Okta's CEO is betting big on AI agent identity

Support for the show comes from Comcast Business. With advances in AI, cybersecurity is getting more powerful, but so are attacks. In the past twelve months, Comcast Business detected 24.5 billion phishing attempts designed to exploit user behavior, steal credentials and compromise devices. AI is forcing a shift in how organizations defend themselves, demanding not only faster responses, but continuous intelligence. To survive in the current climate, leaders must build a security first culture to equip their team with the tools they need to stay protected.

With Comcast Business, connectivity, intelligence and response work as one orchestrated system. Get better equipped to handle today's cyber threat landscape with the 2026 Comcast Business Cybersecurity Threat Report. Read it today at Comcast Business dot com slash cybersecurity. Cyber confidence starts with Comcast Business. Black Friday is around the corner, your biggest chance to grow sales this year. Don't wait. Realize is Taboola's advertising platform for businesses, letting you launch campaigns on top premium websites beyond search and social.

Add Realize to your media mix and scale this Q4. And as an exclusive offer for podcast listeners, new customers get $700 credit back. Just search Realize Podcast on Google or use the promo code Podcast twenty six. Don't miss out on this limited-time offer. Terms apply. Support for the show comes from CrowdStrike. It's not a huge stretch to say that AI is the next major computing platform. Every platform shift changes the way we build software, and it changes security, too.

CrowdStrike is defining cybersecurity in the AI era with AI detection and response, or AI DR, a solution for seeing, monitoring and securing AI across the enterprise. Learn more about how leading companies are turning to CrowdStrike to secure AI and secure their business at CrowdStrike dot com slash decoder.

Hello and welcome to Decoder. I'm Nilay Patel, editor in chief of The Verge, and Decoder is my show about big ideas and other problems. Today I'm talking with Todd McKinnon, the co-founder and CEO of Okta, a platform that lets companies manage security and identity across all the apps and services their employees might use. Think of it like login management. Actually, that's a great way to think about it, because the way most people encounter Okta is that it's the thing that makes you log in again right before joining a meeting several times a week, which makes you late and then you have to apologize.

Can you tell we use Okta? Anyhow, all that is a big business. Okta has 14 billion dollar market cap. But big software as a service companies like Okta are suddenly under a lot of pressure in the age of AI. After all, why would you pay their fees when maybe you could just vibe code your own tools to do similar things? This is the so-called SaaSpocalypse, and Todd himself recently said he was paranoid about it on Okta's most recent earnings call.

So we dug into it and how he's putting that paranoia into practice inside Okta, what he's changing and what new opportunities he's going off to to head off the apocalypse. The biggest opportunity that Todd's thinking about is some deep decoder bait. The idea that it's not just people whose access and security credentials need management, but also AI agents inside a corporation. This concept has really gotten traction recently with the rise of OpenCloud, which comes with a ton of security challenges.

Can any company keep their users, platforms and data safe if people are just gonna go buy a Mac Mini, hand it all their credentials and let OpenCloud do its thing? Is simply installing a kill switch at the agent or login level, as Todd suggests, going to be enough? You'll hear Todd say that agent identity is something between a person and a system, which is in fact some of the richest decoder bait possible. So we spent some time digging into that.

It also seems like we're on the cusp of some of the goofiest org chart ideas in history, as folks start to manage hybrid teams of people and agents. And I wanted to know how Todd was thinking about that inside of Okta. Like so many of our guests recently, it's clear that Todd's a decoder fan. So this one got deep about the very nature of building software itself and what it means to run a software company in 2026.

That's right. The Okta episode got emotion. Hang on, it might surprise you. Okay, Okta CEO Todd McKinnon, here we go. Todd McKinnon, you're the co-founder and CEO of Okta. Welcome to Decoder. Thank you for having me, Nilay. It's great to be here.

You, would you do would you like me to soothe your emotions or not your emotions?

I'm gonna start with your emotions, actually. We are we're gonna we're gonna get right into your feelings, Todd. A few weeks ago, you

Oh yeah, I'm really good at talking about my feelings with massive groups of people, so lay it on me.

well, you you did. Here we go. We're gonna we're gonna just jump right into it. A few weeks ago, Okta had earnings, you're on the call. They asked you about the SaaSpocalypse, which I I wanna talk about in detail, but this was your response to SaaSpocalypse. This is why I was starting feelings. You said, quote, We are paranoid, and we're making sure that we're using all the latest technologies, LLMs, et cetera, to make sure that we have something that's resilient and secure but has the best features and best capabilities.

This is you talking about agentic software development is real. The idea that our customers would build their own tools instead of paying us for these tools is real. We're paranoid about it. We've got to compete with that. That's a big thing to say. Talk about where you are in SaaSpocalypse, cause I I I wanna start there and then I wanna zoom out to basically the the nature of software in general. But that feels like a big thing for you to say, like you need to be paranoid about this threat.

Uh, let's start with me, personality-wise and w- how I operate. I'm very much challenge-driven, and I think a lot of people are, uh, in our business. And just like, what's the next challenge? Uh, and what I see right now in the world is huge challenge and a huge opportunity. It's like a huge mountain to climb, and that is, uh, at a, uh, the fundamental level is that the I believe strongly that the pie for technology is expanding greatly.

Like the pie, that what we can do for people and companies with AI and, you know, the the common things talk people talk about agents. And I mean, this is a massive change, massive disruption. It's bigger than cloud computing, it's, you know, you could talk about is it as big as the internet? It's big. So now now capturing that and and leading a company that thrive I mean company Okta's had decent amount of success, 3 billion in revenue, um, growing over 10% last year, established brand, 20,000 customers, we've had some decent success.

I think the opportunity going forward with all this change and all this disruption is is is massive, it's huge. Technology's getting way bigger, there's all kinds of new categories I think are emerging. So for me personally, it's an incredible opportunity and challenge to lead the company through this. And to go from what is, you know, like a midsize successful SaaS company to be what I think could be one of the most important companies in the world.

So that's a huge challenge. It's a huge opportunity. It's also daunting because in some way it'd be great it'd be great if n things didn't change that much and kind of our locked-in position was, you know, more stable and we could plug along. But there's a huge prize. The prize is massive, and that's incumbent upon us to face this challenge and to go get it.

You've talked about this in terms of the pie, you've said that the total addressable market for software is is growing. I I have a lot of questions about Okta in that I in that market as it's growing. I I know you have some announcements about agents and verifying agents and having kill switch for agents that I want to talk about. I just want to come back to SaaSpocalypse in general. I understand SaaSpocalypse for a run-of-the-mill productivity tool.

We use a lot of run-of-the-mill productivity tools here at the Verge. They're all fine, right? And and I'm always joking that enterprise software CEOs don't love coming on the show. Because When I I'm always like,

grow up, I want to be run of the mill.

right, it's but they're all fine. Like, you can, uh, you can take one piece of project tracking software and replace it with another. And the idea that you're gonna get anything more than 5% productivity improvement, I think, is has always been illusory. Maybe you'll get some better pricing. The idea that I can just vibe code a Trello, and now I don't have to pay Trello because I just have a tre- like, I I understand that argument.

Okta to me has seemed much more insulated from that, right? Cause you're you have identity and you have to protect, you have to do security at a scale that most people can't consider doing security. There's a lot of reasons why me paying you to take that liability on is a good business, regardless of whether I can build it myself for cheaper. What specifically has you paranoid about agentic software and your customers building their own tools like Okta?

Cause to me, that's actually a little more opaque.

I mean, if you look at what these tools can do, it's amazing. The Claude Code and co-work and, uh, Codex and th- these are I mean, from my my grew up as a software engineer, and that whole world is being revolutionized. So I've built a company as a product developer and as an engineer. And so if you don't question and look at how you've built your own company and thinking and and realize that that world is changing, you're just naive.

Now we can talk about the reasons why I think Okta is very well positioned and has attributes of the market and attributes of the product that make it, uh, very resilient and hard to replace. But the just gotta look at the technology and look at what look at what's possible. And if you're not, if you're not circumspect about what got you here and what your modes are and what the upstart would be doing if they were trying to compete with you, I think you're just naive.

So I think it's a healthy paranoia. I when you look at the business, I think there's the features and functionalities of functionality of our products. And then one thing that's maybe misunderstood about what we do, or maybe the buyers understand it, but in general might be misunderstood. You can build the features and functions, but you the last thing you have to do is you have to connect it to everything. Thousands and thousands of different applications and services and pieces of infrastructure, it has to be connected to the last mile.

So that is, you know, and that and that always changes. So you have to keep that integrated and you have to make sure it's always up to date with the latest changes of all the ecosystem. And so the integration part, and then this other part is that it really it has to work, it's mission critical. So even if if you know, if you're building something that look looks like Okta, getting the features to work is like 10% of the battle.

Making sure it works 100% of the time is is takes years and years and years, and is there's a also a reputational thing. It's like, what are you gonna trust? Are you gonna trust the hard, the proven solution that's been out there for years, or are you gonna trust something that your team just cooked up? So, infrastructure software in general, and then cyber software, I think, is also very well insulated from people vibe coding it themselves.

Just because, you know, y- you're talking about things that are purchased on, uh, there's a lot of a brand that goes into it, like, what cyber company do you trust? What cyber company do you trust to be, uh, secure itself? To what cyber company do you trust to be up to date on all the latest threats? And and then people that are buying cyber tools, they're gonna have to look at their bosses and their boards of directors and say, What did you pick?

Oh, we got breached. Well, what did you pick? Well, I wanted to save a little bit of money to vibe code it. So that the the category of security and infrastructure software, I think, is a little bit different from some of the app app categories that you were talking about.

there's a little bit of no one ever got fired for picking IBM in there. And then I think more cynically, there's I want a vendor for this stuff that is rich enough for me to sue them if something goes wrong, right? Like, there, the it's, it's in there. I I I you know, I hear it from the industry. Um,

Sure, yeah. Or can or the the more like glass half full would be can support me

yeah, it's it's one or the other. It's, uh, y- your job is to have the glass be half full. Uh, I have the other job. So I'm trying to connect the dots between what sounds like a good case for being insulated from the market and w- what you're describing as healthy paranoia. Like, there's a new generation of software tools that will help people build competitors to Okta, whether those competitors are just the next n plus one sAaS competitor, or whether it's the internal team at a company saying we'll build our own identity solutions.

What's the mechanism that is leading you to say we have to be vigilant? Is it the new generation of SaaS companies will just be cheaper? They'll have fewer people and they'll build something comparable to Okta that is just vastly cheaper per seat. Is it the companies will realize, oh, we can just build all these connectors and Claude Code is gonna traverse our intranet and log people in manually, and maybe that'll be more costly in tokens, but the front end will be cheaper.

If you have the insulation, what is the mechanism that might be a threat to Okta?

I compartmentalize it in two different areas. Um, the first area is just, uh, and probably the more more important area is is job as a CEO is most important job is, like, figure out strategy, which means which market you're gonna be in and how you're gonna win in those markets. And for us, this there's a big new emerging market, which which is AI agents need to log into stuff, and AI agents need to be, uh, you need to have a system to keep track of them and, uh, define their role and define their permissions and what they can connect to and what they can do.

So that's a big new market, so getting the company oriented on that massive new market, and that's one bucket, which markets. The second bucket is how we execute to go capture that market. And I think the main theme in the second bucket is it's it sounds basic, but I think basics are important, which is it's very clear that, especially in software development and innovation, the technical shift is very significant. So the number one thing that organization has to do is is turn the dial in terms of how much change it will absorb.

So in normal operating mode, let's say you want 20% change, 80% stays the same. You need to turn that dial up now. You need to change more, whether that's the your team structure, whether that's processes, whether that's the technology you're using, you have to turn up the change quotient. So what I tell the team is it's gotta be at least sixty forty, if not more. Um, and then with that, it's like you give them the freedom to experiment with new technology, um, you know, learn from what's happening out there.

By the way, I think one of the most important things is, you know, while you have a a healthy appreciation for the change and the impact, you can fall victim to believing what you see online or what you what you hear. You know, because everyone's trying to sell something, everyone's trying to make their company sound cool, and they're like, they're embracing the change. So when you hear companies, you know, especially big company CEOs say, Oh, you know, uh, AI is writing 90% of our code right now.

I mean, they're trying to sell something, whether it's their own, uh, substance as a leader or their own organization's ability to innovate. So you gotta take that with a grain of salt and say, hey, the art of the possible. But, like, w- w- you know, as we change, what are we embracing, what's working for us, what's not? But it kind of all comes back to giving the teams freedom to change, and change is hard. It sounds trite, but you really, as a leader, you have to force it sometimes, top-down mandates, right?

I like to be bottoms up and empower people, but sometimes to get change happened, you have to push it.

tell me how they changed. It sounds very specifically like you think the change here is there's going to be a universe of agents doing work inside of companies, and they need to be permissioned and controlled, and Okta should focus on that. And you're not so worried about, hey, a bunch of people are gonna vibe code their own tools, or a bunch of cheaper competitors are gonna come up and disrupt us because they vibe coded a competitor to Okta.

Like, it seems like you're bracketing that and saying that's not a big problem for for Okta right now.

We have the opportunity to win this this battle to be the identity layer for AI agents. And if if we win that, that could easily be the biggest category in cyber. I mean, cyber is about 200 and eighty-ish $1 billion a year. Identity management is about, depending on whose number you believe, it's roughly 10% of that. Um, this new agent layer could be the biggest category in cyber by far. Um, so yeah, winning that is is is job number one for our company.

Tell me your calibration on how much it's acceptable to lose the identity piece of your business to whatever vibe coding, SaaSpocalypse people think in order to win the bigger market in, uh, agent control. Because right now, you know, the argument is why would anyone keep paying you monthly or yearly for x number of seats when they can pay a lower fee to some solution that someone has built cheaper? And then once that's done, it's done and you don't, you don't have to pay annually.

Why would anyone keep paying you for that if you think the market is bigger for agents?

They're not mutually exclusive. Um, I think the attributes we talked about, whether it's, uh, reliability, trust, integration, capabilities, you know, does the vendor you're gonna trust have enough money to to support you? Um, that's that's a foundational thing in both of these markets, whether it's people identity for customers and partners and employees, or it's this new identity type of agents and facilitating that. So they're not mutually exclusive, but I think that that w- when I what's happening in the world right now is every organization is is, it's it's interesting.

They're they're, I think I would say they're universally, uh, aware of the potential of the agentic enterprise, which is essentially they wanna make things more automated and they wanna, you know, enhance their digital or enhance their workforce with digital employees, or they wanna add new digital employees. So they're all clearly aware of this, um, and but they don't, you know, it's they're they're getting a very mixed set of signals and a very messy story about how they do it.

There's a combination of, you know, the big platforms, Amazon, Microsoft, Google are gonna sell me, uh, agents. It's not even actually clear what an agent is. Salesforce has agent force, ServiceNow has agents, every, um, SaaS company is building agents, so they're they're trying to sort through it all. But what they see is that they see a tremendous opportunity to automate things and to, um, basically take labor budget and divert it into technology budget and make their companies grow faster and be more efficient.

And they're and now what they're looking for is okay, what are the foundational building blocks to wire that all together and make it work? What are the rails? Um, and so that's where the big opportunity is to get take the first steps on this, you know, what could be the biggest category of cyber?

when you look at things like, uh, open claw, which obviously had a huge moment, and everyone is buying Mac Minis so they can air gap open claw from their production machine, and then they're just giving open claw all of their logins and passwords on the Mac Mini. Do you see that? Like, I look at that, I'm like, you've accomplished nothing, right? You you've you've given it all the access over here, and maybe it just doesn't have your file system with your photos on it, but it still has all the access to the tools.

But that's where the excitement is, right? Is like the sort of like living on the bleeding edge of danger and saying the agent running on this machine can run overnight and invent its own tools and figure out solutions to problems. When you are looking at putting rails on that, it feels like you're actually gonna foreclose some opportunities because we don't yet really know how the agents are gonna work. How did you look at open claw and the way people were giving it permissions?

Is that sort of culture organically developed, and how is it informing your thinking about building for agents at Okta now?

It's the chat GPT moment for agents. It's, you know, and then chat GPT was the Netscape moment for AI. So it's it's very significant. And and the biggest significance I think is it it opened everyone's eyes to the art of the possible. You know, my my son's soccer game, the parents were talking about open claw, and these aren't tech people. They're just talking about how they're gonna automate all their tasks. And so these people are using in in their personal lives and their consumers and their IT buyers at companies.

So it's it's a really eye-opening and def- definitional thing about what an agent can do and what it can be. And there's this attention, you know, when you when you get something like an open claw and you try to experiment with it and play around with it. You say, Oh, it's really not that interesting unless it has my data, unless it's connected to everything. And this is exactly what these companies are, every enterprise is f- is is struggling with.

It's like, Hey, this stuff really needs to have my data, my fifty fifty years of sales inventory and my consum- my customer data and my marketing data. And once it's all combined, these agents in this agentic layer can do things interesting. So what the rails we're putting in place is actually first of all, it sounds basic, but just giving enterprises a a list of the agents they have sounds simple, but they they need a list of the agents they have.

And then they need a system of record and a list for, you know, the agents they could use. So what is Salesforce doing? What is ServiceNow doing? What is Claude doing? What agents do they have? And then then, okay, now what are they connected to? And making sure that we control and secure what the agents are connected to. Because, again, the tension is between more and more data, more and more connections. This is, by the way, why the why the companies like Palantir and Snowflake and Databricks are doing so well.

Cause what they allow companies to do is instead of having to actually connect their agentic enterprise to all these separate systems, they pull it into one data warehouse. So that's one model. You can pull it all into one data warehouse and run the agents on that. Um, but I think the longer term, more scalable model is you actually have the right permissions and the right access tokens to the agents to access the data directly. So when you go back to the example of of open claw, it's like mindset, everyone knows what these things can do now.

Um, and you have to facilitate access. You have to facilitate making sure that these connections are made in a secure way, in a in a way they can be understood and monitored. And when things go too far, you can pull them back. And as you experiment in the lab, you can say, these are the connections we need. This is, you know, we should add more here, we should change this, we should filter this permission. That's what companies have to do, and that's that's the what we're that's the rail, those are the rails we're trying to put in place.

When I said this was gonna be an emotional conversation on software development, the nature of our relationship to databases is at the very heart of that existential crisis that I I feel every week on this show. Let me, uh, just get your answer to this directly. It sounds like you're saying SaaSpocalypse might be real, but it's not real for Okta in the way that most people think SaaSpocalypse is real.

I think the what people miss is that the the pie is getting much, much larger. If you look at, uh, the um amount spent on software, it's, you know, it's about if you do infrastructure and SaaS and everything, the hyperscalers software, it's about, you know, 1.2 or 3 trillion, 1.2 trillion roughly. If you look at the amount of people, the services, the s IT services market, it's about 1.8 trillion. So the markets are getting bigger, you know, we're we're gonna be spending more of that money on software, and the pie is getting bigger.

That's one thing that's true. The second thing that's true is, uh, the every piece of technology in the stack, whether it's SaaS apps, or whether it's, uh, devices or OSs or infrastructure, they're all gonna get agentic features. They're all gonna do things more on their own. They're all gonna they're gonna be able to talk to more of them, and they're gonna optimize for agentic. And I think the last thing is that there is a new layer, and that is the digital worker layer.

And, you know, some I'm sure some of the existing companies are gonna make the leap and they're gonna have real digital workers that are in their and, you know, come from, uh, Microsoft and Salesforce and Amazon. I think it's probably more likely it's gonna come from companies that aren't, uh, kind of weren't born in the in the legacy way of building an app. You know, I think it's hard when you're when you grew up building an app in a certain functional silo, it's hard to build a digital worker because digital workers need to go across different things.

That's why they're called workers. That's why they're not called one app. And so it's really hard for companies that have, you know, focused on collaboration or HR or one silo to say, Hey, now my digital worker really can span all these silos. Because if you look inside those companies, the whole org structures of these companies and the politics of these companies are someone owns one silo. So it's very hard to break through and go broad. So, anyways, I think everything's getting bigger.

I think a lot of the, um, apps will have agentic features. I think there's a new layer of digital workers. Now, back to your question, which is like, what's going on with the SaaSpocalypse? The reality is there will be some losers and there will be some companies disrupted, and, uh, there'll be new people take over categories that are now. Um, but I I mean, that's, you know, back to challenges and making it fun. That's that's what fires me up, and I I think it fires up a lot of people too.

We have to take a quick break here. We'll be right back.

support for the show comes from Quo. You know, when you're juggling five things at once and your business phone rings and you just let it go. That call might have been your next best customer. That's why today's episode is brought to you by Quo, spelled Q-U-O, the business phone system built so you never miss a call. All your calls, texts and voicemails live in one place, so anyone on your team can pick up a conversation, see the full history and respond fast.

More than 90,000 businesses rely on Quo to stay reachable and look professional every day. Setup takes minutes, and you can keep your existing number and add teammates as you grow. Quo's optional built-in AI agent handles after-hour calls, answers questions, and even books appointments, even when your team is offline. Money is on the line. Always say hello with Quo. Try Quo for free, plus get 20% off your first six months when you go to Quo dot com slash decoder, spelled Q-U-O dot com slash decoder.

Support for the show comes from Rippling. You just found out your sales team is at risk of missing quota. Don't panic. Just ask Rippling AI. Since it's built on your real-time people and business data, Rippling AI can pull metrics from Rippling and Salesforce into a meeting-ready dashboard, which shows quota attainment, headcount plan, and monthly revenue to quota by region. In seconds, you'll see exactly what's behind your quota risk and fix it before it's missed. Question answered, action taken, crisis averted.

When you have critical business questions that need answers, don't just file a ticket and wait weeks for an outdated report. Describe what you need and have Rippling AI build it instantly from your live people and business data. Whether it's a dashboard with detailed charts or automated workflows with the right triggers, conditions, and approvals. Ready to rule your business? Head to rippling dot ai slash decoder. Get the only AI built to give you full visibility and take complex actions across your entire organization.

That's r-i-p-p-l-i-n-g dot ai slash decoder. Sign up for exclusive access today. Support for the show comes from Granola. Have you ever left a meeting thinking that was productive, and then ten minutes later, when it's time to take next steps, you're at a loss. Or worse, you've been heads down the entire meeting, furiously typing notes instead of actually listening, and now your brain is fried. Meetings are a mess. Granola fixes that. Granola is an AI-powered notepad that makes your meeting notes useful.

It capture what happens in your meetings and turns it into clean, structured notes with decisions and action items pulled out and made easy to find. And the best part, Granola works through your device's audio, which means it integrates seamlessly into the video conferencing tools you already use. No setup, no awkward bots. It's just your normal meeting with superpowers. You get to actually listen instead of frantically typing every word, and still walk away knowing exactly what was decided, who's doing what, and what comes next.

Once you try it on your first meeting, it's hard to go without. You could try it totally free. Just head to granola dot ai slash decoder. That's granola dot ai slash decoder to get your time back. Go to granola dot ai slash decoder and try it on your next call. This holiday, switch to the Simplicity Plan from Verizon. It's one plan, one price, just $30 a line per month for you or the whole family. And on their best five G network.

Switching to Verizon and shopping their best deals makes the holidays simple. Head to verizon dot com or your nearest Verizon store today. Welcome back. I'm talking with Okta CEO Todd McKinnon about org charts and how deeply weird they're starting to get in the age of agentic AI. You have brilliantly opened the door to the decoder questions by talking about org charts. I actually think we're on the cusp of some some of the weirdest org charts we've ever seen.

So tell me about Okta. What was your org chart in the past? I mean, you you founded the company, I'm sure you've gone through many iterations of it. Where are you at now? And as you talk about changing the balance of change in the company, how are you changing your org chart?

I think the guiding principle is, uh, is try to give the great people, uh, area that they can be great in. So it's really kind of a a people-driven org chart. It's like reward people, promote people, bring in new people, give them give them an area that could really in excite them and motivate them. And it's kind of people-centric. The second principle is is, uh, whe- where possible, try to cluster things so you you minimize communication paths and you let people be more autonomous in small teams.

I found that's pretty hard. Um, I think pretty quickly, there's unless you have very, um, distinct separate business units and really almost separate companies inside your company, it's pretty hard to cut down on the lines of communication. There's got to be lines of communication somewhere, no matter how you slice the org, you're you're kind of moving around where the people have to cross org boundaries. But you do try to take that into consideration. And then I think beyond that, I think a lot of, um, people think things that people try to do with org charts, uh, you know, whether it's, um, get people aligned on goals and get a culture that is shipping things quickly is it's really not an

org chart thing, it's a management thing, it's a leadership thing. And you'd better you instead of moving the org around all the time, you'd be better spent to make sure you have the right management team and the right leadership team to to instill those cultural elements versus, you know, taking your people team and telling them to move stuff around to have a more nimble culture. You probably should just, like, get the right managers. So this, I mean, this is my joke on Decoder, right?

If you tell me the structure of your company, I can tell you 80% of your problems, because the the tensions just exist in certain structures in predictable ways. And it's that last 20% which is priorities and leadership and management. So it sounds like you're pretty functionally structured, but how is Okta actually structured? Are you structured by business line? Is it, uh, or do you just have, like, a crack AI team that's off in the corner?

Like, how does this all work?

On the go-to-market side, it's functional. On the G and A side, it's functional. On the R and D side, it's it's by platform. We have two platforms. There's Okta Platform and Auth zero Platform, and the R and D is by platform.

The other question I ask everybody who comes on Decoder is about decisions. Again, you're it's g- it's always great to have a founder cause you your your frameworks change as you come up with a company. How do you make decisions? What's your framework and how has that changed over time?

I would say the this is, uh, we're we're really talk we're doing introspection here. Um,

It's all should be emotional. This is Decoder. Decoder is just therapy for me personally. I I it's at this point, it's just like you you can tell what my problems are, right? From the questions you're asking.

that's right. You're c- you're, uh, you're, like, casting them out amongst the gods. But it's interesting. So when I started Okta, you know, I'd worked at Salesforce and I had a, you know, decent-sized team there and felt like I was very decisive. I was like, we gotta do something, hear the options, decide. And then I started Okta, and I f- found something interesting. I my decision making process slowed down. And I when I was thinking about why, it's like, I feel realized that when I was at Salesforce, my boss was always a safety net, ultimately, right?

It's like if I was gonna make a bad decision, there was theoretically a boss to to stop me. But when I started doing Okta and the company started getting successful, I was, you know, my decision was, like, the decision, and I I better think about it and get it right. And so it slowed down, it slowed down. And then the company got bigger, and we got into this phase of, um, you know, we were public and got closer to $1 billion in revenue.

And then I kind of felt like maybe I didn't, uh, I needed more input, and I really needed to get expert advice on a lot of things. And what I realized over those years is that my instincts were still pretty good, and I probably should trust my instincts more. Um, a and and so I think that's kind of the mode I've been in for the last three years. Yeah, it's the the company's bigger than it's ever been.

I'm managing a company that's bigger than I've ever managed by definition, but, uh, I think I've been leaning into my more ins my instincts more. And I think to inform those, and there's and then to put more, s you know, detail on that, I think two things are very important. One is that you you have to decide which decisions to make. So that's really important. So there's a bunch of decisions that I should, I shouldn't be involved in, I shouldn't be making.

The inverse of that is super important, which is the ones that I that I am making. I better focus on them and concentrate that concentrate on them and really get get those right. Um, and for me, i doing that in an effective way, having a detailed grasp of what's going on is incredibly important. So being in the details, and you know, it's it's at a scale where it's hard to know every little thing, but you can really dive into areas and get enough details throughout the year.

So that when it comes to make those big decisions that you've narrowed down and focused on, you can, you know, use those details and use your judgment and trust your instinct to make to make good, high-quality decisions. It's the most important thing I do, dec- deciding which decisions to make and getting a a a high success rate on them.

Put this into practice for me. The big decision we've been talking about is, okay, Okta is gonna chase the idea of being the framework for agents in the workforce. That's a huge market. It is so big that maybe you're not as worried about SaaSpocalypse as some of the other enterprise CEOs that I talk to because the market's gonna grow so big. And we're gonna force change at the company from the top down to make sure that the rate of change is higher, and we're all focused on this opportunity.

How did you make that decision? Was it wait, did you stare at the ocean for a while and it came to you in a lightning bolt? Like, what what was the process there?

The high order bit there is recognizing, uh, recognizing a world where everything in the stack is gonna change. Um, and I think w- it's not kind it's kind of similar, like when I started Okta, not I mean, you never wanna exactly follow the past because history doesn't repeat, it rhymes. Um, but a lot of it was, I remember in 2009, I was looking at the world and and saying, Hey, you know, there's gonna be a cloud version of everything in the stack.

And what are the big unique opportunities there? And what's happening with, you know, a agentic, call it agentic, is that everything is gonna be revisited in this agentic world, whether it's current solutions are gonna be have agentic capabilities. I mean, um, you know, it's crazy, like AWS, AWS is like the infrastructure business, the most unassailable business. That market is, you know, with all the changes with agentic and people building agents and running models, it's kind of it's up for grabs, which is crazy.

So all this change, and then you just look at what's gonna be required in all this change. And you say, I it's it's th- these connections between all these agents and where they're running, the the demand for that is gonna be massive because there's gonna be this onrush of agentic capabilities. And there's gonna be new stuff that's built, there's gonna be native vendors that come out of nowhere and take market share, there's gonna be new markets.

And so it's kind of a it's a macro thing, but now it's like, all right, t- m and what do you know about the details of your company, Todd? What are you guys good at? You're good at building something that scales, building something that's reliable, building something that connects to a lot of different systems. Um, you know, w- how can you position yourselves in that new market? And I think that's, you know, that those are the big essential things.

It's that's the bet we're making.

Take me inside the moment, though, right? You you're realizing this happens. Did you write an email? Did you open a Google Doc? Did you just dictate to ChatGPT and send say, fire off an email from me, agent? Like, how did that actually work at the company?

Last year, I was in process of meeting, uh, meeting all our hundred largest customers in person. And the p purpose of the meetings was I wanted to tell them about our vision of this unified identity platform where we're the only ones in the industry that have all these capabilities across customer identity and governance and privilege and, um, and at the same time, the the company, the the teams were working on, essentially, you know, agent identity, a and, um, these meetings, I would, I would pitch what I was talking about, and then there were there'd be interest in the, you know, oh, we we should look at this, we should.

We didn't know how far along you were. And then I started throwing in this agentic stuff at the end of the meeting. And whenever I would get to that, the com- the the, uh, the people in the meeting would just stop and they would be like, Wait, talk about that some more. Um, and then that kept happening and happening until until, you know, where, you know, twenty five, thirty meetings, forty meetings in, I would flip it around.

And we would start with the agents and the the new identity type and what customers were thinking about doing with agents and how they're seeing the potential of the digital worker and agents and all the confusion, and and we wouldn't get to the other stuff. We had our big conference in the fall, and, you know, it was like the last vestiges of the the old pitch, followed by the agents. And after that conference, I just said, Listen, we gotta, we gotta flip this around.

W- this people wanna hear about the agents, the the that's the direction they're going, and that's what we need to pivot and totally focus on.

All right, so let me ask you the my crash out questions about all this. Here's my my first one, and you're a great person to ask this question to because you build a lot of software. You've built a company around building software, like very bespoke, very complicated software, and you're trying to sell a lot of software to people who, like you said, would like to replace labor with, uh, technology, right? And that is, there's a lot there.

I'm looking at the state of the art in AI right now, and I see some cool stuff happening, and I find myself constantly wondering, can the LLM technology we have today that is a foundation of all of these AI systems, can it bear the weight of our expectations? Can it actually, on any reasonable timeline, do all of the things that people think it can do? Because I can see it doing some things, and then I see it just hit walls over and over again.

And I say, well, if it's brittle, people are not gonna adopt it, because that brittleness is exactly where you want a human being to just be available to overcome whatever boundary the AI is gonna fi find for itself. And I can give you examples, but I'm curious if you see that broadly, and if you think the technology can actually develop to the point where the market becomes as big as what you're describing.

Absolutely, the technology can develop. I think there there's a lot of wild extrapolations going on right now, um, which, you know, uh, but I don't. I think that the even if you don't meet the wild extrapolations people are talking about, the market is still massive. And I think it's gonna take a lot of innovation and good product work and good engineering work and good process work to to make sure that that the benefits that we can, we can achieve these benefits, even though it's not some wild extrapolation of some magic LLM that can do everything in the world.

So I I I see one example, right? Every software developer I know is like, especially the senior ones, are like, I am now just describing software. Like, I'm just like writing

Yeah, that's a great example, that's a great example. So now I I believe that is very real and very powerful. But I also believe that there's gonna be more software engineers in five years than there are now. And the reason I believe that is not because I think those people are wrong, but I think that what's gonna happen is there's first of all, there's just way more software that we need to build that can be built.

And two, what's gonna happen is the software engineers are gonna be figuring out how to make it work at scale, how to how to make sure that systems can be maintained, how to make sure we understand how the agentic workflows, what what they actually built, and h- and we w- need when we need to modify them for the next way. No one's ever maintained an agentically developed system for five years. No one's ever figured out how to make it scale.

That's where all the work is. And when you combine that on, you know, we're gonna build ten times more software, that adds up to more people being required to do it. So I think both can be true.

where are those people gonna learn how to do it, right? You you've already described this, right? The traditional career path, the traditional org chart is breaking down. I I think Meta announced that, like, one manager will now oversee fifty ICS. When I say we're on the cusp of some wild org charts, that's what I mean. Like, some very strange corporate structures are gonna blossom here. If the problem is okay, no one's ever maintained an agen- agentic system for five years, and we need more developers to do it.

Where are all those developers gonna learn the skills to evaluate the code that agents are are writing and and deploying and saying, Okay, you got it wrong? Here's how you need to maintain it.

It's, you know, maybe not what everyone's saying, cause people like to extrapolate and say everything in the world is changing, the education system's gonna change, everything's gonna change. I think a lot of the things where people learn, they'll learn like I in college, I think we'll still teach computer science, it'll just be different. Just like, uh, you know, fifty years ago, we didn't teach, uh, modern compilers. W- we taught we taught machine code and assembly, right?

And so now we'll teach how do you coordinate agents and how do you architect systems and how do you, you know, you'll probably take some, uh, you know, Java development classes, kind of like when I was in college, I took machine code classes to understand how it really works under the covers. But you have to learn the new way. It's modernization, it's, um, new challenge, you'll have to learn new challenges. And I think it'll be better because we're gonna learn how to build stuff at scale, not just in terms of, like, the amount of load it can handle, but build a large, complex system at scale.

Learning that in college and learning that on on the job and, uh, people that are early in their career leveling up. You know, there's also this narrative out there that, oh, we don't need any entry-level developers anymore. That's, you know, a bad mindset to have because, first of all, those are the people that are probably most open to doing things differently. They're the least set in their ways. So I think, er, entry-level folks will learn how to, you know, use these tools and command these workflows to do things at scale in a way that people that learned ten, fifteen years ago didn't.

So

W- when I think about the value of agents going out in the world, as you've described, they they need access to a lot of data. The notion that my company has a bunch of disparate databases and that I should hire an agent to go look at all those databases and put them together and use the software. The thing that gets me at that every time is the notion that they're gonna build software. Because I'm not sure the agents are building software for anything but agents to use.

And at some point, that software just gets very specialized and and very narrow, and it is access to the databases that becomes the most valuable thing. One of our own designers here at the Verge, uh, said to me right before I came to talk to you, he heard I was talking to you, and he said, All software development in 2026 is just calibrating the interface between your brain and a database, right? And like right now, all AI development is like, would you like to just chat with this database?

And the answer in the enterprise appears to be yes. Like, let me just talk to my analytics database directly like a person, and it will give me some insights. And the answer in consumer maybe is no, right? Like, uh, Google Photos just walked back its AI search because it turns out people prefer the regular search. And I I don't know which one is gonna win out over time and where where it happens for everybody across work and their personal lives will change.

But the notion that the database is the important thing, and that's where the value is, because anybody can ask an agent to go make a bespoke piece of software to do some business function. Doesn't it seem likely that the database vendors will just raise their prices or increase the barriers to access, or find other ways to to extract more value from having that that data, because that's what all the agents really need access to.

there's, I think there's data, and then there's intelligence, and I think a lot of the intelligence i is is c- now, in the past, has been codified in the application. Raw database is is not that helpful. I mean, when you say you want to talk to the database, what you're really saying is you you want some kind of analysis or intelligence done by something. Um, you don't wanna, you wanna have the ones and zeros, a and, you know, in in gigabytes of data coming at you.

Um, so you're really talking about intelligence, and that's the that's the big debate about SaaSpocalypse. Who's gonna do that intelligence? Is it is it the app vendors we have now? I mean, even even, you know, I mentioned the data warehouse companies like Databricks and Snowflakes and Pal- Snowflake and Palantir. They're they're not really, I mean, they're selling essentially, they're selling some kind of intelligence. They're not the the valuable part of their business is not the is not the ones and zeros.

So the question is like, w- who's gonna do the intelligence? And I think that the application companies are gonna add some to their, you know, um, capabilities, and there's gonna be new ones, and there's gonna be new ones. That intelligence actually becomes work, not in the sense of, you know, app work, but sense of work people would have done.

we're gonna pause here for one more quick break. We'll be back in just a minute.

Support for the show comes from Framer. The future of website building is seamlessly blending all the tools we have available. And you could use a platform that has it all and stays useful even after you launch. That's what Framer is. Framer is the AI website builder that helps creators, teams and businesses ship production-ready sites faster than ever while getting every detail right. You're able to prompt, inspect, edit, and publish in one place at a whole new pace.

On Framer, agents bring speed and scale, while people bring taste, judgment and control. And that all takes place in the same workspace where the real site is designed, managed, reviewed, and published. Everyone's ideas land on the canvas, stay editable, and can be published when the team is ready. Thousands of businesses, from early-stage startups to Fortune five hundreds, are choosing to build their websites in Framer, where changes take minutes instead of days. Learn how you can get more out of your site from a Framer specialist or get started building for free today at framer dot com slash decoder for 30% off a Framer Pro annual plan.

That's framer dot com slash decoder. Rules and restrictions may apply. Support for the show comes from Outshift, Cisco's incubation engine for frontier technology. You can find multi-agent AI in every enterprise roadmap right now. But here's the problem everyone's facing. Agents can pass messages, but can't think together. These systems silently underperform through cognitive failures, misreadings, unverified claims, false consensus, and conventional monitoring can't detect them. Outshift by Cisco is building the fix with their new comprehensive resource, the Internet of Cognition.

It's an open source guide that's a foundation for building multi-agent systems from design to production. The goal is to give agents shared context, shared memory, and guardrails, all to drive the results we actually expect from AI. You can lean on this resource to understand agentic AI's evolution and how it shifted from isolated agents to orchestrated superintelligence. You can gain insights for how to future-proof your business by tackling complex challenges with multi-agent systems. You can read the paper, experience the demo, grab the code from Outshift dot com.

That's O-U-T-S-H-I-F-T dot com. As soon as autumn rolls around and you swap your iced lattes for pumpkin spice, that's your signal to start thinking about the holidays, the decor, the gifts, the shopping lists, but more importantly, the holiday treats, cheesecakes, cookies. Is there anything better? And when the recipe calls for cream cheese, there's only one option Philadelphia, the original cream cheese, made with fresh milk and real cream. This holiday season, whether you're going all out or keeping it simple, make it really, Philly good.

Find your favorite holiday recipe at creamcheese dot com. Why can't we get AI to production? Our competitors are all ready. How do we keep data secure? When do we actually see ROI? All this talk about AI, but talk doesn't transform businesses. AWS AI cuts through the noise, making AI easier to securely deploy and scale with ready-to-use agents and the broadest set of AI tools and services. You can build, buy, or partner your way. Stop overthinking. Start building.

AWS AI is how. Welcome back.

I'm talking with Okta CEO Todd McKinnon about the uneven, messy shift into a tech world, maybe driven by AI agents. When I'm saying I'm having, like, an, um, e- existential crisis. Like, I have, as a tech journalist, I have understood software in one way for my entire career, and it's been a pretty good career because the software industry and the tech industry has grown so fast in the fifteen years since we've started The Verge. But every conversation I've had with Decoder over the past few months is some CEO of, like, a web 2.0 company that put a beautiful mobile app interface on top of a database, and that thing felt like the application, and they built huge businesses

on top of it. And you can describe this in all kinds of way. We just had the CEO of Zillow on. Zillow is just a beautiful interface to a a database, and that's a really good business for them. I'm asking, Okay, if you have agents and you're like, Go find me a house and order me a sandwich, you're gonna end up in a place where it might just want to use Zillow, or it might want to cut Zillow out and go directly to the underlying database.

Yeah, or or Zillow might build the killer agent.

Or or Zillow might build the agent. And I'm just not sure how any of that plays out, because what you're really doing is unbundling the data and the intelligence that acts upon the data and the interface to that data into three very different things, and everybody still wants to make money and and not go out of business. And you're sitting right at the center of it, right? You're providing access to everyone. How do you see that playing out right now?

A different way to frame what you're saying is that the, you know, it's there's an unbundling, and there's like a data layer and an intelligence layer and a front-end layer. But what also is happening is that it's all kind of getting more connected. We think of an app and a database and a user interface as one thing. But as that unbundling happens, what really is happening is all the apps that you thought were in various silos are connecting to each other.

And that's because there's agents on top of them that are connecting to all those silos. There's the apps themselves are becoming more agentic, and, you know, and we're as a as Okta as a company, this is this is why I'm so excited about this agentic identity and these guardrails we've talked about. It's also why we're this this needs to be standardized in the industry. There's no good standard for how we have pretty good standards now for how, you know, when you single sign on into your applications, how that interaction works between you and your browser and your phone and the applications.

There's no good standards for how agents connect to a bunch of other systems they need to get their data. So there's some standardization that's required here too. But I mean, zooming out, it's like, isn't it exciting? It's it's such a challenge. It'd be much easier if if things were just stayed the same and we could kind of keep ma keep, like, in our own little lanes. And

I I agree it. It's exciting, especially because you're gonna s I think we're gonna see a wave of new companies and new ways of thinking, and certainly we'll see new ways of computing, which that's why the Verge exists. Like, we were built around the the concept that mobile phones would be important, which when we launched the site was not. People are like, What are you talking about? Like, it's hard, it's hard to even say now, but that w- this was like a real thing that we said that we got question marks around.

What I would temper that with is when I have CEOs on the show and they say companies are interested in replacing their labor budgets with technology budgets, that is a pretty huge threat. When we talk about how much work will be automated by running around the agents and doing intelligence, I one, I wonder, well, who will be spending all that money if no one is making any of that money? And then I think very importantly, this comes back to me asking about can LLMs do it?

I wonder if any new ideas will be generated in that process at all, right? If we're just gonna automate our way into something that seems pretty boring, right? We're just gonna run a bunch of business logic, and no one at the bottom who's actually operating the business logic will think, Oh, I could do this ten times cheaper if I start my own company and go start a new company. And there's something about all of that that I think I hear from our audience is that's why AI pulls as badly as AI pulls, even though the opportunities look exciting.

There'll be a wave of, uh, people building agentic systems and agentic systems to, you know, uh, do the jobs people do now or help people do the jobs people do now. Then there'll be another wave of of things that are automating processes that weren't possible before. We're still in the early parts of that 2nd phase where we're thinking about, Hey, we could build this new set of digital workers and gonna get productivity. W- we really haven't gotten to this point where, what is the process that should be happening in all these workflows if it could just be agentic from the start?

So Okta's announced a a blueprint for agentic enterprise. It's it's basically got 3 big pillars, right? It's how to onboard agents as an identity, which is I'm very curious about what you think about the difference between agent identity and actual person to standardize connection points, which you've talked about a little bit. And then lastly, and this one is great, is to provide a kill switch in case your agents go rogue. So talking about that 1st one, you wanna create a new identity for agents in the workforce on your network.

What does that look like? Is that how is it defined differently than a an employee or a person?

Agents are a new identity type, and it's it's kinda like a combination of it has some attributes of a human identity and some attributes of a just a system. And it's basically a hybrid of both. And so it definite from a definition perspective, it's pretty simple. I think where it gets interesting is it becomes a a map that m that centralizes the list of agents from all your vendors. So it can it can represent agents from all the big platforms, it can it gives you this central way to kinda keep track of it all.

And that's what companies are struggling with. They they they hear all the announcements and they're very excited about this, but they're they just need a place, Hey, let me bring it in centrally and let me see what I have. And now once I see what I have, I can, you know, some of these things are very much just 1 to 1 with people. Some of them there's a set of agents that multiple agents that work with 1 person.

Some of them are totally headless, and they're just on their own thing, automating some things, and they need a human in the loop, and you can kinda start to organize things that way. But it's all kind of it's all kind of framed in this, um, in this concept of mapping across different silos. So you have you have agents you built yourself, you have platforms you're using, like Amazon or Microsoft or Google, you have big apps you're using, like Salesforce and ServiceNow, and and it lets you centralize all that in a way that doesn't lock you into one of those silos.

And then, like you said, it it can it can help you say, alright, all these things unequivocally need to connect to more things. And I can control where they connect to, when they connect to that data warehouse, what permissions do they have in that data warehouse, and then across all th- all the different various technologies. And then, like you said, stuff is gonna go wrong, and they there's gonna be, uh, issues and threats and prompt injection, and when that happens, it gives you the ability to essentially pull the plug, like, take the connections away, you know, in terms of like, Oh, this agent is doing something that we didn't expect.

Now, what we can do is we can s pull away its connections.

How do you detect whether it's doing something you didn't expect?

We don't have a magic solution to that, cause it kinda depends on the point of the agent, and that's kind of dependent on the the person that wrote the agent and the system it came from. Um, but we are we're working on standards for people to raise that issue or not, uh, not not from a like, from a technical sense, like raise an alert and and have the other elements of the system respond to that.

So is the kill switch just we're we're pulling your access because The the you're fired, get word is that your stuff and is pulling go,

the access to to everything the agent can access, not access to the agent.

right? So it's just saying we're we've revoked all your passwords, agent. Yeah, you're you're you're out of the system now. Almost like you When you say

like almost like you would take a machine off the network.

when you say the the agent identity is somewhere between a person and a system, go into that in more detail. What what specifically do you mean?

When you think about having a system that controls what something has access to, a lot of it's very similar to a person, meaning that, you know, just like you would give a person access to applications and then inside of those ser- services and applications, you would say, here's their role, here's their group, here's their profile. That's a lot of the way these agents are being built and modeled. Um, the reason it's not like a person is because you have relationship between the people and the agents in a way that they're on behalf of, and you wanna always take the identity of the person and pass it to the agent and have it use that.

Um, and some k- sometimes you want the agent to, um, have its own identity and the systems it tech talks to do their permissions based on what the agent is, and then it goes back to the person as a human in the loop. So there's different patterns. So that if you actually look at the physical directory of agents, some of the elements are very much like per like a person, and some of them are, you know, only because they're these agents that can be on behalf of people or they can be connected to other agents, and they're more, you know, kinda like systems versus people.

When you look at how the agents operate, you know, you can go look at the chain of thinking in any one of these systems. A lot of times, they're just talking to themselves in weird ways. I feel like you're provisioning identity. Obviously, Okta doesn't think about identity in in the most deeply philosophical ways. But, you know, Anthropic is, like, very happy to hint that Claude is alive, right? When you think about, okay, I, uh, I'm a provider of identity to these systems that are a hybrid between people and and something else.

Does it ever occur to you that, like, they might be reasoning in a way that is more human or not? Or that you need to address that in some way in the architecture of how you permission them?

We're pretty pragmatic about it. Um, meaning that it's we we know that they're the behavior of these systems is not deterministic, and you have to, it's it's all about, like, getting this balance right between give it flexibility to what data and systems and things it can access and do and what operations. Um, but then having the ability to rein it in when it it goes too far. I think that's the right, uh, uh, ultimately, that's the right, um, way to balance effectiveness of these systems and and the risk.

There's no free lunch. Like, you you have to give it the data if you want it to be effective, and you kinda have to decide if if you you have 0 tolerance for non-deterministic behavior, you can't give it the data. You can't give it the permission. Um, and so that's kind of the balance that we're helping customers strike.

How do you think about, you know, Okta sits in the middle, you were talking about, I don't know. There's there's Salesforce that has its own agents, there's other vendors that have their own agents. They are not gonna want those agents to work across their databases, right? This comes back to, like, I think, the central challenge here, and the reason why something like OpenClaw was able to be so powerful so quickly, cause it had nothing to do with any of those companies or those platforms.

It was just clicking around in a browser Yeah, like instead of was a manual an actual extension,

shot out of nowhere, yeah, yeah.

right? And it was because there was no security built into it, and instead of acting on behalf of a person, it just represented itself as a person, and it was off to the races. You know, Salesforce can't keep an actual human user from using a different system or orchestrating in their own head, right? Well, when you build the agents inside the corporate network, you can absolutely do those things, and Salesforce can absolutely write a terms of service that says, We don't want the agent from your rival vendor using our system as well.

H- eh, are those just politics? Is that negotiation? How's that gonna work?

There's only one thing, it's it's customers. I mean, customers have to have the customers will have the leverage eventually. And if the customers, i in a m in, like, a market mechanism don't have the leverage, the government will step in and do antitrust. I mean, the well, the reason Well, well, we have the reason we have a software industry, do you know why we have a software industry? Because and it customers finally got fed up with IBM and said, You have to sell software and operating systems and applications independent from the hardware.

So this is like fifty, sixty years ago, seventy years ago, IBM is like, you know, there is no software, there is no applications, there's this IBM box, and you get it, and we are technology. And customers wanted choice, and finally, the government stepped in and said, You gotta split it up. You gotta have operating systems, you gotta have hardware, you gotta have software. And so I think similar thing, it's like, yeah, of course, every big vendor that's trying to protect their entrenched things, whether it's Microsoft with their new bundle where they're trying to lock everyone in, they're gonna say, you know, it all has to be on our thing, and you can't use your you can't use other agents against

our agents because our agents are better because they have our data and our workflow. And ultimately, it's it's gonna be customers that demand change, and if there's so much, you know, monopolistic lock in that, you know, we have to rely on regulators to come in and fix it.

well, I do think this is history that you've just made. You're the first CEO of a multibillion-dollar enterprise software company to advocate for vigorous antitrust enforcement on decoder. So I'm just gonna hold that close to my heart. Uh, Yeah, well, I do think

I mean, if if if the market doesn't work, if customer customers can't force the choice.

uh, I do think the sort of, like, pre-Reagan antitrust environment that led to IBM being unbundled is very different than today, but we will set that aside. Uh, d is But I didn't impress that

you with my historical reference? it was No? very good. Uh, Okay.

uh, again, the reason I didn't answer your question correctly is, uh, very surprised that you went to antitrust. That doesn't usually happen on the show. Uh, isn't there gonna be some weird pricing war in the middle of all that where Microsoft says, Sure, let your other vendor's agent into 365, we're just gonna charge you a massive access fee to do it.

But yeah, I think that's very likely. Yeah.

Do you see that playing out now, or do you just see it on the horizon?

I don't I not yet. What is happening now is that people are just getting familiar with the call it the the siloed agents. They're just getting familiar with the agents in Microsoft or the agents in Salesfor- Salesforce. We're not really to the we're not really to the phase yet of really multi-silo agents, agents that can go from a stovepipe to stovepipe and and do these w- in the cases there are, but we're that agent or that, uh, era is still ahead of us.

And I think as you get more to that era, some of these issues will become more significant.

Isn't that? And and again, just to bring this back to OpenClaw, which I think probably most of the audience is most familiar with, that is the promise of that system, right? That's why it lit everyone's brains up, because it was running just from system to system and then doing some logic and and coming up with some outcomes.

The thing about that and a lot I think a lot of these trends and ideas that remember is like, y- that, you know, no one cares about the infrastructure. No one cares about the well, this is obviously a dramatic statement. I'll explain what I mean. But people care about the app in the sense that they care about what it can do. And the reason why, uh, OpenClaw was such a lightning in a bottle is because they saw what was possible.

They saw what it could do. Now, the fact that it had to do that by connecting to all these systems and it required access and there were security issues, it's like, that's infrastructure, and people, you know, that once their mindset gets set on the possible, then it's then it's up to i industry to figure out how it all works under the s covers. But people care about the possible and the apps. Um, and I think that y- you're gonna see it ripple through.

Um, I think it's it's like I said, I thought it was the ChatGPT of agents, and it's it's very exciting.

So you're kind of saying now is the time to build the guardrails so that we make sure these actually work. Can I ask you about the flip side of that? You know, the promise of agents broadly, AI maybe broadly, is we will we will re remove these intermediaries, right? The thing I keep saying is that your computer will just go access the databases on its own, you don't need these app intermediaries or whatever. We're and we're gonna reshape the app economy.

Then I look at Okay, there's a bunch of scammers online who are just setting up, like, fake hotel service numbers and calling grandparents and, like, stealing bookings with, like, AI receptionists by just doing SEO hustles and collecting pennies. And, like, Okta has a role to play there too, right, by saying, Okay, th- this is fraud, this is scam, you shouldn't hand over your identity here. I'm not sure anyone is paying attention to that, but I see it ballooning every day, like just AI-powered scams and frauds and identity theft.

The idea that, you know, someone's gonna call me and verify me by voice is under threat by AI in very specific ways. How do you see the flip side here of making sure that the core business o Okta's in, which is making sure it's a real person doing the thing they're supposed to do at the right time, isn't just totally upended by the amount of AI-powered fraud that's occurring?

Um, uh, 40% of our business is, uh, authenticating and validating customers logging into, you know, customer websites and mobile apps. And this area is is changing a lot with AI as well. And I think what you're seeing is that the offline identity driver's license, passports, these these are rapidly digitizing, and I think it's coming at a great time too, because it gives us a a a something to offer people that really wanna do a better job differentiating between agents and OpenClaw and bots logging into their sites and real people.

And so as the offline identities digitize, people have mobile driver's license, the smartphone wallets are getting pretty capable now, and they can you can do fancy things, just like you do Apple Pay, you can do you can do a biometric authentication into your mobile driver's license, and then that becomes a very powerful thing to present to a website that will actually prove you're a person, um, or, you know, in a better sense than was possible before.

So it's a big deal. Like, people need to really know in certain use cases w- when it's an agent, when it's a bot. This bot problem is is not new. Um, it's like the old the old problem on Twitter and X, and, you know, Elon Musk is is on on trial for talking about bots and how many bots there were. And now I think with AI, it's becoming supercharged. And I think with what we have with these, um, these, you know, m national IDs and passports and mobile driver's license being digitized, we might have a a shot to actually bring some sanity to that world.

There's some real debates there, right, about privacy, about surveillance, about, Yeah, what does you know,

it mean to actually digitize identity? Uh, uh, from a like, a credentials perspective.

are you are you guys in that mix? Is that something Okta is actually thinking about, or are you waiting for that to sort itself out?

I mean, governments are deciding, and governments are s d uh, deciding on that. They wanna digitize, they wanna d issue these passports and these national IDs, and in Europe, it's certain standards across the EU, it's in the United States, it's very much f- at a state level. Um, and our customers are really excited about it, and we're giving them all the capabilities to take advantage of this stuff without really specific judgment about, um, how they should do it.

We're just trying to arm them to make sure that they can a accept all the, you know, regulatory requirements and also all the identities and the digital formats that their their users and their citizens want. And so it's a big part of our future, and we're working hard on that.

Right next to that is, you know, the there's a big fight over age verification in the United States and the app stores and who gets to use what apps. Discord just had a big controversy cause they went to an outside vendor, people had a lot of feelings about that outside vendor, and Discord rolled that back. Are you seeing any of that controversy come your way around age verification?

We work with the vendors that that are trying to log people in, and they want the best tools and technologies to to do age age verification, so we're gonna make sure we equip them with that. It's a lot of times not a technical issue. It's like, you know, it's like, what what ID system do you trust? And is there an ID system for someone that's 12, 13, 14 years old? And so, uh, it's I think one of the challenges has been out of the scope of a lot of the driver's license-based or, you know, passport, national ID-based discussions, but I think that'll be a use case that'll be, um, covered, I think, by governments fairly quickly.

Do you think it's possible to do age verification and still protect people's privacy?

I do, yeah. There's technical solutions, but there's also, um, process and, um, regulatory sulu- regulatory parts of it. I think ultimately, the most privacy-preserving thing is, like, no technology. Um, so there's gonna be a trade off. If you if you are trying to automate something and you're trying to bring technology to something, you're gonna there's gonna be a risk of centralization and privacy controls, but I do think it's possible to get the balance right.

It it seems like that's just the other front, right? The computers are gonna get way more capable on their own, and then we are very interested in limiting what the people can do with computers in, like, very specific ways. And it does seem like you sit at the the middle of it, so Todd, we're gonna have to have you back. I I feel like there's there's y- yet more emotional crash out for me to have with you.

Tell people quickly what's next for Okta, what should they be looking for?

I think they should be thinking about the how they build the SEC- secure agentic enterprise, and how they can use the blueprint we're proposing to the entire industry and how to make that possible. We're ex- excited to work with everyone in the industry and particularly the tools and technologies and products we're gonna be building to make sure that reality comes to fruition.

Amazing. Well, we, like I said, we're gonna have to have you back to see how all this is going, cause it feels like it's gonna change really fast. Thank you so much for being on Decoder.

Thanks for having me.

I'd like to thank Todd McKinnon for taking the time to join Decoder and thank you for listening. I hope you enjoyed it. To let us know what you thought about this episode, or really anything else at all, you can drop us a line. You can email us at [email protected]. We really do read all the emails, or you can hit me up directly on Threads or BlueSky. We're also on YouTube. You can watch full episodes at DecoderPod.

We also have a TikTok and an Instagram. They're at DecoderPod as well, and they're a lot of fun. If you like Decoder, please share it with your friends and subscribe wherever you get your podcasts. Decoder's production of The Verge, part of the Vox Media podcast network. The show is produced by Kate Cox and Nick Stat. It's edited by Ursula Wright. Our editorial director is Kevin McShea. The Decoder music is by Breakmaster Cylinder. We'll see you next time.

Life can be messy and complicated, especially during the holidays. One thing that isn't switching to the Simplicity Plan from Verizon. It's 1 plan, 1 price, just $30 a line per month, for you or the whole family. Make the simple choice this season. Switch to Verizon and shop their best holiday deals today.

From the creators of Zootopia and Frozen comes Disney's Ha-xt. Welcome to Hex and enter the world of witches, where it was foretold that an ordinary girl would become an extraordinary witch and save

the world of magic. Disney's Ha-xt arrives in theaters this Thanksgiving.

Your sausage McMuffin with egg didn't change. Your receipt did. The Sausage McMuffin with Egg Extra Value Meal includes a hash brown and a small coffee for just $5, only at McDonald's for a limited time.

Pricing participation may vary. Promotion pricing may be lower than meal pricing.