Insights on AI Era Security from Okta’s CEO

Today, I’m diving into a conversation with Todd McKinnon, co-founder and CEO of Okta, a platform that helps large organizations manage security and identity across the various applications and services their employees utilize. Think of it as a login management tool — and if you’ve ever found yourself logging in multiple times before a meeting, you know exactly what I mean.

Okta is a significant player in the software as a service (SaaS) market, boasting a market cap of $14 billion. However, the rise of AI has put pressure on companies like Okta. Why pay for their services when you could potentially create your own tools? This so-called “SaaSpocalypse” is a real concern, and Todd recently expressed his “paranoia” about it during Okta’s latest earnings call. We explored this topic, discussing how he’s addressing these challenges within Okta and the opportunities he sees to navigate this shifting landscape.

The most intriguing opportunity we discussed revolves around the management of AI agents within organizations. With the emergence of tools like OpenClaw, new security challenges arise. Can companies ensure the safety of users, platforms, and data if individuals can simply buy a Mac Mini, input their credentials, and let OpenClaw operate freely? Is a simple “kill switch” at the agent level sufficient, as Todd suggests?

Todd describes agent identity as a hybrid between a person and a system, which opens up a fascinating discussion. We also touched on the evolving nature of organizational structures as companies begin to manage teams that include both human employees and AI agents. Todd’s insights reflect a deep understanding of the software development landscape and the emotional aspects of running a software company.

This interview has been lightly edited for length and clarity.

Todd McKinnon, welcome to the conversation.

Thanks for having me! It’s great to be here.

I’m eager to dive into this. Recently, a recurring theme has been my emotional response to the nature of software in 2026, and I can’t think of anyone better to discuss this with than you, given your experience in enterprise software.

Would you like me to soothe your emotions or stir them up?

Let’s start with your emotions. I want to get right into it. A few weeks ago, Okta had its earnings call, and you were asked about the SaaSpocalypse. Your response was quite revealing: “We are paranoid, and we’re ensuring we’re using the latest technologies, including LLMs, to maintain resilience and security while offering the best features.” This indicates a recognition that customers might prefer to build their own tools rather than pay for yours.

That’s a significant statement. Can you elaborate on your perspective regarding the SaaSpocalypse and how it impacts your approach at Okta?

I thrive on challenges, and I see a massive opportunity in the current landscape. The technology pie is expanding rapidly, especially with AI and the rise of agents. This disruption is monumental, potentially more significant than cloud computing. Capturing this opportunity is crucial for Okta, which has seen success with $3 billion in revenue and over 20,000 customers. However, the challenge of evolving from a mid-sized SaaS company to a leader in this new landscape is daunting yet exciting.

You’ve mentioned that the total addressable market for software is growing. I have questions about Okta’s position in this expanding market, especially regarding your announcements about agent verification and kill switches. But first, let’s return to the SaaSpocalypse. I understand it in the context of standard productivity tools, but Okta seems more insulated due to its focus on identity and security at scale.

What specifically makes you concerned about agentic software and customers potentially building their own solutions that mimic Okta?

The capabilities of these new tools are impressive. As a former software engineer, I recognize the revolution happening in this space. If you don’t critically assess how your company is built and the changing landscape, you risk being naive. While Okta has strong market positioning and product attributes that make it resilient, it’s essential to remain vigilant about emerging technologies and potential competitors.

This healthy paranoia is crucial. Our products’ features and functionalities are vital, but the real challenge lies in integrating with thousands of applications and services. Ensuring that everything remains up-to-date and functional is a monumental task. Even if someone builds a tool that resembles Okta, achieving the reliability and trust that comes with years of experience is a significant hurdle.

Cybersecurity software, in particular, is less susceptible to vibe coding due to the inherent trust and brand recognition required. Organizations must justify their choices to stakeholders, making it less likely they’ll opt for unproven solutions.

You mentioned the need for a strategy to navigate this landscape. What are your thoughts on the emerging market for AI agents and how Okta can position itself within it?

The first step is recognizing the new market for AI agents that require identity management. This is a significant opportunity for Okta. The second step is executing a strategy to capture that market, which involves increasing our capacity for change and innovation. We need to embrace a higher rate of change within our organization, allowing teams the freedom to experiment with new technologies.

It’s essential to maintain a healthy skepticism about the claims made by other companies regarding their AI capabilities. While it’s crucial to appreciate the potential of AI, we must also focus on what works for us and what doesn’t. Change is challenging, but as a leader, I believe in empowering teams while also pushing for necessary transformations.

You’ve highlighted the importance of managing AI agents and their permissions. It seems you’re more focused on that than on the threat of cheaper competitors. Is that accurate?

Absolutely. If we can establish ourselves as the identity layer for AI agents, it could become a dominant category in cybersecurity. The potential is enormous, and winning that battle is our primary focus.

How do you balance the risk of losing the identity aspect of your business to cheaper alternatives while pursuing this larger market for agent control?

These markets are not mutually exclusive. The attributes that make Okta valuable—reliability, trust, integration—apply to both human and agent identities. Organizations are increasingly aware of the potential of agents and are looking for foundational building blocks to facilitate their integration.

As companies seek to automate and enhance their workforce with digital employees, they need a reliable framework to connect everything. This presents a significant opportunity for Okta to lead in this space.

When considering tools like OpenClaw, which allow users to bypass traditional security measures, how do you evaluate the permissions granted to these agents?

The rise of OpenClaw has opened eyes to the possibilities of automation, but it also highlights the need for robust security measures. Companies must ensure that agents have the appropriate permissions and that their actions can be monitored and controlled.

We’re working on establishing standards to help organizations manage these connections securely. The goal is to facilitate access while maintaining control over what agents can do.

As we look to the future, how do you see the relationship between AI, identity, and security evolving?

The digitization of offline identities, such as driver’s licenses and passports, is crucial. This transition will help differentiate between real users and agents, enhancing security. As these identities become more digital, they will provide a powerful means of authentication.

The challenge lies in balancing privacy concerns with the need for effective age verification and identity management. We’re committed to equipping our customers with the tools they need to navigate this evolving landscape while adhering to regulatory requirements.

In summary, the future of Okta involves embracing the opportunities presented by AI agents while ensuring robust security measures are in place. The landscape is changing rapidly, and we’re excited to lead the charge in building a secure agentic enterprise.