Okta's Oktane 2025 | David Bradbury, Okta

Clips
More from Okta's Oktane 2025

David Bradbury

Chief Security Officer

Okta

play_circle_outline Cybersecurity Landscape Changes:** Shift toward managing non-human identities and AI agents in security practices.

play_circle_outline Compounded Risks from AI Usage:** Increased potential for security incidents due to rapid AI deployment and vulnerabilities.

play_circle_outline Fostering a Culture of Security: Motivating Employees through Teamwork, Reporting Incentives, and Behavioral Shifts for Safer Practices

play_circle_outline Agentic AI as a New Identity Type:** Recognizing AI agents with unique identity management requirements in the enterprise.

Info
Transcript

David Bradbury, Okta

David Bradbury

Chief Security Officer Okta

At Oktane in Las Vegas, theCUBE host Rebecca Knight and analyst Jackie McGuire are joined by David Bradbury, chief security officer of Okta, for a discussion on how identity is becoming the control plane for AI-driven enterprise security. AI agents represent a new class of identity and why securing them must start at day one, according to Bradbury. He details how Okta is addressing challenges such as weak authentication, token sprawl and context-aware access with solutions like OAuth with DPoP, a token vault and fine-grained controls through MCP. The aim is i... Read more

explore Keep Exploring

What are the key features of zero trust as they relate to different types of identities, including new identities like autonomous agentic AI agents? add

What are the challenges and changes observed in managing and governing agentic AI over the past year? add

What are some effective strategies for cultivating a security culture in an organization where security is everyone's responsibility? add

What are the recent developments in understanding agentic AI and their implications for enterprise management? add

bolt Powered by CUBE AI

David Bradbury, Okta

search

Rebecca Knight

>> Good morning, everyone, and welcome back. We are day two here of Okta Oktane in Las Vegas. I'm your host, Rebecca Knight, alongside Jackie McGuire, my co-host and analyst. We're fresh from the main stage hearing Todd McKinnon talking about AI FOMO, the fear of missing out that you're not doing enough with AI in your companies. What do you think?

Jackie McGuire

>> I understand it. I understand the fear that your competitors are leveraging new technology in a way that you're not. And I think any of us who are pushing 40 or over 40 have been through multiple, like, oh, I should have made that a web page, and then, oh, I should have made that an app, and then now, I should have made it a chatbot. So, I understand it and I think companies are always worried that their competitors are going to outpace them.

Rebecca Knight

>> Exactly.

Jackie McGuire

>> But I also think it pushes them to do some kind of silly things sometimes.

Rebecca Knight

>> Well, indeed, and here to talk more about that is David Bradbury, he's the Chief Security Officer at Okta. Thank you so much for coming on the show, David.

David Bradbury

>> Oh, thank you for inviting me.

Rebecca Knight

>> Yeah. So, let's just talk about the big picture because the cyber security landscape has always been fast moving, but it really feels like it's hit a new gear when you're throwing AI into the mix. What do you think have been just the biggest changes in just the past year or so, in terms of from your vantage point?

David Bradbury

>> Sure. Look, for years we've been securing human identities, and in the past few years we've started to refocus and start to look at application identities and non-human identities. And this year is a pretty big year for welcoming a new entrant into the workforce, which is the autonomous agentic AI agent, and that's a pretty big deal. It's a pretty big deal to think about it as a brand new identity type. And when you think about, say, the three different key features of zero trust, the fact that you need a secure identity, you want to be able to implement least privilege, you want to be able to continuously monitor what they're doing. All three of those elements apply equally to all of those identity types. But specifically when you think about agentic AI, it is absolutely critical to get those things right if you are ever going to manage and govern those things. In fact, I think you can argue that to effectively manage AI agents, that's actually fundamentally it's an identity management problem. And so, over the past year, as we've been seeing a real difference in this time last year, many companies talking about AI. At RSA, when we were there six months ago, we finally started to see people actually turning AI into reality. And now six months later, not only are we seeing it turning into a reality, but we're seeing a fundamental explosion in all the problems that we've had with non-human identities and human identities, but at a huge scale. Right? So that's the bit that's really changed for us as a company looking at the threat landscape over the past year. It's, we've gone from talking about it to seeing it, and now we're actually seeing the incidents that are now happening because, well, sadly, people just aren't doing the right thing in securing their agents and managing them effectively.

Jackie McGuire

>> I think if you don't give people a safe place to do risky things, they're going to do risky things in risky places. Right? So, what are the primary risks you see associated with agents, or what are people generally missing when they're provisioning identity for agents and things like that? What are the most common stumbling blocks you're finding?

David Bradbury

>> Well, it's interesting hearing from Todd at the keynote just now, that the pressure is on all of us coming from the board, coming from the executive team. Do more with AI, and-

Jackie McGuire

>> Justify our spend on AI.

David Bradbury

>> This is it, let's not miss out. And so, as we've seen over the past 12 months, people rushing to build things and push them out the door, sadly, we've seen people cutting corners. And where are people cutting corners? Sadly, they're cutting corners on security. We're using usernames and passwords hard-coded in agents to talk to other services. We're using static API keys, API keys that have gone the way of the dodo over the past decade. We've brought them back to life and we're putting them in agents.

Jackie McGuire

>> But I found an article on Stack Overflow from 2018 that said that's how I'm supposed to do it, is it not?

David Bradbury

>> And for anybody who's vibe coding out there, I guarantee that that agent is sitting there going, I'm going to do it the easiest way I know, based on that 2018 article. And here we are, we're in a situation. And so, what we've been focused on as we've been examining the ecosystem of these agents and looking at, where is it that the developers who are building them, where are they having trouble? How can we be helpful? Because we are the developer platform for identity, surely we can make this easy. And so, that's what we've been doing and that's what we've been working on. So when it comes to focusing on key problems, one of the key problems is that one I just identified around authentication. Why is it that people are going back to that Substack article that you've read to implement hard coded creds in your agent? There are better ways to be doing this. And sadly, if you look at examples just in the past month of the Salesloft Drift incident, where again we see tokens being stolen and reused. There are better ways to do this, people. The OAuth spec has been extended to use DPOP, distributed proof of possession, to cryptographically bind these tokens so they can't be stolen and reused. So, why aren't people using this stuff? This is where we come in, and so problem number one, authentication. With our old Xero platform, we're making it really easy for developers to build secure agents. We're solving the authentication problem so that you can do that really simply and easily. So, that's one big one. The other one is, how do you manage all of these tokens? Token proliferation is going to be a really big challenge because we're all going to have dozens of these agents and each agent wants to connect to, well, everything. It's going to pop up and ask you to approve Google Drive access, Slack access, Zoom access, so many different applications it wants to be able to talk to. Well, each one of those interactions is a token, another token, another token, another token. So, how do we make sure that these tokens aren't just out there in the ecosystem waiting for some threat actor to come along, grab them, and then use them? So, we've come up with a concept of a token vault, and again, the principle being, we've got to make this so easy that people look at it and go, how could I possibly not use this thing? So, that's problem number two, and so we're solving for that one. Problem number three is again, think about that ecosystem of connections that you have with an agent. Perhaps I've got an agent that's talking to a financial management system, it's pulling down some rather sensitive data, but at the same time, I need it to be able to interact with my calendar and move some things around. It's all about context, and MCP the protocol, it's all about context and passing context around. MCP is just, well, it's a pipe, it's created to allow you to connect to things. It's not worrying about the content of that pipe and making sure that actually, when I'm pulling from that sensitive system, passing that whole context to the calendar management app may not be the right thing to do. That's where we've got fine-grained access. This is where we come in with, again, a really easy solution for developers to look at and go, how can I make sure that as that context is coming back to my agent, I've got a different context that's going out to that calendar app? Those are the three big ones that we've been solving for, and I'm really pleased to say that our team has come forward with what I think are really fantastic solutions. And now, it's up to us to really put the word out there to all developers and also to those vibe-coding agents out there, there is a better way, and it's with Okta and Auth0.

Rebecca Knight

>> So, one of the things that a lot of Okta security leaders have talked about is that security is a team sport. So how do you, David, think about cultivating this kind of security culture, and where it's everyone's responsibility, not just something that's in the remit of IT?

David Bradbury

>> That's a great question, and so many CISOs have been asked that sort of a question on stages and panels, and they come up with these amazing long-winded stories about, oh, it's about the vibe and it's the feeling and I've managed to influence my culture by setting expectations. But let's be real, when it comes down to security, people turn up to their jobs and it's just never the first thing they think about. All right? As much as we can say it's everybody's job. So my duty is to figure out, how do I face into that and try to weave myself into everybody's life in some way? And it's different for every person. One of the key hallmarks of our security culture at Okta beyond the basics of yes, we have awareness training, yes, we have company values that enshrine security. It's making sure that everyone understands that if you see something out there, whether you think that something's not quite right, or perhaps you've seen something you think there's a better way of doing something from a security perspective, I'm going to pay you for every idea, suggestion, recommendation, or if you actually come across a security issue, well, I'm going to pay you even bigger. The idea of a bug bounty is very common in the security industry, so we've breathed the life into that from an internal perspective. Not just a bug bounty, though, we'll appreciate any idea. And we pay out in the hundreds, sometimes in the thousands to all employees, and all employees are invited to participate. We then publish this on a quarterly basis, we follow up with employees when they identify something to let them know we're thinking about it or we fixed it. Again, that creates a movement. That creates a culture where people know that when they actually identify something and they contribute something, we're going to take it seriously. Yes, we're going to compensate you as well, which is kind of fun, but we're actually going to do something about it and we're going to show you that we've done something about it. Now that, I think is bigger than any awareness program, any talk that I can do at an all-hands. We do all of those things for sure, but this is the one big thing that's had the most significant impact at Okta over the past couple of years and really changing the way that people turn up to work. They're actually thinking about this, they're incentivized, and they can see that they can make an impact.

Jackie McGuire

>> Highly motivated, and somebody asked me to do a short video this morning for Mentor Monday, and what I said is the seven words that'll absolutely change your career is, "What does success look like for you?" And I think for you, you've gone to, what are people's core motivations? And maybe it's the money, maybe it's the recognition, maybe it's... But really, using that to shape what you're asking them for-

David Bradbury

>> 100%.

Jackie McGuire

>> And giving them something in return.

David Bradbury

>> And bringing all that together.

Jackie McGuire

>> Yeah. Well, and to your point, I think also making things easy, is that I've been told by many an executive that security's an impediment to innovation. It's friction, it's, we're the department of no. And I think if you can make it so easy, to your point, with a token vault to use security that you're like, oh, it's significantly easier to do it this way, it saves me time. That again, goes back to people's motivation, because I'm sure on the off-zero side of things, developers just want to move fast, right? They want to ship.

David Bradbury

>> That's right.

Jackie McGuire

>> But we can't break things anymore. So, we still need to move fast but we can't really break things, especially at Okta's size. I mean, you touch a huge amount of the authorization that goes through the internet, right?

David Bradbury

>> That's right.

Jackie McGuire

>> So I think that's really good takeaway for me for CISOs, is at the end of the day, you have to figure out what motivates employees to do the wrong things and use that to motivate them to do the right things. Right? So as you think about this, as you think about the future of authorization and agents, so I got a sneak peek because I was in the analyst sessions yesterday, but it almost seems like with non-human identities are not enough to describe what these agents are doing. So, how do you see that evolving? What's the third thing between machines and humans that you can't just cover with non-human identities? How do you think about that with agentic AI?

David Bradbury

>> I think the most significant evolution of our thinking around agentic AI in the past 12 months is to recognize them as a different type of identity. When I think about what an agent is, and it can be on a spectrum of autonomy of fully autonomous, semi-autonomous, humans in the loop sometimes, and then we have your more transactional interactions. But when I think about the complexity of the interactions that they have, the integrations, it really elevates them to a moment where they're not quite a human identity. They do have lots of access, but they have a scale of access that's beyond what a human would have. They're not really a service account either, a service account being more of a transactional point-to-point situation. And so, part of our recognition of this and what we're talking about here at Oktane this week is, not only is it really important to shine a spotlight on developers building secure agents, but it's time to think about how we're going to manage agents in an enterprise. As we start to see all of these agents being deployed, how are we going to ensure that we have a secure identity from day one, and that we're governing and managing that identity from day one? And so, that's required us to rethink our platform. So the traditional Okta platform that everyone knows and loves, we've re-engineered it to make sure that AI agents are a specific first-class identity separate to humans, separate to non-human accounts. And we've put special processes and wrappers around those to make sure that you can actually see, again, calling back to the Salesloft Drift instant, if you're worried about that Drift application, that specific agent, you can go into Okta, select it, and see all of the tokens that are associated with it. Allowing your incident response team, if that's the event that you're chasing down, to go and track down each of those or rotate all of those. Centralized management of these tokens, but it's time that we have to elevate our thinking about where age agentic AI sits in our identity stack, they are different. And so, we've got to treat them differently, but we've got to treat them as a first-class identity type.

Rebecca Knight

>> So thinking forward, you've described this as an AI versus AI fight, where we know adversaries are sharing tools and techniques. Where do you think the landscape for identity threat is headed next, and are we ready for it?

David Bradbury

>> I don't think I've ever seen a moment in my career where when I think about a technology shift like AI, every day there is a new company, a new protocol, a new something. And whilst we are experimenting and looking at where we can apply AI, guess who's doing the same thing? Our adversaries. And what we started to see more than a year ago were just the initial pieces of, we were seeing some gen AI on some fake voicemails and some videos and some Zoom calls, but now we're starting to see the most recent Nx NPM incident as an example, where the malware is actually looking for installed LLMs on your machine and it's using them against you. It is actually got prompts that it's looking for, crypto related wallets, and it's using Claude or ChatGPT installed on your own machine and anything that it's connected to, and it's using that against you. And this is an example of, I think, threat adversaries are starting to think through, how can I use these tools in different ways? That's one example. The one example we've seen a lot of and quarter on quarter we've seen phishing attacks, specifically targeted ones against our customers. Not just the generic ones, specifically targeted ones, spiked 300% just last quarter.

Jackie McGuire

>> That's what caused one of the NPM breaches.

David Bradbury

>> And one of the reasons is that it is now so easy to create a perfect copy of a website using the AI tools that are out there. Within seconds, you can create a pixel perfect representation, and now that you can do this in seconds, we're seeing that threat actors are just moving faster. It's easier for them to produce these sites, it's easier for them to go forward. So two interesting examples, but the important thing right now, I think, and the call to all CISOs and security teams out there is, because this is moving so dynamically, it's moving so quickly, it's incumbent upon all of us to share this stuff when you see it. If you are seeing a new novel attack, a new tactic, you need to make sure you get that out in blogs, in Slack groups, in trust groups. Get it out there so that we can consume it and react to it, because everything is moving so fast.

Jackie McGuire

>> And that's what the attackers do, right? And I always say this, I'm like, attackers don't care about IP, they don't care about trade secrets. They've got all these discords where they're just dumping anything that works into it and that's why we're losing is because we don't work together.

David Bradbury

>> Indeed, and I think we're making some really good ground on that, but we do need to make sure that AI specifically, it's just moving so fast. So, let's get that content out there. If you see something, push it out, and we can all move towards it as an industry.

Rebecca Knight

>> It is a brave, new, terrifying world. David, thank you so much for coming on theCUBE, a really fascinating conversation.

David Bradbury

>> Thank you.

Rebecca Knight

>> I'm Rebecca Knight for Jackie McGuire, stay tuned for more of theCUBE's coverage of Okta Oktane. You're watching theCUBE, the leader in enterprise tech news and analysis.