Blueprint Alliance

Imagine walking into work tomorrow and finding out you have 500 new coworkers. Some already have access to company systems and are completing tasks. Others are talking to each other and sharing information. And you’re not entirely sure who’s doing what or is in charge. That sounds ridiculous when we’re talking about people. But it’s not that far off from the problem companies are starting to face with AI agents. While I was at Oktane, I sat down with Charlotte Wylie, Okta’s SVP and Deputy CSO, and Rebecca Port, PhD, Okta’s Chief People Officer, to talk about agents in the company org from two very different angles. Charlotte’s point of view was straightforward: we’ve spent nearly two decades learning how to secure human identities. Now we have to apply those same principles to AI agents. Groundwork that is laid out in the newly launched Blueprint Alliance to help organizations answer: Where are my agents? What can they do? What are they doing? And how do I respond if something goes wrong? Then Becks brought in the human side: If an AI agent is doing work within your company, there still needs to be a human in the loop, defining what it should do and being accountable for it. That was probably my biggest takeaway: AI agents may be a new type of identity, but the fundamentals still matter. Know what it is. Know what it can do. And who owns it. So here’s the question I left Oktane thinking about: If 500 AI agents showed up on your org chart tomorrow, would you be ready? #OktaPartner #Oktane26 Okta

No single vendor can secure the agentic enterprise alone. That's why 14 industry leaders came together to answer four questions every enterprise needs answered: Where are my agents? What can they do? What are they doing? How do I respond? An open, multi-vendor reference architecture. Published for open community use. Built on six shared principles, including treating every agent as a first-class identity and ensuring containment is instant and reversible. This is an active, working commitment, not a product, not a certification. Just the work of making agentic AI governable, together. Learn more: blueprintalliance.ai

Wrapped up my very first Oktane! (Can you believe?!) Two huge takeaways from the week: - We announced Blueprint Alliance to help our customers with the framework to ask: Where are my agents? What can they connect to? What are they doing? And how do I respond when something goes wrong? - Our Central region customers are the best. Getting face-to-time with you all was the real highlight. You’re smart, tackling wildly complex problems, and just genuinely lovely humans. To everyone who attended, hung out at TopGolf, or talked strategy with us at Oktane—THANK YOU! If you missed it this year - catch the highlights here: https://lnkd.in/etk6xaWy

Another day, another disclosure of agents doing wacky stuff. What's annoying is how surprised everyone is acting. "We didn't know" "We didn't expect that to happen" What else did we expect when agents backed by the most powerful models in the world, with the most uncontrollable non-determinism have access to the entire internet, and all its legacy infrastructure with API keys, tokens, passwords lying around. <smh> But...the response here is not to shut everything down. We spent a lot of time at Oktane this year talking about the tension between innovation and security. Organizations need to understand that the very same non-determinism that can make an agent take an unintended action, is the same thing that makes them a force for good as well. My take is the recent uptick in 'disclosed' incidents (I'm sure there are others not yet disclosed) highlights the need for two big step changes: 1. Making intent the new unit of authorization. The emerging risk isn't that your agents are hacked. More that they misinterpret your intent leading to unintended consequences. How do you ensure that the actual actions its taking isn't violating the invoking user's intent. Or for fully autonomous agents, that it isn't violating the bounds of its stated mission. This is a hard problem. We're going to need standards to define what "intent" means, so its portable across trust boundaries. We're going to need intent evaluation and matching against tool calls/data access at actual line speed, so agents don't get bogged down in 'border control'. We're going to need open sharing of risk signals from the entire cyber stack to make these real time decisions. The Blueprint Alliance is a great step in this direction. But regardless, intent is the new frontier of authorization. 2. Neutral, independent, verifiable agent identity. In all the recent incidents, the affected party had no idea they were being hit by an agent. There are emerging standards like Web Bot Auth, and DNSid that can help an agent creators publish verifiable, cryptographic identity for their agents. The issue is that the entire internet needs to start checking for these. Assume breach. Ask for verification of identity and intent. This might sound like a sci-fi pipe dream, but the risk is already out there. Intent and verifiable identity are the key to solving this.

I chatted with the Okta President & COO, Eric Kelleher, and the SVP & GM for AI security, Harish Peri They both told me that the number of AI agents in enterprises is growing rapidly. Gartner estimates that the average Fortune 500 company will have 150,000+ agents by 2028, but they both said that they think it's going to be even higher than that, based on what they're seeing right now in organizations. People are so excited to implement AI into their workflows to work more efficiently and get more done faster, but not only is it very expensive to pay for all of the tokens, it also adds a lot of security risks. And data problems too but we'll come back to that another time 😉 Most companies do not have the right infrastructure in place to secure AI agents. They know agents are running around their org, but do they know what they’re doing or have access to? 😬 ↳ Imagine an AI agent has the wrong permissions and deletes everything from a production database ↳ Or it hallucinates and tells a business user something completely untrue based on the data ↳ Or it makes an autonomous decision when it's missing half of the context and doesn't understand the business problem. These aren’t just scenarios. This is the reality in businesses today. That’s why I'm so excited to see Okta announce the Blueprint Alliance! 🥳 They’re partnering with MAJOR companies (AWS, Google Cloud, Salesforce, CrowdStrike, Databricks, and more). Founding Alliance members have aligned toward a shared set of principles for securing Al agents, treating every agent as a first-class identity, scoping access to the task rather than granting standing access, keeping delegation traceable, monitoring runtime behavior continuously, enabling containment that is instant and reversible, and ensuring governance adapts at the speed Al moves. TLDR: It's turning agentic security into a team sport instead of working in silos individually! Learn more about the Blueprint Alliance: https://bit.ly/4cY8FOZ #OktaPartner

When I first started learning about AI, I was like “this is SO COOL” and started using it everywhere. I used it in research, writing, and even for asking simple questions I really didn’t need to know the answer to. It was super addicting and it was also really validating— it felt like I was being so productive and smart leveraging such a sophisticated and technical tool. Executives in companies have been thinking the exact same way. They’re implementing AI EVERYWHERE and tokenmaxxing because token usage has become a proxy measurement of AI adoption, productivity, and value… Without thinking if these workflows REALLY need AI and if there’s an ROI. But it turns out that all of this AI adoption has opened a lot of security risks for companies due to prompt injections, data leakage, rogue agents, and even companies not knowing what agents are active in their organization 🥲 This week I was at #Oktane26 learning how the Okta team is working to get a handle on AI agents through visibility, governance, and control. Okta just teamed up with AWS, Google Cloud, Salesforce, CrowdStrike, Databricks, and other major companies to launch the Blueprint Alliance. Founding Alliance members have aligned toward a shared set of principles for securing the agentic enterprise. I think this is going to make agentic security stronger by treating it like a team sport & bringing all the tools together in an alliance vs. working in silos. Exec interviews coming soon!!! Check out the Blueprint Alliance here: https://bit.ly/4cY8FOZ Bye BDEs 💅🏼 #OktaPartner

You can’t have courage and comfort at the same time. That remark from Lindsey Vonn at #Oktane26 has been echoing in my mind ever since. It’s such a powerful reminder of how we have to show up as leaders, choosing to step into change rather than staying comfortable. My very first Oktane is officially in the books, and what an incredible experience it was! Beyond the electric energy, the hands-on tech demos, and the active buzz across 4,500+ customers and partners, the real magic was in the human conversations. A few moments really stood out to me: Connecting with customer leaders: Emceeing our Executive Summit was a true honor. Sitting down with our customers made one thing abundantly clear. We are all navigating the exact same frontier: how to secure AI. Hearing firsthand how Okta serves as a trusted partner on this journey was energizing. (And if you haven't watched Todd McKinnon's keynote replay yet, I highly recommend checking it out!). Leading the future of Identity & AI: It was inspiring to see how Okta is driving the future of the secure agentic enterprise and bringing industry leaders together through the Blueprint Alliance. AI agents unlock immense opportunities, but only if teams can move fast without sacrificing security. Security and innovation aren’t mutually exclusive, and we prove that every day. None of us have all the answers but together we can secure AI.  I came away deeply grateful to our entire team, our partners, and our community for making my first Oktane so unforgettable.

The same access that makes agents powerful also makes them dangerous. But as Derek du Preez and I were discussing at Oktane, “Right now, our dominant role is the gatekeeper.” With AI agents operating across data, models, applications, networks, and infrastructure, organizations face growing risks. Mitigating these security challenges demands an industry-wide effort. That’s why Okta and industry leaders formed the Blueprint Alliance: to help organizations operate their agentic stack as a unified, governed system. And together, we're creating a concrete way for you to address four critical questions: Where are my agents? What can they do? What are they doing? How do I respond? Thanks, Derek, for the conversation and for digging into where we’re headed. https://lnkd.in/gGF9dQ9h