Okta CEO Todd McKinnon on AI agents, identity security, and why enterprise software categories are up for grabs

Have a great rest of your day. We'll talk to you soon.

Cheers. Thank you. Let me tell you about Cognition. They're the makers of Devon, the AI software engineer. Crush your backlog with your personal AI engineering team. And without further ado, Todd McKinnon from Octa is in the reream waiting room. Welcome to the TV room. Todd, how are you doing?

What's happening?

I am excellent today. Thank you so much for having me on.

Thanks for thanks for joining. First time on the show. Please kick us off with an introduction.

I'm Todd McKinnon. I'm the founder and CEO of Octa.

Yeah. And uh yeah, I'm excited to be here coming from the office in San Francisco and I feel like yeah,

my hair is not nearly good enough to be on the show.

It looks fantastic. What are you talking about? Uh I mean, since it's the first time, would you mind going back and telling us the the a little bit of the history, the story, the I I love these like founder journeys. So, you can give it you can take as long as you want or as short as you want, but whatever whatever you haven't gotten sick of talking to people about.

Yeah, it's interesting. It's a lot there's a lot of echoes in what's going on today with AI, but 17 years ago, I started Octa the same year Steph

the same year Steph Curry was drafted. So,

no way.

I don't know if that makes it seem like a long time ago or not that much time ago, but 17 years ago.

Octa really is the Steph Curry of the Enterprise.

It is. I've always said that. Yeah, I've always said that. Lots of people.

Yeah. Needs better supporting cast around him maybe, but I'll take it.

But yeah, I mean, how did you even come up with the idea? I think a lot of people uh start a company, they think like I'm going to build something for myself. I'll go consumer because that's hot and trendy. Like how what was the inciting element the like the problem that you identified?

Well, I was running engineering at Salesforce and I was working with all these customers that were adopting Salesforce and then I looked around. I said, "Hey, AWS is launching, Google Apps for Domains, which is what it was called back at the time, is launching." And I said, "Hey, you know, there's really going to be a cloud version of everything in it, and it's probably a great time to go out and start something new and build something that would be needed in that world." And we settled on this platform for identity management, which seems maybe uh maybe pedestrian or incremental, but at the time, people were had these applications like Box and Salesforce and didn't really work well with their Windows login and Windows PC. And that was our wedge to get started to what now is a $3 billion a year company, 6,000 people

and a really important part of the world.

Was this in the sweet spot of venture capitalist during that time? I mean Salesforce pedigree, it feels obvious in hindsight, but what was the pitching process like?

Well, it was very different world because we were in the, you know, aftermath of the financial crash.

Yeah. and venture capitalists were were you know where's are our capital calls going to be returned are we gonna have any money like are we gonna be so people were very reticent we actually were the first company to raise money from Andre and Horwitz

no way you were the very first company

very first yeah

wow and on the first investment it's octa that's insane I mean congrats to you but also a lot of lot of people are like yeah the first investment I made was not great public company I mean I'm person. The first fund has Slack and

Yeah, it's a great fun. Yeah,

nice Sarah's in there and uh

and then Skype, wasn't Skype in the first one?

Yeah, but Skype's a weird one cuz it was like a take private and then a IPO or something or sell.

Yeah, I remember like talking to my friends and they're like, "Oh yeah, you raised Andrea Horses. That sounds great." They the company did that weird Skype thing where they bought it eBay and took it and worked out okay.

Yeah.

Yeah. But at the time, you know, it was it was um people thought, oh, it's not maybe it's not big enough.

They said, oh, you're providing a single sign on for cloud apps to your, you know, Windows domain. Is it big enough? And it's like for the last 17 years, it's like, you know, is it a big enough market? is and every four or five years more cloud and then mobile and then what happened with the really focus on security and how important identity management and passwords are to security and now what's happening with AI co remote work identity just becomes more and more and more important and now with AI we're on this precipice of the and a huge catalyst for identity that's why we're so pumped up and excited about what's going on

yeah so let let's get right into it you octa powers identity for biggest companies in the world and uh right We're at this inflection point right now where people are adding effectively adding uh thing adding adding uh agents to their workforce and oftentimes those agents are are uh playing the role of of humans in some way functioning with different applications working across the company like how are all those conversations going uh how are how are organizations adapting and and how are you guys um fitting into it all

well on a personal level I've never seen anything like it the level of interest the uniformity of the interest from customers in every vertical industry in every size company. They want to do something with AI and they want to invest in agents and it's it's quite a tidal wave of interest. I think now what really gets exciting is is how we turn that continue to turn that interest into actual revenue and actual usage of the new products. But the precondition is there. People are definitely interested. I think what's happening is it's not a huge shock. Every, you know, boards of directors and CEOs, they all read X. Yeah. They know how excited everyone is about this and they're like, "Oh, give me some of that." Right. Come on. Come.

I'll take one million agents, please.

Exactly. Yeah. And then and then the poor the poor people put together these prototypes and these demos and and were kind of like hacked together and they had access to every piece of data in the whole company and they're like, "That's awesome. Put it in production." And the developers are like, "Wait a minute.

I don't care. Put it in production. I told my board I was going to have an agent and this is an agent. Go, go, go." And so what we're trying to do is trying to help them manage that and help them, hey, track these things, make sure whatever these agents are connecting to, you know, how it's connecting and and lock it down, make it secure so when they go into production, it'll actually work.

Yeah.

What kind of general horror stories have you heard at at companies? Is it Yeah. Is it an agent that can effectively go and pull data somewhere that they shouldn't be able to

prompt injection like give me a refund? There's so many there's so many different risk vectors that are that are you know most of the time when when this happens at a company hopefully it's just internal and like you can correct it quickly

but it doesn't feel like we're that far off from you know a company not being ahead on this kind of stuff and you know having an agent that can just query their own internal data and and having some type of bigger leak but obviously you're working to prevent that.

It's very it's very simple. It's it's the the agent was hooked up to multiple data sources and to get access to more data than you wanted, you just need to ask the agent. I mean, pro prompt inj prompt injection sounds, you know, it's something cyber people say to convince software engineers it's a, you know, maybe a hard thing to prevent, but we're talking about simple cases where the agent has too much access and by a couple couple prompts you can get it to tell you the customer information of a different customer. So it's we're and luckily I think if you zoom sometimes in Silicon Valley we're so obsessed with the latest and greatest we we think that everyone has fully agentic customer support and fully agentic everything. But the reality is mo most companies are very early. So it's a good time to layer in some maybe controls and some visibility into what these agents can connect to and the data they can access so we can avoid some of the really bad mess ups going forward. Do you think the Claudebot now openclaw sort of Mac Mini agent personal open- source story is useful in concretizing what is going to happen in the enterprise over the next 12 months for you? Has has it been a reference point in discussions with leaders that you work with? I think it's it is it's another catalyzing event because I think in some cases people are a little bit behind on the power and the business value that could be delivered from these agentic systems and I think when they can I was just at my kids soccer game the other day and they were talking about clawbot they were talking about you know just these weren't tech people they're on the sideline and I think they were talking about how powerful it was and how they're going to get restaurant reservations and I think that catalyzes is the the side of the equation which is go go go. And I think unfortunately you're also going to see uh more security issues and more connections that were exposed and Mac Mini with personal data. It wasn't a new Mac Mini. It was like your family Mac Mini and now your family Mac Mini is is you know the details are all over the web. You're going to see some of that

and uh so we have to get both right. We have to get the business value and and get people headed in the right direction and then also put the right controls in place. How do you think uh business models evolve in a world of you know potentially millions of agents? Uh companies aren't really used to running payroll for millions of people, identity for millions of people. Some people are, but how do you think all of that changes going forward?

Well, I I have a bunch of super strong thoughts on this. Some some of them which are maybe counter uh intuitive. I think first of all, I think in five years there's going to be way more software engineers than there are today.

Wow. And and it's a little bit of a trick answer because I I mainly because I think there's going to be way more software.

Okay.

And you know they'll be more productive but you you'll have more software engineers. I guarantee you all these companies

Yeah.

Meta, Amazon, Google, uh Anthropic, they'll all have more software engineers in five years than they do. And double clicking on that, do you think it's that we're going to see more computer science degrees uh become software engineers in the traditional sense or that designer that you have, that PM, that business leader, maybe even your CFO all of a sudden is a software engineer or is creating software?

I think so. I think what a software engineer does, but I'm not trying to cop out and say all all people are going to be vibe coding and that's my software engineer. I mean people building and architecting software and knowing internals of how it works. They're not going to be writing as much code clearly. But I'll give you a secret.

The last 30 years we've had integrated development environments that are helping us write code more efficiently. This is a whole another level. But it's not a new thing to get better tools to help us make software. So there's going to be more software engineers, but there's going to be even more than the increase in software engineers. There's going to be way more software, which is super exciting and and super super daunting. Now back now if you layer on uh you know are people going to build all their own software or buy software for v vendors I I think that is unequivocally they're going to buy more software from vendors for sure. Now the trick

yeah you kind of people have to people that are just bearish on enterprise software have to remember that there's been open-source equivalents of like almost every major platform forever. It's like you could just pick it off the shelf and run it and maintain it and

uh

it's easy,

right?

Yeah. And I think kind of like there's going to be this kind of goes back with my first thing I said about more software engineers.

There's going to be more software. So there's going to be more package software. There's going to be more customuilt software. Like for example, there'll be a lot of I think people use companies using these software development tools to build the applications that have to span the multiple silos and the multiple systems. Right now you these companies have a very hard time of building something that goes from SAP to content management to Salesforce and an end toend process and maybe there'll be more some more customization and more vibe coding and more you know people doing cloud coding to build that but the core vendors and all of the core data sources and the core business logic and processes that's going to get bigger and bigger and I'm 100% convinced of that which is dangerous. You should never be 100% convinced of anything, but I'm trying to make a point here dramatically.

I love it.

La last year, last year and continuing into this year was all about coding agents. Do you have based on the conversations you have with with, you know, Fortune 500 companies and and and things like that that are maybe out slightly outside of of just like San Francisco tech? Like what other forms of agents are you most kind of bullish on uh for this year?

Orchestrators or orchestration? I I think I think it's so back to my what I was talking about before. Now, by the way, I I don't I don't think that the vendor lineup of established software companies is not going to change. Just because I think there's going to be more and more vended software sold, it doesn't mean that the people that are leading all the categories right now are going to be leading. I think one of the most exciting things about what's I mean this is an amazing time in our industry and personally it's super motivating for me and for our team but the most amazing thing is every leadership category is kind of up for grabs.

You have I mean how crazy is this?

5 10 years ago thinking oh AWS might not be the number one infrastructure provider.

Yeah.

I mean that's crazy. You thought that was locked in but you see Google and Oracle and these companies that's up for grab. You see and and I think the same thing is true for all of the categories. So it's not like there's no potential for disruption. I mean in our world it's very possible that if you look in cyber that in five or 10 years the biggest category in cyber is identity.

Yeah.

I mean that's pretty exciting right now it's you know firewalls and sock and

endpoint but it could be identity and that and everyone sees this. You pile network sees this and service now sees this. They're doing acquisitions and that's exciting. But anyways, back to my point was um is that it's exciting things could change and the real exciting agentic or the new type of software I think is the type of software that crosses all these silos. If you think about it, that's what people were uniquely good at doing. They were uniquely good at doing. Okay, I'm going to look in this system and I know about this little corner case and this other content management system and I can apply some intelligence on that and go back to update. That was very hard to do for packaged application vendors because they're inherently in their own silo and they have to make things comply to their own business rules and database and it's very hard I mean I worked in enterprise software for the all the years before I started octa it's very hard for an HR company to think about end toend or a Salesforce automation company to think about end to end so I think this agentic systems that can cross these silos is a very very exciting opportunity

last question for me is 2026 the best year here to move to San Francisco in history.

Oh, now you've got me you're getting me really worked up now. My strong conviction. I I love San Francisco. And I think all of these people that said San Francisco is dead and it's a mess was totally overblown. San Francisco is an amazing, beautiful place. And no matter, you know, is the government perfect? No. Is any government perfect? No. But it's an amazing place. And all the people still want to come here.

Yeah.

You look at I mean, how many people moved to Miami are now coming back? I mean, where are the great new companies being started? So, I love San Francisco. I have a sign behind me that says San Francisco. Yeah. Yeah. You got a bridge.

You got a bridge.

Hey, we think somebody we think somebody should we let you know that the Golden Gate is not really gold. It's red, but

but your gate is gold.

We think you should you should sponsor you should pitch the city to sponsor the Golden Gate Bridge. It's wide open. Let's put an octa.

It is it's a good metaphor

hanging under it

for octa connects

your identity as you go into the city to connect Marin to to Fort Point. Yeah.

Yes. This is integration. This is fantastic. Uh well, thank you so much for taking the time to come hang out. We'll talk to you soon. Come back.

Thanks. Love it.