When you're defending your enterprise, you want to defend every identity type from customers to employees to partners to AI agents to non-human identities.
Hi, I'm Lauren Everett, director of the Okta Newsroom, and I'm joined by Okta CEO and co-founder Todd McKinnon to discuss a brand new category, the identity security fabric. Hi Todd, thanks for joining me.
Great to be here, Lauren.
Thanks. Great to see you again. As you well know, the security landscape has never been more complex, and that's really driven by this explosion of non-human identities and the rapid deployment of AI agents, and that complexity is creating new risks. But today we are talking about solutions, and a big one of those is the identity security fabric. So before we dive in, could you just explain and walk us through at a high level what an identity security fabric is?
It's a new category. It's not a specific company. It's not a specific product. It's a new way to think about the identity landscape and the security landscape. And the idea is quite simple: your identity technology should have comprehensive coverage. So it should not exist in silos because when you're defending your enterprise, you want to defend every identity type from customers to employees to partners to AI agents to non-human identities. You want it to work across every resource in your entire environment, whether it's databases or servers or SaaS applications or on-premise applications or any other kind of resource. And then you want it to support every use case or every workflow that is traditionally associated with identity tools, whether it's access management, multi-factor authentication, privileged access management. There's many of these details in the categories of identity, but they should apply to everything: every identity, every resource, and every use case.
Thank you for that. And at the beginning of your answer, you mentioned a new category. Could you talk to us a little bit more about that? And do you see parallels maybe between this and the creation of the cloud-based identity management category?
I think every as technology matures in every wave, there's always it gets to a point where you need to create a broad platform or a broad category of what you're trying to do. It happened in the application era with CRM, where it combined sales automation, marketing, and support. It happened with back office with ERP, where it wasn't just about using Oracle for financials or SAP for HR. It was about what is your ERP solution? It was this category. So I think identity technology has come to a place where we understand the importance of it. We understand how important it is for an effective operations of a company, or more importantly the cyber posture of a company, and people have been trying to fill these needs with these point solutions. And the industry is at a point now where it's like we need to rethink what this means. We need to rethink about this in terms of a broad category, and that's what this identity security fabric is all about. It's like framing for the world how a comprehensive solution that's integrated across all these use cases and identity types and resources is a better way.
I love that. And then let's dive into some risks. What are some of the biggest risks posed by AI agents, and how does the identity security fabric help mitigate those?
The concept of an identity security fabric sets you up really well for this agentic age we're in, which is first principles: you have a comprehensive view of the data and the access points that these agents need. So you have all of these resources covered, whether it's you know who's accessing your data warehouse or you know who's accessing your SaaS application. And now you layer AI agents into it, and what is the first thing that everyone wants to do with an AI agent? It's a powerful new identity type in its own right, and they want to give it access to things. They want to give it access to very specific roles inside of applications. They want to give it broad access to things like data warehouses or document repositories. And when you put an agent in this construct of a fabric, you're set up for success because you can model the new identity type of an agent that's kind of like a person, kind of like a service account or a non-human identity, but it's really a combination of both of those. And when you put that new identity type in your fabric, because your fabric knows the resources and knows the data stores and knows the applications, making those connections and getting visibility, governance, and control across all of that, you're really set up for a great chance of success, and success being the agent can meet the business objectives, of course, but as important, if not more important, is that you can do that with a minimal amount of risk.
Oh, that's great. No, thank you. And I know Okta has long been a leader in securing human identities. And based on what we've just discussed, AI agents feel in some ways like a bit of a new challenge, but how are you thinking about them? Are you thinking of them as similar to human identities or maybe this brand new frontier that we're exploring?
I think it's important to understand that there are similarities, and a lot of the work we've done securing humans and giving easy and seamless access to people can be leveraged, but it is different. It's not exactly like that. And you know, the type of access usually is quite broad, and in some ways it's hard to know the access the agent needs ahead of time, where I think in a lot of people-centric workflows, you can more easily define actually where the workflow is going to go. One of the power of agents is that they can use data and use information in ways that can unlock new types of workflows and new types of value. And so it has to be flexible, but you can't give up the visibility. You have to know what the agent's doing. You have to know the sensitivity of the different access points in the applications and be able to put the right guardrails around what the agent can do so you can get the best of both worlds: innovation and security, and visibility and control.
