Okta's Oktane 2025 | James Simcox, Equals Money

Clips
More from Okta's Oktane 2025

James Simcox

Chief Product Officer

Equals Money

play_circle_outline Meet James Simcox: Leading Equals Money's Charge as Chief Operations and Product Officer in Business Banking Innovation

play_circle_outline Challenge of securing services for less technologically savvy users, like older generations.

play_circle_outline Collaboration between Equals Money and Okta, utilizing Auth0 for authentication processes.

Info
Transcript

James Simcox, Equals Money

James Simcox

Chief Product Officer Equals Money

At Okta's Oktane event, theCUBE dives into fintech identity and security with James Simcox, chief operation and product officer of Equals Money. Host Rebecca Knight and analyst Jackie McGuire explore how the company is protecting $50 billion in annual transactions while embracing AI-powered tools.

Simcox explains Equals Money’s role as a multi-currency bank for businesses across the UK and Europe, along with its embedded finance capabilities. The discussion highlights the company’s top challenge - account takeover - and why balancing invisible securi... Read more

explore Keep Exploring

What is Equals Money and what services does it provide? add

What are the challenges faced by fintech leaders in ensuring security while accommodating a diverse customer base? add

What are the needs and goals of a company using Auth0 for authentication while focusing on core business development? add

bolt Powered by CUBE AI

James Simcox, Equals Money

search

Rebecca Knight

>> Hi everyone, and welcome back to theCUBE's Live coverage of Okta Oktane. I'm your host, Rebecca Knight, sitting alongside my co-host and analyst, Jackie McGuire. Let's talk a little fintech in identity and security. Right?

Jackie McGuire

>> Yes. Yes. Everybody who's listened to me knows I'm a recovered finance nerd, economist, stockbroker.

Rebecca Knight

>> Former Wall Streeter. Exactly.

Jackie McGuire

>> Yes, yes. Can't wait.

Rebecca Knight

>> So you're going to have a lot of fun with this one. I would like to introduce our guest. He is James Simcox, Chief Operation and Product Officer at Equals Money, direct from London, England, James.

James Simcox

>> Right from London. Yeah.

Rebecca Knight

>> Welcome.

James Simcox

>> Thank you. Thanks for having me.

Rebecca Knight

>> So why don't you start by telling our viewers a little bit about Equals Money and what you do?

James Simcox

>> Sure. So I always describe us without a regulator in the room as a multi-currency bank for businesses. We provide all the services. Banks do except for lending for businesses in the UK and Europe. We do that direct to customers. So if your business have an account with us, we also do a lot of embedded finance stuff. So you can put our products into your products. I don't know, you're a taxi app and you want to give drivers virtual cards, put it in the app, we do all the reg stuff underneath that, all of the finance pieces and let our customers live their lives. So we have to deal with both our own customers and then other people's customers. So we have a huge kind of risk profile there we have to look after.

Jackie McGuire

>> So you'd like know your customer's customer's customer?

James Simcox

>> Yeah, it's a lot, right? It's not just keeping our customer happy, but it's like keeping their tens of thousands of other customers happy as well, which is quite a big task.

Rebecca Knight

>> So you have said that the security landscape has changed dramatically over the past, I don't know, a decade really. From your perspective as a fintech leader, what have been the biggest changes and biggest shifts that you've seen?

James Simcox

>> I think for us, the finance world has to deal with a lot of different customers, and we can't just assume that everyone is an expert. Everyone's grandparents use financial services, and if you ask them about a passkey, good luck. So for us, it's all the advice has been get rid of passwords, get rid of SMS 2FA, get rid of all these things. And actually for us, it's like our customers interact that way. And so we have to go, "Well, how can we deal with AI-powered threat actors who and also help your grandmother still log into her account?" And so that's been a big balancing act for us of trying to add not too much friction into our customer journeys and do it all in the background whilst keeping their accounts safe. Because for us, account takeover is still the biggest threat we have. That's always the thing. Humans are always the weakest link. And with so many different customers out there and such a good prize at the end, because normally, you steal a data, great, go sell that data. But for us, you steal real money, and it's a shortcut to the end. So that for us is a big challenge to grapple with.

Jackie McGuire

>> I imagine if you're holding multiple currencies and dealing in finance in general, that's a massive amount of risk as it is. And then you add that kind of asymmetry of information with very uneducated customers and then very sophisticated attackers, and that's got to be a recipe for disaster unless you make security really intuitive, right?

James Simcox

>> Yeah, yeah. Security for us has to be the front of everything we do. We think about it all the time. I mean, when we first implemented Auth0 by Okta, maybe it was 14 months ago, someone already had a fake site up in two hours that looked like our login screen. It's insane. And five years ago, you didn't have the tools to do that. And they always say criminals are the best entrepreneurs. They're using AI way better than we are. You can clone a website now in seconds. And so we have to assume that world exists, and so it's bringing all that security in the background, looking at device behavior, consumer behavior. Is this a normal person's patterns? All these things to keep that security there because you're right, there's a lot of money behind there to deal with. And I think we process about $50 billion of transactions a year for our customers, which there's a lot to happen there. And most criminals will happily walk away with a couple thousand and be happy, so there's a lot of opportunities for them.

Rebecca Knight

>> So what is your relationship with Okta? I mean, we are here at Okta Oktane. Tell us a little bit about the collaboration.

James Simcox

>> So we've been Okta customer for about 14 months now. Auth0 is a product that brought us in. I've got about 250,000, 300,000 direct end users of my own. And then obviously we have all the customers I talked about, those customers. And for us, it's how do we make that next step in our authentication journey where I could make all the decisions I talked about, like device behavior, suspicious activity without the customer being involved? I could roll out pass keys to sophisticated customers, but I could still deal with the less sophisticated customer without having to build loads of stuff ourselves. Because we build finance products. I want to go away and build, make payments faster and make card issuing easier and all that kind of stuff. I don't want to build an entire security product for myself. And so Auth0, our developers are really pushing us. They were like, "We use Auth0 in all our side projects, bring it in please." And so that's when we took the leap. Okta were great at expanding all those things and actually it's a fantastic product. So brought Auth0 first, and then we've also rolled out Okta across our other staff as well. Our staff are slightly easier, because I can control their lives and give them the devices they have to use and mandate how they interact with us, and they do that or they get fired. That's how it works. But having that kind of both those products helps us out a lot as well because there's a lot of interaction between the two, so we can deal with those things. Our staff use Auth0 for our customer facing apps as well, so it all works kind of well together.

Jackie McGuire

>> When you think about ... I hate to bring agentic AI into this, but you're in the payment space and you're working with end users, and so eventually there's going to be some of those agents in between your taxi drivers in the end user or your taxi drivers in your cloud. So when you think about that, Auth0, which is generally geared towards developers. Then you have Okta, which is generally more of a consumer facing product. Do you think that having both of those components, as we start to introduce some of these weird, murky, non-human things, do you feel like that's going to give you a better foundation to start building on top of with one platform?

James Simcox

>> So the thing that worries me the most about agentic AIs is that ... Well, not necessarily agentic, but just general AIs. Our staff will use AI tools without us knowing. And so having the right platform that can give me the reporting, the data access, understanding what they're up to. Because I love innovation, I do, but at the same time, it's financial services, so there has to be some kind of guard rail somewhere. Okta lets us do that, so that's really helpful. And then on the other side, enabling our business to use agentic AI where we want to. So we've started to use agents in our onboarding journey, because it's really repetitive. I go and find out who you are, what your business is, look at a whole bunch of systems. Unfortunately, there's not one system that I can look at for every company in the world that tells me who they are. We're not there yet. So we have to go through several systems. Agents are perfect for that. I can scale infinitely overnight if I need to for onboarding, and it just will kind of work. And so Auth0, being in front of our stack, lets us actually use those kind of agentic tools and build out that process, which really helps for us. And our customers can then, in theory, build on top of the future. We're not there yet with our customers, but financial services is moving that way. We're all going to start paying for stuff. The payment part of a journey will probably happen with agents soon. You want to book a holiday, great. Go find the flights, go find the hotel, book it all, it's repetitive. I don't need to do that. Just do that for me. And so we have to be ready for that as well when it comes.

Rebecca Knight

>> James, as a leader, how do you walk that tightrope that you just described in terms of knowing that AI is creating all these innovation opportunities, but also a lot of security threats and risks? And what is your messaging as the chief product officer to your team about that and about that balance that they need to strike?

James Simcox

>> Yeah, it's a very, very fine tightrope. I want the teams to go out and use as much AI tools as they can, but it has to be in that safe environment. So when we look at AI products, we have a very kind of, I'm going to say a rigorous process of checking those tools ourselves and making sure that our custom data isn't being used to train models because that wouldn't be allowed. And making sure that the security of the AI product is good. Because actually, I don't think we pay enough attention to, does that AI tool. Who knows what ChatGPT security's actually like, right? Unless you do a review, we go, "Oh, it's fine. They're a big company." Well, yeah, but you would go and do a deep review on your CRM supplier. So obviously, you do the same on your AI suppliers, right?

Jackie McGuire

>> One would hope anyway.

James Simcox

>> Well, we hope. Yeah. And so we look at for product is always, what's the customer need? What are we trying to solve? What's the problem that our customers actually want us to solve for them? And if AI is the right answer, great, let's bring an AI tool in. Let's do it safely, let's make sure it's monitored. And I think I mentioned earlier about Okta being there to monitor our staff doing things they shouldn't do. Staff always try and find shortcuts. I love that for them. Find the shortcuts, but find them in a way that we can monitor and be safe, right? Don't just go and Google AI tool for this thing and just do it, because that's not what you would do for everything else. And so having a platform that lets us report on that as well is really key because then we can say to teams go and do stuff because I'm confident in the background where we're on top of it as well.

Jackie McGuire

>> Yeah. I recently wrote a guide for CISOs on securing agentic AI specifically, and the number one thing is prioritize visibility of shadow IT. And so how do you use Okta for that? Well, and I guess Auth0 as well. How does that enable you to really monitor what people are logging into and what people are doing? And I guess as a companion to that question, as you start to onboard these services, Okta is working on a handful of different things, agent to agent protocol and a bunch, the cross-app access. How do you think about that in terms of being able to give your employees access to things and being able to see what they've taken access to on their own?

James Simcox

>> Yeah, that's a great question. So for the first piece, obviously, in Okta, first of all, we set a bunch of rules about how you have to access stuff. So it's very hard for our staff just to go off and give their password to a service to go and use it, right? There's a bunch of hardware-based security that we know if they're not using their own machine, which immediately is a red flag and other things will happen then. But it's also starting to run lots of tools which let us monitor, is a staff member accessing a tool in a way which doesn't look like a human's doing it? And we can start reporting on that because there are ways you can get around those elements that we have built in there sometimes. And having that visibility is really important for us. And our IT team can use that reporting to see this staff member's doing six application logins at the same time repetitively all day long. It feels kind of weird a bit. So that's kind of there. And then in terms of how we think about the wider role of agentic stuff, if I'm honest, I'm not sure we're there yet as a business, I'm not sure anyone's there yet as a business, right? And it's important that we have people like Okta or Xero telling us how we should be doing it, because we've all lived in a world where the humans are interacting with those tools. And now, we're in a space where actually you can set an agent up that can go and interact those tools by itself as much as it needs to, potentially even be creative and think about solving tasks using other tools it has access to, but shouldn't do. And I think a lot of times we thought about machine access as just have access to everything machine. You're a machine, we program you to do a task, don't worry. And now it's all about as guardrails, because we don't let humans to have access to things. You get a role, you get permissions, and that's how it works. And agents need that same framework, because they can just be a bit more creative than a task. There's all those horror stories of people who have API keys out there, which just have access to everything, right? "Oh, it's fine because we've programmed it in a way that it doesn't do that." Well, the agent might do that, so maybe we should think about those guardrails a little bit more in that space. But, yeah, I'm not the expert on that yet, and I need the experts to tell me how it should be doing it really, which is why I'm here.

Jackie McGuire

>> So I came into security through data science, and as I'm writing Python and trying to make something work, I go to Stack Overflow and I go look at how a bunch of other mischievous kids who spend all day in Python got around something. And I think when people think about AI being programmed, they don't think about that is that's what's programming the AI, that's what it's training on is all of these things from whether it's GitHub or Stack Overflow that are saying, "Oh, well if that doesn't work, just do it this way. If that doesn't work, just do it this way." And so while we want to think that we know what these agents are doing, if you don't have crazy tight guardrails, they have more resources than you do to figure out how to work around problems.

James Simcox

>> Absolutely.

Jackie McGuire

>> It's something that not everybody really is mindful of. I guess the last thing, last question I have is working with a finance product and thinking about your ultimate duty is kind of as a fiduciary to your customers, right? Do you incorporate that? We've talked a lot with the Okta team about culture and about establishing security culture and fostering this culture of protecting your end users. So as you're building your products, how do you think about that as you're integrating it into your own teams in how you do things?

James Simcox

>> Yeah, so at Equals, we have ... The rule is that security is everyone's responsibility, right? We don't say our security team, go to your jobs, whatever. When we go out and build products, one of the very first steps in our product process has a security assessment built in, and the product team and the engineer building those products has to think about the security elements, what impact it might have, how that sits there, because there's two sides, right? One is we have to think about how our customers will actually use the products we talked about it earlier, and how that can stay secure. But then all those other bits we talked about where, what packages are you bringing in, what other tools are coming in, what might AI build in that space there? I mean, we actually have AI now building lots of our products as well. And so making sure we have those instructions really tight up front helps in that process too. And then even the business, security is not owned by the CTO in the same way that it might be elsewhere. I'm a CPO, so I'm talking to you at this conference. That's not that usual, right?

Jackie McGuire

>> Yeah.

James Simcox

>> And it's partly because, A, our customers always interact security. It's the number one friction they're going to have after they become a customer is how you get into the products. We think about it very much from that customer first perspective. And security is split between me and the CTO for that reason so that we can have it as distributed and not just, "Well, tech didn't do a thing, but now the money's gone." No, the business didn't do a thing and now the money's gone. Ideally, it's not. And so we've kind of tried to push it right down into the teams, because it's very important that everyone thinks about it and-

Rebecca Knight

>> Security is a team sport. That's what we're hearing a lot at Okta. So we're back at Okta Oktane in next year, 2026. How do you think, any changes that you see on the horizon in terms of the fintech?

Jackie McGuire

>> Or asks. Anything you want to ask at Okta? Say, "Hey, I want to see this next year?"

Rebecca Knight

>> Exactly. Any capabilities you're hoping for?

James Simcox

>> So I think changes-wise, we're still very young in the AI agents world. We talk about them a lot, but I haven't seen lots of actually real use cases out there that people have gone, "This is working really well." And we particularly haven't seen it roll out into consumer-facing products in the same way that we talk about it internally. Lots of use cases like I talked about, repeating a task, my team do, but it's a very controlled task. And the team are experts. We haven't gone to customers go do agent things. So I think we'll start seeing lots more around that, right? And that's a lot of what Okta is bringing out is how do you let customers interact with your products in a safe way using AI agents? Asks-wise, it's not really an ask, but it's more of like we need to find ways that those vulnerable customers, like your grandmother, can use these new products in a way that they're okay doing right. The step for them, just using a smartphone is quite a big jump when we say you have to use an app to do the thing versus phone banking. And we've already learned recently now with AI clones, a lot of banks, two years ago, were using your voice as a way of identifying you. That's gone. Any banks are doing that should be in prison now, really, to be honest. And so lots of the ways we had of letting people do more secure things, it's kind of gone away overnight with other AI bits. So it's a problem we still haven't solved, I don't know, how we solve for the more vulnerable customers

Jackie McGuire

>> Nobody is classifying users based on their vulnerability, something like that. Like assessing their behavior patterns or-

James Simcox

>> And trying to find non-invasive ways of identifying them, which is still secure in this kind of new world where we can't identify them in the same way, right? Passwords aren't there. SMS isn't really a thing anymore. Pass keys, they're not going into that world. I can't use their voice on the phone, so how do I do that in a safe way and make it friction-free? Because they're the users where the friction hurts them the most as well.

Rebecca Knight

>> And you're thinking about those grannies.

James Simcox

>> Have to.

Rebecca Knight

>> James, thank you so much for coming on theCUBE, a really fun conversation.

James Simcox

>> Thank you for having me.

Rebecca Knight

>> I'm Rebecca Knight. For Jackie McGuire, stay tuned for more of theCUBE's live coverage of Okta Oktane here tomorrow. We'll be back. You're watching theCUBE, the leader in enterprise tech news and analysis.