WHY APPLICATION-LEVEL PERMISSIONS WON'T SECURE AI AGENTS WITH OKTA'S & NANOCO | DISRUPT 2026 - OKTA INC

Good morning everyone. Welcome to day three of Disrupt and welcome to my guests. Thank you so much for being here. Gabrielle Cohen, it's been a kind of a wild ride for the last six months. You've started your company a few months ago and riding the first wave of agentic software. Nanoclaw, your software has already seen huge success based on this principle that autonomous agents should be more secure and safer than some of the earlier predecessors why is this principle so important to you when I started nano claw started building the project in end of January I was working on a native marketing agency and I started to use open claw I had been using AI tools for a long time and OpenClaw was this big moment where we ran this experiment saying what happens if I just connect frontier AI agents to everything, right? Put security on the side, put AI safety on the site and connect it to everything. And what I found is I got tremendous value from it. It did the work of an employee, but there were major, major security gaps. So I sat down to build a solution that gave me the same value without compromise without gave me the same value without the safety issues and what I see is a big challenge right now is bringing AI safely to to everyone it shouldn't be you know something just for an expert and it shouldn't require compromising on security and so Rick Smith thank you so much for being here I think everyone knows of Okta as the single sign-on provider that pretty much everyone here uses for work. But now we have agents in the enterprise presenting its own kind of set of challenges. Has the business of checking people's logins gotten more complicated as of late? So there's two sides to it. So let's address the agent aspect, which is really dominantly the insider threat that we see today. So when we hire an employee, we go through an onboarding process that grants them access to specific applications data etc and dominantly as we've adopted agents we haven't taken that practice into effect yet we personify agents in the same way that we do a human worker I mean we even talk about displacing them in that capacity and so for us what's really flipped on our business is that our customers are coming to us and asking us like how do we provide that same governance that we for our employees but do it at the scale and speed that's required for AI and so So I think that's a very helpful thing to, you know, a lot of the enterprises out there because we do live in a land of confusion. And I think we get too caught up in, like, the technical abilities of these things without coming down to root principles in terms of how we secure them. And we forget basic things, like identity has always been the last perimeter. And so we're really putting that in a place, and that's really accelerated a lot OF those conversations. Yeah. If I could just jump on, I agree totally with what Rick said. We're speaking with some companies and hearing from them now that they are looking at AI spend and headcount on teams interchangeably. So a department within the organization gets a certain budget and they can use it for AI and they can use it for hiring more people on the team. And AI agents are really becoming that employee. They're connected to accounts. They have identity. We need to protect from the insider risk of those agents exploiting our systems. But we also need to detect the agents. We need make sure the tools they have are secure. If the agent has a browser, that browser has to be patched. Otherwise, someone can hack into the agent's environment, use the accounts that it has access to, and extract data from there. So earlier this year, you published a blog post that said, and I quote, don't trust AI agents. I think the logic there was that AI agents will essentially misbehave by nature. So then how do you and other startups balance the need for autonomy while also ensuring that your agents or anyone else's agents won't run a mock? That's really the key challenge. In order to get value from agents, they have to be connected to everything. And Okta has done tremendous work enabling that with XAA, which we've joined that standard. They have to be connected to things, and then they have to have that autonomy. If you're sitting there approving things every second, you don't really get value from it. There's too much friction. Don't trust AI agents is, it's not about not using them. It's not being suspicious about AI. It's saying, use it, but come to it from a place where it's about trust. It's about instructions and telling the agent behave well and hoping it does. It needs to be verifiable enforcement that's outside of the agent's training, outside of the agent instructions, and outside of the agent environment. So that's how NanoClaw is built. And NanoCo, the agents we provide to enterprises, are built on that principle of put the agent in a box, lock it down, and then intentionally connect it to sources of data, to tools, and and enforce actions, enforce policies outside of the agent's environment. And by doing that and being thoughtful about where you put the approvals, for the most part, an agent can do a long flow of work, research information, pull from your email, fill a spreadsheet. Typically, you really only need approval at one point when it's going to send that spreadsheet out to somebody else or send the email out to someone else. And enterprises, we help them set the right policies so that you can let the Agents do their work, go wild in their own little world that they live in, and then enforce just the actions where you really need human judgment and human approval. Gotcha. And Rick, where do you think that kind of balance is? And what kind of solves the problems, do you thing? Well, we actually solve the problem, like we're actually solving very similar problems, taking a different lens to it. So when I look at something like NanoCo, you're very much insulated around the Agent, which if we look at security, we always think about it, like an onion there's layers to how we deal with these practices we take a much broader aperture in terms of making sure agents only have access to certain toolkits if they're acting on behalf of a human then we take the grants of the human and allow them to be activated for that agent so that those scopes ultimately allow the same kind of access to the human all of those claims that we see in terms what they have access or audit and track so that we can go through the the verification or detection of misbehavior, but roughly the same principles, but we take a broader scope for the enterprise. And so from what are you seeing in the wider Okta ecosystem in terms of the common security mistakes that are being made by companies building their infrastructure around AI? I think that the first thing that we see is that they're running towards value. so what I mean by that is they're trying to ultimately you know they're spending a lot of money on AI they're just trying to extract some productivity gains dominantly and as soon as they start crossing that chasm they start realizing their security exposure and most of that comes down to like very basic primitives so what do they have access to in terms of data what toolkits do they have access what applications do they have access too what are their roles and responsibilities that mapping generally does not happen up front and we're usually asked to come in and help them through that process and obviously provide them with the infrastructure to do it and so can we talk about the notion of kind of intense and about trying to essentially ensure that what a person's intentions are that they actually go through and become the outcome that they want so again how are we trying to find that balance of ensuring that agents are doing the thing that they need to be done that needs to be done, while also not running over the guardrails that they've been given. The approach that we're taking, we have enforcement on specific tools, but also specific actions within those tools. And that's the outer boundary of those policies, of what people in the organization can allow their agents to do on their behalf, is set by IT and security and AI lead. And then within that, there's the individual employees who can tighten those bounds. And by default, agents are given the least privilege, so they're only given the tools that they need to have. And then you set specific policies on endpoints, sending an email, searching through email. But there does need to be that alignment of intent. And if the outer boundaries of security need to deterministic, today with judge models, and just in general models getting better, there does have to be that extra level of looking at what is the user's intent and is this action aligned with that intent. And some of that is for auto-approving actions that otherwise wouldn't be. Some of it could be for blocking actions that would have been allowed. And the approach we take is make the user state the intent, or actually, rather, make the agent state the intents. So when I ask the agent to do some work for me, in our product, the agent comes back and says, and says, here's what I'm going to be doing. Here's the plan. I'm gonna go through a spreadsheet. I'm to go through the email. I'm want to go pull some information from JIRA, cross-reference it with GitHub. And then I'm go and open a pull request. And you approve the plan, and then you can have a judge model look at each and every action and compare it with a plan. And it's not saying, is this safe or unsafe fundamentally? It's saying, it is aligned with the plan that the user has approved. CHET HAASE- So what suggestions do you have for founders and developers who are looking to either build similar technology or they want to kind of extend yours what should they be thinking about large enterprises are we're speaking with you know some of the largest enterprises in the country and globally and we hear again and again that they feel like they're behind right and they can't all be behind but somehow they all feel vast majority say that they're behind they're trying to move very quickly the the people who lead the AI enablement efforts a lot of them haven't spent a lot time in the company they're in or in large enterprises in general you speak with them they're very optimistic but then they run into the processes of their company in terms of security reviews procurement processes legal and they're trying to condense these processes it would have taken 12 months but in the end of the day there's no skipping the security review and there shouldn't be right so these processes do take three four six months I think it's really important people building today to make sure you're not solving for if you're if you're building for a large enterprise make sure not solving four for your problem that you have make sure your solving for their problem but also make sure that you're building for the challenges of four to six months from now and not the challenges today by the time you get to market the challenges of today probably won't be relevant you know the latest model will just the latest agent harness will just make it obsolete I'll take let's take one step back to intent-based authorization so we're taking it actually a more advanced step on this which is when you look at intent- based authorization you first have to start with deterministic fine-grained access and then the intention aspect of it is a narrowing and so a lot of that you have to actually define what is the semantic meaning of accessing specific toolkits taking specific actions and then what data is resident in the risk thereafter and so that's what we're currently working on that does not require you to have human judgment in the midst of that that requires to have a true detection engine in place that we can make these decisions at run time. Now what I think people need to be aware of is really looking at the history of their risk registry within their organization, which is probably terrible. And that's a scarier fact today because all of those CVEs that you have been patching, all of these are time bombs waiting to go off based on what's happening in the market today. I mean, you could be Pavel in St. Petersburg and run a rack of Mac minis with an open weight model and you can go to town on this infrastructure today. And that's just a growing risk. Like every six months it gets worse and the threat gets more real. And so when you really ask what needs to happen, you need to look back at the five, ten years of debt that you've got within your enterprise and start actively working it down because the storm's coming. So then, how much of agentic security today goes back to those security fundamentals of containerization, isolation, and just ensuring that the foundation security is really there? Well, it accelerates it. I think that the introduction of Mephos put the nail in the coffin on it. You've got a couple of factors going on with that, which is, one, we can identify these exposures and actually do some level of pin testing with those models today but there's a tyranny in the system right it's only the enterprises and product companies that can afford to actually activate these things to find them to provide secure services to customers as well as deploy AI to make sure that the patching and automation and software updates actually apply so when we start talking about things like on-premise infrastructure like that becomes a spectacle of madness in terms of how will customers keep up with all the updates that have to go into that infrastructure to make that happen. And if we look at the humanity of it, you know, if we're talking like a regional hospital out in the middle of Midwest, which is constantly barraged with ransomware, they've got no hope. So these are the things that I'm actually more concerned about. Yeah. I would say, in addition to what Rick said, that in terms of infrastructure, principles like least privilege and building for least privilege, assuming that when we think about not trusting agents, you will see container escape. You will see VM escape, even. And there have been. There was one recently disclosed by Vercel where someone reported a zero day that allowed full VM escape. So you need to build least privilege in your infrastructure, not just in employee access, but saying, what is this agent? If it escapes from this container, if it escapes form this VM, what can it access then? What can this pod access? What can node access? What can VPC or this whole account access? And look at that scenario. But ultimately, it does come down to the fundamentals. CVEs that have been sitting there for years, that have maybe been sitting in a backlog because they're unexploitable from the outside, when you take agents and a swarm of agents increasingly, and you set them on this, they look at your infrastructure like it's Swiss cheese, and they can just hop from vulnerability to vulnerability and exit. So we really do need to go back to the Fundamentals and add to it this extra layer of thinking about that highly capable insider in my infrastructure who's going to poke and prod at every hole. There are no doubt employees who are using agentic software in the enterprise today on their corporate network, and their corporate networks may not necessarily know about it. What advice would you give for trying to balance the need for using agentics software and experimenting without necessarily compromising enterprise security? NICOLAS RODRIGUEZ- So I think a lot of well-meaning security teams, CISOs, that say it's too early, this is too scary, the solutions aren't there, so we have to lock down access. We can't allow employees to connect their agents, their AI, to their data, their spreadsheets, their data lakes. It's well-intentioned. It seems correct. But in many instances, they may actually be making their security worse. I was speaking with an employee at a large company, large enterprise that prides itself in its security. And they were telling me about how they use their agents. And their agent can't connect to the data lake, and it can't connected to their BI systems. But they want to build dashboards. And cloud agents build great dashboards, so they're going to their data lake. They're exporting tremendous amounts of customer data, tens of thousands of records, downloading it, uploading it to Cloud on the web, and having it do some analysis to build a spreadsheet for them. And they're doing that every week to keep their dashboard updated. It would be much more secure to have that agent connected through Okta, through the enforcement that we put in place, through governance systems, have that whole data access chain audited, and have the agent be able to pull in just the metrics that it needs rather than exporting a tremendous amount of data. So security, if you want to keep your system safe, you have to find a way to enable access in a safe way. RICK VISCOMI- Rick, same question. Where's the balance, and how do you give that kind of advice? RICK VLASKOVICH- I love that you're giving me a platform on this one. This is exactly my lane. So yes, you should have policies in place about what the agents plus employees should have access to in terms of data. Make sure that they're scoped in terms of the actions they can take within specific applications that they are granted access to. But the reality is, even if you lock all that down, people are smart. And so they'll export something as a spreadsheet. They'll give it to Claude. Claude now has a new understanding of it. I've actually seen a case where a company's SOX compliance was actually compromised as a result of those kind of actions. So it's a slippery slope. You're less worried about those concerns, even though they're risky. You're more worried about what could potentially happen if one of them turned or was used maliciously. So then you've got a new kind of insider threat as a results of that. So a human trying to do something malicious and taking the power of something like Claude on their behalf to do it, this is where you have to go back and look at the choke points in your infrastructure. Is everything operating behind a VPN so you can cut off network access regardless of what's happening? Are the most sensitive things happening in a data diode if it really has to go that far? But those are the kind of escalated security standards that have to be put in place today with what's going on. And we're still stuck in a world where security is second tier. We've let it run behind, and we've a lot of debt that has to be cleaned up to make sure that these things can actually operate in a safe manner in our environments. So what happens when things go wrong? Do agentic software today, does agentic softwares need a kill switch? 100%. And I think it needs it at varying degrees. So obviously we offer a kill-switch so we can terminate sessions to anything that an agent has been provisioned for. But you need to look more broadly within the enterprise. This is one reason why we partnered with a number of vendors to set up the Blueprint Alliance, which basically helps customers understand the interrelationship between all these security vendors and how to actually set up an enterprise to be secure around AI. But I think we get too mixed up in, hey, I've got it on my laptop, let's throw it in a sandbox and all is going to go well, which is not the truth. Gabriel, I'd love to hear your thoughts on this. Yeah, absolutely. You have to have a kill switch in our platform. We're integrated with Okta. We have that level of security. But on the level of the infrastructure, where the agents are running, if they've managed to escape from a VM and are now prodding and poking at your software, your infrastructure, you need to have kill switches on multiple layers. So not just cutting off access to data, You need to cut off access to inference. You need be able to shut down your infrastructure. So we have the ability to revoke access for a specific employee, to change a policy, to cut of access to a tool. And we have just a global kill switch. Just shut it all down, right? Don't let everything we've deployed in this whole account, this whole VPC, don't let it access anything. And with the kind of risks that we've and with OpenAI Hugging Face, and swarms of agents figuring out how to evade the enforcement you've put in place, that becomes really, really important. But I think for most enterprises, most companies, the conversations that we're having, they're very far from the kill switch. Because agents are running on laptops, they're running in environments where there's no isolation, they're many, many steps away from even being able to talk about implementing a meaningful tail switch. SEBASTIAN TRZCINSKI- And so looking ahead to the next few months and year or so, what are your customers asking for in terms of features and what they're trying to accomplish with your software? NICOLAS RODRIGUEZ- AI is moving from an employee using it to do their work and moving to a team function. people within a team working together and enabling flow of information through the organization. Our stand that we take, an opinionated stand, is we say every agent needs to have an owner, somebody who is taking ultimate responsibility for it. We are trying to build in a way which in many ways is very aligned, in some ways a little bit different from what Rick mentioned of saying humans should be in the loop. And we're trying to builds solutions so that humans are at the center, that AI is enabling humans, and that ultimately people are deciding. People are setting the goal, setting the direction, and AI is enables it. Companies are asking for AI that works for the team. Where I think it will be in the next few months is AI teams. So you can call it swarms. It's a little bit intimidating. I think, it's a bit more friendly to say teams. But we know that the labs are working on that. Anybody who's at the frontier of building with AI is working with a team of agents and having a team of agents build for them. And that's the next big frontier in the next three to six months. It seems like probably a new scaling law. You scale training, you scale test time compute, and now we're scaling agent teams from four to eight. I'm running probably 32 agents on a team at the moment. I think if we look forward a few months, we're going to be talking about teams of hundreds. And the frontier labs with frontier models seem to be running thousands. What are your customers looking for? I like how you're trying to get away from derogatory terms to positive terms and referring to agents. You're like, are you preparing for the future, like when you have to work for one? Stay on their good side. That is definitely the perspective of some of the labs of saying, agents are better than us at deciding things, and they will be better. And they probably will be. So I think that it's maybe even the likely outcome that agents make decisions and we work for them. And half the time we're working for them, they're saying, oh, I need you to grant me access to this account, enable this API. So they already have us working for then, but if we're talking about what kind of future do we want to build, I want to built a future where I'm still directing agents and I'm not working for the. We're in the same position. From our perspective in terms of product, like our journey first began on how do we help enterprises allow agents to act on behalf of an end user. And that's expanded to now they want agent to agent interactions. We're now talking about what does the new agent to commerce look like and what is our position in that, which is a net new opportunity. We've got personal agents coming online that we're now being asked to protect. Here's a litany of use cases that we have to help our customers through. I mean, super exciting times, and we're very fortunate to be in the position to help enable them to get through a lot of the security concerns that they've got so that they can realize the value of these investments, but I mean it's a wild ride. Do you have any final thoughts, any kind of best practices that startups should really be thinking about more than anything else with agentic software? So obviously, I'm in the camp of all of these things should be governed in terms of access, but if I was to put my security practitioner hat on, the first thing I would say is, are you running an N-1 patch program in your organization today? And if I look around this room and I ask people to raise their hand whether they're doing it or not, I guarantee that I'll get one. But that is a vital capability that every organization should be putting forward right now because that's where your holes are and there is a new method of doing research very quickly to explore each and every one of those Gabrielle you know you are now six months to almost a year into your journey with your company if you go back and change anything with the benefit of hindsight would you I think we're in an incredible position today we've been in this spot of of personal agents for work that's that's where I started I sat down in February and I sat out to build myself a personal agent for my work and that's now you know obviously the space that's getting I think the most attention we have an enterprise platform that's deployed with companies and we're you know very close to launching also a free version that anybody can can access we have incredible investors and Okta is actually an investor and joined our seed around full disclosure there so I'm a big fan not biased at all as are we and I wouldn't I wouldn' change anything except maybe be more ambitious and I think this is really important for everybody who's building now the models the agents they're getting better at a very rapid rate things that you built a month ago two months ago are now take about half the time to build today and And that just keeps going. So rather than building incrementally and trying to say, well, first, if you're building for enterprises, if that's where you want to go, rather than saying, we're going to build first for small startups, and then we'll move to up markets and medium enterprises, then we will go for large enterprises. We'll start out with simple authentication, then we integrate with IDPs. You should go one shot to the end goal, because you need to be more ambitious. You need to take on bigger challenges. the technology enables it today. We're extremely ambitious now. I would have taken some bigger swings four months ago. I think we can leave it on that note, which is quite a nice way to leave it, I would say. Thank you so much for your time. Really appreciate it. Thanks. Thank you. Thank you, appreciate it