The Total Economic Impact™ Of Adopting An Identity Security Fabric With Okta

Reduced Likelihood Of An Identity-Related Breach

Evidence and data. Interviewees reported that before adopting an identity security fabric with Okta, their organizations relied on reactive, fragmented, application-by-application identity controls that left them exposed to credential-based attacks, phishing campaigns, misconfigured access policies, and authentication anomalies. Without unified visibility across their identity posture, security teams struggled to keep pace with modern identity threats, which made breach risk reduction a top security and business priority.

After adopting an identity security fabric with Okta, interviewees said their organizations achieved a meaningful reduction in breach likelihood through three complementary capabilities. ITP provided real-time detection and automated response to identity-based threats, including brute force attempts and suspicious session activity, reducing response times. ISPM delivered continuous visibility into misconfigurations, unused administrative permissions, exposed credentials, and policy gaps, which enabled proactive hardening and, in many cases, automatic remediation before adversaries could act. Phishing-resistant MFA within Okta Access Management eliminated credential phishing as a viable attack vector, which increased the share of workforce authentication protected by high-assurance factors.

Interviewees emphasized that these capabilities’ value was amplified by their integration within a single platform, which enabled consistent policy enforcement, richer contextual access decisions, and more coordinated threat response across the environment.

• The IAM staff engineer in fintech explained: “With ITP and Workflows, it’s much easier to deal with risk now. We get alerts about suspicious events, and we can terminate sessions even on mobile devices. For example, if a device is no longer up to date, [Okta] will terminate [instant messaging] sessions. Before, this was not possible, and sessions would remain active, which created additional security risk.”
  The staff engineer continued: “We’ve been targeted several times, and our Okta environment was one of the main targets. What we saw during those attacks was that even if a user password was leaked, attackers were unable to access the system. Since we are now passwordless and require devices to be registered and managed, we have been protected several times with Okta.”
  The interviewee described a specific phishing incident that Okta helped contain: “One time we were targeted very severely: Around 600 employees received a phishing email, and it was very sophisticated. About 50 people opened it, and around 10 entered their passwords. Even though we don’t rely on passwords anymore, attackers were able to find some old credentials. But because of the multiple security layers, we were notified immediately that there was phishing activity. If we didn’t have Okta in place, especially without those controls, attackers could have easily gotten access to SaaS tools.”

• The IT infrastructure manager in software explained: “Adaptive MFA through Okta has been huge. Right out of the gate, we block every sanctioned country, so that already lowers our exposure. We also have systems that detect things like proxy or VPN usage, because attackers will use any tool they can to make it look like they’re coming from a trusted location. … We’ve set things up so users can only log in from their country of origin based on their HR profile. If they’re traveling, they can request an exception. Being able to adjust on the fly really limits the exposure you have from accounts being compromised. It’s been powerful for us.”
  The manager continued: “Zero standing privileges is a big thing; people request access when they need it. We’ve also used Workflows so that if people stop using a system for a period of time, their access is removed. That’s not only a cost benefit, it’s a security benefit. If an account is compromised, that’s one less system an attacker can get ahold of.”

• The IT systems admin in software explained: “If there’s an incident, we can act immediately. We can lock someone out or apply a deny rule just by adding them to a group instead of going through a full deprovisioning process. For terminations, Okta Workflows are a big contributor to our security because we can trigger off something like updating a user’s status [in our HR system] and automatically remove access, clear sessions, transfer data, and delete accounts.”

• The VP of information security in insurance shared: “All access is configured within Okta, which gives us strong visibility for audits. If an identity, whether it’s a user, service account, or automated process, is no longer being used, we can identify that and revoke access. We run regular service account audits, and if something isn’t behaving as expected, we can remove its access immediately, with deprovisioning happening within seconds, if not milliseconds.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization expects $2.5 million in cumulative costs per identity-based breach based on direct and indirect costs including incident response, regulatory penalties, reputational damage, and operational disruption. It has a 67% likelihood of experiencing a breach annually. Furthermore, 60% of breaches are driven by identity-related issues, including compromised credentials, misconfigured access, and gaps in authentication controls.²

• Okta addresses 85% of these identity-based attacks, based on the scope of threats mitigated by phishing-resistant authentication, real-time threat detection and response, and continuous identity posture monitoring.

• By adopting an identity security fabric with Okta, the composite reduces its likelihood of experiencing an identity-related breach by 90%.

Risks. This benefit will vary among organizations based on:

• The cumulative cost of an identity-based breach, which will vary based on industry, regulatory environment, and the sensitivity of data at risk.

• An organization’s baseline breach likelihood and the proportion of breaches that are identity-based before deploying Okta.

• The percentage of identity-based attacks addressable by Okta’s platform, which may vary based on the specific threat landscape and the breadth of Okta products deployed.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.6 million.

Improved Business Continuity Due To Faster Identity Threat Detection And Remediation

Evidence and data. Interviewees described identity-related security incidents as a source of significant operational disruption that extended well beyond their security teams. When authentication anomalies, brute force attempts, or suspected credential compromises required investigation, the downstream effects were immediate: Employees faced lockouts, access delays, and repeated MFA challenges that prevented them from accessing critical systems. In interviewees’ prior environments, manual investigation and remediation workflows meant these disruptions often lasted for hours during each incident.

Several interviewees highlighted how ITP changed this dynamic. By continuously analyzing authentication signals, user behavior, and session context across the environment, ITP automatically detected and responded to threats by blocking suspicious IPs, flagging anomalous login patterns, and triggering automated remediation policies without requiring manual intervention. Interviewees noted that threats their teams previously spent hours investigating were now identified and contained within minutes, and in many cases were stopped entirely before they could generate employee-facing disruption.

Interviewees also cited Okta’s adaptive authentication and session protection capabilities within Access Management as critical to maintaining continuity during security events. By applying risk-based policies that evaluated device posture, network context, and behavioral signals in real time, Okta ensured that legitimate users maintained access while anomalous sessions were challenged or terminated. This reduced the collateral disruption that blanket lockdowns or broad MFA step-ups had previously caused. The net effect, interviewees said, was fewer incidents requiring investigation each year, faster containment when incidents did occur, and a subsequent reduction in employee productivity loss attributable to identity-related security incidents.

• The senior SecOps engineer in software explained: “With Identity Threat Protection and Identity Security Posture Management, it’s more of a set up-once-and-monitor situation. Okta does a good job managing how those tools work on the back end, so in some cases, there just isn’t work that we need to do. We’re not manually managing IP block lists or common password lists anymore; it’s all being handled for us. It’s been a benefit on a lot of levels to have everything together.”
  The senior SecOps engineer continued: “Previously, our response time for things that required manual intervention was a few hours. For example, if it’s the weekend and someone flags a brute force attempt, we might not act on it until later. With some of the identity security posture and workflow capabilities from Okta, those actions can happen immediately. If a credential is exposed, we can cut it off right away, rotate it, or take action automatically. There’s essentially no response time on that. In a lot of situations, that brings response time down from a few hours to basically no time.”

• The IAM staff engineer in fintech said: “Before Okta, our identity controls were more fragmented and relied more on traditional MFA and application-specific controls. Today, a much larger share of authentication is protected by phishing-resistant factors like FastPass, along with device-based access controls. We’re also using more contextual signals during authentication, things like device posture, OS compliance, and location, which allows us to make better access decisions and enforce policies more consistently.”
  The IAM staff engineer continued, “Because we now have more centralized visibility and response capabilities, we can detect and react to issues much faster, which reduces both detection and response time and helps limit disruption when incidents occur.”

• The IT systems admin in software said: “One of the biggest things Okta has given us is awareness of threats and the ability to react to them very quickly, within the day. We can see things through reports and logs and take action right away. We’ve had situations where open sites that accept usernames and passwords would get brute forced and start locking people out, but we’ve mitigated those, so they’re gone now. As far as our primary company tech stack, it’s in Okta and it’s doing its job.”
  The IT systems admin continued: “Okta’s Identity Threat Protection and session protection give us visibility into things that may not have been reported before, and they’re stopping them. So it’s not like we even have to do anything in some cases.”

• The system engineer architect in insurance explained: “If someone is trying to brute force a login, Okta handles that and blocks those attempts. So we’re not seeing a whole bunch of accounts locked out, and we don’t have to go in manually. We haven’t gone as far as automatically disabling users, but a lot of that response is already handled for us.”

• The manager of IT infrastructure in software said: “Because everyone logs in through Okta, we can use Workflows to look at activity and immediately take action. For example, if someone hasn’t logged into an application, we can pull that access right away. That level of automation also helps us respond quickly when something isn’t right since everything is in the same system. You don’t have to worry about integrations breaking or processes failing; it just works.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite experiences identity-related incidents requiring investigation and remediation, including authentication anomalies, brute force attempts, and suspected credential compromises, that generate meaningful employee productivity loss when not contained quickly. The cost of 1 hour of IAM-related employee productivity downtime is $250,000, when employees are unable to authenticate, access critical systems, or complete their work during active identity security events.

• The composite experiences 12 identity-related incidents that require investigation and remediation in Year 1, 10 in Year 2, and eight in Year 3. This declining trajectory reflects the progressive hardening of the composite’s identity posture as Okta’s proactive controls, particularly ISPM’s continuous misconfiguration detection and ITP’s automated threat response, reduce the frequency of incidents requiring manual intervention over time.

• Before deploying Okta, the composite’s average mean time to detect (MTTD) an identity-related incident is 0.5 hours and its average MTTR is 2 hours. With ITP’s automated detection and response capabilities, the composite reduces MTTD and MTTR by 50% and 90%, respectively.

Risks. This benefit will vary among organizations based on:

• The hourly cost of IAM-related employee productivity downtime, which will vary based on organization size, workforce composition, and the degree to which business operations depend on continuous identity and access availability.

• The number of identity-related incidents requiring investigation and remediation per year in the prior environment, which will vary based on an organization’s existing security posture and threat exposure.

• An organization’s baseline MTTD and MTTR for identity-related incidents before deploying Okta.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $11.0 million.

Legacy Environment Savings

Evidence and data. Before adopting an identity security fabric with Okta, interviewees’ organizations incurred significant costs from fragmented identity tooling and operations, including overlapping point solution spend, unused software licenses, and manual identity processes. Their environments consisted of a patchwork of solutions for SSO, MFA, provisioning, governance, and credential management, and beyond that operated in silos, required dedicated staff to maintain, and produced functional overlap.

Consolidating onto Okta eliminated much of this redundancy. Okta Lifecycle Management capabilities replaced standalone provisioning tools and manual identity operations through integrations with HR systems; centralized governance capabilities displaced legacy access certification tooling, including homegrown solutions; access management capabilities replaced legacy SSO vendors; and automation through Workflows reduced the need for custom scripts and manual processes previously required to manage identity operations.

Beyond direct point solution consolidation, interviewees identified SaaS license waste as a significant cost driver in their prior environments. Limited visibility into application usage meant access was often provisioned broadly and resulted in unused or underutilized licenses across their organizations. By serving as a centralized authentication layer, Okta provided visibility into actual application use across the employee base, which allowed interviewees’ organizations to identify unused accounts and reclaim licenses.

Staffing requirements to support identity operations also declined. In prior environments, teams had to manage provisioning, access reviews, and policy enforcement manually across multiple systems. With consolidation and automation, the platform absorbed many of these tasks, reducing the number of resources required to manage the identity environment while allowing existing staff to focus on higher-value activities, including improving identity governance practices, strengthening security policies, optimizing access controls, and supporting strategic IT and security initiatives.

• The IT infrastructure manager in software reported that their organization realized $500,000 in annual savings from reduced SaaS sprawl, noting: “Because everything is behind SSO, we get visibility into all the applications people are using, including overlaps. That allows us to proactively guide users toward tools we already have instead of buying new ones. Without that visibility, it’s easy for teams to adopt new tools without realizing there’s already something in place that does the same thing. Over time, that leads to a lot of duplication across systems.”
  The manager continued: “When we revoke an account, it automatically removes access across downstream systems, which eliminates associated licenses. One identity can be tied to multiple applications, so removing unused access creates cascading savings across the environment. It’s also much easier to see who is actually using a tool when everyone is required to log in through SSO. That visibility helps us avoid overprovisioning licenses, especially for teams where access is broadly assigned but not actively used.”

• The VP of information security in insurance said: “Switching from [our legacy MFA solution] to Okta was a direct cost saving. On user access reviews, Okta Identity Governance replaced our in-house system, so we saved development time and didn’t need resources dedicated to maintaining it.”
  The VP added: “There are also time savings from an IT perspective because it’s a single pane of glass. When you can manage everything from one system instead of bouncing between tools, it makes a big difference operationally.”

• The IAM staff engineer in fintech shared: “With Lifecycle Management, we can quickly see which users are assigned to applications and when they last logged in. Business owners can track usage, like how many users accessed an application in the last 60 or 90 days. That visibility helps them understand whether an application is actually being used. For example, if we’re paying for 2,000 licenses but only a small portion of users are active, it becomes clear that we’re not getting full value and then we can cut back on our spend.”

• The senior SecOps engineer in software said: “One of the biggest areas we consolidated was credential management. We previously had multiple password management tools, and we reduced that down significantly. Cost-wise, that was roughly a 50% reduction based on what we saw in renewals.”
  The engineer continued: “Without Okta, managing identity would require a much larger team. We now have a much smaller team managing the environment because automation handles provisioning, workflows, and integrations at scale. We’re running millions of automated actions that would otherwise require manual effort.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite incurs $200,000 annually for legacy identity point solutions in the prior environment, including tools for SSO, MFA, provisioning, governance, and credential management. With Okta, the composite decommissions 75% of these point solutions in Year 1 and 100% by Years 2 and 3.

• The composite organization has 9,000 employees, each requiring access to a range of SaaS applications to perform their roles, and on average, the composite spends $1,500 per employee annually on SaaS licenses. With Okta, the composite reduces unused and underutilized software licensing spend by 4%.

• In the prior environment, the composite dedicates 10 full-time resources to managing identity systems, including provisioning, access reviews, and policy enforcement across multiple tools. The composite reduces the number of resources required to manage identity operations by 66% with Okta.

• The average fully burdened annual salary for an identity management resource is $127,920.

• For this benefit, the composite has a productivity recapture rate of 50%. Employees spend half of the time they save on activities that generate business value, but not all reclaimed time is dedicated to value-added work.

Risks. This benefit will vary among organizations based on:

• The volume and cost of point solutions in the prior environment, which will vary based on the breadth of the existing identity tooling landscape and the degree of vendor consolidation achieved with Okta.

• The number of employees and the average percentage carrying unused SaaS licenses, which will vary based on organization size, SaaS portfolio complexity, and the maturity of license management processes before deploying Okta.

• The number of resources dedicated to managing the prior identity environment and their fully burdened annual salaries.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.4 million.

Faster Application Onboarding

Evidence and data. Before adopting an identity security fabric with Okta, interviewees described onboarding new internal applications to their identity environments as a manual, time-intensive process that required custom integrations, application-specific provisioning logic, and coordination across teams. With Okta, app onboarding became faster and more standardized. The Okta Integration Network (OIN), with pre-built SAML, OIDC, and SCIM integrations, reduced the need for custom configuration, while Okta Lifecycle Management automated provisioning and deprovisioning across applications, which eliminated the need to build and maintain application-specific scripts. Okta Workflows further reduced effort for more complex integrations by enabling teams to automate conditional logic and multisystem processes without custom development. This streamlined approach reduced initial setup time and ongoing maintenance, enabling teams to onboard additional applications without increasing integration effort.

• The IAM staff engineer in fintech explained: “Before Okta, we had to build provisioning and deprovisioning for each application individually, which could take three to four weeks per application. There was also ongoing effort required to maintain those integrations. After moving to Okta and using standard protocols, onboarding takes only a few hours to configure provisioning and access.”
  The engineer added: “We also use group-based rules heavily, which allows us to automate access changes very quickly. Tasks that previously took days, like setting up groups and managing access, can now be handled in minutes.”

• The senior SecOps engineer in software shared: “Onboarding time still depends somewhat on the application, but when a prebuilt integration is available, it becomes very straightforward. We can complete the entire setup, including sign-on, group-based access, and provisioning much more quickly now.”
  The engineer continued: “If onboarding takes longer, it’s usually because of limitations on the application side rather than anything related to Okta. When integrations are supported, the process is quick and repeatable.”

• The VP of information security in insurance said: “We’ve seen some meaningful time savings for onboarding an application. Once you’ve set up an application once, it becomes second nature rather than having to learn a different approach for every application. In the past, for something like a SaaS trial, we might not have even bothered setting up SSO because it required too much effort. With Okta, if the application is already supported, we’ll onboard it into our environment right away so users can access it with SSO. It’s just much more convenient to do so.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite onboards 40 new applications in Year 1, 45 in Year 2, and 50 in Year 3.

• In the prior environment, onboarding each new application required 40 hours on average. With Okta, the composite reduces the time required to onboard each application by 75%.

• The average fully burdened hourly rate for an IAM engineer is $88.

• For this benefit, the composite has a productivity recapture rate of 50%. Employees spend half of the time they save on activities that generate business value, but not all reclaimed time is dedicated to value-added work.

Risks. This benefit will vary among organizations based on:

• The number of new internal applications onboarded per year.

• The average time required to onboard a new application in the prior environment, which will vary based on the complexity of legacy integration approaches and the degree of custom development previously required.

• The fully burdened hourly rate for IAM engineers involved in application onboarding.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $125,000.

Reduction In Identity And Access Management-Related Support Tickets

Evidence and data. Interviewees said access request and identity management tickets were a persistent drain on help desk capacity before they adopted an identity security fabric with Okta. Fulfilling a single request often required coordination across multiple teams, including manual routing, approvals, and provisioning across individual applications. Password resets, account unlocks, and routine access requests generated a steady volume of repetitive, low-complexity tickets.

Okta reduced this volume across several areas. Okta Lifecycle Management enabled automatic birthright access based on HR-driven attributes, which eliminated many access requests at onboarding. For non-birthright access, Okta Identity Governance provided a self-service request catalog with built-in approvals and automated provisioning to mitigate help desk involvement for supported applications. Within Okta Access Management, passwordless authentication reduced reliance on passwords and significantly lowered reset-related tickets. Workflows further streamlined fulfillment by automating multistep provisioning tasks that previously required manual intervention to enable consistent, round-the-clock processing.

• The VP of information security in insurance said: “Previously, access requests had to be routed to multiple teams, each responsible for a different system. Tickets would sit in queues, get picked up, and then require manual work to provision access. With automation through Workflows, that process has been streamlined significantly. We’ve eliminated a lot of the manual onboarding and offboarding steps across systems and reduced the number of people involved. Onboarding a user used to take close to two days for the help desk. Now it’s closer to 2 to 3 hours, with much less manual intervention.”

• The IT infrastructure manager in software explained: “We’ve seen around a 30% reduction in ticket volume. A lot of the common requests are now automated: Instead of creating tickets, we build access workflows that handle those requests automatically.”
  The manager continued: “In Okta, setting up access for a new application takes about a minute, compared to building custom workflows in ticketing systems before. That makes it much easier to eliminate repetitive access request tickets.”

• The IAM staff engineer in fintech said: “Before, we were getting around 20 password reset requests alone per week. Since moving to Okta FastPass and eliminating passwords, that number has dropped to zero. Previously, each request took about 20 minutes to resolve because we had to verify the user and handle the reset securely.”

• The IT systems admin in software shared: “Access request tickets have dropped by over 95%. Instead of going back and forth to approve and provision access, users can request access through the catalog, managers approve it, and provisioning happens automatically. From the help desk perspective, there’s essentially no involvement for most requests anymore.”
  The IT systems admin continued: “Workflows also take over a lot of processes that other teams used to manage themselves. We’ve centralized that and automated it, which reduces overhead not just for the help desk but for other teams as well.”

• The senior SecOps engineer in software said: “The time savings isn’t just the task itself; it’s eliminating delays in how tickets get processed. Before, requests would sit unworked outside business hours until someone on the team could pick them up. With Workflows, those requests are handled immediately, regardless of time zone. Instead of tickets sitting idle for hours, the system processes them automatically.”
  The engineer continued: “Because so much of this is now automated, we don’t need on-call support for these types of requests anymore. The system handles most of the day-to-day access and provisioning tasks without intervention.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization receives 100 IAM-related support tickets per week. With Okta, the composite reduces IAM support ticket volume by 40% in Year 1, 45% in Year 2, and 50% in Year 3.

• In the prior environment, each IAM support ticket required 1 hour on average to resolve, including time spent routing, approving, and provisioning access across systems. With Okta, the composite reduces the time required to resolve IAM tickets by 60%.

• The average fully burdened hourly rate for an IT resource handling support tickets is $35.

Risks. This benefit will vary among organizations based on:

• The volume of IAM-related support tickets generated per week in the prior environment.

• The average time required to resolve each IAM-related support ticket in the prior environment.

• The fully burdened hourly rate for IT resources handling identity and access support tickets.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $103,000.

Improved Efficiency Of Access Reviews And Compliance Certifications

Evidence and data. Interviewees described access certification and entitlement reviews as among the most operationally burdensome recurring obligations their teams faced before Okta. The process was largely manual: Teams exported user entitlement data from individual applications, distributed spreadsheets to managers via email, tracked responses manually, followed up repeatedly to collect certifications, and then triggered deprovisioning actions by hand for any access that was revoked. For organizations running reviews across dozens of applications and hundreds of user populations, the cumulative administrative effort consumed weeks of work per campaign cycle, and the friction involved meant many organizations ran reviews less frequently than their security or compliance posture required.

Interviewees said that OIG transformed access certifications from a manual coordination exercise into a configured, automated workflow. Their organizations created campaigns that were defined once and executed consistently, with in-application reviewer tasks, automated reminder sequences via email and messaging platforms, and policy-driven remediation that automatically triggered deprovisioning through SCIM or Okta Workflows for applications without native provisioning support. Designated reviewers could review and bulk approve or reject entitlements directly within the platform without navigating spreadsheets or responding to email chains, while teams responsible for administering access certifications were freed from the tracking and follow-up work that had previously dominated campaign cycles.

• The VP of information security in insurance explained: “Okta Identity Governance replaced an in-house system we had built for access reviews. Previously, we had a resource spending a meaningful portion of their time maintaining it, especially during review cycles.”
  The system engineer architect at the same organization added: “Access reviews were time-consuming, which limited how often we could run them. In some cases, we struggled to complete them even once a year. With Okta, we’re now able to run them twice a year and are working toward increasing that frequency further.”

• The IT systems admin in software shared: “Monthly access campaigns used to require pulling exports, creating tickets, and following up with reviewers. It took two to three months of effort from multiple admins to complete a full cycle. Now, we can initiate a campaign, run automated reminders, and handle most remediation through Okta. What used to take months now takes about 8 hours of effort for one person. It’s a huge time savings.”

• The IT systems admin added: “We run dozens of campaigns each quarter across different user roles and systems. Okta allows managers to review and bulk approve or reject access directly in the platform instead of working through spreadsheets or tickets. If access is revoked, deprovisioning is handled automatically through integrations or Workflows. Even where additional steps are required, we can automate most of that, which removes a lot of the manual follow-up and remediation effort.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite runs 200 access review and compliance certification campaigns annually that cover regulatory requirements, internal security reviews, and entitlement certifications across the application portfolio.

• In the prior environment, each campaign required 8 hours of administrative and coordination effort on average. With OIG, the composite reduces administrative and coordination effort per campaign by 90%.

• The average fully burdened hourly rate for an IAM engineer or security/GRC administrator responsible for coordinating access certification campaigns is $74.

• For this benefit, the composite has a productivity recapture rate of 50%. Employees spend half of the time they save on activities that generate business value, but not all reclaimed time is dedicated to value-added work.

Risks. This benefit will vary among organizations based on:

• The number of access review and compliance certification campaigns run per year, which will vary based on the size of the workforce, the number of applications in scope, and the frequency of reviews required by internal security policies and regulatory obligations.

• The average administrative and coordination effort per campaign in the prior environment, which will vary based on the degree of manual processes involved and the tools previously used to manage certifications.

• The fully burdened hourly rate for resources involved in access review and compliance certification activities.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $109,000.

Improved M&A Efficiency

Evidence and data. For organizations that have undergone mergers and acquisitions, interviewees explained that integrating identity environments required coordinated effort across directory consolidation, user data alignment, and access reconfiguration. These activities were typically manual and sequential, which extended integration timelines over several months. With Okta, these organizations streamlined identity integration by connecting existing directory environments and standardizing access earlier in the process. Okta Lifecycle Management automated the provisioning of users based on existing directory attributes, while Okta Workflows supported the automation of access assignment and migration tasks across systems. This removed dependencies on manual coordination and directory consolidation to accelerate integration timelines and subsequently reduce IT effort.

The VP of information security in insurance explained: “We went through an acquisition after moving to Okta, and it was much easier, especially for Day 1 access. We deployed the AD agent into the acquired environment and were able to start granting users access immediately instead of waiting on months of planning and integration.”

The VP added: “We could integrate Okta with [the other organization’s] Active Directory and provide application access without waiting for full directory consolidation. In prior acquisitions, this process took six to nine months. With Okta, we completed it in two to three months. It was a huge difference.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite completes one merger or acquisition event in Year 1 and Year 3. For each event, 10 IT resources are involved in identity integration efforts and spend 75% of their time on M&A-related integration activities.

• In the prior environment, identity and data integration requires six months on average. With Okta, the composite reduces the time required for identity and data integration by 65%.

• The average fully burdened hourly rate for an IT resource involved in M&A integration is $35.

• For this benefit, Forrester assumes a 50% productivity recapture rate, meaning that half of the time savings is redirected toward activities that generate business value.

Risks. This benefit will vary among organizations based on:

• The frequency of mergers and acquisitions, which will vary based on an organization’s growth strategy and corporate development activity.

• The number of IT resources involved in identity integration efforts during M&A events and the percentage of their time dedicated to this work.

• The complexity of an acquired organization’s identity environment and the degree of Active Directory consolidation required.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $116,000.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Improved visibility into and control over AI agents and shadow AI. As interviewees’ organizations expanded their use of AI tools and autonomous agents, Okta’s centralized authentication and access control layer provided an increasingly important foundation for governing how those tools accessed enterprise systems. By requiring users of AI applications to authenticate through Okta and enforcing device trust, phishing-resistant authentication, and contextual access policies for critical systems, organizations gained visibility into which AI tools were operating in their environments and the ability to revoke access from human and nonhuman identities instantly when needed. Interviewees acknowledged that AI governance remained an evolving challenge, with shadow AI representing a particularly difficult problem, but noted that having centralized identity controls already in place made it significantly easier to detect unauthorized tools, enforce access boundaries, and respond to ungoverned AI activity.

  • The IT infrastructure manager in software said: “Having a centralized identity layer gives us visibility into what’s connecting to our systems and who has access. We can enforce policies like requiring managed devices and restrict where and how systems are accessed, which makes it much harder for unauthorized AI tools or agents to interact with our environment.”
    The manager continued: “AI introduces new risks because tools can be connected without full oversight. Having centralized authentication means we can monitor access and apply consistent controls, rather than trying to manage it across individual systems.”
  • The IT systems admin in software said: “Most AI tools have to go through [Okta]. We block direct sign-ups and require access through SSO, and only our IT team can create and manage those accounts. That helps us limit shadow use and keep things governed. There are still cases where someone sets something up outside of that process, but with [Okta’s] controls like verified domains and application restrictions, we’re able to reduce that risk and bring it back under governance.”
  • The IAM staff engineer in fintech explained: “One of the main concerns with AI is making sure these agents don’t have excessive access. When you connect an agent to applications, it can easily end up with more permissions than it actually needs. That’s why we’re focused on putting guardrails in place between AI systems and our applications. We’re being deliberate about how we roll out AI. We want to make sure access is controlled and limited, and that we can govern how these agents interact with our systems.”
  • The senior SecOps engineer in software shared: “Every AI application we’re using is integrated with our identity layer for authentication and access control. That gives us a central point to manage access and understand how those tools interact with our environment.”
    The engineer continued: “We’re also using AI in a controlled way to query identity data and surface access information. Instead of manually generating reports or pulling data, we can automate those queries, which reduces manual work while still keeping everything governed through Okta.”

• Faster employee onboarding. Interviewees described a fundamental shift in how they provisioned new employees after integrating Okta with HR systems of record. By establishing their HR system as the authoritative identity source, the act of creating or updating an employee record automatically triggered downstream account creation and application provisioning in Okta, which eliminated the manual handoffs, email-based requests, and days-long delays that had previously left new hires without access on their first day. Birthright access policies ensured that employees arrived with the applications and entitlements appropriate to their role already in place, while access requests for anything beyond birthright were fulfilled automatically upon manager approval.

  • The VP of information security in insurance explained: “Integrating Okta with [our HR system] was a major improvement for us because it became our single source of truth. Previously, we had to wait for emails from HR to trigger account creation or deactivation. Now, once a user is created in the system, it automatically kicks off provisioning in Okta. Before, a new employee might have partial access on Day 1, but it could take several days to get everything they needed. With Okta, that process is much more complete and consistent.”

• The senior SecOps engineer in software said: “Onboarding used to involve a lot of coordination. We had scheduled blocks each week just to create accounts, and it took about 30 minutes per user, not including all the back and forth to set up credentials and walk users through access.”
  The engineer continued: “Now everything is much more consolidated. We don’t have to manually set up accounts or walk users through the process. It’s handled automatically, which eliminates a lot of the overhead.”

• The IAM staff engineer in fintech said: “Before Okta, our onboarding and offboarding automation was really complicated and required support from multiple engineers to maintain. It wasn’t very efficient or easy to manage. After moving to Okta Workflows, one engineer was able to rebuild the process, and it’s now much simpler. We only review it periodically instead of constantly maintaining it.”
  The engineer concluded: “Those resources have been freed up, and the process is easier for others to understand and update when changes are needed. That’s been one of the biggest improvements for us.”

• Reduced end-user authentication friction. Interviewees reported that Okta’s SSO and Okta FastPass significantly reduced the time employees spent authenticating throughout the workday. By replacing repeated credential entry with a single authentication event and enabling passwordless access, their organizations reduced login times from tens of seconds to just a few seconds per authentication. These improvements reduced friction during daily workflows and minimized the interruptions associated with repeated logins, particularly in environments where employees authenticate frequently across applications.

  • The IAM staff engineer in fintech said: “Before Okta, users spent around 30 seconds logging into applications. With Okta Verify and FastPass, that’s been reduced to about 2 to 3 seconds. That time savings adds up because employees log in multiple times throughout the day; in our case, around 10 times per day. It’s a noticeable improvement in how quickly they can access applications.”

• Strategic vendor partnership. Interviewees described Okta as an active partner (rather than a transactional vendor) that engaged with them regularly to understand evolving requirements and support long-term identity strategies. This ongoing collaboration helped their organizations align their roadmaps with new capabilities, make more informed implementation decisions, and build internal momentum for identity initiatives.

  • The system engineer architect in insurance said: “Okta has been one of the vendors that really works to understand our challenges and where they can help. That relationship is very different from vendors we rarely engage with, and it makes it easier for us to evaluate and adopt new solutions because they understand what we’re trying to solve.”
  • The senior SecOps engineer in software explained: “Okta has become a trusted part of our strategy with leadership. When we bring forward new initiatives tied to Okta, there’s already confidence in the platform because it has consistently delivered value. That credibility helps us move faster. We don’t have to rejustify the investment each time; it’s already seen as a proven foundation for new capabilities and workflows.”

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might adopt an identity security fabric with Okta and later realize additional uses and business opportunities, including:

• Securing AI agents and nonhuman identities. As their organizations expand their use of AI-powered tools and autonomous agents, interviewees described Okta as a foundational platform for governing nonhuman identities over time. While many organizations are still in the early stages of AI adoption, having centralized identity already in place positions them to onboard and manage these tools more effectively as use cases scale. Interviewees emphasized that authentication, policy enforcement, and provisioning frameworks will be critical to managing AI agents as first-class identities. As Okta continues to invest in capabilities for nonhuman identity management, interviewees expect the platform to play a central role in enabling secure and scalable AI adoption.

  • The VP of information security in insurance said, “We’re still early in our AI adoption, but it’s much easier to establish the right security controls at the beginning than it is to go back later and try to find and govern all of these AI agents.”
    They concluded, “As we deploy AI agents, Okta’s capabilities provide a layer of visibility and control that will be important as we expand our usage.”

• Expanding identity-driven automation. Interviewees described a compounding return as their organizations expand automation beyond initial provisioning and access use cases to encompass broader identity and IT operations. As teams became more familiar with Okta Workflows, they identified additional manual processes that could be automated, steadily increasing the scope of efficiency gains. The platform’s no-code approach enabled this expansion without requiring dedicated development resources, allowing automation to scale alongside organizational needs. Over time, interviewees expect identity operations to continue shifting away from manual coordination toward more automated, policy-driven processes to further embed efficiency across identity and access management functions.

• Future-proofing identity investments. Organizations that have already deployed Okta for workforce identity can extend the same platform, policies, integrations, and operational expertise to new identity use cases without introducing additional identity infrastructure. Interviewees noted that they can leverage established governance frameworks, authentication controls, and provisioning processes as identity requirements evolve, which allows their organizations to address emerging business and security needs using capabilities already in place. This positions their organizations to support future identity scenarios, including AI agents and nonhuman identities, while maximizing the value of prior investments, reducing complexity, and avoiding the need for separate identity solutions.

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).