Okta held its annual Oktane signature event from October 15 to 17 in Las Vegas, accompanied by an online track on the second day. I really like the conference’s name: it’s a clever play on the company’s brand that conjures up thoughts of speed and power. From my perspective, Oktane 2024 went far to demonstrate the company’s unrelenting focus on identity and access management. IAM continues to be a critical element used to harden enterprise security controls, especially given the rise of user credential compromises that allow bad actors to breach organizations of all sizes across many industries.

Okta made several announcements at Oktane 2024, but two stood out as especially significant: (1) new capabilities tied to securing generative AI applications, and (2) the company’s efforts with the OpenID Foundation to strengthen security for cloud-native applications. In this Moor Insights & Strategy analyst insight, I will dive into each effort and provide my perspective on what is noteworthy.

Securing GenAI Applications for Developers and Users

GenAI is poised to enable a reimagining of consumer and enterprise applications. AI agents will eventually harmonize discrete functions, unlocking value in the form of natural-language-requested outcomes. However, as GenAI continues to gain momentum, it creates security risks given the use of personal and shared data, underlying algorithms and large language models, API calls, and more. To address these challenges, Okta announced a new product within its Customer Identity Cloud portfolio: Auth for GenAI. It includes four key components:

• User authentication schemes that integrate into popular GenAI frameworks and libraries including LangChain and Vercel to ensure proper access control

• Verified API calls that allow AI agents to call on services on a user’s behalf, doing so based on consent

• Async authentication that enables developers to implement on-demand authentication within applications, using push notifications to allow users to approve transactions

• Fine-grained authorization for retrieval-augmented generation (RAG) that ensures that user requests within GenAI inquiries use only content that an individual user has permission to access

On the surface, Auth for GenAI enables developers to build next-generation AI agents and applications securely while not introducing unnecessary constraints that could stifle innovation or create a cumbersome customer experience. Okta’s ability to facilitate security by design for GenAI developers is potentially powerful, anchored by the company’s leadership in IAM.

Improved Security Controls for Cloud-Native Applications

Many cloud-native applications are built without secure identity controls. The fundamental challenge is the lack of a common framework to give developers the ability to integrate new and existing security functions. To address this need, at Oktane 2024 Okta and the OpenID Foundation announced the formation of a working group to establish a new open security standard.

The working group’s goal is the formal establishment of the Interoperability Profile for Secure Identity in the Enterprise. The IPSIE standard aims to make it easier for SaaS providers to address security across the entire tech stack, enabled by a broad ecosystem of participants. The framework intends to aggregate a rich set of functionality, including:

• Single sign-on that centralizes access policies and enforcement

• Lifecycle management that eliminates the existence of orphaned accounts and reduces the resulting likelihood of unauthorized access

• Enforcement of least privileged access

• Broader risk-signal sharing intended to bolster threat visibility

• Session termination that is triggered by threat detection to prevent compromise

Okta is in a unique position to lead the IPSIE effort, given its leadership in IAM. To demonstrate the power and value of the framework, at Oktane 2024 the company announced 125 integrations with industry stalwarts Google, Microsoft, Slack, Atlassian, and others. Furthermore, Okta’s Customer Identity Cloud will provide flexible free, self-serve, and enterprise plans to allow developers to easily leverage IPSIE security features to ensure the highest levels of security for cloud-native applications.

Fueling Security Innovations through IAM

Okta’s Oktane 2024 announcements related to GenAI and cloud-native application security are compelling. Bad actors will continue to find new ways to leverage blind spots, vulnerabilities, and AI tools to compromise organizations in the hopes of financial gain. Auth for GenAI and IPSIE have the potential to level the playing field for defenders, and in the process ensure that developers and users can conduct their daily tasks safely and securely.