You've built teams and systems, and now you're building a workplace where AI agents help people. They need a lot of access—until suddenly it's too much. With Okta, you shrink the risk and sharpen control. Agents get an identity, a defined role, and crystal-clear boundaries—no overstepping, no mystery breaches, no agents going rogue. Did you know the AI agent gave itself a bonus? Clear my afternoon. Because to be useful, AI agents need to stay in their lane. From day one, Okta secures AI.
Please welcome Okta's chief executive officer and co-founder, Todd McKinnon.
Hello! This is amazing. Thank you so much for being here—customers, partners, investors, we love you. Competitors, don't laugh; you'll figure out what to work on. My dad is here. This is the biggest in-room crowd ever for Oktane, beating the 2019 record, so COVID is officially over. We're thrilled you're here for the most important security event of the year. Last year I shared Okta's journey to be the most secure company. This year the story continues: we are embracing AI while staying committed to security. AI is the biggest platform shift since the internet—bigger than mobile, cloud, social. The opportunities are amazing, but we all feel FOMO. At Okta, we've poured over 2 million hours over two years into our Secure Identity Commitment, which is the key to the future of AI security. A recent example: a breach of an AI marketing agent—hundreds of companies impacted. Because of our work, we were not compromised. This shows that without proper security, AI won't reach its potential. AI agents are a powerful new identity type that need access to more data. Without identity security, AI security collapses. AI security is identity security. Complexity is already huge—employees, customers, partners, non-human identities. Layering agents on top creates even more chaos. Agents need broad, persistent access, which is like an insider threat. It's happening now: a famous restaurant chain's agent was tricked into disclosing a password, leading to 64 million records exposed. The UK government's red-teaming of top AI agents found the same issues: overly permissive access. If we don't change, we risk stepping back 10 years in security progress. The solution is a new category: identity security fabric. It covers every identity type, use case, and resource, with no gaps. This is what I've done my whole career—unifying categories at PeopleSoft, Salesforce, and now Okta. Today we're unveiling three innovations: bring AI agents into the Okta platform, strengthen the fabric with open standards, and build fabric-ready agents with Ozero. The Okta platform brings your identity security fabric to life. It's the only modern, integrated, scalable platform with over 8,000 integrations. We are making AI agents a first-class identity—with one click, you can bring any agent into universal directory and manage its visibility, control, and governance. To get AI right, you have to get identity right. Standards are critical. We're working on a new standard called Cross-App Access for AI agent security, and we've made progress on IPSIE, which delivers standards-based single sign-on and session lifecycle. This is essential work to shape the future of identity in the age of AI.
There are more standards to create, more innovations to push forward. We have a playbook: we work with standards bodies to crystallize areas that need standardization, build them into our products—the Okta platform and the Ozero platform. You adopt them and get the security benefits of open standards. Users demand that more people support them, which creates a flywheel that benefits everyone toward the goal of zero identity-based attacks. A critical part of this is making sure developers can build with these standards from the start, which brings us to the Ozero platform. It's purpose-built for developers, works with every language, platform, and framework, and is based on a solid foundation of security and reliability. For years, we've made sure developers could build every application standards-first, and today we're taking that further by delivering cross‑app access support inside Ozero out of the box. You clap for the standard—you have to clap for the implementation in our products. It's the rule of clapping. Whether you're building an agent or a service, you can make sure they're fabric-ready with the right security and visibility. The Okta platform brings your identity security fabric to life with open industry-leading standards like cross‑app access, and Ozero makes it incredibly easy to build fabric-ready agents. Together, this ensures you can build, deploy, and manage AI agents safely, securely, and at scale. Now, let's see all of this in action. Join me in welcoming to the stage Harish and Mallerie to show you what this all looks like.
All right. Thank you, Todd. What's up, Octane? How we feeling today? That's what I'm talking about. In the next few minutes, Mallerie and I are going to walk you through what it's like to bring AI agents directly inside the Okta platform into your identity security fabric. From every single one of you, we're hearing the same thing: we want to roll out agents fast but struggle to balance innovation and security. Specifically, three things: visibility—where are all these agents; control—how do I ensure they only access what they're allowed; and governance—how do I avoid agentic sprawl. Good news: for 16 years Okta has been solving this for human identities, and now we can do the same for AI agents. Start with visibility. This is your AI agent directory—the same Universal Directory many of you use daily, now with AI agents right alongside people and groups. AI agents are a first‑class identity in the Okta platform. You can see the users who own these agents, closing the accountability loop. Click into a customer support agent—complete visibility in one place. Next, control. An agent is only as powerful as the resources it can access. With managed connections, I can fine‑grain control exactly what this agent has access to. It supports cross‑app access, so IT can set read/write permissions. This shifts hidden risk into the hands of IT and eliminates critical attack paths. System logs provide a detailed audit trail. Agents are now in the Okta platform, enabling IT and security to be proactive. Third, governance. Agents move fast from development to production, risking sprawl. Okta Identity Governance can run an access review that shows human users and AI agents accessing Salesforce. I can see the owner, entitlements, risk level, and get a recommendation from OktaAI. The end user has the data to make the right decision. That's the happy path. But what about rogue agents? If the sales team deploys an agent to Salesforce without notifying IT, the Okta platform can detect it. To show you more, I'll hand it to my friend Mallerie.
Great. Thanks, Harish. This is Identity Security Cluster Management—ISPM. Think of ISPM as your real‑time threat hunter. It continuously scans your tech stack for risks like misconfigurations, overprivileged accounts, or hidden app‑to‑app connections. Here, ISPM has flagged a high‑risk issue: grants without Okta policy. Investigating, we see a rogue agent connected to Salesforce, created completely outside IT processes, with broad read access to customer data. With Okta, we don't just find the risk—we remediate it. First, for visibility, bring the agent into Universal Directory with one click and assign a human owner. Second, for control, apply a baseline security policy to limit permissions to read‑only. Third, for governance, trigger an access certification campaign. The new owner will review the agent. And just like that, we've gone from a hidden critical risk to a fully managed and governed identity in Okta. Head back to Universal Directory—you see this agent right alongside all our other AI agents. Fully visible and fully secure. These rogue agents have nowhere to hide.
You know, I think it's cool, but judging by this, I think they think it's pretty cool, too.
So, you know, that's right. Agents in the platform. What you saw was the full power of the Okta platform applied to AI agents. Visibility—all your agents in one place. Control—agents don't access anything they're not allowed to. Governance—you don't end up with agentic sprawl. And ISPM detecting and bringing a rogue agent under control. Agents will transform business and technology. Companies that invest in an identity security fabric and secure every identity type across every use case—those are the ones that will get ahead in our AI future. Thank you, Todd. Back to you.
Nice job, Harish. Nice job, Mallerie. It's amazing. I love seeing all the hard work of the entire team demonstrated on screen. I can't wait for all of you to get your hands on this. We've packaged everything in a solution called Okta for AI agents. It includes everything you need to build and manage agents securely. For agent builders, it includes Ozero for AI agents, so you can build agents that are secure by design. For IT and security teams, it includes all the breadth of the Okta platform with support for AI agents. This is the most comprehensive solution in the market. We're amazingly proud of it. Now I want to zoom out a bit and have a conversation with another industry leader about navigating the tension between innovation and security in the age of AI. We are incredibly fortunate to have Sarah Franklin, CEO of Lattis. Sarah, welcome.
Thank you. Yeah, I can't do the jumping thing in. It's bigger than it looks on camera. It is. It takes time to walk through what an incredible crowd. Thank you so much for having me.
Yeah, thank you for being here. So many customers of Lattis in the audience. For those who aren't current on everything you're up to, what's the latest?
Yeah, so Lattis—our mission has and always will be to make work meaningful. That means helping employees know what to do, what their goals are, how they're doing, and having conversations with their managers. Bringing AI in a way that scales human potential and helps us achieve that nirvana of great outcomes for people. We're really focused on the success of people.
I love that perspective. We talk a lot about infrastructure, standards, risk—but it really is about what we're doing with all this, how we're positively impacting organizations. Do you have AI FOMO?
I don't have AI FOMO. Sometimes it's JOMO—the joy of missing out. No, we have a deep belief in the outcome we want with AI. You talked about security; we deeply care about the human impact. We don't want AI to just automate us out of work; we want it to help us be better at our jobs. That's why it's an incredible opportunity for IT and HR to lock at the hip and say, let's make this secure, accountable, and focus on this as a big people transformation.
When you're out talking to customers, what's the biggest barrier? What slows it down? What's the unlock? For us, it's about how important identity security is to AI. What's the equivalent for your message of empowering people?
