Okta's Oktane 2025 | Jack Hirsch, Okta

Clips
More from Okta's Oktane 2025

Jack Hirsch

Vice President, Product Management

Okta

play_circle_outline Static credentials and OAuth grants pose security challenges in AI integration.

play_circle_outline Gap in identity management for AI due to rushed deployment pressures on businesses.

play_circle_outline Importance of visibility into application access and permissions for security.

play_circle_outline Strengthening National Security: The Imperative of Securing Hardware Supply Chains and Government Role in Protecting National Identity

Info
Transcript

Jack Hirsch, Okta

Jack Hirsch

Vice President, Product Management Okta

In this Okta Oktane 2025 exclusive, theCUBE host Rebecca Knight and analyst Jackie McGuire speak with Jack Hirsch, vice president of product management of Okta, about the growing identity challenges introduced by AI agents. Hirsch explains why CISOs face mounting pressure as more than 90% of organizations have agents deployed but only 10% have real governance. Agentic AI is fundamentally an identity problem and why identity must be treated as critical infrastructure, he suggests.

The conversation highlights Okta’s new Cross App Access initiative, an... Read more

explore Keep Exploring

What are the two main types of credentialing discussed in relation to secure access management? add

What are the challenges companies face in managing AI, and what steps need to be taken to address the gap in AI strategy? add

What concerns have been expressed regarding the SaaS ecosystem and its impact on authentication and authorization decisions in enterprises? add

What measures should the government consider for national level AI regulation and security? add

bolt Powered by CUBE AI

Jack Hirsch, Okta

search

Rebecca Knight

>> Hello everyone, and welcome back to theCUBE's live coverage of Okta Octane. I'm your host, Rebecca Knight, alongside Jacqueline McGuire.

Jackie McGuire

>> Hello,

Rebecca Knight

>> Jackie, let's talk AI. Let's talk AI agents and identity.

Jackie McGuire

>> Oh, I can't wait. I haven't heard about that in at least 30 seconds. And nobody else is talking about it, so let's break new ground.

Rebecca Knight

>> We'll, we are bringing --

Jack Hirsch

>> So glad that you're willing to step out of your comfort zone and talk about something that no one else is talking about.

Jackie McGuire

>> Yes, yes.

Rebecca Knight

>> Jack, I need to introduce you. You are Jack Hirsch. You are the vice president of Product Management at Okta. Thank you so much for coming on the show. We appreciate it.

Jack Hirsch

>> Thank you so much for having me. It's a pleasure to be with you.

Rebecca Knight

>> So as Jacqueline and I were just saying, AI is such a big force today, what are some of the identity challenges that you are seeing, both in managing humans and the non-human agents? What are your conversations with CISOs like?

Jack Hirsch

>> Well, frankly, CISOs right now are sort of stuck because they want to be accelerators to the business, right? And they're getting hit by this tidal wave of AI agents. So just to share a couple of stats, over 90% of organizations have AI agents already deployed and generally running amok. And about 10% have a control or governance strategy to discover control and govern AI agents. And so they're being given this very, very difficult task of not introducing friction to the business because the business wants to realize all these gains, efficiency gains that are being promised from agentic AI. And so that's a huge area of focus that we're trying to unlock here at Okta.

Jackie McGuire

>> Well, nobody's going to CISOs saying, "Hey, we want to do this thing. Could you help us do it safely?" They're saying, "Hey, we did this thing, and"-

Jack Hirsch

>> That's exactly right. There's only two flavors today, right? There's static credentials, so effectively non-human identities, right? These are just API keys. These are NHIs that we know and have grown to revere over the past few years. And then there's OAuth grants that are largely designed for consumer-focused applications, right? They offload the authorization effectively, the security decisions away from the CISO, away from the centralized IT and security teams, and give them to the end users to say, "Oh, yeah, Sam over here in accounting can give Jackie... Or Sam can give..." Or Jackie, I'll pick on Jackie, because hey, why not? Jackie wants to read access to our entire box drive to some random AI agent app. So those are the two choices, either static credentials that are difficult to govern and manage or end user control. So what we're trying to do is create a new open standard at Okta that helps meet CISOs where they need to be, helps builders deliver AI solutions into market successfully, and get adopted safely into modern enterprises with Cross App Access.

Rebecca Knight

>> But let's talk a little bit more about that gap you were just describing in terms of companies that don't have a strategy to manage AI. What is missing? Is it just that businesses are under so much pressure to deploy AI or why is this gap so big and what do companies need to do first thing to close it?

Jack Hirsch

>> Well, this is going to sound rich coming from Okta as the world's leading independent identity security platform, but fundamentally, agentic AI is an identity problem, right? It's an identity challenge. AI agents are identities any way you try to describe them, but they can't be described in the same terms as humans because they can be within an existing platform. So like Box has agents that are deployed in the existing platform, or there are random teams that decide to connect up, name your favorite LLM or name your favorite workflow tool. And again, CISOs with OAuth grants, as an example, it's really hard to gain visibility to which apps or agents are requesting access to which resources in an enterprise. So much so that the CISO of JP Morgan Chase actually wrote an open letter in the past year basically complaining that the SaaS ecosystem was compressing these authentication authorization decisions and not providing the right guardrails for security conscious enterprises to deploy things like agentic AI securely.

Jackie McGuire

>> Well, that says something too, because JP Morgan has an $18 billion security budget. $18 billion. And so I feel like if they're not doing it correctly or having trouble with it, and that's like I hear this from the largest enterprises in the world that we sit down with is like... And so I have been the problem, because I came into security through data science. And when I wrote my first anomaly detection Python script, I handed it to a security guy from Mandian, and he was like, "What did you do?" He's like, "There's hard coded keys in here." I had no idea.

Jack Hirsch

>> How dare you? How dare you?

Jackie McGuire

>> Yeah. And as a data scientist, it's like a dog with a bone. If I'm doing something really cool with agentic AI, I forget that I hard coded those things and then I send it to eight people. One of them didn't notice. They put it into production. I think, is it Mark Twain that said never attribute to malice what can be explained by ignorance? And I don't think people want to do the wrong thing, right?

Jack Hirsch

>> No.

Jackie McGuire

>> They get excited. They see the goal live.

Jack Hirsch

>> Every organization is under so much pressure to deploy AI and to see those efficiency gains that are being promised. And honestly, we're all feeling in our personal lives outside of an enterprise context. So what Cross App Access does in this particular scenario is you could use... It's effectively an extension to OAuth, which we're all familiar with the standard OAuth , such and such app wants access to this other app's data. Do I approve? Yes? No? Great. That's terrifying in an enterprise context. And so all this change does... Again, this is an open standard because security is a team sport, we are not trying to control the entire ecosystem. We want to be the rising tide of security that lifts all of our ships together. And so all this does is it's an extension of OAuth where instead of asking the user first, it just checks with the IDP first. That's it. It's as simple as that. And then if the IDP is Cross App Access aware, you can set policies like, "Oh, this app can read from this app but cannot read from this app." And it's like it's going to be such a game changer. Now. Okta is no stranger to standards. We've been in the business for a while. Last year was IPSIE, the iInteroperability Profiling for Secure Identity in the Enterprise. The year before it was universal logouts. We can terminate sessions across an entire IT ecosystem. I have never seen the type of excitement that we are seeing now for Cross App Access for any open standard. I would just describe it as a deluge of interest from builders and security teams that want to consume in this way, want to consume AI agents this way.

Jackie McGuire

>> Yeah, I knew I was getting old when I was like, "You know, I really think I'd like to write standards and regulations, and we should have more of those." But I think when I was in my 20s, I was like, "Regulations? ." But I think the older you get, the more you realize that there are only really two ways that standard and regulations come to be. They're either passed or they're litigated, right? And so we're either going to proactively offer standards and frameworks or things are going to go really sideways. Everybody's going to start suing each other, and then we're going to have to litigate our way backwards.

Jack Hirsch

>> It's pandemonium. It's complete pandemonium. And so we actually just had a milestone a few days ago where this was accepted into the IETF OAuth working group, which is a major milestone into it becoming an accepted standard. So again, this is not an Okta thing. We are just very, very excited by it. We want to promote it because it's going to be a better way to deploy AI in an enterprise.

Rebecca Knight

>> In terms of this deluge of interest that you're receiving, do you think part of what's driving it is this idea of business continuity? Because if identity goes down, business falls apart.

Jack Hirsch

>> I like to say that identity is critical infrastructure. Yeah, at Okta, we treat the trust of our customers with great reverence. I mean, there are global supply chain logistics rely on Okta, like FedEx. We have many parts of the DoD relying on Okta. And so everything about our own business continuity and how we build our software is basically preparing us for what happens when the worst happens. I think our availability and resiliency posture is industry leading. Happy to share more there, but short answer, yes, absolutely it is. And especially when you think about its role in granting access to those critical resources internally, you don't want to do it the wrong time and you can't go down.

Jackie McGuire

>> But I want to highlight, Okta had a significant security incident a few years ago. And while I think the market was a little bit more harsh to you than they have been to other companies with arguably worse incidents, I think one of the things that has come out of that is Okta has really become a golden example of how to turn adversity into a really seismic culture shift within the company that's now also starting to turn outside and create a seismic shift outside the company. And I listened to an interview that Todd did a few months ago talking about that culture shift and talking about how hard it was as a company, but I really feel like that puts you in a much better position to understand your customers because many of your customers are themselves tech companies who are not security first, who are also struggling with the same thing of like, "We've got these rabbit engineers who just want to deliver and push, but we need to institute a culture of safety." And so I really want to commend the work that you've done, especially in going to, "All right, well, if we're going to be more secure, we need more standards." And I really think that you've done the whole market of service in the way you've kind of taken it on the chin and used it to grow.

Jack Hirsch

>> I mean, everybody gets punched in the nose, right? And it's sort of customary in the security industry. We don't dance on each other's graves. This is something that we can all learn from. Again, security is a team sport. And so thank you for recognizing that. I think one of the things that I'm most proud of about that transformation, yes, it was challenging culturally, but we've come out much better because of it. So we released our Okta Secure Identity Commitment, which I think you've heard about, but it's basically four pillars. And on the product side, we're not only delivering industry-leading products, but we're delivering standards and best practices to uplift the industry, hardening our own corporate infrastructure, promoting those best practices externally. This has really helped us be better, be more in touch with our customers, exactly as you said. And frankly, I think it's given us a ton more empathy for security buyers, security operators, because we've wallowed in that pain, right, because we never want to experience it. And again, the trust of our customers, we treat with great reverence. And we never want our customers to experience that as well. And so many things we do around threat incident, report sharing, promotion of nation state threat actors, and disclosures of that information to the broader security community is a testament to that fact. Again, security is a team sport. We're here showing up alongside our partners. Yeah.

Rebecca Knight

>> Well, I mean, that is what product management is. It is empathizing with the customer, understanding their needs, their perspectives, what they're looking for. Would you say that you're seeing more urgency from some industries rather than others? Which ones are really leading the way in terms of securing AI agents?

Jack Hirsch

>> Honestly, this has been the most universal pull across all of our segments. Every smallest companies to the largest companies. Smaller companies, as soon as they have something to lose effectively, all the way to the largest companies, global companies, companies based around the world that don't have global footprints. It is mania. It is absolute mania. So yeah, I wouldn't say that there's any necessarily specific pull. I do believe that the SI community in general is really leaning in heavily because they're being asked by their clients, "How do we do this safely?" And then in many cases, they're turning around and we're having conversations with the SI community about how we can develop these standards, get better together, and again, be that collective rising tide so that we can uplift the entire IT industry.

Jackie McGuire

>> This might be a Briar patch, but what can we be doing at a government level, at a federal level to help this effort? So if you had an ask of... I know there's debate about whether we should have national level AI regulation, things like that. What do you think, if anything, that our government could be doing to help?

Jack Hirsch

>> I think first and foremost, we need to secure our national assets, right? So as an American citizen, I will say that I think we need to primarily focus on securing our national assets. Again, this is not on behalf of Okta. This is very much a personal opinion. And I think that there's a bunch of different mechanisms to do so, right? This is everything from securing the hardware supply chain, which we know the government is very much paying attention to, to model development and safety guard rails for model development. That's one significant part. The other one that I think is right in Okta's wheelhouse is in order to get security right, they have to get identity right. We have a very large competitor to our north that is in the news every other week for significant breaches. There was an open letter written by the chairman of the Senate Finance Committee demanding that the DoD review all of their contracts because they presented a grave national security threat to the United States. We need to secure our national assets, and security starts with identity. So again, we can go any different direction with what is going on in the federal government. We won't touch that, but I think-

Rebecca Knight

>> We're not going to go there now.

Jack Hirsch

>> But more broadly, more broadly, I think we can all agree that we need to secure our national assets. And the best way to do that is to shore up our identity security so that we can safely deploy agentic AI in the government because we know that other nations are deploying this with different set of restrictions and guard rails around it. And if we want to maintain our competitiveness on a global stage, this is something that we also need to do. We need to, again, be able to deploy these things safely and securely and not introduce friction in the process in government processes. So that's my ask.

Rebecca Knight

>> I like that vision. Jack, thank you so much for coming on theCUBE. A pleasure having you on.

Jack Hirsch

>> Thank you so much for having me. It was a pleasure.

Rebecca Knight

>> Thanks. I'm Rebecca Knight for Jackie McGuire. Stay tuned for more of theCUBE's live coverage of Okta Octane. You're watching theCUBE, the leader in enterprise news and analysis.