Okta Oktane 2026 | Charlotte Wylie, Okta

Clips
More from Okta Oktane 2026

Charlotte Wylie

SVP Deputy Chief Security Officer

Okta

play_circle_outline Charlotte Wylie's remit as Okta Deputy CSO: architecture, vulnerability, product security, GRC

play_circle_outline 130% Phishing Spike from AI-Driven Attacks Pushes Adoption of Phishing-Resistant Authentication

play_circle_outline Agentic Identity, Governance, Authorization, and Visibility to Prevent Rogue AI Actions and Detect Anomalies

play_circle_outline ISPM, Shadow AI Discoverability, and Sandboxing for Secure Endpoint Agents

Info
Transcript

Charlotte Wylie, Okta

Charlotte Wylie

SVP Deputy Chief Security Officer Okta

In this interview from Oktane 2026, Charlotte Wylie, senior vice president and deputy chief security officer at Okta, joins theCUBE Research's Krista Case and co-host Rebecca Knight to discuss how Okta is extending identity security to AI agents as they become active participants in enterprise workflows. Wylie unpacks the newly announced Blueprint for the Secure Agentic Enterprise, a coalition with partners including AWS, CrowdStrike, ServiceNow and Salesforce designed to give customers consistent, high-fidelity risk signals across the agentic stack. She deta... Read more

explore Keep Exploring

What are the responsibilities of the Deputy Chief Security Officer at Okta? add

Is AI making social engineering and phishing attacks more frequent or effective, and what defenses should organizations adopt? add

How should authorization and governance adapt as an AI agent's intent and behavior drift or evolve over time? add

How should enterprises secure and govern AI (including discovery of shadow AI/agents, managing agent identities and authentication, and using sandboxing) so employees can still innovate while protecting production environments? add

bolt Powered by CUBE AI

Charlotte Wylie, Okta

search

Rebecca Knight

>> Good afternoon, everyone, and welcome back to theCUBE's coverage of Okta's Oktane 2026 here at Caesars Forum. I'm your host, Rebecca Knight, alongside Krista Case, who is the principal research analyst at theCUBE. One of the things that you talk about a lot, you write about a lot, is this changing, evolving role of security teams.

Krista Case

>> Yes.

Rebecca Knight

>> And the role they play, particularly as they relate to the board.

Krista Case

>> Absolutely, Rebecca. What we're seeing is that enterprises are going ahead and they're adopting AI. It's definitely in production. They're starting to lean on it for important business functions. And so what that means is that they have to make some tradeoffs, right, between adopting AI and the risks that it takes. And especially in this agentic world, we need to understand what are the potential actions that an agent can take and how might that ripple across the business?

Rebecca Knight

>> Well, here to talk more about that with us is Charlotte Wylie. She is SVP and Deputy Chief Security Officer here at Okta. Welcome, Charlotte.

Charlotte Wylie

>> Hi, thank you. Thanks for having me.

Rebecca Knight

>> So before we get really into the relationship with the board and how it has changed and how it's evolving, I'd love you to talk to our viewers a little bit about what you do as Deputy CSO and what your remit is.

Charlotte Wylie

>> Well, I do a lot of different things. So I've been at Okta for 4 years as the Deputy Chief Security Officer. I run a lot of the technical security services within our security program. So everything from security architecture, vulnerability management, product security, asset management, and governance, risk, and compliance. So I joke that the SOC is the only thing that I don't lead and I have no intention of. But outside of that, I support our customers. I support our team making sure that we're thinking about how we secure our products, that we're building the right features into our products that our customers are asking from a security standpoint, and that I'm working with the business and the executive team around making informed decisions about our enterprise and things like our adoption of AI and the things that we need to be maybe more concerned about as we run the security program.

Krista Case

>> Yeah. And so, Charlotte, on that topic we've been talking today a lot about the Blueprint for the Secure Agentic Enterprise with your partners that was announced this morning. And before we started the cameras rolling, Charlotte, you and I were talking a little bit about the value of having that interoperability between Okta and its partners, because that's really where customers are at, but also how customers can use it to make better informed risk decisions. We were playing a little bit of devil's advocate. You know, I was asking you about, okay, what if there's conflicting information between what Okta is seeing and some of your partners? So prove me wrong. You know, that's—

Charlotte Wylie

>> that was a good— it was a good chat that we had before we started rolling. So some of the announcements that we made today, one of them was the Blueprint Alliance. And this is in recognition of the fact that many of our technology peers and our partners are staring into how we solve the problems around securing agentic identity or securing the agentic stack. And rather than trying to solve that problem alone, there is a recognition that we have to galvanize as an industry to solve this problem for our customers at a speed that they are scrambling to run at. And so we want to make sure that we provide an architecture, a referenceable position of how to use the technology that we all offer in a way that we can secure the entire agentic stack. And so the blueprint reflects that coalition. And so some of the partners that we've announced today— AWS, CrowdStrike, ServiceNow, Salesforce— these are peers and partners of ours who are coming to the table. They're looking at how they fit into this blueprint, how they solve this problem. And to the point around security teams that have this technology across their agentic stack, how do they do the right trade-off around risk decisions and conflicting information? That's definitely not the intention. That's exactly what we're trying to avoid, which is the more that we work together as an industry and we galvanize the security ecosystem to be able to answer some of these questions, We want our customers to be able to make risk-informed decisions with high fidelity using the risk signals that they can get from the various technology providers they're using within their ecosystem.

Rebecca Knight

>> So it has to be one of the most timely announcements ever at a technology conference because we are at a point in time where securing Agentic AI and their identities and their authorizations is actually something that is talked about on kitchen tables around this country because of recent headlines that are pretty scary.

Charlotte Wylie

>> Yes.

Rebecca Knight

>> So when you say that the recognition that the technology industry needs to band together, needs to galvanize to solve these problems, do you think that that word is getting out to regular Americans just in the sense of, we know, we're working on this, we recognize this is a problem and we are working on it together?

Charlotte Wylie

>> I want that message to get out to the families sitting around the kitchen table hearing the news that they're hearing today. And there is a very high amount of fearmongering around the acceleration of AI and what it means to society, what it means to your everyday person. And so the quicker that we can get out there with the message around, hey, we're really thinking about this really hard as an industry. We're working with the likes of some of the big names when it comes to AI very closely to not slow down, the rate at which AI acceleration is happening and AI adoption, but to come to the table in a way that those sitting at the kitchen table, the families and the folks that are talking about what do we do, they have a sense of confidence that we're doing it in the right way. But no, right now I think that message is still yet to really hit home. That's something that we're doing, we're trying to do today. And I'm hoping that some of the messaging that we've got out there about some of our products and about how we're steering into this bleeds well beyond the conference and well beyond the attendees here. And so hopefully they're going back to their families and saying, hey, I know how we're going to do this now. And we've got solutions that I think are going to protect us when we think about what it means to the world and everyday people.

Krista Case

>> And Charlotte, reflecting on those headlines and as you mentioned when you were introducing your role, the work that you're doing around threat intelligence. So I'm hearing two sides of the coin, right? So these days, obviously, AI is increasing the speed and the scale that attackers can operate. Yeah, certainly. I'm hearing that there are pockets where AI is actually allowing malicious actors to create new types of attacks. Right. And new potential attack patterns. So I guess I'd be curious, the research that you're seeing, are you seeing that it's purely kind of a speed and scale play? Are there some new types of threats that we should be thinking about? And then if so, in your role as CSO, how is that changing how you think about Okta's defensive posture?

Charlotte Wylie

>> Yeah, AI augmented attacks are not new. We've been seeing this in the wild for a significant period of time. The types of attacks that we're seeing are also to a degree not new. So Okta Threat Intelligence, something that we stare very deeply into is social engineering attacks. And yes, they are being more AI-driven, but they're the same things that we've been seeing for many years. And this is where for us, a message that we're getting out to our customer base very clearly is phishing-resistant factors matter more now than ever. In August alone, the Okta Threat Intelligence team saw a 130% increase in phishing for our customers. So really, to your point, AI is accelerating the rate at which these threat actors can go and perform these attacks. What we need to do is we know we have the right solutions in place, like phishing-resistant authentication. We want to make sure that that's being widely adopted, well-enforced at our customers and their organizations so they protect themselves from those types of events. But social engineering is not new. It's been out there a long time. It's just that this augmented AI world means that these attacks are happening more frequently and at speeds that we need to counteract.

Krista Case

>> Yeah.

Charlotte Wylie

>> Yeah.

Rebecca Knight

>> So how are you approaching that? Because we heard Todd McKinnon up there on the main stage today talking about this tension between innovation and safety and visibility and control. Yeah. And do you feel like you're almost constantly refereeing a fight between going fast but also staying safe?

Charlotte Wylie

>> I'm actually incredibly excited. This is for security professionals right now. How exciting.

Rebecca Knight

>> What a time to be alive, Charlotte.

Charlotte Wylie

>> I know. How exciting for us to stare into this new world where there is no other option than to go fast and accelerate. And so I'm— yes, there's a certain level of how do you innovate and how do you push forward and do it securely. I think a lot of security teams and security companies like Okta are actually incredibly excited about how they solve that problem without slowing down adoption, without slowing down enterprises in the way that they're operating. So I don't think it's a sense of fear or are we doing the right things or do we have the right products? Everyone is accelerating so fast to be able to solve this. And it's just really exciting for, I think, teams like mine and companies like Okta. Yeah.

Krista Case

>> And Charlotte, on the note of how fast we're accelerating we've just kind of been talking a little bit about the external perspective. We're now leaning into how enterprises again are adopting AI. And a big piece of that is AI agents and the potential insider risk that they create. And I know Okta brings the position to the table that these agents need to have their own unique identity.

Charlotte Wylie

>> Correct.

Krista Case

>> They need to have access that's very scoped according to their specific tasks that they're trying to get done, because we really need to start refereeing, if you will, according to the actions that they're trying to take. So I guess the question is, when we think about an agent's intent and its actions starting to drift or evolve with time, especially in your view as a CSO, you know, I guess, how do you think about authorization and how that needs to adapt as the agent's behavior starts to adapt over time?

Charlotte Wylie

>> Yeah, so some of the big events and incidents that we've seen recently demonstrate that agents don't need to be compromised in order to have a breach. And so the idea of governance really comes into play so that that intent drift that you talked about is very carefully managed. So when we think about some of the products that we have to manage that, yep, authorization is incredibly important. When you can scope the right permissions for an agent and you can govern those permissions effectively with products like Okta for AI Agents and you have the right visibility of how they are performing those actions and when that intent drift happens and you can correlate, hey, this shouldn't— this agent shouldn't be doing that activity. You can stop that rogue agent in its tracks. This is, I think, how we're trying to solve for that idea that how do you trust an agent in a way that you can use it effectively and you have faith in the fact that that intent drift isn't going to happen, that permissiveness around the actions they're performing is not going to be way above your risk tolerance or take an action that is going to compromise your own organization.

Krista Case

>> And Charlotte, beyond the identity context, that is inherent to Okta.

Charlotte Wylie

>> Yeah.

Krista Case

>> We were talking earlier about the Blueprint Initiative. What other pieces of context within the security stack do you think are really critical to understanding the intent of the agent?

Charlotte Wylie

>> Really, when you think about securing enterprise AI, it starts with making a secure path as frictionless as possible to be able to continue with innovation across your company. So yes, it definitely starts with discoverability and looking at What are those custom agents that my employees have on their endpoint? And we use tools like our ISPM product, Identity Security Posture Management, to look at that shadow AI. And then once you have that scope, really it's then about, okay, we know that we have these out there in our corporate environment. What are we going to do to be able to protect them? And that's where we play into the idea of a new identity type, an agentic identity type, and leveraging things that are not new to us like SSO, and having the right authentication in place and being able to govern those agent identities. So this is the way that we think about it in terms of enterprise AI. So we've got ISPM thinking about things in terms of discoverability. We're using Okta for AI Agents so that we can look at how we govern those agents. And things like sandboxing is incredibly important to us to make sure that, there's no bleed or compromise into any production environments. So thinking about this across the enterprise in a way that our employees are still excited, they're still using what they need to use, they're still developing what they need to use, and also that we're shipping code fast and as securely as possible.

Rebecca Knight

>> How has your relationship with the board changed since Agentic AI has entered the conversation? as Krista was saying, there is more of a strategic advisory, a partnership role that you're playing. Yeah. I'm curious to hear about the conversations that you're having and how much you're doing educating board members, how much maybe they don't know.

Krista Case

>> Yeah.

Rebecca Knight

>> That you're explaining what's going on. And then also how much are you helping them with strategy?

Charlotte Wylie

>> I think surprisingly, board members are so engaged in the conversation because they hear it so much in the news. So I think it's almost, it's very different to maybe how security teams have operated in the past where, it's sort of in the dark, and they're trying to explain certain things to a board that maybe is completely uninformed about what the security program and team are trying to achieve. It's the opposite. They're seeing things in the news that maybe they have never seen before. They're asking questions that you would expect maybe a very informed person within the organization to ask of the security team. And so things like the announcement of some of the Frontier models and their capabilities and what their abilities are to find vulnerabilities and how they can be exploited. These are conversations that we're having with the board, which is phenomenal because it does also mean as a security program you're having conversations that can transform the organization. You can get the work done that you need done, and it also galvanizes the entire company to appreciate the role the security team has in both the adoption of AI and the risks that we face around that adoption. So right now the conversation with the board is actually a very different one than I think I've seen and that many other CISOs have seen in the past, and one that I think we can use very effectively to make huge leaps in securing enterprise agentic adoption. So yeah, it's exciting.

Krista Case

>> Yeah, I agree, Charlotte. I'm hearing that from other security practitioners as well, that there is a kind of awareness and an understanding that there's a certain degree of risk that we have to start tolerating now. At the same time, that kind of goes beyond just, okay, how many agents have we deployed? So what would be your recommendation in terms of how to quantify the risk that an enterprise is going to take by adopting an AI driven strategy?

Charlotte Wylie

>> Yeah, there's some things that are important to an enterprise, I think, before risk. So the return on investment needs to be the right conversation first. We talk about the spend around tokens. We talk around if the deployments that people have around the agents that they're using, these custom agents on the endpoint, are actually doing things that are more productive, more cost effective to an organization rather than just tinkering around. So I think really that return on investment conversation, is it truly a revenue-generating or productivity-gaining activity that we're getting here with the use of GenAI that needs to feature? And then underlying that is then what are the risks around doing that and where is that risk tolerance for us as an organization around the potential drift of any agents and the scope that they have, any drift on intention and the access that they have. So that's a slightly different conversation, but one that needs to be overlaid around that agentic adoption. So our role as security leaders is to make sure that the entire enterprise understands that trade-off, or the trade-off, or sometimes just how to make sure that you still stay on the right secure path and you still move down that path of return on investment and revenue generation and use of agentic AI, but very, very securely. So.

Rebecca Knight

>> Excellent. Well, thank you so much for coming on the show, Charlotte. A really interesting conversation.

Krista Case

>> Great, great.

Charlotte Wylie

>> Thank you so much for having me.

Krista Case

>> Thank you, Charlotte.

Rebecca Knight

>> I'm Rebecca Knight for Krista Case. Stay tuned for more of theCUBE's coverage of Okta Oktane. You're watching theCUBE, the leader in enterprise tech news and analysis.