Name: Todd Thiemann, Omdia
Uploaded: 2026-09-24T19:15:00.000Z
Duration: 17 min 1 s

More from Okta Oktane 2026

Todd Thiemann

Principal Analyst, IAM & Data Security

Omdia

Info
Transcript

Todd Thiemann, Omdia

Todd Thiemann

Principal Analyst, IAM & Data Security Omdia

In this interview from Oktane 2026, Todd Thiemann, principal analyst, identity and data security, at Omdia, joins theCUBE's Rebecca Knight and theCUBE Research's Krista Case to discuss how Okta is extending identity security to AI agents as they become active participants in enterprise workflows. Thiemann notes this year's Oktane shifted from laying technology groundwork to real-world implementation of secure agentic AI, alongside continued investment in identity governance and secrets management. He highlights Okta's Blueprint Initiative as a response to Omd... Read more

Todd Thiemann, Omdia

Rebecca Knight

>> Good afternoon, everyone, and welcome back to theCUBE's coverage of Okta's Oktane 2026 here at Caesars Forum in Las Vegas. I'm your host, Rebecca Knight, alongside Krista Case, who is, of course, the principal analyst at theCUBE Research. So we've got two analysts on the show right now. I'm going to sit back and let you guys just be the nerdy, nerdy people you need to be.

Krista Case

>> Well, there's been a lot of behind-the-scenes discussion and, to the extent that we can, we're going to unpack it a little bit, obviously respecting our NDAs and everything. But indeed, it's been great to get some additional color. We spent time with the chief product officer yesterday, the chief operating officer who we're going to have on later this afternoon at theCUBE gave kind of a special conversation with the analysts. So looking forward to unpacking that.

Rebecca Knight

>> Indeed. Well, with that, I would like to welcome our next guest. He is Todd Thiemann, principal analyst, identity and data security at Omdia. Welcome. Welcome,

Todd Thiemann

>> Todd.Great to be here, Rebecca. Great to see you again, Krista.

Krista Case

>> Great to see you, Todd.

Rebecca Knight

>> No, we're excited to have you. This is— you're obviously an industry veteran. You've been around at a lot of not only Okta Oktanes, but a lot of industry shows. We are at a real moment in time with AI agents, and I think that they have become a conversation that ordinary Americans are talking about. I'm curious to hear from your perspective, how this show is stacking up to you in light of this moment that we're all living through with a much greater awareness of AI agents and their potential and their power and their precariousness too.

Todd Thiemann

>> So, so if I look at past Oktanes, there was a lot of focus on some of the technology and laying some of the groundwork. Okta has always been really good about standards and previously had announced Cross App Access. And this year was about sort of implementation, going to town. It wasn't so much, here's some new innovations or new products. And there was some of that, but it was more about let's— we're now in a place where we have the wherewithal to take advantage of AI agents in a secure fashion. And oh, by the way, we're not forgetting the other stuff in terms of identity governance and secrets management. It's not all agents all the time. There was also one of the things that was really good on Okta's part in my mind was the Blueprint Initiative, because there's two— one of the things our research at Omdia found was when I asked about 400 people, what's the primary inhibitor for you implementing identity security for AI agents? The number one answer that came back was basically confusion and also an uncertainty about where the attacks are going to come from. where should I patch? I don't know. There are all these different points. What should I do? That was the number one factor. And I think Todd McKinnon, great name, that Todd guy, he kind of laid that out and that this provides a conversation piece, sort of an overview of all the different elements you need to consider. And it allows you as a CISO or you as an identity leader to understand, okay, I might have something there, I have a gap there, I might need to do something there, and that's good in diminishing the confusion and allowing greater comfort in terms of how people are going to move forward. Maybe it's gaps to fill or maybe other vendors they already have can get slotted in there.

Rebecca Knight

>> Well, Todd, he also said, which I thought was a really interesting point, in terms of talking about these competitors banding together, galvanizing the industry in this way. Confusion is our competition. Yes, we're competitors with each other, but our real competition is confusion. And so that is alleviating that.

Todd Thiemann

>> So it's confusion, but it's also there's still uncertainty as to where the threats are going to come from. Yes, to some extent that's becoming clearer when you have like Hugging Face and Anthropic. But adversaries are really going to town, that's going to happen in all probability because there's such a new exposed attack surface with AI agents. But we haven't seen it in a great degree yet. Yes, you've had phishing attacks that are amped by AI, but in terms of going after AI agent infrastructure breaches tied to AI agents, that's still early days there.

Krista Case

>> Yeah, no, and Todd, you and I were talking, yesterday about some of the research that you fielded specifically on these longstanding credentials and some of this insider risk. Maybe you can share a snapshot of that to try to clarify some of this confusion.

Todd Thiemann

>> So this was something published back in May of this year. So it's fairly recent, fairly fresh. And it asked the question, what credentials do you use today? And what credentials do you plan to use in 2 years? And the long story short, people use OAuth today and they want to use even more OAuth into the future, which is consistent. That's where Okta is going, where a lot of others are going in the industry. The other one that was a bit surprising is mutual TLS or mTLS, where those are basically certificates that allow you to say, okay, that laptop's a known good, in a known good state, so I'm good to go. But one of the things that was surprising was there are long-lived credentials that are out there, be it, static API keys, service accounts. And those— the research said they're not going away. And that's sort of a festering problem that's going to be with us. And you're going to see AI agents take advantage of that in a bad way, in all probability, unfortunately. There's no big motivator for enterprises to solve the problem of existing long-lived credentials. It's not like there's a compliance regime that says you got to get rid of that or you're in trouble. It's just something that's out there and it's not easy, non-trivial to sort of remove some of those. So we're going to continue to see problems tied to those long-lived credentials is what the research implied.

Krista Case

>> Yeah, and Todd, so thinking about the impact to the customer or the practitioner. One thing we were talking about in the analyst program yesterday was how much of this market is going to change or how much of this market needs to change as a result of not only enterprise adoption of AI in these new agentic identities, as well as the adversarial piece that we were just talking about. I think the consensus seemed to be that it's not necessarily a new architecture, but there's going to be existing flaws in the identity security infrastructure that's exposed, and certainly some new considerations as agents enter the equation. So what's your take? How much of this is new architecture? How much should be kind of wrapped in? What should practitioners be thinking about?

Todd Thiemann

>> One of the things that's super interesting— you've seen this, and we talked about it— is sort of the smushing together of these different categories. It used to be you had identity governance and administration here and privileged access management there and access management there and ITDR. But a lot of those things, they're coming together at the margins or in a big way. And that gets to— that's a bit— can be a bit confusing. That's one of the things that comes to light. I, in the research, I asked the question, where's the most sensible place for you to put identity security for AI agents? What tool, where would you want to put that? Because right now the research shows there's 11 different tools that are out there for workforce identity. If you're an identity leader, your team has 11 different tools they're bouncing between, and that's not optimal for a variety of reasons that most people, everybody understands. But I asked the question, for identity security, where are you looking to do that? And the number one answer was my data security platform. So that's like Palo Alto Networks. Now they have CyberArk or Microsoft or something like that. The next answer was I want to use my identity platform. That's Okta, the other people that are playing in the identity space. And then it was, I'm going to use a new specialist tool to solve that problem. And that's all your startups that are doing this stuff. And that's sort of the decision tree for a lot of enterprises. They're first going to look to what they have in terms of data security platform. Does that do it? Probably not, actually. Then they're going to look at their identity security platform and see, does that do it? Well, a lot better chance. the authentication authorization, that's pretty well understood and solved. Ways of solving that, and there's a lot of functionality there. And then, okay, neither of those work, I'm going to go with some startup. And that's sort of the decision tree for most enterprises out there.

Rebecca Knight

>> Well, in light of that, as an industry analyst, how do you see that complexity in that decision tree? And I don't know if you're thinking about giving advice, but the 11 different tools, that's a lot. And how do you help the industry think through goals being maybe to simplify this process?

Todd Thiemann

>> Well, I think some of it's you need to prune your stack over time because things change and you might have bought that tool way back in the day, but things have evolved over time. So look for efficiencies where you can, but there's a reason why a lot of vendors are creating platforms like Okta focusing on the Okta platform that solves for a bunch of different things. And you're going to see consolidation there, but there are new problems that are cropping up like AI agents, and that may mean a new tool to solve that because a lot of the larger vendors have a lot of tech debt that they need to take care of to move forward where your startups, they don't have the code base, the tech debt that has to be patched for all the past vulnerabilities. So they can go a lot more quickly. So that's one of the dynamics there. I think you're going to see consolidation in some areas, but you're going to see new tools for new problems also be deployed.

Krista Case

>> Yeah, it's—

Todd Thiemann

>> It's not a simple answer.

Rebecca Knight

>> Nothing is.

Krista Case

>> Right, and it's definitely not. And I think thinking about the security stack as a whole, we've seen for many years that there's always been this preference for best of breed. And that's created maybe even dozens of security tools in the tool chain, at least some of the research that we've fielded has shown that, Todd. So that's where something like the Blueprint Alliance, right, that Okta talks about, I think from the standpoint of providing some shared threat intelligence and providing some integration points is going to be valuable. But what I've been trying to dig into is, is this going to in fact just create another point of fragmentation, potentially in terms of another point of control that enterprises have to worry about. So I'd be curious to get your take on that. How does something like the Blueprint Alliance potentially help customers to actually move towards this goal that they've had for many years of this security platform that's integrated, that works well and addresses some of these new challenges, but at the same time doesn't add another point of fragmentation that becomes a headache down the line.

Todd Thiemann

>> I think it lays out a lot of the issues that enterprises are going to have to solve for, and they are also going to be able to map some of their existing tools to solve certain areas. Or maybe they can say maybe it's a new tool so I can consolidate on a bigger platform. One of the things it does bring to light that I think we're going to be wrestling with on a go-forward basis is one of the key control points for AI agents is the gateway. And Okta has the Okta Agent Gateway. I think that was the name of it. And it's a brilliant thing in terms of providing authentication and authorization and also visibility to what's going on with those agents. But CISOs have a lot of other security concerns around AI agents. It's not just identity. There's data security, and that blueprint actually lays out here's the different gateway functionalities you're going to need. And what that might mean is multiple gateways, which is going to be— if you have gateway proliferation, that's not optimal for CISOs to manage because there might be, chinks in the armor from a security standpoint, and there's policies to maintain across all those gateways, and just maintaining them, it adds complexity that they'd prefer to avoid. So how that's going to work itself out is one of the questions that's out there. it is with AI agents a bit of the Wild West, a lot of change happening. That's one of the issues, in that Wild West that's going to have to work itself out.

Krista Case

>> So I'm really bullish on kind of the intersection point of data and security. So really interesting to hear that your research turned that up as well. But I guess I'm curious, when you think about how this control plane is moving, will it ultimately be owned by one piece of that stack? It sounds like maybe not, but I'd love to get your take on that.

Todd Thiemann

>> I'm seeing, there's going to be multiple pieces of that stack. I don't know that it's going to be one. And you talk to some of the, you talk to various vendors out there and it's defense in depth and talk to CISOs, it's defense in depth. So there's going to be probably multiple moving pieces, multiple layers here. It's not, there's one winner, all the time, or one platform or one plane. I did research last year where I asked for all these different categories of identity, how many tools do you have? Do you have one tool? Do you have multiple tools? Or are you looking to deploy something in the future? And I give a bunch of different categories like MFA and SSO and identity governance administration, a whole laundry list. And what came back was like 45% of the time enterprises had multiple tools in each of these different categories. So it's not like it's winner take all all the time. Okay, I've got one IGA solution, I'm done. They might have multiple or I have one secrets management solution. They have multiple. So I think that's going to continue to be the case on a go-forward basis in all probability. But you can prove me wrong.

Rebecca Knight

>> So you're having conversations here with obviously Okta executives, but also vendors and customers. Is there anything that's striking to you about things you're hearing a lot of that you say, I'm going to ask that in my next research survey. This is a trend that I think could be big, maybe something that's underhyped now.

Todd Thiemann

>> Well, let me list 3 things. I actually talked to someone who I have a lot of respect for who's really plugged into the CISO community, and one of the things she said was, well, there's a group of people, CISOs are really receiving warmly Blueprint Alliance, 'cause that's a very valuable tool, and it's not like Okta's trying to sell something with that. It's an impartial tool, a bunch of vendors coming together, that's going to help security leaders and CIOs better understand and operate and manipulate things. The other thing was how identity and AI agents are a board-level conversation, and that's kind of freaking some people out. It's not— there's a spotlight on that, and you need to have your act together or have answers or at least know the right questions that you need to be prepared for. And that's moving fast, and that's just every week is some new adventure there. And the other thing was some security teams are actually shrinking, which surprised me, is what this person said. And I think it might be because AI agents are taking away maybe SOC level 1, level 2 analysts. You don't need as many of them. You need more higher-level folks, and that could be what's going on. But it surprised me that some security teams are shrinking. So that was one of the other things that came to light.

Rebecca Knight

>> Interesting, interesting. Well, Todd, thank you so much for coming on the show. Really interesting conversation, especially between two analysts, meeting of the minds. Thank you.

Todd Thiemann

>> Thank you, Rebecca. Thanks, Krista.

Rebecca Knight

>> I'm Rebecca Knight for Krista Case. Stay tuned for more of theCUBE's coverage of Okta Oktane. You're watching theCUBE, the leader in enterprise tech news and analysis.