Okta Oktane 2026 | Eric Kelleher, Okta

Clips
More from Okta Oktane 2026

Eric Kelleher

President and Chief Operating Officer

Okta

play_circle_outline Okta Blueprint and Blueprint Alliance: Four-Part Secure Agentic Enterprise Framework for Open Standards

play_circle_outline Runtime Monitoring and Identity-Based Enforcement of Agents via Okta Agent Gateway

play_circle_outline Okta Identity Fabric: Agentic Identities, Signal Fusion, Token Vaulting, JIT Provisioning, and Auditable Agent Governance

play_circle_outline Agent Kill Switches and Nuanced Containment with Recovery Planning: Data Rollbacks, System Rebuilds, Provider Coordination

Info
Transcript

Eric Kelleher, Okta

Eric Kelleher

President and Chief Operating Officer Okta

In this interview from Oktane 2026, Eric Kelleher, president and chief operating officer of Okta, joins theCUBE Research's Krista Case and theCUBE's Rebecca Knight to discuss how Okta is extending identity security to AI agents as they become active participants in enterprise workflows. Kelleher unpacks the company's Blueprint for the Secure Agentic Enterprise and the newly announced Blueprint Alliance, a coalition of more than a dozen technology companies aligned around a simple framework: knowing where agents are, what they can do, what they're doing and ho... Read more

explore Keep Exploring

What are the key considerations for securing AI agents in an enterprise? add

How should organizations manage, verify, monitor, and respond to software agents at runtime, and what role do Okta's Agent Gateway and the Blueprint Alliance play in that process? add

How is Okta extending its identity platform to support AI/agent (agentic) identities, and what capabilities does that provide? add

How do you contain, investigate, and recover (including rollback) when an autonomous agent behaves unexpectedly or maliciously? add

bolt Powered by CUBE AI

Eric Kelleher, Okta

search

Rebecca Knight

>> Good afternoon, everyone, and welcome back to theCUBE's coverage of Okta's Oktane here at Caesars Forum. I'm your host, Rebecca Knight, alongside Krista Case, who is, of course, the principal analyst at theCUBE Research. Our penultimate interview. Krista, what a day we've had.

Krista Case

>> We have had an amazing day. We've been talking a lot about Okta's evolution, some of the new announcements, including the Blueprint initiative. We've had customers, we've had partners, we've had Okta execs. So really excited to continue the dialogue

Rebecca Knight

>> here.And here to bring it home for us, our penultimate guest, Eric Kelleher, of course, President and Chief Operating Officer here at

Eric Kelleher

>> Okta.It's great to be here. Thanks for having me and thanks for all the great work this

Rebecca Knight

>> week.Yeah, we're excited. So you are both the President and

Eric Kelleher

>> COO.That's correct.

Rebecca Knight

>> In practice, how do you divide— what's the President job and the COO job? How do you make that

Eric Kelleher

>> work?They're very integrated for us at Okta. Really, we're all working together just to build a company that can help secure as many customers as possible. For me, functionally, my scope has ranged from all of our customer organizations to our marketing organization, our IT organization, our legal. I really partner with Todd and the executive team just to help make the company better.

Rebecca Knight

>> Okay.

Krista Case

>> And I imagine, Eric, one of the things that you've probably been working on quite a bit is the Blueprint initiative. I know we were talking about it a little bit before the cameras rolled and we've been talking about it with a number of our guests today. So can you talk about the role that you see it playing in simplifying the very complex task that customers have of trying to assimilate all this different telemetry into kind of signals of risk that they can actually make sense of and even leaning into the runtime enforcement and how do they try to figure out where the control points—

Eric Kelleher

>> that's—you covered a lot and you opened up really in the right place, which is simplifying. So we have been very active with customers for over a year now, helping them understand what their requirements are and thinking about how to secure themselves in the age of artificial intelligence. And everyone, every company out there knows that they need to be looking at ways to apply artificial intelligence to make their own companies more effective, to make their own companies more competitive. Every board of directors, every executive team is driving their company to figure out how to best bring this technology in to make the company better. And every company goes through a similar process of figuring out how to get started to really try to encourage people to experiment with these technologies and bring them in to really find out how to apply them in ways that can make their companies work better and work more effectively. As they get from this experimentation phase into production phase, the issue of security really becomes critical path and they need to understand how to secure it. One of the challenges companies have in navigating this is every technology vendor they talk to from every component of the stack is telling them that they're the one-stop shop that's going to fix everything. And so the biggest challenge that we have in talking to our customers is helping them navigate the confusion of understanding how to think about the problem, how to secure AI in a way that's simple. 6 months ago, we published the blueprint for the Secure Agentic Enterprise, and the blueprint was intended not as the Blueprint for the Secure Agentic Enterprise, but as an industry blueprint as to how to think about this in a way that's very simple. This week we announced the Blueprint Alliance, where the blueprint has been embraced by over a dozen leading technology companies, from hyperscalers to technology providers to network providers. The blueprint simplifies the process into 4 things, 4 things customers need to think about. Number 1, where are my agents? Customers need to know that they have a way of identifying where agents are deployed. Number 1, where are my agents? Very simple. Number 2, what can they do? And so here it's understanding for the agents that are active in your company, what have you connected them to? Have you connected them to your email, to your finance, etc.? The third thing is, what are they doing? And this is really important because this is where you hear FUD about agents coming out and maybe doing things that hadn't been intended. The runtime component of actually monitoring agents' behavior and connecting it back to their intended behavior and design is very important. So where are they? What can they do? What are they doing? And the fourth item is how do I respond? So those four areas are really, really important. And we're standardizing the conversation right now through the Blueprint and through the Blueprint Alliance.

Rebecca Knight

>> Well, that third question of what are they doing is, in my mind, the critical one right now, particularly in light of all the headlines, the Hugging Face incident, because you don't always know what they're doing. And in fact, they could be cheating on a test and then running around trying to cover their tracks and figure out the psychology of the graders and all of these things that the humans who deployed this had no idea and didn't intend for them to do that. So how do you help your customers think through that?

Eric Kelleher

>> It's really by bringing them back again to the simple categories of the Blueprint. So the runtime is important. First, you have to know what agents exist and have them in a directory that's managed with authenticators and tokens and encrypted tokens so you can verify that an agent that's taking action is what it says it is and isn't being impersonated by a threat actor. The second, when analyzing what it's doing, you need to first understand what it's intended to be doing, like what has it been connected to. Then in runtime, we've got to look at its behaviors and the way that you can look at that. And Okta's Agent Gateway is in the middle of this, as are our partners through the Blueprint Alliance. But we look at everything across the alliance from endpoint detection. We have endpoint providers and companies like CrowdStrike are part of the process, network providers, companies like Zscaler, the identity layer provided by Okta and our gateway. We'll look at what agents are connecting to and we'll compare that against the systems that it's been authorized to connect to, to see if there's a disparity. That real-time data all flows back into a system to help us identify, does something look suspicious? And if it does, that then creates an opportunity for the company to assess how do they respond. So again, bringing it back to the Blueprint, where are the agents? What can they do? What are they actually doing? And then how do we help our customers understand how to respond to that? These 4 areas are the 4 areas that we address. And it's really encouraging to see the interest in signing on to the Blueprint Alliance. We announced today with a dozen members. We have a lot of interest in this. We certainly will have a second cohort coming in as more people come in. It really will take the entire industry. And so these open standards and alliances are very, very important.

Krista Case

>> And so, Eric, thinking about that last point, how do we respond when it comes to the Blueprint initiative? One thing we've been digging into today a little bit is how does Okta think about rationalizing policies between what Okta is bringing to the table versus your customers? And especially as someone in a COO role, certainly I don't need to tell you that part of the value of using AI to start making some of these decisions is the ability to be able to trust it to make those decisions and take action on our behalf. But again, how do you think about potentially rationalizing policies between yourself

Eric Kelleher

>> and—we're all collaborating to determine the best way for us to bring our solutions to different layers. Okta's focus is on the identity layer. And so we have always focused on identity. We are completely neutral. So we're not embedded in any vertical stack, any application stack, any network stack. We work with all of those providers. We have over 8,000 integrations today out of the box. So Okta has always been the neutral identity provider managing human identities and non-human identities or service accounts. What we've done with our Okta for AI Agents release, which went generally available just in April and now has many customers live on it, what we've done is basically add Agentic identity as a first-class identity into our Identity Security Fabric. So human identity, non-human identity, and Agentic identities are all now first-class citizens in that stack. That allows us to provide all the capabilities that our Identity Security Fabric provides for agents the same way we do for humans. So things like our governance capability, which provides just-in-time provisioning and deprovisioning. It provides auditability. So you can see when you've given a human access to something and you can see who authorized that. We can now do that for agents and see who authorized an agent to connect to a system and when that happened as well. Privileged access or token vaulting and taking the credentials for agents and storing them in an encrypted fashion in a token vault where there's business rules that require them to be rotated rather than having them sit out statically on a server, which used to be the case. All those capabilities from Okta's platform come in to help secure an Agentic identity. Meanwhile, we have endpoint providers that are looking at endpoint detection to see if something looks anomalous on a device and network providers that are looking at network traffic to see if something looks suspicious. And then we overlay that with our 58 billion authentication events a month that we process through our identity layer And combined, we can connect all of those signals to help identify whether something is out of bounds. And once you discover that it's out of bounds, you need to be able to take action on that. So one of the actions that our platform takes is called the Agent Kill Switch, which is a capability that allows customers to completely deactivate an agent and all of its connections to everything. So one signal saying something's anomalous, we can immediately shut it off. And that contains what we call the blast radius of that session that is malicious.

Krista Case

>> And so, Eric, I agree. So from a kill switch perspective, obviously it addresses the containment piece of it. I'm curious how maybe you think about kind of the resilience and the rollback end of things. If an agent takes an unanticipated, potentially malicious action, you kind of talked a little bit to having the auditability of the agent behavior. But how do you think about recovering back if an agent, takes Yeah, the first step in recovery is being able to trace back to what happened.

Rebecca Knight

>> Yeah.

Eric Kelleher

>> So the capabilities I mentioned in governance that allow us to understand what was authenticated, when it was authenticated, by whom, and then the Agent Gateway's ability to track the actual transactional traffic and the behavior is important to unwind that so that you can assess what recovery is required, whether it's a data rollback or a systems rollback or if something needs to be rebuilt. So again, all the providers in the Blueprint Alliance are coming together to determine their respective role in that. And you have companies like Databricks, an early member of the alliance. They're going to focus on the data layer and what needs to happen from a data recovery perspective. Similarly, from the network providers, from the hyperscaler providers, and the cloud computing providers. So everyone's going to play a role in helping address exactly that.

Rebecca Knight

>> Is the kill switch the end-all solution? we had another guest earlier today talking a little bit about is the kill switch an option, but there's also this graduated response of, okay, can we isolate this? Can we just rein that authority in or this bit of the authentication?

Eric Kelleher

>> It is much more nuanced than just having a kill switch. The kill switch, the idea of the kill switch gets a lot of airtime right now because people are afraid. There's so much fearmongering that's going on right now. And incidents like you mentioned, the Hugging Face incidents with OpenAI. People want to be assured that if it's determined that an agent is doing something beyond its bounds, that we have the opportunity to shut it off. And the kill switch does provide that capability. That is a necessary capability, but it's not the one-step fix to everything. There are going to be cases where agents, as they're exploring their intended work, end up stepping over boundaries that were not intended, where you'll want to redirect them and bound them back in. And those adjustments will also be something that companies are going to want to look to as well. So it's much more nuanced than just killing them. But certainly knowing that we have the opportunity to just shut it down and contain anything is important for every company as well.

Krista Case

>> And Eric, an important part of this kind of remediation conversation is the human in the loop. Yeah, right. And so where do we require human oversight and human judgment versus where can we start to lean on AI to start making some of these decisions for us? What's your take on that?

Rebecca Knight

>> It's interesting.

Eric Kelleher

>> We had a talk about this earlier today. I very much believe we're going to see an evolution over time. There's enough awareness of the potential risks and the potential exposure of agents behaving in unintended ways that human in the loop is a really important component of most workflows today to ensure that as we're introducing these technologies into the workforce, we have humans involved in the loop to determine and have eyes on the work as it's progressing. we can see a future where we very quickly evolve from a human in the loop default to a human on the loop default. Where the loop is happening, agents are doing work, and humans are really looking at exceptions as things come out of the process by exception, to eventually we're going to get to the point where many of these workflows are fully autonomous, when we're comfortable that we no longer need to be actively monitoring for exceptions and we no longer need to be working on it. The problem with human in the loop is it's limiting because it forces machines to work at human pace, right? And as we get into human on the loop, we start to let machines work at machine pace with humans still looking for exceptions. And as they get fully autonomous, we'll really see the speed and capability of innovation. It's going to be very exciting, but we're going to get there as we have confidence as an industry that we can be there.

Rebecca Knight

>> How do you think about leadership in this era? And in terms of what you're doing now, the thought leadership, the guidance you're providing to the industry and to customers, as well as this idea of leadership at a time where not every worker is going to be human. In the very near future. Increasingly, they're not all human. So how do you think that this is going to become a basic skill for managers of managing the machines?

Eric Kelleher

>> I do. I think we see a future where work is done differently. And historically, the way we've all built companies is you have a need that you need to serve and you figure out who you have to hire to serve the need. And as you grow your company, which people you hire and which roles, and that will continue. But the nature of how work gets done is evolving. The work was done by people before, and then it started being done by people who had tools to use for the jobs. And software tools have evolved too, and B2B SaaS in particular, to help automate workflows and help with that. We're now evolving into a new generation where in addition to people and tools, we have autonomous workers that happen to be digital and can work at machine speed. And so the way that we're designing workflows is going to be different. That requires people to understand how to design workflows to be agent-first, which means this needs to be a core competency for new technologists as they're coming into companies and managers that have learned throughout their entire career. We pay managers for their experience. We pay them for pattern recognition. We pay a premium for more experience and more pattern recognition. In addition to continuing to do that, we need to start infusing the way things have always been with thinking that's open to reimagining the way that work has been done. And that's really exciting. It's a really exciting time right now to be able to think about how to lead a company to become what it's going to be, because we're no longer encumbered by the past. We're benefiting from what we've learned in the past, and we have an opportunity to completely rethink the way that work gets done.

Krista Case

>> Absolutely, Eric. And it goes beyond kind of the discussion of speed that we tend to associate with adoption of AI. We need to embrace AI to move faster. So when we think about using AI to do work in a different way or reimagine how it's being done, from your perspective, what are some of the metrics or the KPIs that we should be thinking about when we're making decisions about when to introduce AI into a workflow, whether it be security, business, or otherwise?

Eric Kelleher

>> You see the industry right now trying to figure that out. We've gone through a phase where it was perceived that the critical path item was that people weren't embracing the capabilities of the technology enough. And so, every company was looking at ways to drive its employees to pull the tools in and use them. Then we saw that be successful and people were using them, and then we had companies were famously just driving their employees to burn tokens. And then, all of a sudden, you've got a token bill that's tens of millions of dollars, in some cases hundreds of millions of dollars. And so then you have to look at, okay, what's the return on the investments that we're making, and how do we get that? I think every company is going through a maturation where it's getting very deliberate and intentional about ensuring it's investing in areas where there's a positive return. And we've reached the point now where people are looking at the economic tradeoffs between driving work through agents that come with token costs versus scaling them with humans that come with human payroll costs. And that's really where the math should be. We should be looking at what work is cost efficient to be automated and what work is cost efficient to be humanized. Or to continue being delivered by humans. And then we have to look at areas where we can improve the quality of life for our workers. And every worker has 30%, 40% of their job that they feel is transactional or repetitive or anything like that that can be automated and offloaded to agents frees up people to go do things that are interesting. So job definitions themselves are going to evolve to allow people to spend more of their energy, more of their time, more of their passion on the work that's really rewarding to them and bring in digital colleagues that can take on the pieces that are more administrative or transactional in nature. It's a pretty exciting time to think about that.

Rebecca Knight

>> And that will lead to better life satisfaction, job satisfaction, more loyalty on the part of the humans.

Eric Kelleher

>> So that's the path.

Rebecca Knight

>> Indeed it is. Eric, thank you so much. A great conversation.

Eric Kelleher

>> Thanks for having me. It's great to be here.

Krista Case

>> Thank you.

Rebecca Knight

>> I'm Rebecca Knight for Krista Case. Stay tuned for more of theCUBE's coverage of Okta's Oktane. You're watching theCUBE. The leader in enterprise tech news and analysis.