Businesses at Work

The platform effect

Apps secure a solid foothold at the top

Some of the apps Okta connects to serve as platforms in their own right: moving beyond specific functionality, companies can build on top of these platforms, integrating their functionality into other systems, and even baking the platform’s underlying technology into the company’s own app stack. These platforms become a core, integral part of the company’s operating technology and would be expensive and cumbersome to replace. They have long-term staying power because they are so intertwined with how business gets done.

How do platforms rank among our customers’ app usage? Since our first report in 2015, Microsoft 365, Salesforce, and Google Workspace have held three of our top four spots. They may have rebranded once or twice, but they are embedded in our desktops and our work lives. Since 2015, AWS has improved its global rank by number of customers from #6 to #2. And Atlassian, ranked #6 globally by number of customers, has built a pervasive platform for developers. Network effects amplify the staying power of these platforms, making it easier to adopt and integrate new pieces of technology to solve evolving problems.

The average number of apps deployed per customer has risen steadily across all industries and company sizes, for a combined growth of 22% over the past four years. This year, the average number of apps per customer remains at 88.

We broke that out by customer size and found that our largest customers are adopting more apps than our smaller customers. Our larger customers, with 2,000 or more employees, deploy an average of 175 apps per customer, while our smaller customers, with 1,999 or fewer employees, deploy an average of 73 apps per customer.

New customers tend to initially deploy fewer apps through the OIN, then add more over time. Customers who have been with Okta for less than a year adopt an average of 23 apps. That number increases to 55 apps between one to two years, and 101 apps between two to four years. This year we see that customers who have been with Okta for four years or more deploy an average of 207 apps, an increase of 9% over the previous year. At the high end of the app deployment scale, 10% of our customers deploy 199 apps or more.

When we break out app deployment by industry, it makes sense to see technology companies at the high end of the spectrum. These organisations live, breathe, and even build the tools they are using. In the past three years, their average number of apps has increased 57% from 99 to 155, with 17% growth in the past year.

In April, Goldman Sachs predicted that companies would slash spending by 33% in 2020. By fall, JP Morgan found that global corporate profits had “tanked” by 33%. While companies may splurge on a few best-of-breed apps, we might expect they would tighten their belts where they see clear redundancy.

However, 36% of Okta’s Microsoft 365 customers now also deploy Google Workspace, the largest jump in the past three years. Top collaboration tools have never been more important for productivity.

The concept of a company choosing to lock in as a “Microsoft shop” continues to fall out of favour, too. 44% of Okta’s Microsoft 365 customers deploy Salesforce, 41% deploy AWS, 15% deploy Smartsheet, and 14% deploy Tableau.

This year, with eight apps featured, we see that 81% of organisations are supplementing their Microsoft 365 suite with one or more best-of-breed tools. Nearly 10% of customers are deploying six or more. These numbers have grown steadily year over year. Even in a difficult year — or perhaps specifically because of it — customers are prioritising functionality over established software suites.

Developers expand their toolboxes to build the best user experiences

Developers are expected to move quickly, and efficiently. And they need a deep toolbox to build the hottest apps.

This year we welcome two new developer tools, Sentry and Atlassian Opsgenie, to our top-ranking developer tools. If you’ve been paying attention, it should be no surprise that they joined us here: Sentry is our ninth fastest growing app for 2020, with 86% year-over-year growth, and in 2019 Opsgenie was our second fastest growing app, with 194% year-over-year growth.

Our top three developer tools have held their previous spots. The Atlassian Product Suite, whose rank as a developer tool includes customer deployments of Jira, Bitbucket, and Fisheye, continues to stand firmly in first place. Deployment of these tools in the Atlassian Product Suite has grown over 283% over the past four years. GitHub and PagerDuty have held tight in second and third place, respectively.

However, there is significant movement below the top three. Upstart Datadog, a monitoring, security and analytics platform, pulled sharply ahead of Application Performance Monitoring (APM) tool New Relic this year to claim fourth place. We also see APM tool Splunk — last year’s fourth fastest growing app, with 102% year-over-year growth — pull ahead of Atlassian’s incident communication tool Statuspage to take sixth place. And deployment of the open source automation server Jenkins has grown 51% over the past year.

Turning to Segment’s data, we see that company size affects the number of apps receiving customer data across the organisation. While the rise in data destinations can be seen across customers large and small, the average number of destinations used by larger customers stands at 14, while SMBs use a more modest nine. Given tech stack growth and adoptions of large companies versus small ones, this is a trend that appears to be growing year over year.

Overall, Segment sees that the average number of apps businesses are connecting to their CDP has risen to 11, up from eight last year. As businesses further embrace digital operations on the back of COVID-19, their tech stacks are becoming populated with more and more software.

Diving deeper into the types of apps being adopted on Segment’s customer data platform, we can get an in-depth view of how the SaaS market is evolving.

Analytics apps remain the #1 category on the Segment platform. As 2020 drives more customers into digital experiences, it’s having a second order effect on marketing technology adoption, driving more and more businesses into analytics apps.

Meanwhile, digital advertising tools rose to #2 this year, up from #3 in the same period last year, reinforcing the hypothesis reported in Segment’s COVID Tech Stacks Report — businesses are going all in on advertising tools to match consumer behaviour.³

Finally, there is growing adoption of what can be broadly categorised as customer engagement tools. Based on Segment’s data, customer success, email marketing, and heatmaps/ recording tools all saw increased adoption in the region of 18- 25%, indicating that many companies are continuing to lean in to digital engagement and transformation efforts, despite the uncertain economic circumstances.

_{Note: Data from November 1, 2019 to October 31, 2020.}

_{[3] Segment, “How COVID-19 is Impacting Tech Stacks [According to Our Data],” June 10, 2020.}

With security attacks on the rise, CIAM customers turn to easily deployable factors

Forrester reports that after software vulnerabilities and web applications, the use of stolen logins and encryption keys known as credential stuffing is the top attack vector for applications in 2020, accounting for 27% of external attacks.⁴ Many of our CIAM customers add additional security protections for their end users via Multi-Factor Authentication (MFA).

Okta’s CIAM customers have different use cases, which affect their choice in factors. For B2C relationships, companies typically choose more familiar factors, such as email and SMS, which are inherently weaker factors. On the other hand, B2B relationships warrant a higher level of security.

We see that SMS continues to be the most popular choice because it is one of the easiest and most familiar factors to deploy for B2C end users. Across CIAM customers, use of SMS has grown nine percentage points in the past two years. Looking at the total volume of MFA authentications, SMS is by far the most popular choice, with eight times more authentications than second-place Okta Verify. We see a 226% increase in the use of SMS year over year.

The second most popular factor for our CIAM customers is Okta Verify (including Okta Verify with Push Notifications), whose usage has increased by 15 percentage points over the past two years. The total volume of MFA authentications with Okta Verify (including Okta Verify with Push notifications) has grown by 266% year over year. This stronger factor is more popular with B2B customers.

_{[4] Forrester, “The State of Application Security, 2020,” May 4, 2020.}

People are notoriously the weakest link in the security chain, and hackers are well aware of the fact. Verizon’s 2020 Data Breach Investigations Report finds that “attackers have become increasingly efficient and lean more toward attacks such as phishing and credential theft,” while there has been a corresponding decrease in attacks using Trojan and RAMscraper malware.⁶

Our customers invest in a wide range of people-centric security tools. This category includes security training, email security and password management, ID proofing, privileged access management (PAM), identity governance and administration (IGA), as well as on-site visitor management tools.

While most tools have seen significant growth in the past few years, our top-ranking tools generally focus on security training, email security, and password management. Security awareness training tool KnowBe4 has grown 46% since the start of 2020, and 194% in the past two years. Our tenth fastest growing app this year, 1Password, has had a major growth spurt of 582% in the past two years. Visitor management tool Envoy is an interesting case: with sharp drops in workers’ physical presence in offices, but growing concerns about managing the number of workers in a space at one time, Envoy — our eighth fastest growing app last year — grew 32% in the past year.

_{[6] Verizon, “2020 Data Breach Investigations Report,” May 19, 2020.}

The balancing act of life and work: corporate + personal app adoption

By the end of 2020, we were marveling at the layer of dust on our passports and the length of time between our trips to the gas station. Our “big outings” had become dog walks in new parts of town. Most people weren’t getting on a plane unless they absolutely had to. It’s no surprise that the number of airline passengers tanked year over year. Compared to the same month the prior year, there was a -51% change in March, and a whopping -96% change in April, with only small upticks by summer. Our lives seemed frozen in place, and corporate and personal adoption of travel apps generally froze as well. In fact, the ranked order of our hotel and lodging apps stayed exactly the same as last year.

For most of our top hotel and lodging apps, growth was measured in the fractions of percentages, or negative numbers. Bonvoy (the combined rewards program which includes Marriott and Starwood hotels) measured -1% year over year, Hilton Hotels grew 3%, and Hyatt Hotels gained less than 1%.

There was one standout exception in this field. For travelers who ventured out, the option of a private living room won out over a chic hotel lobby, and a private kitchen was more appealing than the all-you-care-to-eat breakfast buffet. Use of popular travel alternative Airbnb saw nearly 11% growth year over year, including 3% growth since the end of February.

Health and wellness meant one thing to us in January when we made our New Year’s resolutions and looked forward to the new decade with eager anticipation. By the end of March the year wasn’t turning out the way we had expected, and health and wellness took on a whole new meaning altogether. Around the world, many workers who were fortunate enough to still have jobs were trying to figure out how to work from home, while some became impromptu school teachers for their children. During this incredibly stressful time, a dedicated few were inspired to turn to exercise to improve their overall well-being, or just to get outside.

Which were more powerful drivers for personal health and wellness: New Year’s resolutions, or pandemic resolutions? It seems we were more collectively focused on January 1. Our gold medal health and wellness app, Fitbit, saw nearly 5% growth in January 2020, compared to 3% growth in April. (Overall, the app saw over 21% growth in 2020.) Growth of silver medal MyFitnessPal was 3% in January, but nearly flat in April. Bronze medal app Strava grew nearly 4% in January, and another 3% in April.

Remember how many of us showed off our homemade sourdough successes (and fails) last spring on Instagram? Well, after more than two months of shelter in place, our kitchen ambitions caught up with us. The surge in WW (formerly Weightwatchers) tipped the scales at over 7% growth over the months of June and July, a bit shy of their 11% growth in January.

In a difficult year, companies embrace Apps for Good

According to Giving USA, Americans gave $450 billion in 2019, reflecting a 5% increase from 2018. But the pandemic and quarantine left tens of millions of people unemployed or underemployed, and sent communities reeling. The need is greater than ever.

Apps for Good helps Okta customers support their employees’ charitable spirits. These unique tools enable companies to simply and securely deploy world-class “giving apps” to their workforces, so employees can donate time, money, expertise, and more. With Apps for Good, companies can select the tools that fit their corporate giving culture and goals, deploy them directly to employees’ Okta dashboards, and start giving back immediately. It’s a nearly frictionless way to make a positive impact.

We’re proud to report that over 930,000 users have been assigned to Apps for Good. Which apps do they use most? More than 50% of Okta customers who have deployed an App for Good are deploying CareerVillage, which connects students with real-life professionals for free personalised career advice; the number of organisations adopting the app (for personal and non-personal use) has grown 91% year over year. The number of companies deploying Kiva, an app that allows people to lend money via the Internet to low-income entrepreneurs and students around the world, has grown 12% year over year. And Benevity, which provides companies a robust giving and volunteering management platform, grew 29% year over year.

Most popular factors

This past year, like never before, we have lived the concept of collective responsibility for our shared well-being. In our physical world, that has meant mask wearing, hand washing, and deciding whether or not we saw our family and friends over the holidays. In our work lives, as many people moved to remote work for the first time, that has meant adopting security measures to protect employees, and critical company data.

Proofpoint’s State of the Phish report, released in January 2020, makes it clear that IT managers had quite the job ahead of them as employees moved to remote work.While 95% of survey respondents said they use a smartphone, 10% had no lock on their device. 95% of global workers surveyed had home Wi-Fi networks, yet only 49% password-protect their network, and 11% said they find Wi-Fi security measures too time-consuming and/or inconvenient to implement.⁷ (IT managers, please take a moment to breathe…)

Of course, hackers never let a good crisis go to waste. F5’s 2020 Phishing and Fraud Report saw a 220% increase in phishing attacks during the pandemic compared to the yearly average, with large spikes in phishing activities that closely coincided with lockdown rules and used “covid” or “coronavirus” in their subject lines. And where are employees most vulnerable? F5 warns that the login page of our most popular app, Microsoft 365, is one of the most popular targets for generic phishing because “attackers know that stealing Office 365 credentials can grant them access not only to email but also corporate documents, finance, HR, and many other critical business functions.”⁸

Okta customers are stepping up to the challenge. They are deploying multiple factors in addition to, or instead of, passwords, and they are choosing stronger factors.

_{[7] Proofpoint, “2020 State of the Phish Report,” January 23, 2020.}

_{[8] F5, "2020 Phishing and Fraud Report,” November 11, 2020.}

Digging into MFA, we see that, compared to traditional brittle forms of authentication (i.e., simple two-factor methods), higher assurance factors are on the rise. Consumers and services are moving to adaptive forms of authentication, such as Okta Verify. Of customers authenticating to Okta with a factor in addition to, or instead of a password, we see that use of Okta Verify (including Okta Verify with Push notifications) is on the rise, from 78% last year to 82% today.

Once again we see weaker factors such as SMS and security questions on the decline. SMS as a factor has dropped from 53% two years ago to 49% today. Security questions have dropped from 18% two years ago to 15% today.

In March, 2019, W3C made a recommendation for Web Authentication (FIDO 2.0) as a simpler, stronger authentication. In October 2019, the new MacOS Catalina 10.15 included Safari 13 by default; it was the first version of Safari to support WebAuthentication (WebAuthn). From that point on, any new Mac sales or OS upgrades supported WebAuthn. WebAuthn has been maturing quickly as overall security awareness improves. Since the fall of 2019, we have seen a steady increase in WebAuthn, matched by a proportionate decrease in U2F (FIDO 1.0).

When Fortinet conducted a global survey of IT decision makers in June 2020 for their Remote Workforce Cybersecurity Report, they asked respondents where they were planning to make new investments. The largest group (30%) chose MFA.⁹ Companies have their sights set on protecting their workforces.

_{[9] Fortinet, “2020 Remote Workforce Cybersecurity Report: Enterprises Must Adapt to Address Telework Security Challenges,” August 19, 2020.}

With identity-related attacks increasing, organisations are continuously evaluating how to optimise the security policies in their environment. In late 2019, Okta ThreatInsight — a baseline security feature which helps organisations secure themselves against large scale identity attacks, especially attacks which target passwords — became generally available. ThreatInsight is a component of Okta’s risk engine and security intelligence, in which login patterns are analysed to enable secure access decisions. When Okta identifies password spray and brute force across all customers, those IPs are added to the ThreatInsight database. Organisations can then choose to block access from those IP addresses. ThreatInsight allows organisations to secure their business before becoming the victim of an identity attack.

Not every organisation experiences a large volume of attacks. ThreatInsight protection is like insurance. With the average cost of a data breach now estimated at $3.86 million in IBM’s 2020 Cost of a Data Breach Report, this is an insurance policy well worth enabling.¹⁰

Detected threats include password spray and login failures. Password spraying is a variant of a brute force attack, where an attacker gets past the usual security measures by “spraying” the same password across many accounts before trying another one. Login failures are flagged when too many failures happen within a short period of time. When we see password spray or numerous login failures coming from an IP address, we flag that IP address as suspicious.

The number of authentications has risen steadily over the past six months; meanwhile the overall growth of detected threats have been less consistent, but the trend line shows a significant increase in the late summer and fall.

_{[10] IBM, “2020 Cost of a Data Breach Report,” July 2020.}