Okta's Todd McKinnon: Identity for AI Agents Is the Company's Big Bet

Okta CEO Todd McKinnon has laid out the company's strategy for the AI era. While the whole industry argues about the SaaSpocalypse, Okta is making its main bet on managing the identity of AI agents inside corporations, a market that could become the largest in all of cybersecurity.

Okta, a platform with a market capitalization of 14 billion dollars and annual revenue of 3 billion, manages corporate access to thousands of applications. Put simply, it is the reason you have to enter your password again right before a meeting.

On the latest quarterly earnings call, McKinnon admitted that the company is "paranoid" about the SaaSpocalypse: a scenario in which businesses build their own tools through vibe coding instead of paying for ready-made SaaS products. But paranoia is a tool, not a paralyzing fear. McKinnon is convinced that Okta is well protected against direct replacement. Security requires scale, reputation, and thousands of live integrations, none of which can be assembled over a weekend. When a company suffers a breach, it needs a vendor with a name, one it can hold accountable and one that fears the consequences enough to actually monitor threats. Vibe coding offers none of that.

The real opportunity McKinnon sees lies elsewhere. The rise of agentic systems has raised a question few have had time to formulate: who manages the identity of the agents themselves? When a corporate AI agent logs into a CRM, queries databases, or sends emails on your behalf, it needs a clear identity, limited permissions, and a way to be shut off instantly. Nothing like that exists in the corporate world today.

According to McKinnon, an agent is a new type of identity, something between a human and a system. Like a human, it gets access to applications with roles and a profile. Like a system, it can run fully autonomously or act on behalf of a specific employee.

Okta is building a centralized agent registry: a single place where companies can see all their agents, from Microsoft and Amazon platforms to homegrown solutions. The key element is standardized connection points: clear rules on which data an agent can access and under what conditions. The third component is a "kill switch": the ability to instantly revoke all access for an agent that has behaved unpredictably. It works like cutting an employee off from the corporate network on the first day after dismissal.

McKinnon estimates agent identity management as potentially the largest category in cybersecurity, a market with annual volume of about 280 billion dollars. Human identity management accounts for roughly 10% of it. By Okta's forecast, the agent layer could surpass it in scale.

At the same time, the company is thinking about another threat: AI-driven fraud. Forty percent of Okta's business involves verifying real users on consumer sites. McKinnon sees a way out in digitized government IDs: mobile driver's licenses and passports offer a chance to reliably tell humans from bots through biometrics right on the smartphone.

McKinnon's main thesis is that the technology pie is getting significantly bigger. Agentic systems will not destroy the SaaS market; they will create new categories that do not exist today. For Okta, that means not a defense against vibe coding, but a race for a new market that the company intends to define and lead.