Okta Oktane 2026 | Bhakti Pitre, ServiceNow

Clips
More from Okta Oktane 2026

Bhakti Pitre

Vice President of AI Platform Security Product

ServiceNow

play_circle_outline Responsible AI Governance and ServiceNow AI Platform Security for Production Deployments

play_circle_outline AI Governance Framework: Discover Shadow AI, Observe Runtime, Ensure Compliance, Secure Systems, Measure FinOps ROI

play_circle_outline Need for multi-vendor, interoperable approach and industry alliances

play_circle_outline Identity and session token security collaboration with Okta

Info
Transcript

Bhakti Pitre, ServiceNow

Bhakti Pitre

Vice President of AI Platform Security Product ServiceNow

In this interview from Oktane 2026, Bhakti Pitre, vice president of AI platform security product at ServiceNow, joins theCUBE Research's Krista Case and theCUBE's Rebecca Knight to discuss how enterprises can safely operationalize AI agents through governance frameworks that pair business context with identity security. Pitre outlines ServiceNow's five-pillar approach to AI governance — discover, observe, govern, secure and measure — emphasizing that shadow AI discovery and continuous observation are foundational to everything that follows. She reframes the p... Read more

explore Keep Exploring

How should organizations approach security and governance for AI systems? add

How does ServiceNow approach AI governance and what are its main pillars? add

Why is it critical that industry stakeholders (hyperscalers, security vendors, and SaaS providers) collaborate on AI governance, security, and safety? add

Can ServiceNow implement and scale AI capabilities on its own, or does achieving democratized, secure, and governed AI require collaboration with other vendors and partners? add

bolt Powered by CUBE AI

Bhakti Pitre, ServiceNow

search

Rebecca Knight

>> Good morning, everyone, and welcome back to theCUBE's coverage of Okta's Oktane 2026. I'm your host, Rebecca Knight, alongside Krista Case, Principal Analyst at theCUBE Research. So Krista, responsible AI governance, that is the buzzword of certainly Okta's Oktane, but also maybe of the year.

Krista Case

>> It is, Rebecca. It's more than even just a buzzword. we talked about this in our kickoff for the day following the keynote. I hear consistently from practitioners that their companies are going ahead, they're moving AI into production with or without their help. So we need for IT and security to be able to meet them where they're at and provide some of these responsible guardrails in order to facilitate that process.

Rebecca Knight

>> Well, indeed. And here to talk more about that, I would like to welcome our guest to the show. She is Bhakti Pitre, VP of AI Platform Security Product at ServiceNow. Welcome, Bhakti. Welcome back, I should say.

Bhakti Pitre

>> Thank you. I'm happy to be here.

Rebecca Knight

>> So your title is AI Platform Security Product. Talk a little bit about what you and your team spend your time building. Why don't you start there?

Bhakti Pitre

>> That's a great question. Cybersecurity is not new. It has been there forever. AI has accelerated it as an enabler. Now, we don't look at security as, hey, I don't like those security people in my company because they ask me not to do something. We look at security as an enabler, which is where we say that, hey, what we could do for you to securely build AI, that's where most of our time is going. And the other aspect of that is the governance of AI. So it's not enough to secure the AI. You also have to watch it. You have to govern it. You have to comply with the guardrails, and then you have to make sure that it is safe for everybody to use.

Krista Case

>> And Bhakti, can you talk a little bit about from the ServiceNow perspectives, what exactly does safe and responsible AI governance look like for your customers? you were kind of just talking through this lifecycle that I think really meshes with what we heard on the main stage this morning from Okta in terms of those four pillars, everything from discovery through having that kill switch. But if you could provide some color, what you're hearing from where your customers are at today, that would be great.

Bhakti Pitre

>> Yes. That's a fantastic question. I think it's a lifecycle, as you said, right? So the way we think about at ServiceNow, AI governance, it's 5 different pillars. The first one is discovery. You can't act on something unless you see something, and that's where it all starts. But let me tell you one more secret sauce around that. You also need to see what you can't see, which we say is shadow AI. So for ServiceNow, it's discovery of what you know and discovery of what you don't know, but we bring that discovery to you and that makes it a complete discovery. Once you have the discovery, because AI is a probabilistic technology, non-deterministic, you also need to observe it continuously. So continuous observations are very critical to see the AI that you have built, to see what that AI is doing in real time. Now, those two are foundational in our opinion. Once you have those two, then you need multidimensional focus on AI. And what do we mean by that is you need the risk and compliance governance for it. Most of our customers operate in regulated market. They need to make sure that they comply with the frameworks that they need to, to perform their businesses. And for that, we have built a technology which makes sure that what we discover for AI, we connect that to the frameworks of compliance and we present it to our customers how compliant their AI is. So that's the governance aspect. The second aspect is security, which is an interesting one because now historically the security has been, hey, we need to put in place some security guardrails before we put something into production. And after you put something into production, you need to see what it is doing. So it's a proactive and reactive approach of security. What AI is forcing us to do is runtime security. And that's where ServiceNow focuses on to make sure that we have an autonomous security that we can offer to our customers. And last but not the least, FinOps. It's money at the end of the day, what it is bringing to the business. With the investments that we are making into AI. And we think that that's a critical approach for our customers to consider when they make their AI investment. So as you could see, if I have to summarize, it's 5 different things: discover, observe, govern, secure, and measure. That's what we are building at ServiceNow.

Rebecca Knight

>> But part of that vision is empowering a team to be able to step in if an agent is misbehaving or going rogue or doing something we don't want it to do and shut it down quickly. Can you talk a little, walk us through a scenario where that might be what needs to happen and talk a little bit about how rare that is? Is that a rare break glass situation or is that something that happens maybe more frequently than—

Bhakti Pitre

>> That's a great question. I get that a lot when people call it kill switch. I love the term, but I also encourage everybody to think about that kill switch is not just a button. It's not on and off. It's not always the break glass. It doesn't have to be that way. The way I encourage everybody to think about it is it's a graduated response. What I mean by that is your agent which you have built is working in production and looking at say some knowledge articles. Now if it's just looking at the knowledge articles and not producing any result, it doesn't pose much of a risk for you. In that scenario, you might just want to pause the agent and investigate the agent and see, hey, why this agent is not producing the results, right? That's more like the softer response to agent not behaving, right? But then it could happen that you build an agent to provide, say, discounting. right? And that agent was allowed to discount only 10% and it got prompt injected and now it is discounting 100%. Now that's when you have a big problem. That's when we say that you need to pull the plug. And to pull the plug is when we say the kill switch scenario, right? And for ServiceNow, the way we have thought about it and how we are going about it is it's one thing to pull the plug. It's very easy in a way to pull the plug. Why to pull the plug is very critical. You need to have the business context. And that's what ServiceNow focuses on. We are the hub of all the IT assets. With Discovery, we are the hub of AI assets. And now we have an ability to show the impact of AI assets on business assets and business assets on AI assets. And that's when we tell you what is the business impact of you pulling the plug on that agent. And that's the most critical aspect in my mind is the why, right? Because if you don't know why you are killing the agent, you might be causing the business interruption, right? So that's more like the business context of it. And one last thing I would say is you always don't need to pull the plug either, right? It may happen that, hey, this agent gained more access than it should because the technology is non-deterministic. And that's when ServiceNow has this product called Veza, which helps us reduce the access of the agent to bring the agent back into its access boundaries.

Rebecca Knight

>> Bring it in a bit. Okay.

Bhakti Pitre

>> Right. And that's why I say it's a graduated agent containment response with the holy grail of kill switch. And all of that needs to be built with the partnerships like Okta that we are currently building with.

Rebecca Knight

>> Graduated response doesn't have quite the same ring to it as kill switch. But we'll get there.

Bhakti Pitre

>> We'll get there.

Rebecca Knight

>> Yes.

Krista Case

>> Yes. It's very true. And Bhakti, so much of this comes down to understanding the context and the intent. And one of the things that we spend our time looking at is how that context comes together, right? So you have a company like Okta that has the identity side of it, but really that business context really lives in the application layer, right? like a ServiceNow. And you spoke a couple of minutes ago, Bhakti, to this kind of push and pull between the fact that these agents are probabilistic, but we need some deterministic controls at the end of the day. So I guess the question to you is how do you think about cultivating that context and then creating kind of deterministic controls underneath all of this that are going to help to prevent the agent from going off the rails to begin with?

Bhakti Pitre

>> Yes, I think that's a great one. The context and the intent of the agent execution is critical to get the outcomes that you are looking for. And throughout that execution of agents, it may happen that the agent left the boundary. And we have seen recently the incidents happening around that situation, right? And that's the reality of AI. And that's why I say I completely agree with you. Kill Switch is the hammer. In fact, the graduated agentic containment response has a vibe to it which gets you to the hammer, right? And going back to what you were asking me about, I think that there is a different way of thinking about it. In my opinion, there are some static deterministic aspect attributes of agents, right? For example, what's the identity of this agent? What access it was given when the agent was created? What is the risk of this agent? If this agent was created just to watch something, it might not have that much risk. But if this agent was created to manage the data center, the risk of the agent goes up because now your entire business is dependent on what this agent is gonna do for you. Right? So it's a collection of those static attributes of agents. And then there is a dynamic aspect to it. When you put that agent out into production, what it's gonna do based on the responses it's gonna get from the model that it's gonna rely on and the user prompts or the system prompts that it's gonna process. And that's when you start losing control. Losing control because you don't know what prompt it's going to get and what models are going to tell it. And at that point, if you remember, I said the runtime controls are very critical. Runtime controls are when you can scan through, hey, if this agent is processing my credit card when it's not supposed to, if it is, oh no, you are not allowed to do that, right? And it has to happen right there during the agent execution. And that's why I said that the runtime controls are very, very critical. Now, all of that needs to be backed by the business context. Why I say that is because if you have built an agent to process the financial transaction, it must process the credit card information. In that case, you should not be stopping that agent, which is going back to what I was saying. You are stopping your business. You build the agent for a purpose. You have to let the agent serve the purpose, right? But if the same agent is built to just scan through the news and is processing your credit card, that's when you have an issue.

Krista Case

>> Very different levels of risk. And is that why when we think about governance and orchestration from your perspective, is that why a multi-vendor approach is needed? We were talking about this earlier on theCUBE today in reaction to the keynote and the Blueprint Alliance that it's meeting customers where they're at because they're using different applications potentially different models and pieces of infrastructure. So to get that full context and visibility and then have the required points of control, we do see that interoperable multi-vendor approach being critical. But can you give some more color on your perspective on why that's critical?

Bhakti Pitre

>> Yes, I think for AI governance, security, and in general AI as a technology to be successful, industry needs to come together. And why do I say that is because you don't know where AI is going to come from. It's going to come from hyperscalers, it's going to come from security vendors, it's going to come from, the SaaS vendors. And they all have to work together for AI to be safe and successful for the customers, the individuals, and for the enterprises. And that's something that ServiceNow strongly believes in as well. And that's why I said that when we are building the Kill Switch framework, slash Graduated Agent Containment Framework, we are working with various different vendors to make sure that they, A, understand the business context, B, process the business context, and C, enforce the business context. And that's when this multi-vendor approach is very critical because some of them are sitting at the endpoints controlling the behavior of the agent. Some of them are sitting at the network layer managing the access of the agent to the tools. Some of them are sitting at the gateway making sure that the agent gets the tool that they need. And those are the areas which is where all of this business context, identity context, access context needs to be enforced, processed, understood. Why?

Rebecca Knight

>> Why join an alliance to do this? Why not just say, hey, we're ServiceNow, we can build our own and compete on our own? What was the impetus for you to say, let's get other industry players here to work on this?

Bhakti Pitre

>> Yes, I will double down on what I said. Everybody in the industry needs to come together and be each other's friends or frenemies. You can say whichever way you like it. To make the AI safe for individuals. And I would even take it to the next level, for humanity to use. ServiceNow, can ServiceNow do it on its own? Any company can do it on its own. Technology is such a good tool that you can just use technology and you can just start building. If you ask that question to a developer, they're going to go use AI agent and build something tomorrow, right? But is that the scalable approach? Is the question. If the AI needs to be at the scale where it is democratized for every person to use it, then every vendor needs to come together and play their part. ServiceNow is playing our part by providing the tools, the controls, the governance, the security. I'll give an example of Okta. We are working with them to make sure that the agent session tokens and agent identities are secure. I'll give an example of other hyperscalers who we are working with, who have a responsibility to make sure that they consume the business context that we have. Right. And that's why the alliance is very critical because A, we need to bring everybody on the same page. B, we need to make sure that we are serving the bigger purpose. And for us to serve the bigger purpose, we need a big group, the group which believes in the right purpose to provide the safety, security, and governance to the AI.

Krista Case

>> And so how do you think about avoiding that becoming a potential pitfall? Right. Because if you think about there's kind of this control plane that ServiceNow is bringing to the table with the workflow and the business context, you then have other partners like Okta in this case bringing the identity and the delegated authority. It makes sense why there needs to be kind of those control planes. But how do you think about dividing responsibility and making sure that those control planes are working together at the end of the day instead of creating more complexity for customers?

Bhakti Pitre

>> Yeah, that's a great question. And in my head it's complementary. Yeah, AI, as I said, has many dimensions. It has identity and Okta is going deeper into that, but it also needs the business context, which is where ServiceNow's strengths are. And the way I look at it is We combine the identity strength, we combine the business strength, and that's what we offer to our common customers who have both these vendors in their ecosystem to make sure that they have the full comprehensive solution to manage their AI. So it's not competing in my head. It's not at all a competition between Okta or ServiceNow or any other vendor in the market. As I said, everybody has a role to play. And everybody is playing that role to make sure that we build the safety, the governance, the security that is needed for customers and consumers to win with AI. I think the end goal for all of us is for them, them meaning to say customers and consumers, to win in the AI era. And I think that's when I feel like as I said, it's not a competition, it's complementary.

Rebecca Knight

>> I like it.

Krista Case

>> I like it.

Rebecca Knight

>> Bhakti, thank you so much for coming on the show. Really interesting conversation.

Bhakti Pitre

>> Thank you. Thank you for having me.

Rebecca Knight

>> I'm Rebecca Knight for theCUBE. Stay tuned for more of theCUBE's coverage of Okta Oktane 2026. You're watching theCUBE, the leader in enterprise tech news and analysis.