AI Is the Biggest Cyber Threat — Only Okta’s AI Security Playbook can safe you

Jack Hirsch, Head of AI Products at Okta ($15B market cap), reveals the wildest AI cybersecurity threats. He shares why AI agents are the biggest security blindspot, and explains his controversial take on why traditional PM experience is bad founder preparation. Transcript: https://www.news.aakashg.com/p/jack-hirsch-podcast Timestamps: 00:00 Intro 02:02: Wildest AI Cybersecurity Threats 04:27 Moment AI Changed Security 06:32 How AI Agents Change Security Equation 11:14 Most Dangerous AI Threats 14:16 Okta's AI Threat Detection System 18:10 Ads 19:50 Okta's AI Security Playbook Revealed 22:15 T-Shaped Identity Strategy Breakdown 26:42 One Thing Every Company Must Do This Year 31:37 Ads 33:16: How to Handle AI Security Threats 40:09 Building AI-Secure Products at Okta 46:47 Fundamental AI Product Development Principles 01:06:29 Butter.ai Startup Story (2015) 01:19:18 Why Evernote Failed Despite Early Success 01:20:48 Hustling Into PM at Evernote 01:26:51 Personal Identity Protection Guide 1:30:36 Outro Thanks to our sponsors: 1. Amplitude: The market-leader in product analytics: https://amplitude.com/session-replay?utm_campaign=session-replay-launch-2025&utm_source=linkedin&utm_medium=organic-social&utm_content=productgrowthpodcast 2. The AI Evals Course for PMs: Get $1155 off with code ‘ag-evals’: https://maven.com/parlance-labs/evals?promoCode=ag-evlas 3. The AI PM Certificate: The #1 AI PM certificate: https://maven.com/product-faculty/ai-product-management-certification?promoCode=AAKASH550C7 4. Kameleoon: Leading AI experimentation platform: http://www.kameleoon.com/ ---- Key takeaways: 1. Identity is Everything: Over 80% of breaches stem from identity attacks, not device or network vulnerabilities. You cannot get security right without getting identity right - this is the new reality. 2. DPRK Infiltration Operations: North Korean agents are passing full interview processes, getting hired, having laptops shipped to device farms, and operating as inside threats within major organizations. 3. AI Agents = Security Blindspot: Companies deploy AI agents en masse without treating them as identities requiring access management. JP Morgan's CISO called this out as the biggest current threat vector. 4. Help Desk Social Engineering: Attackers use AI voice cloning and deepfakes to impersonate employees calling help desk for password resets, MFA bypasses, and account access - often successfully. 5. Session Security Over Time: Authentication degrades after login. Okta focuses on continuous session monitoring and risk signal sharing between security vendors rather than constant MFA prompts. 6. T-Shaped Identity Strategy: Deep identity security (phishing-resistant auth, lifecycle management, risk sharing) plus broad integration across all enterprise systems - not just SSO and MFA. 7. Cross-App Access Standard: New OAuth standard allows AI agents to inherit user permissions across enterprise apps without individual OAuth dances for thousands of employees. 8. Essential vs Discretionary AI: Essential AI (bot detection, fraud prevention) stays always-on. Discretionary AI (log summaries, access reviews) gives customers opt-out control for compliance. 9. AI Product Principles: Accelerate don't abdicate, solve real problems before prototyping, ignore AI hype cycle. Use AI as thought partner, not replacement for product judgment and domain expertise. 10. Personal Security Stack: Lock credit reports immediately, use password manager with unique passwords, enable passkeys everywhere, lock phone number with carrier PIN to prevent SIM swapping attacks. ---- Where to find Jack: LinkedIn: https://www.linkedin.com/in/jackhirsch/ Okta: https://www.okta.com Where to find Aakash: Twitter: twitter.com/aakashg0 LinkedIn: linkedin.com/in/aagupta/ Newsletter: news.aakashg.com #cybersecurity #ai #productmanagement About Product Growth: The world's largest podcast focused solely on product + growth, with over 187K listeners. Hosted by Aakash Gupta, who spent 16 years in PM, rising to VP of product, this 2x/week show covers product and growth topics in depth. Subscribe and turn on notifications to get more videos like this.

Aakash GuptahostJack Hirschguest

Sep 21, 20251h 31mWatch on YouTube ↗

WHAT IT’S REALLY ABOUT

Okta’s identity-first playbook for AI-era cybersecurity and product building

AI is accelerating identity-centric attacks—from DPRK “employees” and help-desk social engineering to phishing kits generated with coding assistants—making identity the primary breach vector.
Organizations are deploying AI agents widely without treating them as managed identities, creating a major, under-discussed risk: overbroad, under-governed access to sensitive resources.
Okta’s defense focus is shifting from one-time authentication (SSO/MFA) to continuous session security using first- and third-party risk signals shared across an open security ecosystem.
Okta’s emerging “AI security playbook” includes standards-based approaches like Cross-App Access to give enterprises centralized visibility and granular control over AI-agent-to-app permissions at scale.
For product builders, AI should accelerate work without replacing accountability; strong PM fundamentals, deterministic security workflows, and hype-resistance are key to shipping reliable AI-enabled products.

IDEAS WORTH REMEMBERING

5 ideas

Treat identity as the core security control plane—not an IT checkbox.

Hirsch argues identity has replaced networks/devices as the primary target; most breaches begin with identity compromise, so SSO/MFA alone is insufficient without deeper lifecycle and session controls.

Assume credentials and sessions will be stolen; design for continuous verification.

Okta’s posture shifts from “secure the login” to continuously reassessing device, network, and behavioral signals over time to prevent long-lived session replay and cookie/token abuse.

AI agents must be managed like employees: least privilege, lifecycle, auditability.

Enterprises are granting AI tools broad access without visibility or governance; Hirsch frames this as a ‘clear and present danger’ because agents become powerful identities that can exfiltrate data.

Lock down help desk and reset flows—deepfakes make humans unreliable gatekeepers.

Voice cloning and real-time impersonation can trick support into MFA/password resets; critical admin actions should be strongly verified, constrained, and heavily logged.

Use open standards to share risk signals and coordinate remediation across vendors.

With frameworks like Shared Signals Framework, device/network providers can flag risk to the identity layer, enabling rapid step-up auth, session termination, and downstream app sign-outs.

WORDS WORTH SAVING

5 quotes

The DPRK is basically planting workers into many of the organizations that you might be familiar with, going through full interview loops… and then there are inside threats.

— Jack Hirsch

Identity actually has become the primary threat vector. Before it was devices, networks… Now they're going after the identity.

— Jack Hirsch

I wrote myself a little phishing kit based on the Okta SDKs… if we're not careful, the wheels are gonna come off the bus.

— Jack Hirsch

We're deploying AI agents en masse… and we're not thinking about them as identities that we need to manage.

— Jack Hirsch

You cannot get security right without getting identity right.

— Jack Hirsch

AI-enabled social engineering and insider threats (DPRK worker infiltration)Help desk compromise: MFA/password resets, voice impersonationIdentity as the primary modern threat vectorAI agents as unmanaged identities inside enterprisesContinuous session security and risk-signal sharing (SSF)Okta Cross-App Access (OAuth/OpenID) for agent permissionsT-shaped identity strategy: pre-auth, auth, post-auth lifecycle depthBuilding AI products: accelerate vs abdicate, avoid prototype-first trapsDeterministic vs non-deterministic systems in security workflowsPersonal identity protection: credit freezes, passkeys, SIM locks

High quality AI-generated summary created from speaker-labeled transcript.

Get more out of YouTube videos.

High quality summaries for YouTube videos. Accurate transcripts to search & find moments. Powered by ChatGPT & Claude AI.