Okta's Oktane 2025 | Mike Uster, Mantech

Clips
More from Okta's Oktane 2025

Mike Uster

Chief Information Officer and Chief Technology Officer

Mantech

play_circle_outline Managing Security Risks: Embracing a Zero Trust Approach for Identity in AI and Non-Human Entities

play_circle_outline Human Interaction with AI:** Trust issues arise; humans need to validate AI-generated information.

play_circle_outline Balancing Innovation and Security:** CIOs must enhance productivity while managing acceptable risk levels.

Info
Transcript

Mike Uster, Mantech

Mike Uster

Chief Information Officer and Chief Technology Officer Mantech

Concluding the two-day coverage of Okta Oktane 2025 on a high note, theCUBE’s Rebecca Knight and Jackie McGuire are joined by Mike Uster, CIO and CTO at ManTech. Uster shares how ManTech treats AI agents as identities, not exceptions, to simplify security. The zero trust journey is strategy first, then persistent execution, even when plans get “punched in the face,” as he says. Uster highlights fast, confidence-building wins like passwordless with Okta Verify and FastPass to drive adoption. He shares a HUD ICAM example where strategy meets legacy reality, the... Read more

explore Keep Exploring

What impact do non-human entities, such as AI agents, have on the security landscape? add

What concerns are raised about the tendency of humans to trust information, particularly when it comes to interactions with AI? add

What are the responsibilities of the CIO and CISO in managing the tension between improving productivity and minimizing risk? add

bolt Powered by CUBE AI

Mike Uster, Mantech

search

Rebecca Knight

>> Good afternoon, everyone, and welcome back to theCUBE's Live coverage of Okta's Oktane. We are in the homestretch, our last guest of the day. I am your host, Rebecca Knight, alongside Jackie McGuire, analyst and co-host. We did it.

Jackie McGuire

>> Homestretch.

Rebecca Knight

>> Save the best for last.

Jackie McGuire

>> Yes. I have the end of marathon high right now.

Rebecca Knight

>> Okay. Well, let's keep that energy going, Jackie, with our next guest. He is Mike Uster, CIO and CTO of ManTech. Welcome, Mike.

Mike Uster

>> All right, let's bring it home.

Rebecca Knight

>> Okay. We're going to do this. We're going to do this. So you've been at ManTech for ... You're a veteran, 20 years.

Mike Uster

>> I am. 20 years.

Rebecca Knight

>> Tell our viewers who may not be familiar with ManTech, what you do.

Mike Uster

>> Yeah. ManTech partners with our clients in the intelligence community, Department of Defense and federal civilian sectors. And we deploy and develop advanced solutions for them in the cyber area, AI and mission-critical systems that they use.

Jackie McGuire

>> No big deal.

Mike Uster

>> No big deal.

Jackie McGuire

>> No big deal.

Mike Uster

>> Now you know what ManTech does.

Rebecca Knight

>> So you've built a zero trust foundation at ManTech. So how does that shift from legacy systems change the way your teams manage identity and access?

Mike Uster

>> Yeah, identity and access is part of it, right? It's part of one of the elements, but zero trust overall helps develop a framework of really transforming your entire enterprise. It is a security thing. It's talked about security, but it really goes into getting into delivery for your customers and your clients, internal and external. And that all stems around that identity portion of it. Knowing who your personas are, who's operating, what applications do they need? What is their job? What do they start with with their job? What do they do at 10:00? What do they do right in the afternoon?

Jackie McGuire

>> And those are just the humans.

Mike Uster

>> Those are just the humans. Yeah. And the humans are the easiest.

Jackie McGuire

>> Oh, yeah. Well, they do unpredictable things, but they don't do them very quickly. So I think the volume and velocity at which agents can do things is what makes them hard, because humans do wild things, but at least you have time for those alerts to pop up.

Mike Uster

>> Yeah, yeah, that's true. But they do, do different things.

Rebecca Knight

>> Well, talk about that a little bit because we do know that AI is creating both tremendous opportunity, but also real threats and real risks. So how do these non-human entities complicate the security landscape from your vantage point?

Mike Uster

>> Yeah, I don't think they next ... And I'm a little bit counter to the current thought, right?

Rebecca Knight

>> Okay. All right.

Mike Uster

>> But I don't think they complicate the security so much. They really are their own entity, if you will. I don't know if I want to use that word, but they're their own identity and you have to treat them as their own identity. And if you do that and you treat them like a human, then it actually works. So when we bring in an AI agent and we're going to implement an AI agent, we don't say, "Oh my gosh, it's an AI agent, what are we going to do?" We have to rethink everything because the word AI is embedded in it. No, it's more like, "Okay, let's treat this as a person. What access do they have? What privilege access do they have? What do they need access to on each individual and so forth?" And you look at that all the way through. I think that's where it's a little bit different. Where I feel that it's a threat is not necessarily AI, but it's how the humans interact with the AI, right? Malcolm Gladwell, Talking With Strangers. I don't know if you read that book, but he talks about the default to truth. Humans, we believe things we trust. It's part of our nature, and there's a few group of people that don't trust, but for the most part, we have to trust to actually just be in existence, if you will. Well, that's where the danger is. Why are we necessarily always trusting everything out of AI? And I say we, because I mean me as part of the we. When we read something, it's like, "Okay, are we treating that AI like we're talking to a human, so we just trust it?" It's not. That's where I see the danger of what humans are doing with it and then how far we go with it without validating it, not necessarily AI itself.

Jackie McGuire

>> The nature of generative AI is hard, right? Because you have the discriminator model and then the generator, and the discriminator basically makes sure that the way the generator is telling you bad information is very believable. So it's like even if the information's bad, the discriminator is literally programmed to say it to you in the most authoritative, believable way possible, which makes it really difficult, right?

Mike Uster

>> To say it as if a human, and make it even more and more, here we go, convincing.

Jackie McGuire

>> Yeah. Yeah.

Mike Uster

>> So it's going to be even more convincing.

Jackie McGuire

>> And you ask it, "Are you sure?" And it's like, "You know what? I am so sure, Mike." So let me ask you this, because zero trust is not a product you buy, it's not a policy. I've written this so many times that I hate to even say it out loud because it sounds cliché, but it's a journey, not a destination.

Mike Uster

>> Yeah.

Rebecca Knight

>> That's a self healthy.

Jackie McGuire

>> Yeah, but you're dealing with, to your point, mission-critical systems. So when you come into an agency or an organization, how do you prepare them for that? How do you prepare them for the fact that zero trust is not something that you're ever going to be done with, it's a different way of viewing the security world, and really the data world in large. Do you have a method for preparing? And it's a mandate at the federal level now, but how do you prepare someone for the fact that it's not like, you don't just buy it and then you're done, right?

Mike Uster

>> Yeah. Yeah. Jackie, that is a great question and I do have the answer on that. And this is, by the way, a passion of mine. I just absolutely love it. The first thing that you start out with zero trust, and as you said, it is a journey and all that, so that's how you got to look at it. You're going on the hero's journey. Isn't that exciting? You're going to write your own book, because yours is going to be different than everybody else's, right? So it first starts with the strategy. So you kind of understand the principles of zero trust, identity, micro-segmentation, automation, all the elements of it. And then you say, "Okay, let me sit down and build out what that strategy is." And then you go to implement it. And then you remember, I think it was Mike Tyson that said everybody has a plan until they get punched in the face, right?

Jackie McGuire

>> Have you ever been punched in the face? It really does hurt.

Mike Uster

>> I have. It's late, but yeah, I was doing Taekwondo poorly growing up. And one of my friends said, "Hey, I box, you want a box?" And I said, "Sure, let's box." We put on boxing gloves. Well, he was a boxer, and he just pummeled me in the face and I threw on the boxing gloves and said, "I'm not doing that again."

Rebecca Knight

>> So you speak from experience. . We know Mike Tyson.

Mike Uster

>> Yeah. Oh, I've been punched in the face. Yeah.

Jackie McGuire

>> Yeah, yeah.

Mike Uster

>> But anyhow, you take that and then you go into knowing that. And then what does a boxer, what does a person that knows that they're going to go through do that get surprised when you get punched in the face? No, you're persistent. You have to be persistent and say, "I'm sticking to the plan. I'm going to change the plan as I go forward and move forward with this." Now, we've done this, and we're doing this with one of our current clients, a HUD. Tarrazzia Martin is the program manager for the ICAM element of Housing and Urban Development, and they're doing a fantastic job and they got this strategic plan and we're starting to implement it. And as we go through it, we've got the support of HUD and moving everything through. But at the same time, you reach legacy systems, you reach the challenges, and then you have to address it and then change the plan going forward and then treat it like a journey, treat it like a story that you're going to tell after the fact, and it becomes wonderful. It becomes enlightening.

Rebecca Knight

>> So collaboration seems to be a real theme in your approach and in how you think about things. Why? What is it about collaborating and federating identity across partners strengthen your security?

Mike Uster

>> It strengthens your security because when you make identity the first line of defense, you now change the game. Because in the game with the adversaries that are coming after you, they can invest a lot of money and they have a lot of money, and they can get what they want if they try hard enough, so we all know that. So what do you do? You up the costs. You say, "Okay, if you're going to do this, then you're going to have to invest some time. You're going to have to invest some money. You're going to have to invest some focus. You're going to have to invest some persistence. You're going to have to be persistent in this."

Jackie McGuire

>> Well, attackers are kinda lazy.

Mike Uster

>> Likewise, the blue team had to do this.

Jackie McGuire

>> That was one of the things that I found was really interesting, sitting through Black Hat and DEFCON and some of the other conferences I went to this year is attackers are actually kind of lazy. If you make it hard enough, generally they'll move on to an easier target, right? Well, I guess, it depends on the nature of your customer.

Mike Uster

>> I wouldn't say attackers, I think that's how humans are. We typically go to let's go with the easiest or the simplest solution easier, because why not? And if they have something that works, stick with it. With identity, making it the first line of your defense, you've now changed the game somewhat and now they're going to have to take over an identity. Well, now with Okta, you've got the right behavior analytics, you're looking for abnormalities on identities, whether they're AI, RPA, bots or they're humans. And if they do something different, you simply have the appropriate alerts and triggers to knock them off and make sure that, that's all automated, right? Don't put a human in that loop and then you can act quickly.

Jackie McGuire

>> Yeah.

Rebecca Knight

>> So Todd McKinnon was up on the main stage today talking about that tension that exists in so many organizations to innovate and to be first and get there, but also stay secure. How do you think about that within ManTech as the CIO and CTO, and how do you talk to customers about that tension?

Mike Uster

>> Yeah. And that tension is real, and I think Todd did a great job of actually displaying it with the imagery that he showed and what he talked about it. It's the responsibility of the CIO and the CISO to make sure that you first make things better and you make things more productive. That's what business is about. Grow top line, increase bottom line, move forward with that, but only so much where you don't take a big enough risk. So as long as when you get to that risk, you've got a compensating control or something that will allow a tripwire, that's as far as you go, and then you stop. If you go too far into it and start taking too many risks, you just have to pull back.

Jackie McGuire

>> So how do you feel ... Let's say I've got my zero trust program in place. I think you've said that, that really is the foundation for being able to deploy other technology. So once you've got that in place and you're setting objectives, how do you ensure accountability? How do you bring people back to, "Okay, this is the plan, this is the ..." And as we're trying to deploy these things, how do you establish an accountability plan and then bring people back to that? Because I think that's one of the hard things in the enterprise is that a lot of times, I'll see enterprises start with these zero trust ideals and these programs, but then you never see somebody establish, "Okay, this is what the goal was. Let's all come back to that and revisit that." How do you establish a program that enforces that?

Mike Uster

>> Yeah, if you ever watch a football game and the score is three, zero at the end, you're like, "Okay, that's four hours." And as a defensive game. And if you're a real football fan, you're like, "Okay, that was a great game. It was a defensive game." And they start explaining. People like putting things in the end zone. Field goals are okay, but they like touchdowns. So what you do is, on your strategy, you have quick, easy wins that builds confidence, not just confidence with the team that implements it, but confidence with the people who are actually using it, and then you provide that understanding. So it's like, "Oh, I'm using Okta Verify and I'm going to use FastPass to actually get in. I'm using passwordless authentication. What does that mean for me? Oh, wow. Oh, now I understand that it's pass-through assessed, and they're trusting the device." I'll get an example today. I went to the hotel where I'm staying, got in the elevator and I had an Okta badge on, and so did the person next to me. And there were people here just in Vegas that were on, and they go, "Oh, are you with Okta?" And the Okta person said, "Yes." And they talked about Okta and they go, "We use Okta at work, we use Okta Verify, and this is what we do with Okta Verify." There was an excitement in them of just using it for a different company. That's because that company was successful in bringing them with the journey, so it's a team effort. And when you start getting end zone moments and then you build upon those and build above, that builds the team, and then you get this energy going, that snowballs in the right direction, and that's what you always got to be working for, snowballing in the right direction versus the other.

Jackie McGuire

>> So setting more realistic steps rather than standing in one end zone and being like, "We need to get all the way there." Celebrating every time you get a new set of downs.

Mike Uster

>> It's the percentages. Run the percentages, three yard gains, five yard past, not always going for the Hail Mary or whatever it is. And people like that. They like that.

Rebecca Knight

>> Mike, what are we going to be talking about at next year's Oktane? How do you think about the next frontier in identity security? AI was obviously the theme of this year. It's likely to be the theme of next year's too. And how do you also think about that, especially in the context of your blueprint for navigating a new threat landscape?

Mike Uster

>> Yeah, it is going to be AI. Whether we want it or not, it's going to be AI either way. I think it's going to be the sophistication levels. And from what I saw two years ago to or a year ago into now, you're actually getting these wins and these success stories that are coming out that are really proving true. So what's been tremendous about AI is the hype and all that, but then the success stories are starting to roll in. We're going to see more and more of those success stories and the actual application and then how quickly you can apply it going forward. That's what I predict next year.

Rebecca Knight

>> Those end zone moments.

Jackie McGuire

>> Yes.

Rebecca Knight

>> .

Mike Uster

>> Those end zone moments. You're going to start seeing those.

Jackie McGuire

>> I'm going to prepare my touchdown dance for next year

Mike Uster

>> And they're going to be contagious. I think they're going to be contagious.

Jackie McGuire

>> Yeah. I think that just as FOMO is causing everybody to run towards there, but I feel like fear of being bit in the butt by AI is also what's keeping people in development instead of prods. So I think you're right. Once we see a couple significant production-level deployments of agentic AI that are really driving revenue, it will be kind of a watershed moment, because they think everybody doesn't want to be the first person to stick their head out and get the hammer, right?

Mike Uster

>> Yeah. And it's that mindset of like, "Okay, I got to go forward. And if I break an arm or my neck, I don't know, we'll see what happens." It's like, "Well, can you run just a little bit and skin your knee and then get up, fix your knee, then run again and maybe you won't skin your knee? Okay, now run a little bit faster." I think it's having that mindset going forward.

Rebecca Knight

>> So we've talked about running and football and Taekwondo and boxing.

Mike Uster

>> I know. You didn't know that's going to happen.

Rebecca Knight

>> This is a good one. This is a good one. Mike, we did it. Thank you so much for being our last guest and we saved our best for last. We really did, so thank you so much again.

Mike Uster

>> Thank you for having me. This is a pleasure. Really, thank you.

Rebecca Knight

>> That wraps up theCUBE's live coverage of Okta Oktane. For Rebecca Knight and Jackie McGuire, and for Brendan and Anderson and Maverick and Jay ...

Jackie McGuire

>> Our production crew is awesome....

Rebecca Knight

>> thank you for tuning in. This has been a great show. Thank you to Jenny and her team at Okta too. You are watching theCUBE, the leader in enterprise tech news and analysis.