Okta’s CEO is betting big on AI agent identity
Today, Iâm talking with Todd McKinnon, who is co-founder and CEO of Okta, a platform that lets big companies manage security and identity across all the apps and services their employees use. Think of it like login management â actually, thatâs a great way to think about it because the way most people encounter Okta is that itâs the thing that makes you log in again right before joining a meeting several times a week, so then youâre late for the meeting⌠Can you tell we use Okta?
Anyhow, all of that is a big business â Okta has a $14 billion market cap. But big software as a service companies like Okta are under a lot of pressure in the age of AI. Why would you pay their fees when you can just vibe-code your own tools? This so-called Saaspocalypse is a big deal, and Todd recently said he was âparanoidâ about it on Oktaâs most recent earnings call. So we dug into it, and how heâs putting that paranoia into practice inside Okta â what heâs changing, and what opportunities heâs going after to head off the apocalypse.
Verge subscribers, donât forget you get exclusive access to ad-free Decoder wherever you get your podcasts. Head here. Not a subscriber? You can sign up here.
The biggest opportunity youâll hear us talk about is some deep Decoder bait: the idea that itâs not just people whose access and security credentials need management, but also AI agents inside a corporation. This concept has really exploded with the rise of OpenClaw, which came with a ton of security challenges. Can any company keep users, platforms, and data safe if people are just going to buy a Mac Mini, hand their credentials to it, and let OpenClaw do whatever it wants with them? Is simply installing a âkill switchâ at the agent level â as Todd suggests â enough?
Youâll hear Todd say that agent identity is something in between a person and a system, which is some of the richest Decoder bait possible, so we spent some time digging into that. It also seems like we are on the cusp of some of the goofiest org chart ideas in history, as people start to manage hybrid teams of people and agents, and I wanted to know how Todd was thinking about that inside of Okta itself.
Like so many of our guests lately, itâs clear that Toddâs a Decoder fan, so this one got deep, about the very nature of building software itself, and what it means to run a software company. Thatâs right, the Okta episode got emotional. Hang on, it might surprise you. Okay: Okta CEO Todd McKinnon. Here we go.
This interview has been lightly edited for length and clarity.
Todd McKinnon, youâre the Co-founder and CEO of Okta. Welcome to Decoder.
Thank you for having me, Nilay. Itâs great to be here.
Iâm excited to talk to you. I feel like a real theme of Decoder lately is just me being emotional about the nature of software in 2026. And I canât think of anyone better to do it with than you, because when I think of emotional software development, I think of big enterprise software CEOs.
Would you like me to soothe your emotions or upset your emotions?
Iâm going to start with your emotions, actually. Weâre going to get right into your feelings, Todd.
Oh, yeah. All right. Iâm really good at talking about my feelings to massive groups of people, so lay it on.
Well, you did. Here we go. Weâre going to just jump right into it. A few weeks ago, Okta had earnings. Youâre on the call. They asked you about the SaaSpocalypse, which I want to talk about in detail. But this was your response to SaaSpocalypse; this is why weâre starting with feelings. You said, âWe are paranoid, and weâre making sure that weâre using all the latest technologies, LLMs, et cetera, to make sure that we have something thatâs resilient and secure but has the best features and best capabilities.â This is you talking about, âHey, agentic software development is real. The idea that our customers would build their own tools instead of paying us for these tools is real. Weâre paranoid about it. Weâve got to compete with that.â
Thatâs a big thing to say. Talk about where you are in SaaSpocalypse because I want to start there, and then I want to zoom out to basically the nature of software in general. But that feels like a big thing for you to say; you need to be paranoid about this threat.
Letâs start with me, personality-wise, and how I operate. Iâm very much challenge-driven, and I think a lot of people are in our business and just like, âWhatâs the next challenge?â And what I see right now in the world is a huge challenge and a huge opportunity. Itâs like a huge mountain to climb. And the fundamental level is that I believe strongly that the pie for technology is expanding greatly. The pie of what we can do for people and companies with AI and the common things people talk about, agents, and⌠This is a massive change, massive disruption. Itâs bigger than cloud computing. If you could talk about it, is it as big as the internet? Itâs big.
Now, capturing that and leading a company that thrives⌠Okta has had a decent amount of success, $3 billion in revenue, growing over 10 percent last year, an established brand, and 20,000 customers. Weâve had some decent success. I think the opportunity going forward with all this change and all this disruption is massive. Itâs huge. Technology is getting way bigger; there are all kinds of new categories that I think are emerging. For me, personally, itâs an incredible opportunity and challenge to lead the company through this. And to go from what is a mid-size, successful SaaS company to what I think could be one of the most important companies in the world â thatâs a huge challenge. Itâs a huge opportunity. Itâs also daunting because, in some way, itâd be great if things didnât change that much, our locked-in position was more stable, and we could plug along. But thereâs a huge prize. The prize is massive, and thatâs incumbent upon us to face this challenge and to go get it.
Youâve talked about this in terms of the pie. Youâve said that the total addressable market for software is growing. I have a lot of questions about Okta in that market as itâs growing. I know you have some announcements about agents, verifying agents, and having a kill switch for agents that I want to talk about. I just want to come back to SaaSpocalypse in general. I understand SaaSpocalypse for run-of-the-mill productivity tools. We use a lot of run-of-the-mill productivity tools here at The Verge; theyâre all fine. And Iâm always joking that enterprise software CEOs donât love coming on the show becauseâŚ
When I grow up, I want to be run-of-the-mill.
Right. But theyâre all fine. You can take one piece of project tracking software and replace it with another, and the idea that youâre going to get anything more than a 5 percent productivity improvement, I think, has always been illusory. Maybe youâll get some better pricing. The idea that I can just vibe code a Trello and now I donât have to pay Trello because I just have a Trello⌠I understand that argument. Okta, to me, has seemed much more insulated from that because you have identity, and you have to do security at a scale that most people canât consider doing security. There are a lot of reasons why paying you to take that liability on is a good business, regardless of whether I can build it myself for cheaper.
What specifically has you paranoid about agentic software and your customers building their own tools to look like Okta? Because to me, thatâs actually a little more opaque.
If you look at what these tools can do, itâs amazing. The Claude Code, Cowork, and Codex and⌠These are⌠I grew up as a software engineer, and that whole world is being revolutionized. Iâve built a company as a product developer and as an engineer. And so if you donât question and look at how youâve built your own company and realize that the world is changing, youâre just naive. Now, we can talk about the reasons why I think Okta is very well positioned and has attributes of the market and attributes of the product that make it very resilient and hard to replace, but you just have to look at the technology and look at whatâs possible. And if youâre not circumspect about what got you here and what your moats are and what the upstart would be doing if they were trying to compete with you, I think youâre just naive.
I think itâs a healthy paranoia. When you look at the business, I think there are the features and functionality of our products. And then one thing thatâs maybe misunderstood about what we do, or maybe the buyers understand it, but in general might be misunderstood, is that you can build the features and functions, but the last thing is to connect it to everything. Thousands and thousands of different applications, services, and pieces of infrastructure have to be connected to the last mile. And that always changes, so you have to keep that integrated and you have to make sure itâs always up-to-date with the latest changes of the ecosystem. And so the integration part⌠And then this other part is that, really, it has to work. Itâs mission-critical.
Even if youâre building something that looks like Okta, getting the features to work is 10 percent of the battle. Making sure it works 100 percent of the time takes years and years and years. And thereâs also a reputational thing. Itâs like, âWhat are you going to trust?â Are you going to trust the proven solution thatâs been out there for years? Are you going to trust something that your team just cooked up? Infrastructure software in generalâŚ
And then cyber software, I think, is also very well insulated from people vibe coding it themselves just because youâre talking about things that are purchased on⌠Thereâs a lot of brand that goes into it. What cyber company do you trust? What cyber company do you trust to be secure itself, and what cyber company do you trust to be up-to-date on all the latest threats? And then people who are buying cyber tools, theyâre going to have to look at their bosses and their boards of directors and say, âWhat did you pick?â âOh, we got breached. Well, what did you pick?â âWell, I wanted to save a little bit of money to vibe code it.â The category of security and infrastructure software, I think, is a little bit different from some of the app categories that you were talking about.
Thereâs a little bit of âno one ever got fired for picking IBMâ in there. And then I think more cynically, thereâs, âI want a vendor for this stuff that is rich enough for me to sue them if something goes wrong.â Itâs in there, I hear it from the industry.
Or the more glass-half-full view would be that it can support me.
Yeah, itâs one or the other. Your job is to have the glass be half-full; I have the other job.
Iâm trying to connect the dots between what sounds like a good case for being insulated from the market and what youâre describing as healthy paranoia. Thereâs a new generation of software tools that will help people build competitors to Okta. Whether those competitors are just the next N+1 SaaS competitor or whether itâs the internal team at a company saying, âWeâll build our own identity solutions,â whatâs the mechanism that is leading you to say, âWe have to be vigilantâ? Will the new generation of SaaS companies just be cheaper? Theyâll have fewer people, and theyâll build something comparable to Okta that is just vastly cheaper per seat? Is it that the companies will realize, âOh, we can just build all these connectors, and Claude Code is going to traverse our intranet and log people in manuallyâ? And maybe thatâll be more costly in tokens, but the front end will be cheaper.
If you have the insulation, what is the mechanism that might be a threat to Okta?
I compartmentalize it into two different areas. The first area is just⌠Probably the most important area is the job as CEO is⌠The most important job is to figure out a strategy, which means which market youâre going to be in and how youâre going to win in those markets. And for us, thereâs a big new emerging market which is AI agents need to log into stuff, and AI agents need to be⌠You need to have a system to keep track of them, define their role, define their permissions, and what they can connect to and what they can do. Thatâs a big new market, so getting the company oriented on that massive new market, and thatâs one bucket, which is markets.
The second bucket is how we execute to capture that market. And I think the main theme in the second bucket is, and it sounds basic, but I think basics are important, which is⌠Itâs very clear that, especially in software development and innovation, the technical shift is very significant. The number one thing that an organization has to do is turn the dial in terms of how much change it will absorb. In normal operating mode, letâs say you want 20 percent change, 80 percent stays the same, you need to turn that dial up now, you need to change more. Whether thatâs your team structure, processes, or the technology youâre using, you have to turn up the change quotient. What I tell the team is that itâs got to be at least 60/40, if not more. And then with that, you give them the freedom to experiment with new technology, learn from whatâs happening out there.
By the way, I think one of the most important things is that while you have a healthy appreciation for the change and the impact, you can fall victim to believing what you see online or what you hear because everyone is trying to sell something. Everyone is trying to make their company sound cool, and theyâre like theyâre embracing the change. When you hear companies, especially big company CEOs, say, âOh, AI is writing 90 percent of our code right now.â Theyâre trying to sell something, whether itâs their own substance as a leader or their own organizationâs ability to innovate. Youâve got to take that with a grain of salt and say, âHey, the art of the possible, but as we change, what are we embracing? Whatâs working for us? Whatâs not?â But it all comes back to giving the teams freedom to change. And change is hard. It sounds trite, but you really, as a leader, have to force it sometimes, top-down mandates. I like to be bottom-up and empower people. But sometimes to get change to happen, you have to push it.
Tell me about the change. It sounds very specific that you think the change here is that thereâs going to be a universe of agents doing work inside of companies, and they need to be permissioned and controlled, and Okta should focus on that. And youâre not so worried about, âHey, a bunch of people are going to vibe code their own tools, or a bunch of cheaper competitors are going to come up and disrupt us because they vibe coded a competitor to Okta.â It seems like youâre bracketing that and saying, âThatâs not a big problem for Okta right now.â
I think if we have the opportunity to win this battle, to be the identity layer for AI agents, and if we win that, that could easily be the biggest category in cyber. Cyber is about 280-ish billion dollars a year. Identity management is about roughly â depending on whose number you believe â itâs roughly 10 percent of that. This new agent layer could be the biggest category in cyber by far. Yeah, winning that is job number one for our company.
Tell me your calibration on how much itâs acceptable to lose the identity piece of your business to whatever vibe coding SaaSpocalypse people think in order to win the bigger market in agent control. Because right now, the argument is, why would anyone keep paying you monthly or yearly for X number of seats when they can pay a lower fee to some solution that someone has built more cheaply? And then once thatâs done, itâs done, and you donât have to pay annually. Why would anyone keep paying you for that if you think the market is bigger for agents?
Theyâre not mutually exclusive. I think the attributes we talked about, whether itâs reliability, trust, integration, capabilities, and whether the vendor youâre going to trust has enough money to support you, are a foundational thing in both of these markets. Whether itâs people identity for customers, partners, and employees, or itâs this new identity type of agents and facilitating that. Theyâre not mutually exclusive. But I think whatâs happening in the world right now is every organization is⌠Itâs interesting. I think Iâd say theyâre universally aware of the potential of agents or agentic, the agentic enterprise, which is essentially that they want to make things more automated, and they want to enhance their digital, or enhance their workforce with digital employees, or they want to add new digital employees. Theyâre all clearly aware of this, but theyâre getting a very mixed set of signals and a very messy story about how they do it.
Thereâs a combination of the big platforms, Amazon, Microsoft, and Google, that are going to sell me agents. Itâs not even actually clear what an agent is. Salesforce has Agentforce, ServiceNow has agents, every SaaS company is building agents, and theyâre trying to sort through it all. But what they see is that they see a tremendous opportunity to automate things and to basically take the labor budget and divert it into the technology budget and make their companies grow faster and be more efficient. And now what theyâre looking for is, âOkay, what are the foundational building blocks to wire that all together and make it work? What are the rails?â And so thatâs where the big opportunity is to take the first steps on this, which could be the biggest category of cyber.
When you look at things like OpenClaw, which obviously had a huge moment, and everyone is buying Mac Minis so they can air-gap OpenClaw from their production machine, and then theyâre just giving OpenClaw all of their logins and passwords on the Mac Mini. I look at that, and Iâm like, âYouâve accomplished nothing.â Right? Youâve given it all the access over here, and maybe it just doesnât have your file system with your photos on it, but it still has all the access to the tools. But thatâs where the excitement is, right? Itâs living on the bleeding edge of danger, and saying the agent running on this machine can run overnight and invent its own tools and figure out solutions to problems.
When you are looking at putting rails on that, it feels like youâre actually going to foreclose some opportunities because we donât yet really know how the agents are going to work. How did you evaluate what was going on with OpenClaw and the way people were giving it permissions, just as that economy developed? I donât want to call it an economy. How did you look at OpenClaw and the way people were giving it permissions? Is that culture organically developed, and how is it informing your thinking about building for agents at Okta now?
The first thing is that itâs the ChatGPT moment for agents, and then ChatGPT was the Netscape moment for AI. Itâs very significant. And the biggest significance, I think, is that it opened everyoneâs eyes to the art of the possible. At my sonâs soccer game, the parents were talking about OpenClaw. And these arenât tech people, theyâre just talking about how theyâre going to automate all their tasks. And so these people are using it in their personal lives, and theyâre consumers, theyâre IT buyers, theyâre a company. Itâs a really eye-opening and definitional thing about what an agent can do and what it can be.
As you mentioned, the rails needed are the⌠And this is a tension⌠When you get something like an OpenClaw, and you try to experiment with it and play around with it, you say, âOh, itâs really not that interesting unless it has my data, unless itâs connected to everything.â And this is exactly what these companies or every enterprise are struggling with. Itâs like, âHey, this stuff really needs to have my data, my 50 years of sales inventory, my customer data, and my marketing data. And once itâs all combined, these agents and this agentic layer can do interesting things.â
What the rails weâre putting in place are⌠Actually, first of all, it sounds basic. But just giving enterprises a list of the agents sounds simple. But they need a list of the agents they have, and then they need a system of record and a list for the agents they could use. What is Salesforce doing? What is ServiceNow doing? What is Claude doing? What agents do they have? And then, âOkay, now what are they connected to?â And making sure that we control and secure what the agents are connected to because, again, the tension is between more and more data, more and more connections.
This is, by the way, why companies like Palantir, Snowflake, and Databricks are doing so well, because what they allow companies to do is, instead of having to actually connect their agentic enterprise to all these separate systems, they pool it into one data warehouse. Thatâs one model; you can pool it all into one data warehouse and run the agents on that. But I think the longer-term, more scalable model is that you actually have the right permissions and the right access tokens for the agents to access the data directly.
When you go back to the example of OpenClaw, itâs a mindset. Everyone knows what these things can do now, and you have to facilitate access; you have to facilitate making sure that these connections are made in a secure way, in a way they can be understood and monitored. And when things go too far, you can pull them back. And as you experiment in the lab, you can say, âThese are the connections we need. We should add more here. We should change this. We should filter this permission.â Thatâs what companies have to do, and those are the rails weâre trying to put in place.
When I said this was going to be an emotional conversation on software development, the nature of our relationship to databases is at the very heart of that existential crisis that I feel every week on this show. Let me just get your answer to this directly. It sounds like youâre saying SaaSpocalypse might be real, but itâs not real for Okta in the way that most people think SaaSpocalypse is real.
I think what people miss is that the pie is getting much, much larger. I think a few things are true. Everything is getting bigger. I think if you look at the amount spent on software, if you do infrastructure and SaaS and everything, hyperscalerâs software, itâs about $1.2 trillion roughly. If you look at the number of people, the services, the IT services market, itâs about $1.8 trillion. The markets are getting bigger. Weâre going to be spending more of that money on software, and the pie is getting bigger. Thatâs one thing thatâs true.
The second thing thatâs true is that every piece of technology in the stack, whether itâs SaaS apps or whether itâs devices or OSs or infrastructure, theyâre all going to get agentic features, theyâre all going to do things more on their own. Theyâre going to be able to talk to more of them, and theyâre going to optimize for agentic.
And I think the last thing is that there is a new layer, and that is the digital worker layer. Iâm sure some of the existing companies are going to make the leap, and theyâre going to have real digital workers that are coming from Microsoft, Salesforce, and Amazon. I think itâs probably more likely that itâs going to come from companies that werenât born in the legacy way of building an app. I think itâs hard when you grew up building an app in a certain functional silo. Itâs hard to build a digital worker because digital workers need to go across different things; thatâs why theyâre called workers, thatâs why theyâre not called one app. And so itâs really hard for companies that have focused on collaboration, HR, or one silo to say, âHey, now my digital worker really can span all these silos.â Because if you look inside those companies, the whole org structures of these companies and the politics of these companies are that someone owns one silo, so itâs very hard to break through and go broad.
Anyway, I think everything is getting bigger, I think a lot of the apps will have agentic features, I think thereâs a new layer of digital workers. Now, back to your question, which is, whatâs going on with the SaaSpocalypse? The reality is there will be some losers, and there will be some companies disrupted, and thereâll be new people to take over categories that are now⌠But thatâs back to challenges and making it fun. Thatâs what fires me up, and I think it fires up a lot of people, too.
You have brilliantly opened the door to the Decoder questions by talking about org charts. I actually think weâre on the cusp of some of the weirdest org charts weâve ever seen, but tell me about Okta.
Talking about change and change more⌠One of the hardest things about this whole thing for everyone is experience, what worked in the past, how you got promoted, and what you built your career on; a lot of it is being invalidated. We learned for 30 years like, âOh, this is how org charts work.â And a lot of that stuff is probably different now, so itâs hard for people to adjust.
Tell me about Okta. What was your org chart in the past? You founded the company; Iâm sure youâve gone through many iterations of it. Where are you at now? And as you talk about changing the balance of change to the company, how are you changing your org chart?
I think the guiding principle is to try to give great people an area where they can be great. Itâs really a people-driven org chart. Reward people, promote people, bring in new people, give them an area that could really excite them, and motivate them. And itâs people-centric. The second principle is that, where possible, try to cluster things so you minimize communication paths and you let people be more autonomous in small teams. I found thatâs pretty hard. I think pretty quickly thereâs⌠Unless you have very distinct, separate business units and really almost separate companies inside your company, itâs pretty hard to cut down on the lines of communication. I think you can do it, but itâs always, I found a little bit⌠Thereâs got to be lines of communication somewhere, and no matter how you slice the org, youâre moving around where the people have to cross org boundaries. But you do try to take that into consideration.
And then I think beyond that, I think a lot of things that people try to do with org charts, whether itâs get people aligned on goals and get a culture that is shipping things quickly, is⌠Itâs really not an org chart thing; itâs a management thing, itâs a leadership thing. And instead of moving the org around all the time, youâd be better spent making sure you have the right management team and the right leadership team to instill those cultural elements. Doing that versus taking your people team and telling them to move stuff around to have a more nimble culture, you probably should just get the right managers and instill that value that way.
This is my joke on Decoder: if you tell me the structure of your company, I can tell you 80 percent of your problems because the tensions just exist in certain structures in predictable ways. And itâs that last 20 percent, which is priorities, leadership, and management. It sounds like youâre pretty functionally structured, but how is Okta actually structured? Are you structured by business line? Do you just have a crack AI team thatâs off in the corner? How does this all work?
On the go-to market side, itâs functional. On the G&A side, itâs functional. On the R&D side, itâs by platform. We have two platforms, the Okta platform and our Zero platform. And the R&D is by platform.
The other question I ask everybody who comes on Decoder is about decisions. Again, itâs always great to have a founder because your frameworks change as you come up with a company. How do you make decisions? Whatâs your framework, and how has that changed over time?
Weâre doing an introspection here. I love it.
I told you it would be emotional.
Yeah, you did.
This is Decoder. Decoder is just therapy for me personally. At this point, you can tell what my problems are by the questions I ask.
Youâre like casting them out amongst the guests. Itâs interesting. When I started Okta, I found myself⌠Iâd worked at Salesforce, and I had a decent-sized team there and felt like I was very decisive. I was like, âWeâve got to do something, here are the options, decide.â And then I started Okta, and I found something interesting: my decision-making process slowed down. And when I was thinking about why, I realized that when I was at Salesforce, my boss was always a safety net, ultimately. Itâs like, if I were going to make a bad decision, there was theoretically a boss to stop me. But when I started doing Okta and the company started getting successful, my decision was the decision, and I had better think about it and get it right. And so it slowed down, it slowed down.
And then the company got bigger, and we got into this phase where we went public and got close to a billion dollars of revenue. Then I felt like maybe I needed more input, and I really needed to get expert advice on a lot of things. And what I realized over those years is that my instincts were still pretty good, and I probably should trust my instincts more. And so I think thatâs the mode Iâve been in for the last three years. Yeah, the company is bigger than itâs ever been. Iâm managing a company thatâs bigger than Iâve ever managed by definition, but I think Iâve been leaning more into my instincts.
I think to inform those⌠To put more detail on that, I think two things are very important. One is that you have to decide which decisions to make. Thatâs really important. There are a bunch of decisions that I shouldnât be involved in, and I shouldnât be making. But the inverse of that is super important, which is the ones that I am making. Iâd better focus on them, concentrate on them, and really get those right. And for me, doing that in an effective way, having a detailed grasp of whatâs going on, is incredibly important, being in the details. Itâs at a scale where itâs hard to know every little thing, but you can really dive into areas and get enough details throughout the year so that when it comes to making those big decisions that youâve narrowed down and focused on, you can use those details, use your judgment, and trust your instinct to make good, high-quality decisions. Itâs the most important thing I do, deciding which decisions to make and getting a high success rate on them.
Put this into practice for me. The big decision weâve been talking about is whether Okta is going to chase the idea of being the framework for agents in the workforce. Thatâs a huge market. It is so big that maybe youâre not as worried about SaaSpocalypse as some of the other enterprise CEOs that I talk to, because the market is going to grow so big and weâre going to force-change the company from the top down to make sure that the rate of change is higher and weâre all focused on this opportunity. How did you make that decision? Did you stare at the ocean for a while, and it came to you in a lightning bolt? What was the process there?
I think the high-order bit there is recognizing a world where everything in the stack is going to change. And I think itâs similar to when I started Okta. You never want to exactly follow the past because the past is always⌠Or history doesnât repeat, it rhymes. But a lot of it was⌠I remember in 2009, I was looking at the world and saying, âHey, thereâs going to be a cloud version of everything in the stack, and what are the big unique opportunities there?â And whatâs happening with agentic, call it agentic, is that everything is going to be revisited in this agentic world, whether current solutions are going to have agentic capabilities⌠Itâs crazy, like AWS. AWS is the infrastructure business, the most unassailable business. That market, with all the changes with agentic and people building agents and running models, is up for grabs, which is crazy.
All this change and then you just look at whatâs going to be required in all this change, and you say itâs⌠These connections between all these agents and where theyâre running, the demand for that is going to be massive because thereâs going to be this onrush of agentic capabilities. Thereâs going to be new stuff thatâs built, thereâs going to be native vendors that come out of nowhere and take market share, and thereâs going to be new markets. And so itâs a macro thing, but now itâs like, âAll right, what do you know about the details of your company, Todd? What are you guys good at? Youâre good at building something that scales, building something thatâs reliable, building something that connects to a lot of different systems. How can you position yourselves in that new market?â And I think those are the big essential things, thatâs the bet weâre making.
Take me inside the moment, though, when youâre realizing this happens. Did you write an email? Did you open a Google Doc? Did you just dictate to ChatGPT and say, âFire off an email from me, agent.â How did that actually work at the company?
Last year, I was in the process of meeting all of our 100 largest customers in person. And the purpose of the meetings was that I wanted to tell them about our vision of this unified identity platform, where weâre the only ones in the industry that have all these capabilities across customer identity, governance, and privilege. And at the same time, the teams were working on agent identity. And in these meetings, I would pitch what I was talking about, and then thereâd be interest in, âOh, we should look at this. We didnât know how far along you were.â And then I started throwing in this agentic stuff at the end of the meeting. And whenever I would get to that, the people in the meeting would just stop, and theyâd be like, âWait, talk about that some more.â
And then that kept happening and happening until weâre 25, 30 meetings, 40 meetings in, so I would flip it around. We would start with the agents and the new identity type, what customers were thinking about doing with agents, how theyâre seeing the potential of the digital worker, agents, and all the confusion, and we wouldnât get to the other stuff. I remember during our big conference in the fall, it was the last vestiges of the old pitch, followed by the agents. And after that conference, I just said, âListen, weâve got to flip this around. People want to hear about the agents, thatâs the direction theyâre going, and thatâs what we need to pivot to and totally focus on.â
All right. Let me ask you my crash-out questions about all of this. Hereâs my first one, and youâre a great person to ask this question to because you build a lot of software. Youâve built a company around building software, very bespoke, very complicated software, and youâre trying to sell a lot of software to people who, as you said, would like to replace labor with technology. And thereâs a lot there, and Iâm looking at the state of the art in AI right now, and I see some cool stuff happening, and I find myself constantly wondering, can the LLM technology we have today, that is a foundation of all of these AI systems, can it bear the weight of our expectations? Can it actually, on any reasonable timeline, do all of the things that people think it can do?
Because I can see it doing some things, and then I see it just hit walls over and over again. And I say, âWell, if itâs brittle, people are not going to adopt it because that brittleness is exactly where you want a human being to just be available to overcome whatever boundary the AI is going to find for itself.â And I can give you examples, but Iâm curious if you see that broadly and if you think the technology can actually develop to the point where the market becomes as big as what youâre describing.
Absolutely, the technology can develop. I think thereâs a lot of wild extrapolations going on right now, but I think that even if you donât meet the wild extrapolations people are talking about, the market is still massive. And I think itâs going to take a lot of innovation, good product work, good engineering work, and good process work to make sure that we can achieve these benefits even though itâs not some wild extrapolation of some magic LLM that can do everything in the world.
I see one example. Every software developer I know, especially the senior ones, who are like, âIâm now just describing software.â Iâm just writing-
Yeah, thatâs a great example. Thatâs a great example. Now, I believe that is very real and very powerful. But I also believe that thereâs going to be more software engineers in five years than there are now. And the reason I believe that is not because I think those people are wrong, but I think whatâs going to happen is, first of all, thereâs just way more software that we need to build that can be built. And two, whatâs going to happen is the software engineers are going to be figuring out how to make it work at scale, how to make sure that systems can be maintained, how to make sure we understand what they actually built, and we need to modify them for the next wayâŚ.
No one has ever maintained an agentically developed system for five years. No one has ever figured out how to make it scale. No one has ever figured out⌠Thatâs where all the work is. And when you combine that with the idea that weâre going to build 10 times more software, that adds up to more people being required to do it. I think both can be true.
Where are those people going to learn how to do it? Youâve already described this, the traditional career path, the traditional org chart is breaking down. I think Meta announced that one manager will now oversee 50 ICs. When I say weâre on the cusp of some wild org charts, thatâs what I mean. Some very strange corporate structures are going to blossom here. If the problem is, âOkay, no one has ever maintained an agentic system for five years, and we need more developers to do it.â Where are all those developers going to learn the skills to evaluate the code that agents are writing and deploying, and saying, âOkay, you got it wrong. Hereâs how you need to maintain it.â
I think itâs maybe not what everyone says because people like to extrapolate and say everything in the world is changing, the education system is going to change, everything is going to change. I think a lot of the things where people learn, theyâll learn like in college. I think weâll still teach computer science, itâll just be different. Just like 50 years ago, we didnât teach modern compilers; we taught machine code and assembly. And so now, weâll teach how to coordinate agents and how to architect systems and how to⌠Youâll probably take some Java development classes, like when I was in college, I took machine code classes to understand how it really works under the covers, but you have to learn the new way. Itâs modernization, itâs a new challenge⌠Youâll have to learn new challenges. And I think itâll be better because weâre going to learn how to build stuff at scale, not just in terms of the amount of load it can handle, but build a large complex system at scale. Learning that in college, learning that on the job, and people who are early in their careers are leveling up.
Thereâs also this narrative out there that âOh, we donât need any entry-level developers anymore.â Iâm very, very⌠Thatâs a bad mindset to have because, first of all, those are the people who are probably most open to doing things differently; theyâre the least set in their ways. I think entry-level folks will learn how to use these tools and command these workflows to do things at scale in a way that people who learned 10, 15 years ago didnât.
When I think about the value of agents going out in the world, as youâve described, they need access to a lot of data. The notion that my company has a bunch of disparate databases and that I should hire an agent to go look at all those databases, put them together, and use the software. The thing that gets me about that every time is the notion that theyâre going to build software because Iâm not sure theyâre building software for anyone⌠Because Iâm not sure the agents are building software for anything but agents to use, and at some point, that software just gets very specialized and very narrow, and it is access to the databases that becomes the most valuable thing.
One of our own designers here at The Verge said to me right before I came to talk to you, he heard I was talking to you, and he said, âAll software development in 2026 is just calibrating the interface between your brain and a database.â And right now, all AI development is like, âWould you like to just chat with this database?â And the answer in the enterprise appears to be yes, like, âLet me just talk to my analytics database directly like a person, and it will give me some insights.â And the answer in consumer maybe is no, Google Photos just walked back its AI search because it turns out people prefer the regular search. And I donât know which one is going to win out over time and where habits for everybody across work and their personal lives will change, but the notion that the database is the important thing and thatâs where the value is, because anybody can ask an agent to go make up a bespoke piece of software to do some business function.
Doesnât it seem likely that the database vendors will just raise their prices, increase the barriers to access, or find other ways to extract more value from having that data? Because thatâs what all the agents really need access to.
Well, I think thereâs data, and then thereâs intelligence. And I think a lot of the intelligence has been codified in the application. The raw database is not that helpful. When you say you want to talk to the database, what youâre really saying is you want some kind of analysis or intelligence done by something, you donât want to have the ones and zeros and gigabytes of data coming at you. Youâre really talking about intelligence.
And thatâs the big debate about SaaSpocalypse: whoâs going to do that intelligence? Is it the app vendors we have now? I mentioned the data warehouse companies like Databricks, Snowflake, and Palantir; essentially, theyâre selling some kind of intelligence, the valuable part of their business is not the ones and zeros. The question is like, âWhoâs going to do the intelligence?â And I think that the application companies are going to add some to their capabilities, and thereâs going to be new ones. And thereâs going to be new ones where that intelligence actually becomes work, not in the sense of app work, but in the sense of work people would have done.
Again, when Iâm saying Iâm having an existential crisis, as a tech journalist, I have understood software in one way for my entire career. Itâs been a pretty good career because the software industry and the tech industry have grown so fast in the 15 years since we started The Verge. But every conversation Iâve had at Decoder over the past few months is with some CEO of a Web 2.0 company that put a beautiful mobile app interface on top of a database, and that thing felt like the application, and they built huge businesses on top of it. And you can describe this in all kinds of ways. We just had the CEO of Zillow on. Zillow is just a beautiful interface to a database, and thatâs a really good business for them. Iâm asking if you have agents and youâre like, âGo find me a house and order me a sandwich.â Youâre going to end up in a place where it might just want to use Zillow, or it might want to cut Zillow out and go directly to the underlying database.
Or Zillow might build the killer agent.
Or Zillow might build the agent. And Iâm just not sure how any of that plays out because what youâre really doing is unbundling the data and the intelligence that acts upon the data, and the interface to that data, into three very different things. And everybody still wants to make money and not go out of business. Youâre sitting right at the center of it, youâre providing access to everyone. How do you see that playing out right now?
Well, I think the connections are very important because the app needs to⌠And I think a different way to frame what youâre saying is that thereâs an unbundling, and thereâs a data layer, an intelligence layer, and a front-end layer, but what also is happening is that itâs all getting more connected. We think of an app, a database, and a user interface as one thing. But as that unbundling happens, what is really happening is all the apps that you thought were in various silos are connecting to each other. And thatâs because there are agents on top of them that are connecting to all those silos. The apps themselves are becoming more agentic, and Okta as a company⌠This is why Iâm so excited about this agentic identity and these guardrails weâve talked about.
Itâs also why this needs to be standardized in the industry. Thereâs no good standard for how⌠We have pretty good standards now for how⌠When you single sign-on into your applications, how that interaction works between you and your browser, your phone, and the applications â there are no good standards for how agents connect to a bunch of other systems where they need to get their data. So, thereâs some standardization thatâs required here, too. But zooming out, itâs like, âIsnât it exciting? Itâs such a challenge.â Itâd be much easier if things had just stayed the same, and we could keep in our own little lanes, and our success would be more assured.
I agree itâs exciting, especially because I think weâre going to see a wave of new companies and new ways of thinking. And certainly weâll see new ways of computing, which is why The Verge exists. We were built around the concept that mobile phones would be important, which, when we launched the site, was not⌠People were like, âWhat are you talking about?â Itâs hard to even say now, but this was a real thing that we said that we got question marks around.
I think that what I would temper that with is when I have CEOs on the show, and they say, âCompanies are interested in replacing their labor budgets with technology budgets.â That is a pretty huge threat. When we talk about how much work will be automated by running around the agents and doing intelligence, one, I wonder, well, who will be spending all that money if no one is making any of that money? And then I think very importantly â this comes back to me asking about whether LLMs can do it â I wonder if any new ideas will be generated in that process at all if weâre just going to automate our way into something that seems pretty boring. Weâre just going to run a bunch of business logic, and no one at the bottom who is actually operating a business logic will think, âOh, I could do this 10 times cheaper if I start my own company.â And go start a new company. Thereâs something about all of that that I think, and I hear from our audience, is thatâs why AI polls as badly as AI polls, even though the opportunities look exciting.
Well, thereâll be a wave of people building agentic systems to do the jobs people do now, or help people do the jobs people do now, then thereâll be another wave of things that are automating processes that werenât possible before. Weâre still in the early parts of that second phase where weâre thinking about, âHey, we could build this new set of digital workers, and weâre going to get productivity.â We really havenât gotten to the point where we question, âWhat is the process that should be happening in all these workflows if it could just be agentic from the start?âÂ
Okta has announced a blueprint for agentic enterprise; itâs basically got three big pillars. Itâs how to onboard agents as an identity, which Iâm very curious about, and how you think about the difference between agent identity and an actual person. Two, standardize connection points, which youâve talked about a little bit. And then lastly, this one is great, which is to provide a kill switch in case your agents go rogue.Â
Talk to me about the first one. You want to create a new identity for agents in the workforce on your network. What does that look like? How is it defined differently from an employee or a person?
Well, agents are a new identity type, and itâs like a combination of⌠It has some attributes of a human identity and some attributes of just a system, and itâs basically a hybrid of both. And so from a definition perspective, itâs pretty simple. I think where it gets interesting is that it becomes a map that centralizes the list of agents from all your vendors. It can represent agents from all the big platforms. It gives you this central way to keep track of it all. And thatâs what companies are struggling with: they hear all the announcements, and theyâre very excited about this. They just need a place. âHey, bring it in centrally and let me see what I have. And now once I see what I have, I canâŚâ Some of these things are very much, âHey, theyâre just one-to-one with people.â Some of them are a set of multiple agents that work with one person. Some of them are totally headless, and theyâre just on their own thing, automated with some things, and they need a human in the loop. And you can start to organize things that way.
But itâs all framed in this concept of mapping across different silos. You have agents youâve built yourself, you have platforms youâre using like Amazon, Microsoft, or Google. You have big apps youâre using, like Salesforce and ServiceNow. It lets you centralize all that in a way that doesnât lock you into one of those silos. And then, as you said, it can help you say, âAll right, all these things unequivocally need to connect to more things. And I can control where they connect to, when they connect to that data warehouse, what permissions they have in that data warehouse, and then across all the different various technologies.â Then, as you said, stuff is going to go wrong, and thereâs going to be issues, threats, and prompt injection. And when that happens, it gives you the ability to essentially pull the plug, take the connections away in terms of like, âOh, this agent is doing something we didnât expect. Now, what we can do is we can pull away its connections.â
How do you detect whether itâs doing something you didnât expect?
We donât have a magic solution to that because it depends on the point of the agent, and thatâs dependent on the person who wrote the agent and the system it came from. But weâre working on standards for people to raise that issue, from a technical sense, like raise an alert and have the other elements of the system respond to that.
Is the kill switch just weâre pulling your access, youâre fired, get your stuff, and go?
Itâs pulling the access to everything the agent can access, not access to the agent.
Right. Itâs just saying we revoked all your passwords.
Shut it down. Yeah, exactly.
Youâre out of the system now.
Itâs almost like you would take a machine off the network.
When you say that the agent identity is somewhere between a person and a system, go into that in more detail. What specifically do you mean?
When you think about having a system that controls what something has access to, a lot of it is very similar to a person, meaning that just like you would give a person access to applications and then inside of those services and applications, you would say, âHereâs their role, hereâs their group, hereâs their profile.â Thatâs a lot of the way these agents are being built and modeled. The reason itâs not like a person is that you have a relationship between the people and the agents in a way that theyâre on behalf of, and you want to always take the identity of the person and pass it to the agent and have it use that. And sometimes you want the agent to have its own identity and the systems that talk to do their permissions based on what the agent is, and then it goes back to the person as a human in the loop.
There are different patterns, so that if you actually look at the physical directory of agents, some of the elements are very much like a person. Some of them are only because theyâre these agents that can be on behalf of people, or they can be connecting to other agents, and theyâre more like systems versus people.
When you look at how the agents operate, you can go look at the chain of thinking at any one of these systems; a lot of times, theyâre just talking to themselves in weird ways. I feel like youâre provisioning identity. Obviously, Okta doesnât think about identity in the most deeply philosophical ways, but Anthropic is very happy to hint that Claude is alive. When you think about it, âOkay, Iâm a provider of identity to these systems that are a hybrid between people and something else.â Does it ever occur to you that they might be reasoning in a way that is more human or not, or that you need to address that in some way in the architecture of how you give permissions to them?
Weâre pretty pragmatic about it, meaning that we know that the behavior of these systems is non-deterministic and you have to⌠Itâs all about getting this balance right between giving it flexibility to what data, systems, and things it can access and do, and what operations, but then having the ability to reign it in when it goes too far. And I think thatâs the right⌠Ultimately, thatâs the right way to balance the effectiveness of these systems and the risk. Thereâs no free lunch; you have to give it the data if you want it to be effective. And you have to decide if you have zero tolerance for non-deterministic behavior. You canât give it the data, you canât give it the permission. And so thatâs the balance that weâre helping customers strike.
How do you think about⌠Okta sits in the middle. You were talking about Salesforce, which has its own agents; there are other vendors that have their own agents. They are not going to want those agents to work across their databases. This comes back to what I think is the central challenge here, and the reason why something like OpenClaw was able to be so powerful so quickly, because it had nothing to do with any of those companies or those platforms. It was just clicking around their browser as though it were an actual person.
It was like a cannon shot out of nowhere. Yeah. Yeah.
Right. And it was because there was no security built into it. And instead of acting on behalf of a person, it just represented itself as a person, and it was off to the races. And Salesforce canât keep an actual human user from using a different system or orchestrating in their own head, right?
Well, when you build the agents inside the corporate network, you can absolutely do those things, and Salesforce can absolutely write a terms of service that says, âWe donât want the agent from your rival vendor using our system as well.â Are those just politics? Is that negotiation? How is that going to work?
I think thereâs only one thing, itâs customers. Customers will have the leverage eventually. And if the customers in a market mechanism donât have leverage, the government will step in and do antitrust. The reason we have a software industry, do you know why we have a software industry? Because customers finally got fed up with IBM and said, âYou have to sell software, operating systems, and applications independent from the hardware.â This is 50, 60 years ago, 70 years ago, IBM is like, âThere is no software, there are no applications, thereâs this IBM box, and you get it, and we are technology.â And customers want a choice, and finally, the government stepped in and said, âYouâve got to split it up. Youâve got to have operating systems, youâve got to have hardware, youâve got to have software.â
And so I think a similar thing, itâs, yeah, of course⌠Every big vendor thatâs trying to protect their entrenched things, whether itâs Microsoft with their new bundle where theyâre trying to lock everyone in, theyâre going to say, âIt all has to be on our thing, and you canât use other agents against our agents because our agents are better because they have our data and our workflow.â And ultimately, itâs going to be customers that demand change, and if thereâs so much monopolistic lock-in, then we have to rely on regulators to come in and fix it.
Well, I do think this is history that youâve just made. Youâre the first CEO of a multi-billion-dollar enterprise software company to advocate for vigorous antitrust enforcement at Decoder, so Iâm just going to hold that close to my heart. I do think-
If the market doesnât work, customers canât force the choice.
I do think the pre-Reagan antitrust environment that led to IBM being unbundled is very different from today, but we will set that aside.
But I did impress you with my historical reference.
It was very good. Again, the reason I didnât answer your question correctly is that Iâm very surprised that you went to antitrust. That doesnât usually happen on the show. Isnât there going to be just some weird pricing war in the middle of all that, where Microsoft says, âSure, let your other vendorâs agent into 365. Weâre just going to charge you a massive access fee to do it.â AndâŚ
Yeah, I think thatâs very likely. Yeah.
Do you see that playing out now, or do you just see it on the horizon?
Not yet. Itâs still very early. If you think of⌠What is happening now is that people are just getting familiar with the⌠Call it the siloed agents. Theyâre just getting familiar with the agents in Microsoft or the agents in Salesforce. Weâre not really to the phase yet of multi-silo agents, agents that can go from stovepipe to stovepipe and do these⌠In cases there are, but that era is still ahead of us. And I think as you get more into that era, some of these issues have become more significant.
And again, just to bring this back to OpenClaw, which I think most of the audience is probably most familiar with, that is the promise of that system. Thatâs why it lit everyoneâs brains up because it was running from system to system, doing some logic, and coming up with some outcomes. Again, the problems that-
The thing about that, and I think a lot of these trends and ideas, is to remember that no one cares about the infrastructure, no one cares about the⌠Well, this is obviously a dramatic statement. Iâll explain what I mean. But people care about the app in the sense that they care about what it can do. And the reason why OpenClaw was such a lightning in a bottle is that they saw what was possible, they saw what it could do. Now, the fact that it had to do that by connecting to all these systems, and it required access, and there were security issues, itâs like thatâs infrastructure and people⌠Once their mindset gets set on the possible, then itâs up to industry to figure out how it all works under these covers, but people care about the possible in the apps. And I think that youâre going to see it ripple through⌠As I said, I thought it was the ChatGPT of agents, and itâs very exciting.
Youâre saying now is the time to build the guardrails up to make sure these actually work.
Exactly.
Can I ask you about the flip side of that? The promise of agents broadly, AI maybe broadly, is that we will remove these intermediaries. The thing I keep saying is that your computer will just go access the databases all on its own, and you donât need these app intermediaries or whatever, and weâre going to reshape the app economy.
Then I look at how thereâs a bunch of scammers online who are just setting up fake hotel service numbers, calling grandparents, stealing bookings with AI receptionists by just doing SEO hustles, and collecting pennies. And Okta has a role to play there, too, by saying, âOkay, this is fraud, this is a scam. You shouldnât hand over your identity here.â
Iâm not sure anyone is paying attention to that, but I see it ballooning every day, just AI-powered scams, frauds, and identity theft. The idea that someone is going to call me and verify me by voice is under threat by AI in very specific ways. How do you see the flip side here of making sure that the core business that Okta is in, which is making sure itâs a real person doing the thing theyâre supposed to do at the right time, isnât just totally upended by the amount of AI-powered fraud thatâs occurring?
Forty percent of our business is authenticating and validating customers, logging into customer websites and mobile apps, and this area is changing a lot with AI as well. And I think what youâre seeing is that the offline identity, driverâs license, passports, these are rapidly digitizing. I think itâs coming at a great time, too, because it gives us something to offer people who really want to do a better job differentiating between agents, OpenClaw, bots that log into their sites, and real people. So, as the offline identities digitize, people have mobile driverâs licenses, the smartphone wallets are getting pretty capable now, and you can do fancy things. Just like you do Apple Pay, you can do biometric authentication on your mobile driverâs license, and then that becomes a very powerful thing to present to a website that will actually prove youâre a person, or in a better sense than was possible before.
Itâs a big deal. People need to really know in certain use cases when itâs an agent, when itâs a bot. Itâs like this bot problem is not new; itâs an old problem on Twitter/X, and Elon Musk is on trial for talking about bots and how many bots there were. And now I think with AI, itâs becoming supercharged. I think with what we have with these national IDs, passports, and mobile driverâs licenses being digitized, we might have a shot at actually bringing some sanity to that world.
There are some real debates there about privacy, about surveillance, about-
Yeah. What does that mean to actually digitize identity from a credentialsâ perspective?
Yeah. Are you guys in that mix? Is that something Okta is actively thinking about, or are you waiting for that to sort itself out politically?
Well, governments are deciding, and governments are deciding that they want to digitize, they want to issue these passports and these national IDs. And in Europe, there are certain standards across the EU. In the United States, itâs very much at the state level. Our customers are really excited about it, and weâre giving them all the capabilities to take advantage of this stuff. Without really specific judgment about how they should do it, weâre just trying to equip them to make sure that they can accept all the regulatory requirements and also all the identities and the digital formats that their users and their citizens want. And so itâs a big part of our future, and weâre working hard on that.
Right next to that is a big fight over age verification in the United States on the app stores and who gets to use what apps. Discord just had a big controversy because they went to an outside vendor. People had a lot of feelings about that outside vendor, and Discord rolled that back. Are you seeing any of that controversy come your way around age verification?
We work with the vendors that are trying to log people in, and they want the best tools and technologies to do age verification. Weâre going to make sure we equip them with that.
Technically speaking, itâs often not a technical issue. Itâs what ID system do you trust, and is there an ID system for someone thatâs 12, 13, 14 years old? And so I think one of the challenges has been out of the scope of a lot of the driverâs license-based or passport national ID-based discussions. But I think thatâll be a use case thatâll be covered, I think, by governments fairly quickly.
Do you think itâs possible to do age verification and still protect peopleâs privacy?
I do. Yeah. Yeah.
Go ahead. How do you start to bounce?
There are technical solutions. There are also process and regulatory parts of it. I think ultimately the most privacy-preserving thing is no technology, so thereâs going to be a trade-off. If you are trying to automate something and youâre trying to bring technology to something, thereâs going to be a risk of centralization and privacy controls, but I do think itâs possible to get the balance right.
It seems like thatâs just the other front; the computers are going to get way more capable on their own, and then we are very interested in limiting what people can do with computers in very specific ways. And it does seem like you sit in the middle of it. Todd, weâre going to have to have you back. I feel like thereâs yet more emotional crash out for me to have with you.
This is fun. This is super fun.
Tell people quickly whatâs next for Okta, what they should be looking for.
I think they should be thinking about how they build the secure agentic enterprise, and how they can use the blueprint weâre proposing to the entire industry, and how to make that possible. And weâre excited to work with everyone in the industry, and particularly the tools, technologies, and products weâre going to be building to make sure that reality comes to fruition.
Amazing. Well, like I said, weâre going to have to have you back to see how all this is going because it feels like itâs going to change really fast. Thank you so much for being on Decoder.
Thanks for having me.
Questions or comments about this episode? Hit us up at decoder@theverge.com. We really do read every email!
The Vergeâ˘3/30/2026
đď¸13