Okta's Oktane 2025 | James Bonifield, Anthropic Identity

Clips
More from Okta's Oktane 2025

James Bonifield

CEO

Anthropic Identity

play_circle_outline Discussion on the founding purpose of Anthropic and its focus on human-centric identity.

play_circle_outline Exploration of Okta's acquisition of Auth0 and its impact on customer and workforce identities.

play_circle_outline Insights on agentic AI and its influence on identity solutions and application modernization.

play_circle_outline Highlighting collaboration within the identity ecosystem to address common security challenges.

Info
Transcript

James Bonifield, Anthropic Identity

James Bonifield

CEO Anthropic Identity

The Okta Oktane 2025 event remains in full swing, as theCUBE host Rebecca Knight and analyst Jackie McGuire are joined by James Bonifield, chief executive officer of Anthropic Identity, to discuss why identity must be rethought for the age of agentic AI. Bonifield shares how his company’s “human-centric identity” approach grew from a need to address SIAM challenges beyond technology, focusing instead on organizational alignment and business drivers. Now, Okta and Auth0 are converging to enable AI-ready applications, he explains. Real-world crossover use cases... Read more

explore Keep Exploring

What experience led to the recognition of a need for a specific focus on customer identity and the skills required to address it? add

What is the relationship and differentiation between the customer bases and use cases of Okta and Auth0 following Okta's acquisition of Auth0? add

What are the common needs and problems in the context of authentication and authorization that Anthropic might be able to address? add

What is the current status of collaboration in the identity ecosystem? add

bolt Powered by CUBE AI

James Bonifield, Anthropic Identity

search

Rebecca Knight

>> Good afternoon, everyone. And welcome back to theCUBE's Live coverage of Octa's Octane. I'm your host, Rebecca Knight, alongside Jackie McGuire, my co-host and analyst. We're on the homestretch, Jackie.

Jackie McGuire

>> Homestretch. Yeah.

Rebecca Knight

>> Yes.

Jackie McGuire

>> Yes. I switched from water to coffee.

Rebecca Knight

>> Caffeinated. Exactly.

Jackie McGuire

>> That's how you know that we're there.

Rebecca Knight

>> Okay. Well, I think we've got a great new guest too. I'd like to welcome. He's James Bonifield, CEO of Anthropic Identity. Thank you so much for coming on.

James Bonifield

>> Thanks for having me. Great to be here.

Rebecca Knight

>> So talk a little about... So Anthropic identity is about a little over a year old. What do you do and why did you found it? What was the reason for it?

James Bonifield

>> So before I got into Identity, I worked as a developer. And I actually came into Identity by way of being a developer. Started working with Okta, started working with identity products. I was over at Optiv for about three years running the Okta Practice, which was a very confusing tongue twister every single day on Optiv Okta and saying that a couple times. And I felt like in my time there, that there was a serious need in the marketplace for focus on the unique challenges of customer identity and taking the unique skill set that is required to be successful with those technologies, but more than the technologies, the change management, the programs, everything that's required. And not as many firms and not as many people who are really specifically focusing on that narrow need and that narrow requirement. So that was the genesis. The idea was instead of saying customer identity, we were going to say human-centric identity. That's where the name comes from, Anthropic, which Anthropic Identity. Not to be confused with a slightly larger company, but that was the genesis.

Jackie McGuire

>> So tell us a little bit about Okta acquired Auth0. And so these are very different customer bases, and we were actually just talking to the CRO of Okta about this. But they're somewhat converging, right? And so we're going to have to bring some of the Auth0 capabilities into enterprises so that they can build AI-ready applications and then you have Okta there to do the kind of authorization on the end user side. So what kind of opportunity do you see there and how are you seeing enterprises reconcile the auth that your developers use versus the auth you use for your HR platform?

James Bonifield

>> Yeah, so it's interesting because a lot of the technologies, a lot of the standards, the four letter acronyms that get thrown around a lot, they're shared between workforce and customer identity. But the difference comes not only with who you're serving obviously, but the use cases in some ways diverge in terms of e-commerce versus internal workforce. But where it actually I think gets very interesting is in some ways, to your point, they are actually coming together. So we see a lot of, from DPRK North Korea IT worker fraud in terms of needing to take tools that, for example, were paired with Auth0 for identity proofing, know your customer for services, and internal workforce is actually applying that to their internal hiring and to their internal access controls. So although the use cases continue to diverge, we are seeing an agentic AI as a whole other thing where we're seeing those capabilities and those bots that are shared both for B2B, B2C use cases being used on the B2E side. So it is really interesting in that there's sort of this, sometimes capabilities start on one side and they're pulled to the workforce side. Sometimes they start on the workforce side and they're pulled to the customer's side. So I think that's one of the strengths of the broader Okta platform, meaning including Auth0, is you sort of have that interplay and that cohesive roadmap across all areas of identity.

Rebecca Knight

>> But are there pitfalls that companies should watch out for as they migrate to Auth0?

James Bonifield

>> Yeah I think one of the largest challenges with any SIAM project is the scale in which you're engaging different stakeholders in the business. So on the workforce side, it's not easy, but you're mostly dealing with security and an internal folks. If you're doing, like for example you're a retailer, you're commercial food and beverage, and you're changing something that impacts your customers, you've got marketing in the room, you've got loyalty in the room, you've got obviously security, application teams, infrastructure. Everybody's got a voice. Everybody wants to say. So I think for SIAM, the technology is often the easy part. The hard part is driving that organizational change and really getting everybody marching to the same tune and really aligned on what the next best step is and getting out of that analysis paralysis. Got it.

Jackie McGuire

>> You've been at Octane in the last couple days. I took a little spin around the floor, but I've been mostly doing the hosting thing and the analyst thing. What is the general kind of feeling you're getting from the vendors here in terms of what they're thinking about in terms of how they're going to scale agentic AI and how they're going to enable their developers to build things that are kind of AI-ready? Because I think we've heard that there are two real mandates. One is build agentic AI stuff, but then the other thing is get your apps ready for integration into agentic AI. So is there a common kind of theme you're hearing from people here? Any common needs you're hearing, problems that are coming up over and over that you feel like Anthropic can solve, Anthropic identity can solve?

James Bonifield

>> Yeah. So I think two big things that come to mind for me is one is authentication isn't solved for, but we've got a lot of tools there, authorization. What you can actually do once you're inside the application is still, in many use cases, the wild West. So as these application teams and as these companies are looking to make their applications available for agentic AI and building some of these capabilities, there's a lot of modernization that needs to happen both in terms of the identity side but also the application side. So we're doing a lot of work around tools like Okta's FGA, fine grain authorization, in terms of being able to bridge that gap between legacy technologies and legacy authorization models and leveraging a tool like that. I think the other point around agentic AI is there's a lot of definition of the solution space right now. A lot of vendors out there talking about agentic Ai. What I liked from what I've seen at Octane so far is the strong definition of the problem space. Not just, "This is our platform. We do agentic AI." But hey, we see your business is asking you for compliance. It's asking you for speed to execute on these AI agents, but also the boundaries and asking, "Hey, is this acting on behalf of a person? Is it a separate identity? Does it drive on the road? Does it have a bus lane?" Trying to figure out the mechanics there. And I think Okta is leading with a prescriptive, "This is what we're seeing in the market." And that's why I enjoy these Octane and enjoy these conferences, is it's great to hear the roadmap from Okta, but I think even more powerful are talking to the other Okta customers and talking to the people in the trenches and saying, "Hey, how are you solving this? What have you seen be successful? Where are the challenges that you're trying to solve as a program?" And then between Okta, the clients, us, myself as a partner in the Okta ecosystem, working to figure out how to navigate that together.

Rebecca Knight

>> So I want to return, James, to something you talked about a little earlier talking about the SIAM, because you said the technology is one thing, but it's really about getting the people marching in the same direction, aligned, understanding the benefits and understanding the why. And you're a founder and a CEO, but you also help companies do this. So how do you approach it from your business perspective but then also internally and take what you learn from your own workers, your own employees, and maybe translate it?

James Bonifield

>> Yeah. So I tell people pretty often, it's a pretty fun time to start a business because of agentic AI. We're doing a lot internally in terms of how do we operationalize AI because we want to really understand what are the challenges we can run into internally so that when we're talking to companies that are maybe a little bit larger than us, we can speak with some authority in terms of, "Hey, we started tying this to a particular person's identity, but what is sustainable?" You can solve kind of the first order problems, but what are those second order problems? Things including but not limited to compliance, similar things that we solved around service accounts or other elements of non-human identity. So I think that's an interesting part. But a lot of what we solve around SIAM, we really start with the why. And I like that you mentioned that because our framework is why, how, what, which I didn't invent. It's basically rather than starting with just what are you trying to solve. We pull it all the way back to what's the business case. Like, you want to implement SIAM, what are the actual quantitative and qualitative business drivers that drive that? For example, I was working with a client a couple of years ago. One hour of downtime cost them 1 million in loss revenue. They had 25 hours of downtime in 2021. So that was a pretty easy business case for us because we had other things. I was like, "Do you want us to keep going or can we stop here?" So by starting with that why, it really crystallizes the decision to move forward with SIAM because we don't find... With SIAM, we're competing against doing nothing. That's the competitive decision. Once you can crystallize that decision to, "We know this is a problem, but we've measured and we've quantified and we can stack rank what kind of problem it is," once we get over that hump, that's when I think solving gets a lot easier.

Jackie McGuire

>> It's insane how much agentic AI is kind of uncovering the bad practices companies have been somehow surviving with for forever. Because if you have an overprivileged account, but your employee's really only using it to do their day-to-day job, you generally don't find out that account's overprivileged until somebody breaches that employee's account and is able to do crazy things with it. But when you start giving agentic access to the account that employee's overprivileged in, all of a sudden that agent isn't going to wait to find thing outside their day-to-day operations. They find them like that. So I mean, great opportunity for you, right? Endless job security, amazing revenue opportunity.

James Bonifield

>> Right.

Jackie McGuire

>> Are you finding that because this is really shining a light in all these crazy dark corners, that customers are more receptive? You said it's SIAM is the opposite of doing nothing, but that negative inertia can really be... For a vendor who's really never done anything, are you finding that these problems are now people are more open than they were a year ago?

James Bonifield

>> Well, it certainly brings into the spotlight some of these challenges, which most companies would tell you, "Yeah, we probably have an issue with overprivileged accounts and we're not really following least-privileged access." I don't want to say you can get away with that because there's a certain degree of risk, but at the same time, agentic AI least-privileged LPA, least-privileged access, maybe 40, 50 years old, it's not a new concept. It's no longer optional, right? It's mandatory. And I think with a agentic AI, we have the opportunity with this sort of paradigm shift to do things the right way from the start. And that's what encourages me with Okta, and I think the broader identity ecosystem, is there's a lot of collaboration not only within Okta, but Okta with other folks in the space, things like IPD, IPSE, some of the additional standards that are coming around secure access, where people are really collaborating and say, "How do we solve this as an industry in an effective way?" And we see the challenge and how do we plan for adapt and actually build in support from an identity and IDP perspective, but also with applications and relying parties.

Rebecca Knight

>> So there've been so many sessions here, lots of product announcements. What, in your mind, are your biggest takeaways of Octane and the things that you think when you go back to work on Monday are going to really affect your customers?

James Bonifield

>> Yeah, I don't think most of the folks on my team or most of the folks here were surprised that AI was a theme of the conference. I don't think a lot of people were surprised with a lot of the content that came out around agentic AI with Auth0, some of the non-human identity pieces, ISPM, posture management, threat protection. Those have all been on the roadmap. I think what has been really exciting is seeing various early adopters and various folks who have actually started to... It's shifting from just the conference and just something that gets talked about in conferences and sessions like this, to, "We're actually doing this." And then, "We're doing this really quickly." I was talking to a company that was looking at using sort of similar to ISPM, basically agentic AI to serve up like, "Hey, we see there might be an overprivileged account here." Or, "Hey, this looks suspicious. Should you check on this?" And it's just something that they built integrated with Okta. So I think what's really been exciting and what we're going to take back is all of the conversations we've had with different clients and with various Okta product teams in terms of... And we're excited. We're implementers. Every da. We're out doing Okta implementation projects and Auth0 implementation projects, and taking that to the projects we're doing to ultimately make the world more secure, our clients more secure, and to get things done more effectively.

Jackie McGuire

>> We had Ben Kus on earlier, the CTO of Box, and we were talking about there are all of these things that have been these pervasive problems that we've wanted to solve and haven't been able to, because a lot of them, it's a volume issue. And a human, to pay your security team like going through Box and figuring out that you should only have access to this type of information, but we've misclassified these four documents, so you somehow have them, that gives me a lot of hope. So hopefully you've heard the same thing, is I think we've had so many problems that are just volume problems that the cloud created. We love the cloud. The cloud enables us to do a lot of things, but it also enables us to create these swamps of files that you're never going to do anything with. So as you're talking to your customers and thinking about... When you're talking to them about, "All right, your environment is a little bit of a mess," so if we're going to start, what are the first, the things you tell your customers to start doing in the first 90 days to set them up for success when they're trying to also deal with this kind of whole... They don't have the benefit of just starting a company a year ago and building it for this purpose, so what should they be thinking about the first 90 days?

James Bonifield

>> Yeah, so I think one of the interesting things about AI, and I guess more broadly, humans as well, is there are things that we're really good at that AI hasn't figured out. And there are things that AI is really good at that take us a little more time, like really complex math problems or looking at a thousand different files in a second. So what we do from a delivery perspective is we've begun pairing AI with our architects. So I think your point is really well-made that it's easy to start from scratch, but no company or very few companies are actually starting from scratch. Legacy is often thrown around as kind of a dirty word, but the reality is a lot of companies and a lot of the world infrastructure is run on legacy technology. One of the focuses for one of the sessions earlier today was launching additional on-premises capabilities and extending... I think I saw a stat and it was 81... I think from one of the earlier sessions, 81% of data lives on-premises. So it's not trained, it's not leveraged, it's not necessarily secured in a way that it can be consumed by AI.

Jackie McGuire

>> It's just chilling.

James Bonifield

>> It's just chilling. Just hanging out. And I think that operationalizing that in a safe way and extending that and extending a lot of these capabilities to legacy companies which have applications written in '80s, 2000s, 2010s, I mean, it will become a requirement I think, because we can't just move forward with it. We have to figure out how we can operationalize and bring everything up to this point to AI securely.

Rebecca Knight

>> Excellent. Well, James, thank you so much for coming on theCUBE. A really interesting conversation.

James Bonifield

>> Absolutely. Thanks for having me.

Jackie McGuire

>> Thank you.

Rebecca Knight

>> I'm Rebecca Knight for Jackie McGuire. Stay tuned for more of theCUBE's live coverage of Okta's Octane. You're watching theCUBE, the leader in enterprise tech news and analysis.