Okta's Oktane 2025 | Damon McDougald, Accenture, & Alex Valenzuela, Okta

Clips
More from Okta's Oktane 2025

Damon McDougald

Global Cyber Protection Lead

Accenture

Alex Valenzuela

VP, Americas Partners & Alliances

Okta

play_circle_outline Importance of AI in reshaping cybersecurity and identity management challenges.

play_circle_outline Securing Non-Human Identities: The Primary Cybersecurity Challenge in the Evolving Landscape of Digital Threats

play_circle_outline Need for organizations to consolidate and simplify their security environments.

Info
Transcript

Damon McDougald, Accenture, & Alex Valenzuela, Okta

Damon McDougald

Global Cyber Protection Lead Accenture

Alex Valenzuela

VP, Americas Partners & Alliances Okta

TheCUBE brings you exclusive insights from Okta's Oktane 2025 event as Damon McDougald, global cyber services lead of Accenture, sits down with Alex Valenzuela, vice president of Americas partners and alliances of Okta. Host Rebecca Knight and analyst Jackie McGuire lead the conversation on how identity has become the control plane for securing AI in today’s enterprise. This is a must-watch exchange on the speed of change, the rising scale of AI-driven attacks and the urgent need to govern non-human identities.

McDougald shares that CVEs rose 16% in ... Read more

explore Keep Exploring

What are the most urgent challenges companies are facing in relation to the impact of AI on cyber security? add

What are the challenges associated with securing non-human identities in the context of identity management and access governance? add

What are the key considerations for organizations in relation to identity and security when securing the future of work and leveraging AI? add

bolt Powered by CUBE AI

Damon McDougald, Accenture, & Alex Valenzuela, Okta

search

Rebecca Knight

>> Hello everyone, and welcome back to theCUBE's live coverage of Okta Oktane here in Las Vegas. I'm your host, Rebecca Knight, alongside Jackie McGuire, my co-host and analyst, just nerding out with all of this identity.

Jackie McGuire

>> It's been great so far. Yeah, I think we've gotten some really good insights on the technical side, but also handling the people side of AI and identity, which I think is something that's of top concern for most leaders right now.

Rebecca Knight

>> Well, here, to talk more about that, we have got two new guests. I'd like to welcome Damon McDougald, global cyber protection lead at Accenture. Welcome, Damon.

Damon McDougald

>> Yeah. So quick correction, I just got a new role at Accenture, global cyber services lead. So I run all the global offerings and capabilities that we provide for our clients to keep us

Rebecca Knight

>> Well, congratulations on the promotion.

Alex Valenzuela

>> Congratulations.

Rebecca Knight

>> Thank you so much.

Damon McDougald

>> It's just recent, but previous-

Rebecca Knight

>> All right. Breaking news,...

Damon McDougald

>> previously cyber protect, and I've spent, I've been at Accenture 21 years, and most of that time I've been doing identity, so I can nerd out on identity all day.

Rebecca Knight

>> Exactly. And then you're here with Alex Valenzuela, VP Americas Partner and Alliances at Okta. Thank you both so much.

Alex Valenzuela

>> Yes. Excited to be here. Thank you.

Rebecca Knight

>> Yeah, so why don't we just start with the big picture for our viewers and level set, because we know that AI is clearly reshaping cyber security. From your perspectives at Accenture and Okta, what are the most urgent challenges inside of companies, and the companies inside and outside the companies are facing right now? Let's start with you Damon.

Damon McDougald

>> There's quite a few challenges that us as security professionals should be aware of when we think about AI. And one thing that is extremely prevalent today is the speed of change. In my 21 years, I have not seen the pace of technology change that I've seen in the past two years. It's been phenomenal. It's been exciting. I enjoy it. I started at Accenture as a coder back in the day, a long time ago. And as I've grown up in Accenture, I've gotten away from writing code. But now that I can use agents to write code for me, I'm enjoying it.

Jackie McGuire

>> You're vibing?

Damon McDougald

>> I'm vibing. I'm having a great time with all this technology. However, if I'm using it for good, the bad guys use it for bad. So we've seen some trends out in the industry. We've seen just in this past year, 16% increase in CVEs. And then we've seen a 32% increase in the zero-day exploits to those CVEs. So when they're coming out, they're getting exploited right away. And the only way that's happening is through AI.

Jackie McGuire

>> Yeah. It's crazy that hackers are better at automating attacking than we are at automating defending.

Damon McDougald

>> 100%.

Jackie McGuire

>> And I would say like we've gone from living off the land to now they're thriving off the land.

Damon McDougald

>> But we're going to fix that.

Jackie McGuire

>> Yeah.

Rebecca Knight

>> Alex, how about you? What are you seeing?

Alex Valenzuela

>> Looking at it from an identity perspective, I think the number one attack vector today is identity. Right? So when you think about AI coming into that mix and folks historically securing their businesses of human identities, the big question is how do you secure the non-human identities? How do you govern them? How do you provide them access to the right applications at the right time? That's a big question today. And to Damon's point, the pace at which all of this is happening is really challenging for many customers to get in front of.

Jackie McGuire

>> If an employee goes rogue, generally it takes them long enough and they have to go through enough steps to do things, that stuff's going to stop popping up in the sim, right? You're going to start getting alerts. If an agent goes rogue, you're going to get alerts in your sim, but you're going to get them like 50 milliseconds after a hundred different actions have been taken all across your environment.

Alex Valenzuela

>> Yeah.

Damon McDougald

>> The pace and scale of those attacks are going to be unprecedented. And then a lot of, or what I'm seeing is that some organizations just aren't even monitoring for this stuff or trying to detect AI traffic at this point in time. So the capabilities that Okta is rolling out around the AI discovery, agent discovery extremely important for organizations take advantage of.

Rebecca Knight

>> So what specifically are you hearing from companies that are struggling to manage and govern these non-human entities, identities?

Damon McDougald

>> Well, there's a few struggles and organizations, I still haven't seen a very large scale rollout of agents from an organization yet. Everyone's in kind of like, let's try it, let's put it in here. They're starting to see some stuff works.

Rebecca Knight

>> Is that wise? Just because-

Damon McDougald

>> That's one of them. But I think another thing that really stops it is that most of these agentic frameworks have zero security in them-

Jackie McGuire

>> Yeah....

Damon McDougald

>> at all. And if there's a few, there's critical stuff for agents to work. There's the multi-agent orchestration, there's agent memory between the agents so they can remember what they're doing. There's the ability to pick different models and use different models for agents and have them flexible. But then something that's really important is the building trust between these agents. And you've got open standards like A2A, I haven't seen, when I see organizations build agents, they just build them and put the credentials in their .env file maybe.

Jackie McGuire

>> Maybe they're hardcoded in Python, I don't know.

Damon McDougald

>> Yeah, sometimes they're hardcoded in Python. We have one of the world's best offensive testing capability at Accenture, and the few organizations that have asked us to do red teaming, like real red teaming, not responsible AI red teaming on their agentic frameworks, in less than a few hours, we have complete control of the infrastructure, the data, and the agents. So I feel security is extremely critical to build the trust for these agents, for the organizations to scale them out. And so building an A2A, actually giving agents identities to manage them because they're going to have access to sensitive stuff and data, and then also they have tools, MCP servers and MCP is a great protocol and it's very exciting that you can add context and connect to systems and integrate agents with data, anything you want. However, when that standard was built, no security. But three months ago-

Jackie McGuire

>> Yeah, the response can be malicious. I keep asking people, I'm like, when you get a response from an MCP, what are you doing to make sure there's nothing malicious in that response? And nobody has an answer. It's crazy.

Damon McDougald

>> We've seen some interesting attacks already using MCP servers. And Anthropic, I think has realized that, and a few months ago, they reissued their updated standard and it was from security ground up, but there's so much proliferation of MCP servers built on the old standard.

Jackie McGuire

>> Yeah. And everybody now has their own MCP server, so

Damon McDougald

>> I've written a few too. It's a lot of fun, but it's got to be built with security.

Rebecca Knight

>> So Alex, describe your collaboration? When Okta and Accenture are working together for a customer, how does it look?

Alex Valenzuela

>> Yeah, it looks great, is the way it looks.

Rebecca Knight

>> Okay.

Jackie McGuire

>> Beautiful.

Alex Valenzuela

>> It looks beautiful.

Damon McDougald

>> Good answer.

Alex Valenzuela

>> I think the really important piece is that Okta's core responsibility is to bring forward the technology that helps solve for the problems that our customers are facing. And we go leverage Accenture in those discussions to help us establish milestones for customers on that journey, ensure that we're incorporating all aspects of their business in not just the near-term challenge, but helping them future-proof. Because cybersecurity continues to grow in its importance across the landscape. And again, back to the pace of change, it's only going to continue to exponentially grow. So I think where we lean in together to create confidence or establish confidence with our joint customers in what that plan looks like and helping them ultimately consolidate within their environments. Many of our customers today have disparate systems that are doing one thing or another, and the ability to efficiently manage their identities across a single platform is really critically important. And a partner like Accenture can help us go provide that vision and establish the path for us to get that done.

Rebecca Knight

>> So these kinds of partnerships really only work if all teams are aligned and on the same page. How do you build that kind of trust and collaboration across your teams as the leaders? Damon?

Damon McDougald

>> Well, there's a few things. Obviously, you need executive alignment and top-down alignment. So we've got great top-down alignment from Todd, the entire leadership, Alex, et cetera, helping push the vision of better together with our teams. Then it's the capabilities. They've got world-class leading software and capabilities, we've got world-class system integration and managed services. But then the real trust gets built in the trenches when we do the hard jobs together and set ourselves out to reach a goal and always through any journey, there's ups and downs, but sticking together and persevering and getting to the end. That's what really builds the trust between organizations.

Jackie McGuire

>> We've done a lot of surveys that show this kind of very counterintuitive sentiment that a smaller a company is the more likely they are to think they should do things, which is absolutely crazy to me, right? Because I wouldn't self-ensure if I had 10 employees, so I don't know why I would sell. So are you finding that this kind of incredible need for talent and head count and engineering resources, are people more willing now to bring in an Accenture or services partner? Are you finding people are more open to, all right, we need some bench strength, we need some expertise, we need help setting goals? Is the sentiment there changing, especially as you look at earlier stage companies or less mature companies?

Damon McDougald

>> The target that Accenture has is the Fortune 2000 companies. So we do do some stuff where we have joint ventures where we can go mid-market and work with those organizations that have typically might've gone down market either in their software purchases or tried to build stuff themselves. And I think in the identity space, it's been around a long enough where I think organizations are like, why should I build my own access management system or identity governance system? I've seen that in my 21 years, I've seen in actually some of the world's largest organizations, some of them still have custom software in that space as well. And it's pretty scary that they support that complex of a business on something they built 10, 15 years ago. And so back to your original question, yeah, I'm seeing a huge influence, but something else that I, a trend that I'm starting to see as well, the large organizations are getting more confident now to start to write their own code because they got the coding assistants and agents to build their own stuff.

Jackie McGuire

>> Oh, gosh.

Damon McDougald

>> However, as anyone that has played with these tools and spent time with them, the lack of security that comes with these coding, and if that person that is guiding the agent architect or whatever you want to name that person trying to build a system, if they don't have that experience and saying, "Oh, when you code this thing, you have to put in this type of security, and here's my security specs and requirements." I feel like we're winding the clock back to the early 2010s, where we had cross-site scripting, cross-site request forgery, all those OAuth's top 10 things. I feel like that we're going to see that stuff come back to the fold where we've already seen speculative systems out there that people thought might've been vibe-coded that had no security at all, and that were just thrown out into production. So I feel like that's going to be a trend in our security industry that we see. And at Accenture, we've noticed that trend and we've started to build our own AI agents that sidecar with the developers that come in and while you're building the code, it actually builds the security into it itself. And then we have our own agents to do the pen testing, the red teaming. And so we realize that it's going to be a challenge, but it's also an opportunity for organizations.

Alex Valenzuela

>> When regarding the sentiment down market, so the smaller customers, we are seeing a shift there in the willingness and openness and desire to engage with an organization that can provide managed services in particular. So there are joint offerings to help serve that community because they're not investing in the tools or the resource to go do it on their own. And consuming oftentimes services beyond just maybe the cybersecurity on its own. So looking for that efficiency and scale.

Rebecca Knight

>> So we know that companies are all over the map in terms of their embrace, and grasp, and deployment of AI, but for those companies that maybe are just starting their AI journey, what is your advice about where they should focus first when it comes to identity and security and how they should approach securing the future of work? Alex, I'll start with you.

Damon McDougald

>> Well, one thing that is most important is that organizations that have large amounts of tech debt, large amounts of security sprawl where they have multiple tools that do the same thing across their entire organization and data fragmented all over, they might not be able to take advantage of the power of AI and its Accenture's approach and vision and push into the market that those organizations need to simplify. And so with Okta, since they have the platform for identity, like when organizations can push onto Okta and be on one tool set, one vendor set, it makes it easier to start taking advantage of AI agents. And in the identity space, we have many opportunities to use agents. We have at Accenture, we just did a demo yesterday where we showed how we can migrate off of legacy identity tools using agents and MCP servers and pushing right to Okta and onboarding the thousand apps that were onboarded onto it in just a few minutes. So organizations have opportunities to use them to modernize, and we also have opportunities to operate because operating identity systems is very complex because they touch everything in the organization. And so I foresee a much easier and better future for security professionals as long as they're able to consolidate, get rid of the tech debt, simplify their security footprint as much as humanly possible.

Alex Valenzuela

>> Yeah, and I'll just say it starts with what we've heard a lot in the last couple of days, which is AI security is identity security. And the Okta identity security fabric helps us accomplish that with our customers leading with the orchestration and the application, the various applications across the stack. To Damon's point, bringing it all together in a consolidated platform to create those efficiencies and make it simple, more simple from a day-to-day management perspective.

Rebecca Knight

>> And-

Jackie McGuire

>> Okta has also really stepped up with frameworks and policies and guidance and things like that so that if you're getting into this journey and you're like, there's nothing to tell me where to start. I think you guys are also doing a lot of both open source and collaborative initiatives, your own kind of frameworks and policies. So I think that helps quite a bit as well.

Alex Valenzuela

>> Absolutely. And really in an effort to raise the entire identity community, so that these customers are following the standards that are set and ultimately working with the right approach.

Rebecca Knight

>> Standards make the internet possible.

Alex Valenzuela

>> Absolutely.

Rebecca Knight

>> According to your CEO, Todd McKinnon.

Alex Valenzuela

>> That's correct. Yeah.

Rebecca Knight

>> Exactly. Well, David and Alex, thank you both so much for coming on theCUBE, a really interesting conversation.

Alex Valenzuela

>> Yeah, appreciate it. Thank you.

Damon McDougald

>> Yeah, thank you for the opportunity.

Rebecca Knight

>> I'm Rebecca Knight for Jackie McGuire. Stay tuned for more of theCUBE's live coverage of Okta Oktane. You're watching theCUBE, the leader in enterprise tech news and analysis.