most popular apps by number of customers, developer tools are making the biggest waves. This year, we see the Atlassian Product Suite jump into fifth place. This suite includes Confluence, Jira, and Bitbucket, frequently accessed together via a subscription to Atlassian Access. (Last year Jira held the eighth spot as a stand-alone product.) GitHub, acquired by Microsoft in late 2018, joins the ranks at #13. And flowchart design tool Lucidchart earns a spot on the list for the first time.

How does this look different than our first report, six years ago? Social media apps LinkedIn and Twitter have logged off. GoDaddy and GoToMeeting got up and went. And collaboration tools Slack and Zoom, absent six years ago, have quickly become the talk of the town.

Over the years, it’s been nearly impossible to dislodge the top-ranking apps. When looking at app popularity by number of customers, Microsoft Office 365 and Salesforce have held spots #1 and #2 respectively for six years in a row. For the past three reports, Amazon Web Services and G Suite have held tight in spots #3 and #4.

Popularity by active unique users looks at which apps are being adopted by the most users across organizations. For the first time, G Suite pushes ahead of Salesforce to claim the fourth spot. Zoom is brand new here. We also welcome UltiPro, joining the ranks of Workday and SAP SuccessFactors as human capital management apps that individual users interact with regularly. We’ve seen Microsoft Office 365, Workday, and ServiceNow holding the top spots for the past three years.

With Office 365 taking the lead and G Suite now ranking fourth whether looking at popularity by number of customers or users, we looked deeper into how their numbers compare. Office 365 still has nearly twice the number of customers as G Suite. But, G Suite shows slightly faster year-over-year growth, increasing its number of customers by 37%, versus Office 365’s increase of 36%. Looking at active unique users, G Suite’s year-over-year growth stands out at 50%. Office 365 has seen 38% growth. We dig in further to the perennial Office 365 vs. G Suite rivalry in the section of our report focused on app usage.

App FOMO: the need for best-of-breed

While companies’ finance teams might be tempted to go all in on software suites, the reality is that their stakeholders aren’t willing to sacrifice the functionality provided by the top-ranked apps. We see customers increasingly “double dip” by purchasing best-of-breed apps in addition to bundles.

Popular office suite bundles generally include tools for personal productivity, communication, collaboration, and content management. We looked at whether companies that invest in the Office 365 suite — the most popular app in our network — find it meets all their needs. We looked at whether deploying Office 365 means they commit to an exclusively Microsoft environment. The answer is increasingly “no”: the overlap of companies that deploy Office 365 and also invest in best-of-breed apps continues to grow.

How did we determine which apps and integrations are best-of-breed? Salesforce, Amazon Web Services (AWS), Box, Slack, and Zoom each represent unique product categories in which Microsoft has a competitive offering. These apps dominate our rankings for the stand-alone functionality they provide, earning them our best-of-breed designation.

In general, the demand for best-of-breed apps is growing over time. Zoom and Slack adoption continues to grow. Among Okta customers with Office 365, 32% also deploy Zoom and 31% also deploy Slack. (Zoom’s gain of 24% in four years is especially noteworthy.) 44% of Okta’s Office 365 customers are choosing to deploy Salesforce, and 38% deploy AWS.

It might make sense to commit to one office suite bundle and add a few other best-of-breed apps à la carte as needed, but what about committing to redundant bundles? Looking at head-to-head competition, over 30% of Okta’s Office 365 customers now have G Suite as well.

Gartner recognizes the fragmentation in the social software and workplace collaboration market. “The market is not yet a winner-take-all space, creating opportunities for innovation that will expand the size of each submarket,” said Craig Roth, research vice president at Gartner. Overall, the company estimates that the worldwide market for social software and collaboration in the workplace will grow from an estimated $2.7 billion in 2018 to $4.8 billion by 2023, nearly doubling in size.²

^{2. Gartner Press Release, “Gartner Says Worldwide Social Software and Collaboration Revenue to Nearly Double by 2023,” September 24, 2019.}

This year, nearly 78% of Okta’s Office 365 customers have adopted one or more of these best-of-breed apps, an increase from 76% last year. We see that 3.2% of Okta’s Office 365 customers are using all six best-of-breed apps, compared to only 2.4% last year. It’s clear our customers are prioritizing functionality and employee needs over bundling.

The most popular apps by category

Each year, we dig into our data to look at app popularity by category. This year, we look at developer tools, HR tools, and video conferencing apps to see what companies select for their workforces. For these categories we only look at apps that have been deployed to the company by their IT team.

We also like to see what tools users choose to integrate into their daily lives, whether they are paying bills, planning trips, taking online classes, or donating to charitable causes. For this, we expand our scope to include apps that employees adopt as personal apps through Okta, in addition to those assigned by IT.*

^{*Consistent with the rest of our Businesses @ Work report, all data is anonymized.}

Configure

It’s just business: apps deployed by organizations

Developers are showing serious buying power. When we look across our network at overall popularity and speed of growth, we see the rise of tools that developers use to do their jobs and manage their stacks. GitHub has become one of our most popular apps by number of customers. Atlassian’s Opsgenie, which provides app security for development teams, ranks as the second fastest growing app year over year. The Atlassian Product Suite (Confluence, Jira, and Bitbucket) appears in the top 15 when measured both by number of customers and by active unique users. So it isn’t a surprise to discover the Atlassian Product Suite and GitHub rank as our top two developer tools.

The rising tide may lift all boats, but we’re noticing some category disruption as the waves swell. New Relic, a performance monitoring company with a go-to-market strategy focused on IT, is feeling the impact of Datadog, which sells to developers.

Workday continues to hold a solid lead in HR. This year we saw BambooHR pull ahead of UltiPro by number of customers. But UltiPro had its own triumph, joining the ranks of the most popular apps by number of active unique users. These two apps have consistently shown impressive rates of growth: BambooHR has experienced a 286% increase in number of customers over the past three years, and UltiPro grew 226% during the same time period.

Zoom was the #1 fastest growing video conferencing app in 2016, and it hasn’t slowed down since. Over the past three years, Zoom has enjoyed an astounding 876% growth in number of customers in our network. For comparison, second-place Cisco Webex grew 91% over that same period. RingCentral, which recently announced a partnership with Avaya,​ surpassed GoToMeeting this year and is coming up fast on Webex.

The video conferencing segment has room to grow before reaching maturity. IDC forecasts a 7.1% compound annual growth rate for global unified communications and collaboration solutions between 2019-2023,^​3​ increasing the market size to $48.3 billion by 2023.^​4​ Of course, network effects have a powerful impact on the adoption of video conferencing apps, so it will truly be an uphill battle to dislodge Zoom from its perch.

<sup>3. IDC, Worldwide Unified Communications and Collaboration Forecast, 2019–2023, Doc #US45097919, May 2019. 
4. IDC, IDC MarketScape: Worldwide Unified Communications and Collaboration 2019 Vendor Assessment, Doc #US45331319e, July 2019.</sup> 

Mixing business with pleasure: corporate + personal app adoption

The online learning space has grown substantially since we last studied it in our 2018 report. The appeal of “micro-learning” — small learning units or short-term learning activities — combined with the lower cost and flexibility of online courses makes it convenient for everyone to fit some personal growth into their busy schedules.

Lynda.com content moved to LinkedIn Learning in early 2019, promoting LinkedIn Learning to a strong first place. Its skills-based classes range from software development to business to creative design skills. Enterprise-focused Pluralsight, ranked #3, caters to developers and IT professionals, allowing customers to bolster the technical abilities of teams.

Grammarly, which didn’t appear on our radar two years ago, has enjoyed 353% growth over the past two years and now sits at #2. Its success earned the company a $90 million round of funding this fall, putting its valuation over $1 billion.​ On the other hand, former second place Coursera, which secured a $103 million Series E round in April 2019,​ has shown some of the slowest growth in the category.

It’s a pain to switch banks. There’s the paperwork, and the hassle of reconfiguring direct deposits and automatic payments. The friction in changing financial institutions gives established banks an edge for retaining customers. So it’s no surprise that banking and finance apps continue to grow along steady trajectories. We were impressed to see that PayPal’s growth remained parallel with major banking institutions, keeping the lead for over three years. And while the growing flock of disruptive financial technology (“fintech”) companies beyond PayPal have shown growth in our network, we don’t yet see them on our top banking and finance apps. Venmo currently is growing at 93% year over year (when including personal adoption in addition to corporate), so we will look for them next year.

It’s no secret that Airbnb has seriously disrupted the business of booking accommodations: this summer, Airbnb recorded $9.4 billion in total booking value in the first quarter (up 31% from the same quarter the year prior), booking nearly 91 million nights during the quarter. Other businesses in the hospitality space have been forced to find innovative ways to keep up. Marriott consolidated Marriott Rewards, Ritz-Carlton Rewards, and Starwood Preferred Guest programs into the new Marriott Bonvoy brand, enabling them to reclaim the penthouse suite at the top of the category. But don’t unpack your bags yet, Marriott — Airbnb seems intent on snagging your reservation.

Everyone likes a redemption story, and that’s exactly what we’re seeing for American Airlines. It’s emerged from the pack to become the leading airline app, overtaking incumbent Southwest by a few thousand feet. Southwest has traditionally been a top choice for our business fliers, with cheaper flights and a more forgiving policy for last minute cancellations.

Uber still sets the pace for ground transportation. Uber for Business is proving to be one of the company’s most successful products, allowing companies to cover the cost of rides for employees, job candidates, and business associates by paying for the ride plus a service fee. Year over year, gross bookings grew 65%. Traditional car rental companies have held the remaining five of the top six spots.

Our business travelers are increasingly turning to one-stop trip planning apps. Over the last three years, TripIt and Expedia have steadily beat out competitors, with TripIt pulling sharply into the lead. Corporate travel management provider Egencia, part of the Expedia Group, is also showing steady growth that has elevated it to the #3 spot.

Companies are baking Apps for Good into their social impact strategies

When people support charitable causes, everyone wins. A recent study shows that 75% of people who volunteered in the past year reported that volunteering made them feel physically healthier. And, more companies are supporting employees’ volunteerism. According to a Deloitte study, 89% of working Americans believe that companies that sponsor volunteer activities offer a better overall working environment than those that do not. In fact, 70% of respondents say that volunteer activities are more likely to boost employee morale than company-sponsored happy hours.

Apps for Good is a new ecosystem in the Okta Integration Network designed to help companies harness and turbocharge employees’ charitable spirit. These integrations make it easier than ever for companies and employees to donate time, money, expertise, and more.

When looking at apps deployed for both corporate and personal use, CareerVillage is currently the most popular App for Good, followed by Kiva. Customers are also deploying Benevity, YourCause, BrightFunds, and VolunteerMatch.

Security teams are protecting the new perimeter: their people

The security landscape is changing rapidly. From an IT perspective, it’s a cloud and mobile world, and the traditional perimeter is gone: people are the new perimeter. The threat landscape is changing as well. Attackers are increasingly targeting users and their credentials to gain unauthorized access to accounts. Security teams are adjusting to these dynamics, increasing their investments in security tools and prioritizing the protection of their people first.

According to IDC, “worldwide spending on security-related hardware, software, and services is forecasted to reach $106.6 billion in 2019, an increase of 10.7% over 2018."⁵​ This pace of growth is expected to continue for the next several years as companies attempt to armor themselves against increasing — and increasingly costly — attacks. The 2019 report from the Ponemon Institute estimates the total cost to an attacked organization averages $13 million, up 72% over the past five years.

Our customers are at the front of the security parade. We see an increase in the deployment of security tools across the board, with the largest focus on tools that protect people.

^{5. IDC, Worldwide Semiannual Security Spending Guide, 2018-2022, October 2019.}

Configure

The four strategic layers of the modern security stack

Looking at our network, companies deploy over 150 security-focused tools. An analysis of our data over the past four years shows that there is a new “modern security stack.” We’ve broken that stack into four layers of security, protecting: 1) people, 2) devices, 3) network, and 4) infrastructure.

PEOPLE​: Tools that protect people focus predominantly on accounts and credentials, but physical security solutions are also widely adopted. The people layer includes email security and password management, ID proofing, privileged access management (PAM), identity governance and administration (IGA), cloud access security brokers (CASB), as well as on-site visitor management tools.

DEVICES​: In the devices layer, we include tools for security analytics, endpoint management and security, and certificate management.

NETWORK​: The network layer of the security stack includes secure web gateway tools, VPNs and firewalls, and proxies.

INFRASTRUCTURE​: In the infrastructure layer, we include content delivery network providers, server access, and infrastructure monitoring tools.

As a baseline, we investigated how many customers adopt tools from the security layers. We looked at customers that deploy at least one app through the Okta Integration Network and found that 67% are adopting at least one security tool, up from 48% three years prior.

Over 42% of companies deploy a tool in the people layer, an increase from only 24% three years ago. Approximately 33% of customers currently deploy a tool in the network and devices layers, and 22% in the infrastructure layer.

Where do customers start their security journey? When customers adopt their first security tool, more than one third start with a tool from the people layer. Approximately one quarter start with a tool from the network or devices layers.

It makes sense that companies are more likely to protect their people first: people are generally considered the weakest link in the security chain, and attackers know that. A 2019 Proofpoint threat report shares startling statistics about the increase in attacks on people. Email fraud attacks rose to an average of 36 per targeted organization, an 80% jump from the same quarter a year before. Email-based corporate credential phishing attacks quadrupled compared to the previous quarter. Attackers don’t always go after company execs — frequently, lower-level workers are at greater risk of becoming a very attacked person (VAP) than higher-level employees.

Therefore, a CISO’s top concern is often better-securing individual credentials, whether personal credentials (via a password manager) or privileged credentials (via a privileged access management tool). Our data confirms this. When we double-click into the people layer, the fastest growth is coming from password managers, at 84% year-over-year growth.

The infrastructure layer is seeing the fastest growth by number of customers, at 61% year over year. Customers that have already built a foundation with a tool from the people layer see that their next step is to beef up infrastructure security, closely followed by network security.

These security tools are so hot right now

After reading the stats above about credential-based attacks, it should be no surprise that our two most-adopted security tools — KnowBe4 and Mimecast — focus on securing email against phishing attacks. KnowBe4, Jamf Pro, and Envoy are also among our ​fastest growing apps​ this year based on year-over-year adoption.

What are the top security tools across the board? If you were to build a modern security stack based on the most popular tool in each security layer, this is what it would look like:

• People:​ KnowBe4
• Devices:​ Jamf Pro
• Network:​ Palo Alto Networks Prisma Access (formerly GlobalProtect)
• Infrastructure:​ New Relic

Digging in to the device layer a bit more, we investigated usage data and saw some different patterns. With Okta Device Trust, our partner platforms have deep insight and visibility into the type and state of device from which a user is accessing applications. We’ve built integrations to and with leading unified endpoint management platforms to help unify these device signals into authentication requests. VMware’s Workspace ONE platform leads these integrations, representing more than 50% of connections to the Okta platform. Customers have more options than ever before to secure their user and device population, and the breadth of implementations in this section shows that a unifying platform helps that journey.

Apps and tools from all four security layers show substantial increases in adoption. The top apps are coming within striking distance of our most popular apps by number of customers. We look forward to seeing what develops next year.

Finally, we were curious: how large does a company generally get before it begins to take security concerns seriously? When looking at company size determined by the number of users assigned to apps in the Okta Integration Network, we found a clear delineation: customers tend to change their behavior when they have 150 users assigned to apps. Companies with 150 or more users are two times as likely to have a tool from the people layer or the device layer, and 2.4 times as likely to have a tool from the network layer, than those companies with less than 150 app users.

Most popular factors

People joke about passwords like “password,” but according to the UK’s National Cyber Security Centre, the most commonly hacked password — the password with 23 million victim accounts hacked worldwide — was (wait for it)... “123456.” (Don’t go patting yourself on the back for using “qwerty,” either: that’s number two). And in a recent survey by the Ponemon Institute, 69% of respondents admit to sharing passwords with their colleagues in the workplace to access accounts, and 55% do not use any form of two-factor authentication at work.

What’s at stake? An awful lot. The latest statistics put the average total cost of a data breach at $3.9 million, up slightly from last year. In 2019, on average, 25,575 records were compromised, and it took 279 days to identify and contain the breach.

In light of these statistics, we’re pleased that Okta customers are deploying multiple factors in addition to, or instead of, passwords. And new customers are choosing their factors carefully, opting for fewer but stronger factors.

When we look at customers that are authenticating to Okta with a factor in addition to or instead of a password, we see that use of Okta Verify (including Okta Verify with Push notifications) is on the rise, from 70% two years ago to 78% today. SMS and security questions are on the decline. SMS as a factor has dropped from 56% two years ago to 51% today. Security questions have dropped from 22% two years ago to 17% today.

Less is more: number of factors per customer decreasing

For the first time since we’ve tracked factor deployment, we see a downward shift in the distribution of the number of factors deployed. More than ever, customers now deploy just one factor on top of a password.

This year we noticed that, of Okta customers deploying a factor, nearly 26% deploy only one factor. One year ago, that number was 17%. Last year, the bulk of customers (54%) used two or three factors.

Companies could be responding to “factor sprawl” — having too many factors for IT to efficiently manage. Companies that use Multi-Factor Authentication (MFA) want to provide as many options as possible, but they need to ensure that MFA is user-friendly or it won’t work as intended. When companies allow for too many factors, employees may feel overwhelmed and might attempt to ignore requirements.

To understand the reduction in factor distribution, we wondered, do newer customers behave differently than older customers? We found that yes, in fact, they do.

New dogs learn one secure trick

We discovered that the migration toward fewer factors is being significantly driven by newer customers. We define newer customers as those who have been with Okta for less than one year. Of these newer customers, 39% deploy only one factor. In comparison, 17% of older customers — Okta customers for more than one year — have only one factor.

Across our network we see customers shifting toward more secure factors (app-generated codes, push authentication, and physical keys) and away from lower assurance factors like SMS and security questions. Newer customers are driving this trend. Among newer customers with one factor, 71% are deploying Okta Verify (including Okta Verify with Push). In contrast, 37% of older customers are deploying Okta Verify for two step verification.

The deployment of security questions has dropped by half. Our newer customers are truly deploying a simpler, stronger factor experience. This enables them to deploy better security without compromising the user experience, solving the dilemma of usability versus security.

In addition to identity solutions for the workforce, we also offer customer identity solutions to help organizations build and scale seamless digital experiences for their customers. When looking across our customer base at organizations building these experiences, we see C# and Java rank as the most popular tools. C# is a language built on top of the .NET framework. The largest organizations in the world use .NET, indicating that these types of companies are leading the charge in buying a customer identity solution vs. building a homegrown solution. In a recent poll of over 100 of our customers, 89% reported they are currently building custom apps, and 81% report they have an internal team that works on application development. Newer SDKs like Go are also quickly being adopted, signaling newer, modern organizations are also buying customer identity solutions to keep their developers laser-focused on the core business and accelerating time to market of new apps.

The script is changing. Data management tools are taking center stage. Developer tools are moving out from the wings and into the spotlight. Security tools are like bouncers popping up at every door and window. App adoption is growing across the board as customers become best-of-breed apps’ biggest fans. Behind the scenes, users are relying on corporate and personal apps to get their jobs done. It’s a crowded stage for apps and tools, and the show has a long run ahead of it. We hope this report gives you an unobstructed view of the changing landscape.

2020 Businesses @ Work

Download PDF Businesses @ Work Dashboard

Businesses @ Work (From Home)

We published a mid-year update that looks at trends as organizations adapt to COVID-19.

Read report