Keynote: Okta secures AI | Oktane 2025

Hello, Oktane! Wow! This is amazing! Thank you so much for being here. Customers, partners, we love customers, we love partners. Investors, we love investors! Competitors? Hey, don't laugh! They have to figure out what they're going to be working on for the next few years. We're happy to share all of our hard work with all of you. We're very excited! My dad is here. Welcome to Oktane, dad! Nice to have you here! This is very cool.

So, in the room, it's official, I got the update. This is the biggest in-room crowd ever for Oktane! Bigger — it beats the record of 2019, which was the previous record. So I think that means COVID is officially over! Congratulations, everyone!

We are thrilled to have you here for the most important security event of the year. Last year, I told you a story of how Okta was on this journey to be the most secure company in the world. This year, the story is about how Okta is still on that journey and has made a lot of accomplishments towards being the most secure company in the world. But also, how we're doing that and embracing and transforming with AI. Because there's a huge opportunity — this is the most obvious statement I'll make today — there's a huge opportunity for all of us with AI. It's the biggest platform shift since the internet. It's bigger than mobile, it's bigger than Cloud, it's bigger than social. The opportunities and the potential is amazing. We see it in the products we use. We hear it in the headlines we read.

Do you read these headlines? I feel like I should just be doing more. I should be doing more with Okta, I should be leading, we should be adopting more AI, we should be putting our products more and more and more. I feel like if I haven't built a company worth a trillion dollars or I haven't built a $500 billion data center, it's like, what am I doing with my life?

Does anybody know what they're doing with FOMO in their life? Anybody know FOMO? What's going on here? What's the tension? It's really that Okta has spent the last few years on this journey to be the most secure company in the world and that's really driven our priorities and what we've focused on and what we've invested in, and we have to figure out how we do both, how we innovate with AI and how we continue on this journey to be the most secure company in the world. And it's a tension that we all face everyday. I know, because in my conversations with you, it comes up over and over again. It's easy to fall in the trap of one extreme. Either complete lockdown mode and totally focused on security or the other way where you're being fast and loose and innovation at all costs. And we all know we have to do both, strike the right balance, innovate and be secure. Every company struggles with this. Don't feel bad about it, don't feel guilty. We have to figure out how to do both.

And at Okta, our foundation, our bedrock, our core priority is incredibly clear. And it starts with this Okta Secure Identity Commitment, which is our long-term commitment to lead the industry in the fight against identity-based attacks. This is how we do it. When we think about this tension, about balancing innovation with AI and about security, we had this key revelation, which is the thing we've been focused on is actually the unlock to do both. This is how we innovate without compromise.

The Okta Secure Identity Commitment has four pillars from building industry-best products and making sure those products are secure by default, to hardening our corporate infrastructure, making sure it's the most secure in the world. To championing customers' best practices. Because if it doesn't all work for you and it's not easy to adopt and get value out of, it's not good for you and also the industry of fighting the attacks. We launched this formally over two years ago and we have poured our blood, sweat, and tears into this. One way to quantify it is, it's added up to over two million hours in two years. Two million hours in two years. And we're very proud of the progress here. And when you write it down, it's a lot of stuff. But that is what is required from a company like Okta. That is what is required and that's what we have been doing.

It's not just about security and locking it down, it is the unlock to how we reach the potential of AI. How we help the entire industry reach this potential. Being secure, the Secure Identity Commitment is the key to the future of AI security and to AI. And what do I mean by this? Well, nothing like a great example. And we recently saw a very important and poignant example, it's a major industry-wide breach, I'm sure many of you were involved and impacted in some way, shape, or form. This is a breach of an AI agent and this AI agent was used to automate marketing. So companies use this agent and it sat on their website and it helped prospects learn about the company and create sales leads and automate the marketing process. And the company that builds this agent was hacked and the hackers got the access tokens that this agent used to connect to the SaaS application of hundreds and hundreds of companies. Hundreds and hundreds of SaaS applications from hundreds and hundreds of companies and many people in this room.

I share this story for two reasons. The first reason is it's a very strong demonstration of the work we've done at Okta to harden our corporate infrastructure. We are customers of this AI agent. And because of the work we've done on infrastructure, we were not impacted by this breach. We were not impacted.

Yeah, thank you, thank you, I appreciate that. And I don't share this — this is a really bad situation for the entire industry, and I don't share this story to celebrate this whole thing happening, but a lot of times, hardening corporate infrastructure and focusing on lockdown security mode, it's hard work, it's focused day after day, it's prioritizing, it's having an amazing team that can get things done and make hard projects amongst many dependencies in challenging times. And this focus and this dedication directly impacted Okta being protected from this issue. So it's nice sometimes to see success be demonstrably apparent when many times security work, as you know, is the best thing that can happen is you never hear anything about it. So that's the first reason I share it.

Now, the second reason is that this is an example of what can happen in our industry without the right security for AI agents. Think about this breach. This is an AI agent. If every system has breaches like this, AI will not reach its potential, it's not going to happen, companies will be afraid to adopt it, we have to fix this problem and elevate the industry and we have to show the industry a better way.

If you think about what's going on here, this AI agent and many other AI agents, they are a powerful new identity type. A powerful new identity type. They can act independently on their own or on behalf of a user or a team or a company. They can access tools, applications, and data. They can plan and complete tasks on their own. They're kind of like a piece of software, kind of like a system account, kind of like a person, somewhere in-between. And the pace here of innovation is absolutely stunning. We all see it. So, it's not surprising that many of you are making AI agents the number one priority in your entire technology investment. And now these AI agents and the potential here and the potential benefits, they are getting very, very powerful and it's happening very quickly.

If you think about just five years ago, the complexity of a task that an agent could complete would be something that would take you about nine seconds. Think about adding the last sentence to your e-mail. Now just in five years, it's dramatically different. AI agents can complete tasks on their own that would take you two hours. Think about kind of a medium complexity support issue where you have to look at the support database and interact with the customer and then solve that issue.

So, key here is as this improvement happens, agents need access to more and more data. More and more data, more and more access, which means it's very important these AI agents have an identity in the sense that we talk about identities. And that means that without identity security, AI security collapses. So, AI security is identity security. You can't be successful in one without the other. AI security is identity security.

So, to understand why, think about the complexity you are already facing. I know it's something you think about all the time. You're working with it everyday. You have identities. You have employees, customers, partners, non-human identities. You have various tools from different identity vendors that connect the identities to your resources. The resources, they're absolutely critical. It's your applications, it's your data, it's your business process, it's your APIs, it's the things that power your business. And this could be thousands, even for a medium-sized company. It's a big challenge to stitch all of this together, this web of complexity.

Now, you take this complexity and you layer on top of it a million agents. And these agents, they need to connect to everything. Just like your people do. Machines, servers, APIs, data, customer data. Other agents, identities. This results in even more and more complexities. It all mixes together. But complexity isn't the only challenge here. Agents, to be most effective as they get more powerful, need broad and persistent access.

My friend, Steve Williams from NTT, Steve is here, I think. He had a great line about this. We were talking and he said, Todd, it's like you take an insider threat and you just put it in your company and give it all the access it needs and let it run wild. I thought that was an interesting way to think about it. Scary, but interesting. So there is enormous risk here. And this isn't some abstract concept that a CEO of an identity company is up here trying to scare you about. This is happening now. The risk is real now. And we're seeing instances of this everyday.

This is an example of one of the world's best-known restaurant chains. They implemented an AI agent. This agent sits on their website and helps job applicants who want jobs at the restaurants learn about the positions, the person gives information to the agent, the agent lets the person apply for the job, automates this important process and they get a job in the restaurant. And the hackers tricked it into exposing the password in the back-end of the administrator account that the agent entered. And guess what the password was?

I understand, you think this is, like, for humor, and I will just say, like, take a step back and think about what's going on here. This — I don't have any inside knowledge about this, but I bet you something like this happened. The CEO of this company, the Board of Directors of this company, is pushing the team to adopt AI. Adopt AI. What are we doing with AI? Has anyone heard this? What are you doing with AI? Adopt AI. And so these hard-working, smart people built this great AI agent and they probably took it to a meeting and said, look what we have. And I'm doing this at Okta. I'm saying, what do we have? What are we doing? What are we doing with AI? I don't want to miss out. And I'm sure you're doing it to your teams and your boss is doing it to you. So this team took what they had and the boss said, put it in production, now! And the team is looking at each other, like, I'm not sure it's ready. What do you mean it's not ready? We're going AI. So they put it into production and so it's not a surprise that this happens, and now the threat actors have access to 64 million records about chats and conversations and personal information. It's a big issue.

So we have to help. We have to do a better job here as an industry to make these kind of things successful, because if we don't, AI is not going to reach its potential. So it's not just a one-off incident. The Government of the United Kingdom organized a big red-teaming exercise which means a bunch of people got together and tried to break into systems so they could find the vulnerabilities before the bad guys did. And these weren't against AI agents built by a restaurant company, these are some of the most well-known AI agents we all use. Guess what they found, in almost all of them, the same kind of issues: overly permissive access, not clear deployment patterns, which led to compromise and these actions. And without the right identity controls. This is a big problem.

If we don't do something differently, we're at a risk of taking a step backwards ten years in all the security progress we've made. We've done such a great job with phishing and cross-site scripting and building more secure web apps and this is the potential to throw it all away and we can't let that happen. This means AI security is identity security. It's the key to agent security and the entire AI security world. And we face these clear and present challenges today.

I'll share another very memorable story from my conversation with a customer. This customer is a great Okta customer called Emerson Electric and I was talking to Matt and Scott and we were talking about this pressure they feel, like, do more with AI, they had off-site meetings and they said we have to get together and do more with AI. Of course we do! And they looked at me and said, Todd, we want to do all of this stuff with AI. If we don't get our identity foundation in order, we have no shot, we have no shot, it's not going to work. That really stuck with me.

And you can't address this issue with a grab bag of standalone identity tools. This requires a completely new category. A unified approach that simplifies control and strengthens protection. Now, a key thing here is that it's got to be comprehensive and cover everything. No gaps, no little wedges for any kind of threat to sneak through. It's got to cover every identity type, every use case, and every resource.

It's called Identity Security Fabric and it transcends previous identity categories, and the goal here is very simple. The goal here is to zero out identity-based attacks and it's an approach going across every type, employees, customers, partners, contractors, every identity use case, governance, privilege access management, access management, threat protection, posture management, these are not individual products, they're really features of a bigger category. And it's integrated across every resource. Apps, infrastructure, databases, APIs, everything, no gap, no wedge to sneak into. And it has to be fully secure. And it can do this with the ability to orchestrate across the fabric, so the left hand knows what the right hand is doing. It can share risk signals. So, coordinated defense against attacks and you can take actions, like automating universal logout when any kind of threat emerges.

This is what you ask us for every single day. You don't want 50 different solutions from 50 different identity vendors. Now, this idea is what I've been doing my entire career. Okta is my third job. My first job was at a company called PeopleSoft, it was in the ERP category, unifying HR, financials, manufacturing. My second job was at Salesforce, unifying sales, marketing, service, and support. My third job is Okta, the category is Identity Security Fabric and we're unifying access management, identity governance, cost management, identity threat protection, it's a new category.

Now it's bigger than just Okta and it will require the whole industry to work together to make this a reality, but it's our North Star and we are continuously chasing this vision, this dream, and innovating as technology evolves. This is absolutely critical to our overall vision as a company, which is to free everyone to safely use any technology. And this vision is more relevant and more urgent than ever in this new age of AI and all the potential that we're surrounded by. For us, securing AI agents is just like securing any other type of identity and it's what we were built to do.

Today, we are unveiling three important innovations that will help all of us address the challenges of agentic security. The first is how you can bring your Identity Security Fabric to life by bringing AI agents into the Okta Platform. Second is how to strengthen the Identity Security Fabric with open, industry-leading standards for AI agents. And third, how you can easily build fabric-ready agents with the Auth0 Platform. And it all starts with the Okta Platform, it's the best and fastest and easiest way to build an Identity Security Fabric.

It's the only modern, fully integrated scalable identity platform and it's built for IT and security teams. Individually the products in the Okta Platform are excellent, but together they are spectacular and enable use cases that were never before possible. And it does this in an independent and neutral way; that is, integrated to everything. Over 8,000 integrations in our Okta Integration Network, we don't have an opinion on which technology you choose, we focus on identity and leave the choice of technology up to you. There's no lock-in, there's no forcing of any direction of technology.

So, the simple way to put it is the Okta Platform, it brings your Identity Security Fabric to life. That's how you simplify control and strengthen security as your environment grows. It takes you from this multi-vendor fragmented approach, to consolidation on a single identity platform. Of course, a key feature of the Okta Platform is that it continues to adapt and evolve, as the technology world changes and new technologies emerge. And that's why we're making AI agents a first-class identity in the Okta Platform.

This means every use case in Okta will support AI agents, from storing them in Universal Directory, to discovering them with Identity Security Posture Management and managing governance and managing critical resources with Okta Privileged Access. And you can think about this: you put people in Okta forever and have visibility and governance and control and now you can do the same thing with AI agents, all with total flexibility you would expect from Okta. And now in an AI world where everything is emerging and adapting and changing every quarter, Okta is your AI partner. We focus on the fundamentals, governance, visibility, and control, and free you to choose whatever emerging technology in this dynamic landscape that serves your needs the best. You need a partner that will take care of the basics and free you to choose. Okta does that for you and makes sure that your choices are future-proof.

And one concrete example of this, is with one click, you can bring any AI agent into Universal Directory. You can decide what's the right source of truth. Should that come from Salesforce? Should that come from an agent you build yourself? Should that come from ServiceNow? Should that come from Workday? The choices are dizzying. You can choose, though, you can choose and we'll take care of the visibility, control, and governance, just like any other type of identity, we will do for you. You will have a great cyber posture and be free to integrate with AI and meet your business objectives. To get AI right, you have to get identity right. To get AI right, you have to get identity right. And the Okta Platform makes that possible by bringing your Identity Security Fabric to life.

And the Identity Security Fabric is only as good as the standards to link it with all of your resources together in the environment. We love standards. Everyone knows their value. You get in your car, your phone seamlessly hooks up to your Bluetooth. Well, sometimes it does. We're still working on that one. Standards make the internet possible. And now it's especially important in an emerging new area like AI agents, standardization gets everyone on the same page, where to innovate and who is doing what and it's key as these evolve. And you can't have this Identity Security Fabric if the resources aren't speaking the same language.

Let's look at a concrete area here that needs to be standardized. Everyone that's implementing agents, whether you're a SaaS company or building your own, is doing the security and access control slightly differently. It's hard-coded and it can be brittle and error-prone as we've seen, if you move it from development environment to production. And when something goes wrong, there's a lack of visibility because guess who has to clean it up? IT Security, IT and security, and they go and clean it up, it's not clear how it was implemented or what connects to what, so there's a big opportunity to standardize that.

And so there are a lot of standards in the AI world but there's a missing standard here and that's why Okta is working with the standards bodies to propose a new standard we call Cross-app Access, and this lets IT and security teams set the access policies up front for these AI agents which makes it open and transparent and visible to everyone involved. You're clapping for this standard? Okay, this is my kind of crowd! It's my kind of crowd! You see the value in it. It's kind of down in the details, but you see the value in it.

So you get this visibility and get to set things up beforehand and most importantly, a lot of ways people do this now is that when the agents start being used, they ask the users to allow all these grants and you get this prompt that says do you want to allow access to your calendar from this agent? Yes, yes, yes. It's complexity for the end user and there's total access. And we've been working on this for a couple years now and we're partnering with the IETF working group and other ISPs and others across the industry to work on that open protocol and that's important and we're seeing a ton of support across the industry. Technologies signing up and getting on board.

Now, why are they doing this? These people are all busy and they're trying to push their business forward. The reason why, they see the opportunity and their AI technologies are going into these companies and they see the friction and confusion and all of this and they free it up to have the technology deployed and they see this and that's why they're so excited. It's not just these listed here, there's dozens more who recognize the power here and the value of securing the agentic future with a protocol like this.

And this is a standard and this is a continuation of what we've always done. We work with standards and we kickstart standards from the beginning, whether it's WS-Fed or others. And last year I talked about our pioneering work on IPSIE and a bunch of you in the room worked together on the first draft of IPSIE Lifecycle One, which is a sign-on and lifecycle and transparently into authentication methods. Now, this is just the beginning and we are already working with everyone involved on higher levels to add more use cases and standardize how technology works with identity and makes things more secure, it's a very important thing we're working on, and if you want to hear more about this, there's a session this afternoon with Gail Hodges, who is the OpenID Foundation's executive director and it's important work because it's key to shaping the future of identity in the age of AI. And we're not stopping there. There are more standards to create and more innovation to push forward. We have a playbook for it. And it starts with working with

We work with standards bodies and the community to crystalize areas that need to be standardized, then build them into our products. We build these standards into the Okta Platform and other platforms, so you get the security benefits of open standards. Users demand that more and more people support them, and technology builders see the open standard and say, I'm not going to get locked in, I can add that and it will solve this problem of agentic access. That leads to more customer incentive and you see this flywheel that spins everyone towards the goal of zero identity-based attacks. It's a powerful motion and it's happening, and you're all part of it, so it's very exciting.

Now, a critical part of this entire playbook is making sure developers can build with these standards from the start, and that brings us to our zero platform. Here is where a developer is building a service or agent or application to sell to customers, or it's a developer inside a company building applications and services and agents for internal use. Auth0 works amazingly with every program, language, platform, and framework. You can use it in bite-sized components where it helps, and it gets out of your way. It's perfect for a developer, and of course it's all based on the solid foundation of security and reliability.

Now, for years in the Auth0 platform we've made sure that developers can build every application standards-first, and today we're taking that journey even further by delivering inside of the Auth0 platform cross-app access support.

Yeah, if you clap for the standard, you have to clap for the implementation in our products. That's the rule of clapping. Whether you're building an agent or agentic services, which is something that an agent talks to, you can make sure they're fabric-ready out of the box with the right levels of security and visibility. Now, to bring it all together, here's a summary of everything we've covered so far. The Okta Platform brings your Auth0 security platform to life with open industry-leading standards and helps everything in your fabric from the identities down to the resources, making sure they all speak the same language. And the Auth0 platform makes it incredibly easy to build fabric-ready agents and agentic systems. Together, all of this ensures that you can build, deploy, and manage AI agents safely, securely, and at scale. Now, let's see all of this in action. So join me in welcoming to the stage Harish and Mallory to show you what this all looks like.

All right. Nice job, Harish, nice job, Mallory! It's amazing! I love seeing it all, all the hard work of the entire team demonstrated on screen there. I can't wait for all of you to get your hands on this. And to make that incredibly easy, that's why we've packaged all of this up in a solution that we call Okta for AI Agents. Now, it includes everything you need to build and manage agents securely. For agents, you can build agents that are secure by design, and for IT and security teams, it includes all the products on the entire breadth of the Okta Platform with support especially for AI agents. This is the most comprehensive solution in the entire market. We are so proud of it and we can't wait for you to deliver value to your companies and organizations.

So I want to cap things off today. I want to zoom out a little bit and have a conversation with another industry leader thinking about how to navigate this tension between innovation and security in the age of AI. We are incredibly fortunate to have the following guest here at Oktane. I would like to introduce Sarah Franklin, the CEO of Lattice. Sarah?

It's bigger than it looks.

Thank you for being here. So what's the latest with Lattice?

I love that. We're talking about infrastructure and standards and risk, but it really is all about what are we doing with all of this stuff and how are we positively impacting our organizations. Do you have an AI FOMO?

When you're out there talking to customers, what's the biggest barrier? What slows it down? For us, the whole idea here is that we're emphasizing how important identity security is to AI. What's the equivalent as you try to spread this message of empowering your people?

By the way, the way the industry pundits talk about it doesn't help.

Everything is going to change, it's all horrible!

What's the biggest success story? Do you have a customer story to demonstrate how to do this wonderfully? What are the barriers and what's the positive case?