Okta Oktane 2026 | Shane Callahan, Vanderbilt University

Clips
More from Okta Oktane 2026

Shane Callahan

CIO

Vanderbilt University

play_circle_outline Campus as City: Navigating Multiple Identities Across Policing, Athletics, Housing, Hospitality, and Research

play_circle_outline Managing legacy and distributed technology stacks across schools and departments

play_circle_outline AI Agents: Dynamic Authentication and Access Control Challenges, Liability, and Incident Response for Guardrail Breaches

play_circle_outline Govern AI with Cross-Functional Teams and Existing Identity and Data Controls

Info
Transcript

Shane Callahan, Vanderbilt University

Shane Callahan

CIO Vanderbilt University

In this interview from Oktane 2026, Shane Callahan, chief information officer of Vanderbilt University, joins theCUBE Research's Krista Case and theCUBE's Rebecca Knight to discuss how identity security requirements are evolving as AI agents become active participants in university workflows. Callahan explains how higher education's inherent complexity — students who are simultaneously staff, donors and researchers — has already forced Vanderbilt to manage fluid, overlapping identities long before agentic AI arrived. He describes the emerging question of whet... Read more

explore Keep Exploring

What unique challenges does identity and access management in higher education present compared with a typical enterprise? add

How prepared is Vanderbilt University (or a similar long-established university) to handle identity management and AI agents given its distributed technology stack and legacy systems? add

How do you plan to design your identity and access/security architecture to scope access and authentication based on job role and intent (including for software agents), and how will you handle incident response, accountability, and liability if an agent or tool acts outside guardrails? add

How should higher education institutions govern and organize for AI adoption, and what common mistakes (including failures of CIO leadership) should be avoided? add

bolt Powered by CUBE AI

Shane Callahan, Vanderbilt University

search

Rebecca Knight

>> Good afternoon, everyone, and welcome back to theCUBE's coverage of Okta's Oktane here at Caesars Forum. I'm your host, Rebecca Knight, sitting alongside Krista Case, who is, of course, theCUBE's principal research analyst.

Krista Case

>> Yeah, I've met you before. Yeah, right. We're getting to that point in the afternoon. We are. Yeah, we are indeed. But we have a really interesting conversation coming up, talking about a whole host of different stakeholders and, the new identity security requirements that creates. So really looking forward to it, Rebecca.

Rebecca Knight

>> Well, with that, I would like to introduce our next guest. He is Shane Callahan, the CIO of Vanderbilt University, live from Nashville. You're coming in.

Krista Case

>> Yes. All right.

Shane Callahan

>> Live from Nashville.

Krista Case

>> Yeah. Right?

Rebecca Knight

>> So as Krista was saying, a university, higher education in general, there's a lot of complexity there. we talk to people who run billion-dollar enterprises. You're obviously a nonprofit, but you have so many different stakeholders, so many different kinds of environments that you're managing. Talk a little bit about the parts of securing an environment that you're involved with that most companies never even have to think about, never, doesn't even cross their mind.

Shane Callahan

>> So this is my first time in higher ed. I've come from large enterprise. I have an intelligence background, a lot of different things, retail, healthcare. But in higher ed, one of the things that never occurred to me as I started was we are a small city inside of a larger city. So I have to think like a mayor. I don't always have to think like a CIO. For example, we have a police department, we have athletics. Yeah, we're residential. So we have thousands of students living on campus. So we're hospitality too.

Krista Case

>> Yeah.

Shane Callahan

>> And that just— and then we have well over $1 billion of research that we're doing. We have 10 or 11 different schools. It's all these different businesses. So when you think about identity, since we're here at Okta, usually at a company, you have very fixed, specific things that people do. But when it comes to university, you could have multiple identities and sometimes at the same time. For me, I'm a student, I'm a staff member, could be a donor, all these different things and they all have different profiles of how you work at a university. So it could get very complex. And sometimes you could be a student that becomes faculty, that becomes staff, that then becomes a student again. And keeping track of that security profile is very, very difficult.

Krista Case

>> And Shane, so I'm really glad that you painted this picture, right? Because all these different personas are going to have different, kind of access requirements and usage requirements for data, right? Which as a CIO, it's— you're kind of the steward of delegating access to that data. We've been talking here at Okta Oktane a lot about the AI agent side of things and how those create more dynamic kind of authentication and access requirements to the data. But, you know, the picture that you're painting is that Vanderbilt actually may have been in a position to be well-prepared for this agentic AI revolution because you already were having to deal with some of those more fluid access requirements. So I guess the question is, can you talk a little bit about how you are seeing your identity security requirements change as Vanderbilt is maybe starting to adopt AI in portions of its processes?

Shane Callahan

>> Sure. So I would like to say we're very prepared, but we're like any other organization that's always working ahead. And when you think of a university, you have to sometimes think we've been around for 150 years. So, and with a distributed technology stack where there are different bespoke needs everywhere, you could have 15 or 30 years of technology legacy things that you have to go in and pull apart. So we're more centralized than we ever have been at Vanderbilt. We're mostly centralized. We have a couple pockets of technology everywhere. So when you think of getting ready for identity and agents, I would like to say that, yeah, we have it under control, we're on our way, but it's becoming more complex because we have also multiple layers of types of AI that you're going to look at. You have to be very prescriptive of what we're talking about. For instance, if you're an accountant that is going to use something for personal productivity, that's very different than being a researcher on cutting-edge AI that you're trying to advance AI itself, or you're working on a DoD project and requiring— these are all very different scenarios. And then when we get into that space, what I would see in the future is you have Bob who's— pick a career field, whatever they're doing. Does Bob have a shadow agent?

Krista Case

>> Yes.

Shane Callahan

>> Next to him, or are they completely independent? How does that identity get tied into HR where you can turn off or on access. And what happens when Bob leaves? But he was the one that was controlling it. It's all getting very complex. And the more it gets involved in business, the more we have to look at it almost— I don't want to do this, but almost as a human. And so I'm going to go one step further, if you don't mind. If you're looking at HR and you're looking at an organization, How do you treat a manager that has a team of 10 FTEs, but then over time has a team also of 15 agents?

Krista Case

>> Yes.

Shane Callahan

>> Do you give that manager credit for leadership over a larger portfolio? I don't know. How's that going to work?

Krista Case

>> So do you have a take on that, Shane? Because we've been hearing a lot that the AI agent, it needs its own unique identity.

Shane Callahan

>> —yeah.

Krista Case

>> We need to be able to scope their access and authentication according to the job at hand. Yes. And really kind of tied back to the intent of why they're looking to access data or take a certain action. So, understanding that this is probably a problem that you're working through, but can you share a little bit about how you're thinking about putting the pieces in place to be able to potentially achieve that objective someday?

Shane Callahan

>> Sure. So, one of the concerns I have right now is, well, if we go back a little bit, from an HR perspective, at some point, or leadership perspective, your leadership is also going to require an understanding of agents of some sort and how that works. That is going to be a completely different palette for whatever we do. I'm sorry, we're going to have to back up a little bit. I got tied up on the HR part. What was the second part of your question?

Krista Case

>> So I was basically asking you, how do you think about preparing your identity security architecture to have kind of the scope?

Shane Callahan

>> Yes. Yeah. Yeah. So I'm not gonna add a specific technology to it, but I'm gonna talk a little bit about incident response. So right now we have problems where, say a bad actor does something, we know exactly where to go. We can tie that identity to Bob and say, Hey Bob, what happened? You did X, Y, and Z. If you have an agent that does something and it goes outside of your guardrails, are you accountable for that or is the tool accountable for that? What happens if that tool gets out of guardrails and impacts another group or another company? Does cyber insurance help us with that? Where do we go? Where does the liability stand. So I feel very confident that we're going to be able to understand the technology and say, okay, we can make this thing do that. But when we don't understand the actions of some of these things and when they can make an impact, that's where I get a little bit worried. We don't understand where liability or responsibility falls at this point.

Rebecca Knight

>> But I think no one does, right? I think that we're all still— everyone is still figuring that out in terms of when AI makes mistakes, Who is at fault? So many of your users are 18-year-olds, young, young people who are smart, motivated, incredibly tech savvy. Are they a bit of a wildcard here in terms of how they're using AI and given how fast they are able to adopt new tools and use them very effectively without a second thought?

Shane Callahan

>> Yeah, sure. I would say wildcard in a sense, but not in a bad sense. Yeah. Okay. We're still trying to figure out how people use things. And I find— I'm not going to speak for deans or how we do teaching and learning at Vanderbilt. But what I can say is some of the best questions that we've had when we were deploying large-scale AI tools are from students saying, well, how does this work? Can I use it for homework? Can I use it to do this type of coding to create these kind of things? And quite often they would come to us for advice. On those things too. So I think, going back to the beginning of the conversation, I think our students are the highlights of what we do. Super creative. They want to do what's right. But I can guarantee you too, there are probably some wild card things that are happening too. Let's not be naive about it. It's definitely happening. But I think the overall vibe is it's pretty positive. And one thing I didn't expect, and I've noticed this talking to some other groups, is the skepticism that is coming out of student-led organizations and people where, people my age, they're either anti-AI and just, it's going to kill us all, or they're just sold on it. But I think our students in that generation, it's the future, which is very comforting because they are skeptical of things and they're asking questions. They want to do things safely. And that gives me a lot of hope in how we handle these problems.

Krista Case

>> There's some optimism there for sure. And so I guess, Shane, there's kind of two problems to be solved, in this day and age. One is kind of the runtime and kind of governance piece that we've been talking about a little bit. But the other piece kind of goes to what we're talking about in terms of, how folks within the organization are adopting AI and that sort of thing, the visibility and the discovery piece of it. So, Maybe we can spend a minute talking through how you're thinking about approaching the discovery problem, especially considering that agents might appear through SaaS applications, developer tools, individuals experimenting. Maybe you could comment on that.

Shane Callahan

>> Yeah, this is a tough one, particularly at a university where we're about openness, sharing, discovery. What I go back to all the time, even when I was CISO, is I would give people advice If you want to be a really good CISO, try to be a good CTO. Focus on the user experience because if you can get the user experience right and people want to use your tool, it protects everybody. They're not— because they're the smartest people in the world. They're not doing the right thing. They're going to go outside that, creating more security issues. So the biggest thing for us is to make sure we get ahead of vetting tools and vetting products and giving people a great user experience and giving them a sandbox to play in. Otherwise, it's going to be a free-for-all because historically universities will have a lot of rogue IT just popping up everywhere sometimes for good reason, sometimes just because people wanted to play with something.

Krista Case

>> And so you kind of referenced, Shane, that you've had your experience as a CISO, you're a CTO, kind of your robust background. We also were talking a few minutes ago about the fact that there is kind of this shared accountability as we start to not only experiment with AI but move it into production, something that we've been spending a lot of time thinking about as well. Can you talk to the team at the table, given that you've held many different roles, and sort of what does that team look like today as we're thinking about not only establishing maybe from a university perspective how we're using AI, but then from a security and a technology perspective What are the pieces that need to be put in place, both technology and process-wise, to enable that adoption to happen safely?

Shane Callahan

>> Yeah, so there are a couple things that I say about this all the time that are a little bit, people would raise an eyebrow about, where one of the biggest struggles that I see for some of my peers in and outside of higher ed is we're treating AI like it's a brand new thing. But really, you're still talking about identity data in another technology tool. So I try to tell people, you don't have to recreate everything. If you have a governance process and a technology intake program, do that, use that. You will run into problems in AI if you don't have a cross-functional governance group, if you don't coordinate with the provost, if you don't coordinate with the researchers and students and others and have them give input, you're probably a utility organization where you're just keeping the lights on and making sure wireless is working. But if you're a strategic partner in the university, you have a cross-functional governance program already. So just utilize that. And sometimes I give people side-eye when they create these entirely new groups, new titles, new— sometimes it's warranted where you have to add something here or there. But generally speaking, the tools are already there. You just have to think about things a little bit different, maybe a couple of additive things. But I think I could go into a whole rant about CIOs are not doing their job. If you go into an organization and you have a whole alphabet soup of all these other technologists that sit next to the CIO. If that's happening, you're not a strategic partner in your organization and the business knows that. And they're creating new titles, they're creating new positions, they're creating new committees because you're not delivering.

Rebecca Knight

>> I think that that really gets at the tension right now that's happening across businesses around the world in the sense that this is just another— AI is just another tool, just another technology. And yet we're also hearing and seeing and feeling for ourselves that it's also fundamentally different, that is going to change absolutely how we live our lives, how we do our work, all of it. So it is this tension that we're all trying to navigate here. But I also wanted to ask you, because in addition to this very professional career that you have, you also moonlight as a musician. I do. So I'm curious to hear how you think about your role as CIO and what you do in the music world and how those worlds collide for you and how you use your technology brain and your music brain.

Shane Callahan

>> Yeah. So sometimes those sides of the brain, they really argue. I remember in undergrad I was an engineering undergrad and one of my favorite professors used to say, you have the artist brain that just gets angry with the engineering brain and those two fight. And I thought that shouldn't be— that's the same brain. Engineers are very creative. But when I think about it from a CIO perspective, I think a lot of it is about organizing. usually when people think about leadership, they think of sitting at the podium and go team and all the cool, sexy things about it. But really, at the end of the day, the key part of leadership is organization. And getting the right people in the right spaces. And if you can get into a studio with a song that did not exist before and it was created by 1 or 2 people and get 10 other people to somehow mold it into something and walk out as friends, there is something to be said about being able to pull teams together because you have all these Type A musicians that think that thing that they did is the most important part of the song. And maybe it's not. Maybe it has to go on the floor. Maybe it's what makes the song. And to be able to do that and also lean back and just be a musician sometimes and say, I got to be the player here and I have to be the team player. I wish all leaders could go into a studio for a week with top-tier professional musicians. It will change your life in every way.

Rebecca Knight

>> That's where the magic happens. I love it. Shane, thank you so much.

Shane Callahan

>> Really great conversation. Oh, thank you. I appreciate it.

Rebecca Knight

>> I'm Rebecca Knight for Krista Case. Stay tuned for more of theCUBE's live coverage of Okta Oktane. You're watching theCUBE, the leader in enterprise tech news and analysis.