AI Is the Biggest Cyber Threat — Only Okta’s AI Security Playbook can safe you

Aakash Gupta 0:00 Okta has been making huge waves. You guys probably get one of the best views into what is happening in cybersecurity out there. What are the wildest AI cybersecurity threats you have seen?

Jack Hirsch 0:12 The DPRK is basically planting workers into many of the organizations that you might be familiar with, going through full interview loops, virtual backgrounds, ship laptops, and then there are inside threats. Yeah, there's another one around help desk scenarios, people calling in saying, "I need to reset my password. I no longer have access to my corporate email." And then suddenly you've got someone that's come in through a help desk. But ultimately, it all comes down to the human element, which is always the weakest link.

Aakash Gupta 0:39 Some reports are saying cybersecurity threats are up 40% compared to last year. AI is really enabling these hackers to do more.

Jack Hirsch 0:47 Yes, I think 40% is probably a low estimate. Identity actually has become the primary threat vector. Before it was devices, networks. Now they're going after the identity.

Aakash Gupta 0:56 So what was the first moment you realized AI is gonna change security forever?

Jack Hirsch 1:01 I wrote myself a little phishing kit based on the Okta SDKs. That's when I realized if we're not careful, the wheels are gonna come off the bus.

Aakash Gupta 1:09 Really quickly, I think a crazy stat is that more than 50% of you listening are not subscribed. If you can subscribe on YouTube, follow on Apple or Spotify podcasts, my commitment to you is that we'll continue to make this content better and better. And now on to today's episode. Okta is one of the world's largest cybersecurity companies, with a market cap of $15 billion. Jack Hirsch is the product leader behind it. He leads all of Okta's core products, including their AI products. Today, we're gonna break down what you need to know about AI cybersecurity threats, how to secure yourself against them, and how to build products in this AI age. If you're somebody who's building AI products or building products, there's gonna be something for you. Jack, welcome to the podcast.

Jack Hirsch 2:01 Thanks for having me. Great to

Jack Hirsch 2:02 be here.

Aakash Gupta 2:02 Okta has been making huge waves. You guys probably get one of the best views into what is happening in cybersecurity out there. What are the wildest AI cybersecurity threats you have seen?

Jack Hirsch 2:17 That's a great place to start. Uh, I will say that the threat landscape has changed quite a bit in the past few years. Um, I think just jumping straight to the wildest, uh, I think the, the DPRK is basically planting workers, uh, into many of the organizations that you might be familiar with. Uh, and so what they're doing is going through full interview loops. They will have, you know, virtual backgrounds. They will be using, uh, AI interview tools. They will get onboarded. They will mail their devices to, uh, device farms somewhere, you know, in whatever country, whether it be the United States, places in Europe. They have places where they receive laptops, and they'll ship them over to DPRK, and then there are inside threats, uh, inside. So I think that's one, uh, very, very scary threat vector we're seeing across the industry. Um, yeah, there's another one that's also, also just as, uh, fun, not quite as nefarious, but really needs-- Uh, or I guess not quite as creative, but really needs focus, is around, uh, help desk scenarios, so things like MFA resets, right? So people calling in saying, you know, "Hi, I'm Aakash. Um, uh, I need to reset my password. Can you just go ahead and reset my password? Oh, I don't have a-- I no longer have access to my corporate email. Sign me in." You know, like, uh, "Reset my MFA, reset my password." And then suddenly you've got someone that's come in through a help desk. Oftentimes, those get really sophisticated. They will impersonate voices. Uh, they will go in via Slack. Uh, you know, there'll be threat actors that move laterally and again, use all the tools in the, like, [chuckles] we're all talking about VO for, for, uh, generating small clips of video. Uh, there are some really sophisticated threat vectors when you're combining all these, like, audio and video generation tools, voice changers, et cetera. So yeah, but ultimately, it all comes down to, uh, often it comes down to the human element, which is always the weakest link. So yeah, uh, exciting times in the world of cybersecurity.

Aakash Gupta 4:26 Yeah.

Aakash Gupta 4:27 I think some reports are saying that this year, cybersecurity threats are up 40% compared to last year. So it seems like AI is really enabling these hackers to do more.

Jack Hirsch 4:38 Yes, I think 40% is probably a low estimate by what we're seeing at Okta. Um, but I will say that, uh, one of the things that is most interesting for us at Okta is that, uh, identity is actually becoming, uh, has become over the past few years, the primary threat vector. So before it was devices, networks, and people who are attacking systems, right? Poor coding practices. Now they're going after the identity, whether that be, uh, the physical identity in a DPRK, uh, DPRK cases or digital identities. Um, so yeah, uh, identity really is the, the center of modern cybersecurity. Um, so very interesting times, exciting times to be at Okta, exciting times to be working in identity security.

Aakash Gupta 5:21 So what was the first moment you realized AI is gonna change security forever?

Jack Hirsch 5:26 Um, I, uh, I pulled up, uh, a vibe coding, a vibe coding tool. It's not one of the big ones. It was one of the, uh, you know, one of the sort of early movers and, uh, I wrote myself a little phishing kit based on the Okta SDKs. So looked like Okta, felt like Okta, and since then, uh, we actually just published a report, um, that sure enough, threat actors have figured this out themselves. Um, but yeah, that's when I realized, uh, if we're not careful, the wheels are gonna come off the bus.

Aakash Gupta 5:59 Because the vibe coding tools are crazy good at replicating any design.

Jack Hirsch 6:03 Absolutely. I mean, especially when the designs themselves, they're SDKs, right? Like, they're not, they don't necessarily have to be that good. Um, you just pick a domain name that's one or two letters off of what your, your target is. You know, you assume they're using, uh, insert your identity provider, insert your SSO provider, grab those SDKs, and start building. Um, and then it's all about finding your targets and, you know, doing the last mile social engineering to get there. But yeah, it's, uh, it's pretty wild out there.

Aakash Gupta 6:32 Being an employee is, like, scarier than ever. Like [chuckles] those little phishing tests that companies send you, they could just easily catch you now. Why can't traditional cybersecurity stop AI attacks?

Jack Hirsch 6:46 [sighs] Yeah. Um, I... The reality is, uh, traditional cybersecurity... And I think, [sighs] well, traditional cybersecurity typically focuses on a defense in depth strategy, right? There's some combination of device security, network security, and of course, identity security. Um, identity used to be considered, like, an IT thing. Like, oh, it's SSO, it's MFA, the IT folks will take care of that. It is very much a security game, uh, as of the past five, 10 years. And so, uh, the thing that needs to change is that we need to start thinking about identity as the, the final frontier and the first frontier in terms of stopping cyber threats. Uh, so I think that's probably the biggest, uh, the biggest thing to keep in mind.

Aakash Gupta 7:32 How do AI agents change the security equation?

Jack Hirsch 7:35 Uh, AI agents change the security equation in a couple different ways. Um, one is, uh, they present a threat vector in and of themselves in their capabilities, but I think more interestingly and sort of more nefariously and kind of flying under the radar is that we're deploying AI agents en masse in every single modern organization.

Aakash Gupta 7:54 Yeah.

Jack Hirsch 7:54 And we're not thinking about them as identities that we need to manage that are being granted access to critical resources inside of the organization. And so it was just, uh, just a, uh, a couple months ago, the, uh, CISO, chief information security officer, of JPMorgan Chase put out an open letter to the SaaS ecosystem, basically calling out SaaS vendors for not taking this seriously. And there was a h- there was a hint that AI agents was, were just making this worse.

Aakash Gupta 8:22 Mm.

Jack Hirsch 8:22 Uh, this idea that we're collapsing authentication and authorization. We're taking these AI agents, we're bringing them into our corporate boundaries, we're giving them unfettered access to our customer data, our user data, uh, and frankly, with, with little control, little visibility, little oversight, uh, little security. And so I think that is probably the most clear and present danger today. Um, there's obviously, you know, external AI agent threats to modern organizations, but I think the, the real, the real scariest thing is the fact that security teams and IT teams don't wanna be hindering their organization's adoption of AI tools, so they have to let them in, right? The business always wins, and security is always playing catch-up, frankly.

Aakash Gupta 9:06 [laughs]

Jack Hirsch 9:06 And so the unfortunate thing there is that, uh, oftentimes those things are, uh, potentially doing nefarious things, whether the users like them to or not. So that's, uh, that's probably the biggest issue.

Aakash Gupta 9:17 AI agents and MCP, I feel like people have been at least talking about security in the circles I come to. What are the underrated things? What are the security threats that nobody is talking about within AI that they should be?

Jack Hirsch 9:29 AI, MCP, normal security threats, what else is there outside but still AI-adjacent security threats?

Aakash Gupta 9:35 Exactly.

Jack Hirsch 9:36 Okay.

Aakash Gupta 9:36 That nobody's talking about, but they should be.

Jack Hirsch 9:38 Great. Um, well, I think as context windows are getting bigger and bigger, you can just slurp in an entire, uh, API surface and look for various combinent- combinations of access patterns and look to go in, you know, what used to be the hard way, used to be someone had to be, uh, very, very smart, keep a lot of context in their head, understand how, uh, different access functions at an API surface, uh, uh, uh, fundamentally function.

Aakash Gupta 10:09 Yeah.

Jack Hirsch 10:09 And then now you can just jam that all in an LLM, tell it that you want in, tell the agent to go, and they will go. Um, and so I think, uh, uh, if you, if you think about how APIs get built at large organizations in API security, there are dozens, hundreds of teams that are building various bits and pieces of API surface. How often are they actually cross-checking different, uh, uh, different access patterns across those teams, right? Everyone is so siloed. AI is not siloed. AI will take it all in. AI will find the vulnerabilities and will go after them very, very easily.

Aakash Gupta 10:48 Mm.

Jack Hirsch 10:49 So, uh, and that you do not have to be a sophisticated actor to go after those. So I think, uh, especially a lot of the vibe coded tools that are out there, uh, on the market, this is, uh... I, I would recommend you build some sort of, um, uh, you know, red teaming concept LLM and turn it loose on whatever application you're vibe coding, especially if you're bringing any sort of sensitive information into it.

Aakash Gupta 11:13 Mm.

Aakash Gupta 11:14 I like that. So is the state-of-the-art then to basically ha- train an LLM to red team against you and act as that agent so that you can follow those threat vectors?

Jack Hirsch 11:26 I mean, I don't know about state-of-the-art necessarily, but I feel like w- I would be remiss if I didn't recommend people do that, right?

Aakash Gupta 11:31 Yeah.

Jack Hirsch 11:32 I mean, you think about, uh, a really m- robust software development life cycle, you're definitely having security review things before they go out the door.

Aakash Gupta 11:40 Yeah.

Jack Hirsch 11:41 If you don't have a security team, what are you gonna do, right? Uh, we all talk about having these AI board of advisors, right? Well, think about your software development life cycle. Who are the, what are the personas that you want involved in that life cycle? You might have a legal review, I don't know. Uh, but you definitely want a security review, and so training an LLM to review the code that you're publishing. There's so many, uh, like every second day, every second hour, I should say, there's a story about some vibe coded app getting hacked.

Aakash Gupta 12:09 Yeah.

Jack Hirsch 12:09 Um, andFrankly, all of that me- much of that could have been, uh, dealt with if you just would've, you know, thought adversarially for a beat before you pushed it out.

Aakash Gupta 12:21 Nice. I like that. So as you're pushing these things out, add that adversarial beat in, just like you would've if you weren't vibe coding it. So there's so many other AI threat vectors we haven't even talked about yet, right? AI-generated identities, deepfakes, synthetic fraud. What of these are the most dangerous, and why?

Jack Hirsch 12:42 Um, deepfakes are very, very dangerous, I think, on a human level. I think we're seeing, um, I saw Pennsylvania state senator, I think, speaking about how his physical identity was compromised, um, because of a deepfake, right?

Aakash Gupta 12:57 Wow.

Jack Hirsch 12:57 Um, people are... And this is, this is pretty com- I mean, not pretty common, but I think this is, this is made at and out of the sort of technosphere and into the general news cycle, where you'll have, uh, I think, I think the, the person in question I'm thinking about, uh, their son had some, uh, YouTube recordings up. And so they scraped the son's YouTube, uh, grabbed a bunch of their audio, faked their audio, called their dad, who happened to be a Pennsylvania s- I believe a Pennsylvania state senator, we should check this afterwards, um, and basically said, "Hey, I'm in jail. Uh, [laughs] help me get out. I need, you know, need money." And it was a real-time conversation that they had with their son. Uh, and so, uh, I think those things, when you extrapolate them out into the software world, like, yeah, I might, if I were a help desk representative and I got a call from the CEO, I might reset the CEO's password if the CEO called me and said, "Hey, I need you to reset my password. I'm locked out."

Aakash Gupta 13:56 Yeah.

Jack Hirsch 13:56 Uh, that's a really easy way into an organization, unfortunately. Uh, and so in the security, in security circles, um, locking down those critical access flows from support desks, that's a, a also a major area of focus.

Aakash Gupta 14:12 Crazy. So hopefully people got the picture, right?

Aakash Gupta 14:16 AI cybersecurity, if you haven't been hearing about it on the news yet, you should be, because it's a serious, serious issue. You guys are at the center of this all. You need to secure your own systems from these types of crazy attacks we've just been talking about. What is your own AI threat detection system? Walk us through it.

Jack Hirsch 14:36 So, uh, actually I'll, I'll maybe take this in two angles. One is the same, uh, threat vectors, uh, of, you know, credential stuffing, M- like push bombing MFAs. So like basically sending MFA pushes through some phishing site over and over and over again until a user relents and just says, "Okay." Like, we need to guard against that. And so at Okta, we have bot detection, fraud detection built into the standard auth flows.

Aakash Gupta 15:03 Mm-hmm.

Jack Hirsch 15:04 And that's evolved quite a bit. It's taking in a bunch of new signal types. Uh, but that is sort of business as usual, I would say. It's just evolving with the times. The second part, which I think is actually more interesting, frankly, is the assumption now that identities are effectively compromised. Everyone's identity is compromised.

Aakash Gupta 15:23 Mm.

Jack Hirsch 15:23 Um, I think the stat that I last saw was somewhere between two and four billion credentials and session tokens and cookies were stolen just in the past year.

Aakash Gupta 15:32 Wow.

Jack Hirsch 15:33 And I think that was just from the Fortune 1000 alone, which is where they were able to get the data. So if you think about this, the front door is wide open, right? So you need to ready your defenses. So we used to say, you know, in an enterprise context, "Oh, it's all about SSO and MFA and securing the point of access." Well, we've all had that experience where you're MFA-ing over and over and over again, and it's exhausting, right? You're getting like, oh, if you're at work, you're, okay, single sign-on into Slack, single sign-on to Teams, single sign-on to this, single sign-on to that. Um, that's exhausting. And then over time, you know, those, like, mission critical systems, if you're in a finance system, they might force you to reauth every few hours or once a day. It's exhausting. So how do you maintain that session security over time? Because that session security naturally degrades over time, right? You create the session, you cut the cookie, create the token. Just by the very fact that that thing exists out in the wild means that there's more likelihood that someone's gonna compromise that, right? And so a huge area of focus for us at Okta has been, how do we maintain session security over time while keeping the user experience, you know, as good or better, uh, than, you know, pushing MFA all the time?

Aakash Gupta 16:45 Yeah.

Jack Hirsch 16:46 Uh, and so we've taken an approach of, uh, so Okta, you know, this is not about Okta, but I think in general, the open ecosystem approach, which we're huge fans of, uh, we have an open ecosystem approach using open standards like Shared Signals Framework, uh, which is effectively, uh, security vendors will share risk signals with each other. So for example, CrowdStrike or Zscaler or Palo Alto Networks will share a risk signal on behalf of Akashi and say like, "Hey, your identity may have been compromised, but CrowdStrike may have detected it."

Aakash Gupta 17:16 Mm.

Jack Hirsch 17:16 So what remediations can we take on the identity side, uh, to be complementary to device or network security, right? Uh, and so I think how we do that in a seamless way, that's been really, really exciting. So maintaining that session security over time. And as an end user, I think we don't, we don't think about it because ideally, the, the, uh, the ideal experience is you're not MFA-ing all the time. You're just seeing continuous access.And what's happening in the background is we're continuously reverifying all of the signal that we have about you. Has your device posture changed? Has your network environment changed? Have you immediately magically traveled around the world to Azerbaijan, you know, in one step? Like, and did we recognize that? We would, we have first-party detections. Did a third party recognize that? And how we orchestrate remediation around the security ecosystem, that's been, uh, probably the second area of focus, and I think that's new as of the past

Jack Hirsch 18:10 couple of years.

Aakash Gupta 18:10 Today's episode is brought to you by Amplitude. Replays of mobile user engagement are critical to building better products and experiences. But many session replay tools don't capture the full picture. Some tools take screenshots every second, leading to choppy replays and high storage costs from enormous capture sizes. Others use wireframes, but key moments go missing, creating gaps in your understanding. Neither approach gives you a truly mobile experience. Amplitude does things differently. Their mobile replays capture the full experience, every tap, every scroll, and every gesture, with no lag and no performance hit. It's the most accurate way to understand mobile behavior. See the full story with Amplitude. AI evals are one of the most important skills for PMs, and I know you know they matter. The question is, are you doing them right? Most teams are winging it with basic metrics and hoping for the best. Meanwhile, the teams that actually ship reliable AI, they've cracked the code on systematic evaluation. Today's episode is brought to you by the AI Evals for Engineers and PMs course by Hamel Hussain and Shreya Shankar. This live Maven course will teach you the battle-tested frameworks from Hamel and Shreya, who are the engineers behind GitHub Copilot's evaluation system and 25-plus production AI implementations. Four weeks, live instruction. Next cohort starts July 21st. Start shipping AI that actually works. Enroll at maven.com with my code AG-PRODUCT-GROWTH for over $800 off. That's AG-PRODUCT-GROWTH.

Aakash Gupta 19:50 So for customers, what's in Okta's AI Security Playbook? Give us the secret sauce.

Jack Hirsch 19:55 Oh, uh, that is actually really exciting. So we've got some, some new things in the works, uh, that we have not yet officially unveiled, but I would love to share with you.

Aakash Gupta 20:05 Ooh.

Jack Hirsch 20:06 Um, so, uh, we are in the month, uh, so early in August, uh, we announced a, uh, a new technology with the OpenID, uh, basically as part of our, the, the OAuth standard that we call cross-app access. So what this is, is a way to allow an AI agent to request access to a resource inside the organization through the central identity provider.

Aakash Gupta 20:34 Mm.

Jack Hirsch 20:34 So what this means is practically imagine, like, the, uh, the Claude 4.1 launch video had, uh, someone asking a question of Claude and it reaching out to Gmail, Google Calendar, Asana, all of those things. Imagine starting your workday, uh, as an employee of Acme Corp, and you're day one, right, employee of Acme Corp, and you sign into Claude, your AI agent companion, and it immediately has access to all of your, you know, uh, Google Workspace, your Asana, your Slack, your, you know, Salesforce, all of the things that you need to be productive, it's all wired in immediately. That should be the end user experience. Now, the difference is today, if you were to do that, you're doing an OAuth dance. Every user is doing an OAuth dance. You say, "Oh, you wanna connect Claude to Gmail? Sure, do an OAuth dance. Oh, you wanna connect Claude to Asana? Do an OAuth dance." Imagine spraying that out to thousands of employees or hun- you know, tens of thousands of employees at the largest organizations in the world. So we don't want our customers to go through that. We want our customers to have that elegant experience where all their users just sign in and they start using their AI agents, and they're augmented immediately. So that's the, that's what we're, we're going for. And so I think from, you know, our, our customers at Okta, generally security and IT practitioners. So for them, the benefit they get is they get visibility into all the agents that are deployed in their enterprise.

Aakash Gupta 22:06 Mm.

Jack Hirsch 22:07 They get the ability to control with a very granular access. These users might be able to connect Claude just to these applications

Jack Hirsch 22:15 over here, but these other users, they might be privileged. They can connect Claude to a bunch of other services over here. So they get that granular level of control. They get to manage the lifecycle of those AI agents. So I think that's a huge area of investment for us at Okta right now.

Aakash Gupta 22:30 Mm. [lips smack] So in June of this year, you spoke with Gartner. You broke down T-shaped identity strategies, which I think are deep AI for threats and broad for security. Can you break this down?

Jack Hirsch 22:41 Yeah. Uh, so this is part of one of the sort of mega trends in identity security these days. Uh, we used to think, again, about identity as being the point of a- auth, right? Secure auth. Well, it turns out that there's a whole user lifecycle, so that the top of the T is before auth, what do we do to make sure that you're gonna have the right level of access to the right things at the right time, no more, no less, and that's it. And that, all that happens before you ever hit a sign-in box. And then when you go to auth, how can we make it phishing-resistant? How can we guarantee that phishing resistance regardless of what device you're using, whether it be a Mac or a PC, iOS, Android, whether you're on a managed device, unmanaged device, all of that needs to be phishing-resistant, um, and controlled by the organization. And then a- again, the, the last part of the T is how you maintain that session security over time.

Aakash Gupta 23:35 Mm.

Jack Hirsch 23:35 So again, as we talked about, session security degrades over time, so how do we maintain that session security without, uh, wi- without dropping the, you know, the dreaded MFA, MFA, MFA-

Aakash Gupta 23:47 [chuckles]

Jack Hirsch 23:47 ... um, you know, continuously. And then the, the sort of base of the T... is about not just having, uh, so identity used to be thought of as, again, SSO.

Aakash Gupta 23:58 Yeah.

Jack Hirsch 23:58 Now it's so much more. It's managing the user's life cycle, so joiners and movers and leavers. Like, you know, Jack changed teams. Does he have access to the right tools when he changed teams, right? All of those, all of those types of integrations, those are lifecycle management integrations. There's an open standard called SCIM that manages those lifecycle changes. Then it's how do you share risk signals, for example, with, uh, security, with other security vendors or tooling. There's actually, uh, tooling on both of our devices right now that will share risk signals back with Okta using an open standard.

Aakash Gupta 24:33 Mm.

Jack Hirsch 24:33 Right? So, uh, not just SSO and MFA and lifecycle management and risk signal sharing, but then session termination is another one. So it's how deep you go in those integrations. So sess- session termination would be like, uh, let's say we discover that your identity's been compromised. Oh, no. Uh, someone stole a credential off of your device and is replaying it. I don't know why I wanna pick on Azerbaijan, but, uh-

Aakash Gupta 24:57 [laughs]

Jack Hirsch 24:57 ... it's fun to say, and so I'll pick on them. But say, like, there's someone else, there's a threat actor replaying your session elsewhere. How do we terminate your session, not just at the IDP, not just at Okta or on Entra or on Ping or wherever, but in all the downstream applications so that you get signed out of Slack and Zoom and, uh, Salesforce and, and then your device logs you out as well. So how do we shut down access all at once? So that's way more than just the moment of auth. It's maintaining security through that entire end user's lifecycle and having a depth of integration, uh, that goes way beyond SSO and MFA.

Aakash Gupta 25:39 Mm-hmm.

Jack Hirsch 25:39 Uh, and so that's, that's fundamentally what's needed, and that means that you can detect risks, you can respond to them in an automated way, you can remediate them. Uh, and so again, you know, the moment we discover that I'm not actually sitting across from you and it's actually a DPRK threat actor-

Aakash Gupta 25:55 [laughs]

Jack Hirsch 25:55 ... uh, you know, we can terminate this, uh, this interview immediately.

Aakash Gupta 25:57 Oh, very interesting.

Jack Hirsch 25:58 So that's, that's the, yeah, maybe the analogy.

Aakash Gupta 26:01 So before we close this Okta section here, how many AI-powered attacks do you reckon Okta is stopping per day, and your success rate?

Jack Hirsch 26:09 Oh, goodness. Um, this, I'd actually wanna check with our security team on this. I, I'm worried about drastically undershooting-

Aakash Gupta 26:17 [laughs]

Jack Hirsch 26:17 ... because I'm gonna use an M in front of the illion and not a B.

Aakash Gupta 26:20 Oh.

Jack Hirsch 26:21 Um, but it's, it's of that scale.

Aakash Gupta 26:23 Wow.

Jack Hirsch 26:24 Um, and so when you think about it, Okta's doing tens of millions of logins a month, right? We are, Okta is so big, and this is actually one of the things that, you know, we can talk, talk about if we get into product management as a discipline and sort of the ecosystem. We see macroeconomic trends in our data, right? We are so big that that's,

Jack Hirsch 26:42 we see that sort, those sort of moves.

Aakash Gupta 26:44 Yeah.

Jack Hirsch 26:44 Right? And so yes, absolutely, we're seeing a significant amount of AI-powered attacks, uh, across the Okta product suite.

Aakash Gupta 26:52 Crazy. So let's move into the playbook for any company.

Jack Hirsch 26:55 Sure.

Aakash Gupta 26:56 What's one thing every company should do this year to protect themselves from AI-enabled threats?

Jack Hirsch 27:02 Number one, you cannot get security right without getting identity right. Um, this is not about, this is not a pitch or a plea for Okta. This is, uh, I guess a plea for every organization to make sure that their users are protected. Um, again, threat actors today, the vast majority, over 80% of threat of, uh, breaches stem from some form of attack on identity.

Aakash Gupta 27:27 Yeah.

Jack Hirsch 27:28 And so what that means is every organization needs to get their identity security in order. Um, it's no longer just enough to have SSO. It's definitely not. It's not enough to just have MFA. It's not just enough to have phishing-resistant MFA. It's not enough to have... You know, you need to have that continuous session security, or else you're gonna continue to have those, uh, a- you know, long-lived, uh, session threats.

Aakash Gupta 27:50 Mm.

Jack Hirsch 27:51 We need, you know, you need to close down support desk and make sure that all of those acts are, are the, those actions that the s- those support folks can take is logged and controlled. So all of that is to say is you can't get security right if, uh, if you don't get identity right.

Aakash Gupta 28:05 Mm.

Jack Hirsch 28:06 Um, that's, that's the number one thing.

Aakash Gupta 28:09 What are the biggest mistakes companies are making when trying to AI-proof their security?

Jack Hirsch 28:14 I think assuming that there's gonna be a, a singular solution, frankly. Um, and I think that we've been, you know, we're trained to think about... And when I say singular solution, there are these, like, monolithic, or let's call it microlithic platforms, uh, up, up in, uh, Washington, based in Washington, that, uh, will say, oh, they'll, they'll keep you secure.

Aakash Gupta 28:39 Mm.

Jack Hirsch 28:40 But they'll keep you secure when you're using products in their ecosystem, right? That's their, that's their commercial incentive, right?

Aakash Gupta 28:47 Yeah.

Jack Hirsch 28:47 Is to keep, keep their, their customers safe. And they wanna say, "Oh, if you use something outside of our ecosystem, that's scary. You don't wanna do that." Uh, and then at the same time, you know, the best-of-breed world has had a bit of a reckoning too, right? So if you say, oh, well, I'll, I'll take, again, the identity space. Identity and access management used to be thought of as a totally different market than identity governance, totally different market than privileged access management. All of those markets are converging, and so there's the platformification around all these security vendors. So I think a, another big area of focus here needs to be on making sure that you're investing in your primary security, uh, primary security clouds wisely, and I think identity definitely deserves to be in there. I also think, uh, frankly, network, you know, you need a defense in depth, device strategy. All of these things need to be thought through. Um, yeah.

Aakash Gupta 29:43 What's the right stage to really just take... Like, when do you need to take a really close look at how AI-proofed your security is? Is that any stage company? Is there a certain stage you need to reach?

Jack Hirsch 29:59 I think anytime you have something to lose.

Aakash Gupta 30:00 Hmm.

Jack Hirsch 30:01 So I'll, uh, this was not... So, uh, many, many years ago, I worked for a company called Evernote.

Aakash Gupta 30:08 Hmm.

Jack Hirsch 30:09 Evernote famously had a breach where a bunch of, uh, usernames and password, uh, hash, salted hash passwords, uh, were released. Um, and that really, that was a huge catalyst for the, uh, I wouldn't say demise, but definitely, like they're not considered a winner by any, you know, by Silicon Valley standards at this point.

Aakash Gupta 30:34 Yeah.

Jack Hirsch 30:34 And so they had a lot to lose. Um, and the threat vector there that I, I don't know if it's been disclosed, but years later, I'm pretty sure statute of limitations has expired, but, like that was related to very similar to a help desk attack, right? That was an identity-based attack that eventually-

Aakash Gupta 30:51 Oh

Jack Hirsch 30:51 ... got a threat actor in, [lips smack] uh, and was able to push code to production to exfiltrate that data. And so, uh, yeah, I mean, I think, you know, in terms of to answer your question very directly, as soon as you have something to lose, um, if users are using normal credentials to get access to production systems, um, and they're just using a username and password, that should be a huge red flag. They need to be using phishing-resistant authentication. Every single system that that user uses, they are now a privileged user. Every single system that that user use- uses needs to be phishing resistant, needs to have risk signal sharing on, needs to have continuous, uh, continuous session monitoring. Um, yeah, because, uh, it is, it is way too easy to hit one of those missteps and lose

Jack Hirsch 31:37 it all.

Aakash Gupta 31:37 Today's episode is brought to you by the AI PM Certification on Maven. Run by Miqdad Jaffer, who is a product leader at OpenAI, this is not your typical course. It's eight weeks of live cohort-based learning with a leader at one of the top companies in tech. OpenAI just doesn't stop shipping, and this is your chance to learn how. Run along with product faculty and Mo Ali, the course has a 4.9 rating with 133 reviews. Former students come from companies like OpenAI, Shopify, Stripe, Google, and Meta. The best part? Your company can probably cover the cost. So if you want to get $500 off, use my code AAKASH25 and head to maven.com/product-faculty. That's M-A-V-E-N.com/P-R-O-D-U-C-T-F-A-C-U-L-T-Y. Today's episode is brought to you by the experimentation platform Kameleoon. Nine out of 10 companies that see themselves as industry leaders and expect to grow this year say experimentation is critical to their business. But most companies still fail at it. Why? Because most experiments require too much developer involvement. Kameleoon handles experimentation differently. It enables product and growth teams to create and test prototypes in minutes with prompt-based experimentation. You describe what you want, Kameleoon builds a variation of your webpage, lets you target a cohort of users, choose KPIs, and runs the experiment for you. Prompt-based experimentation makes what used to take days of developer time turn into minutes. Try prompt-based experimentation on your own web apps. Visit kameleoon.com/prompt to join the waitlist. That's K-A-M-E-L-E-O-O-N.com/prompt.

Aakash Gupta 33:16 So everybody needs to do it. So then walk us through your playbook that, like for those companies that don't have security professionals, how should they be evaluating if their current security can handle AI threats?

Jack Hirsch 33:27 I think f- uh, so first off, um, AI threats in general, it's, uh, there's any number of different market segments and categories, right? Are you trying to secure your software, the software that you're actually building? Are you trying to secure your network perimeter, your boundary, if you're running a physical operation? Uh, are you trying to, uh, secure your devices? So really it, it's gonna depend on the type of organization that you're, you're running.

Aakash Gupta 33:52 Yeah.

Jack Hirsch 33:53 But I think all of that diversity of, of types of organizations means that there's only one constant. It's identity. And I hate to say this coming from Okta, a- as the world's leading independent neutral identity vendor, but like fundamentally, identity is central to security. And so you can't get it right. Uh, you cannot get security right without getting identity right. So the, the way that I would start, frankly, is making sure that identity security is locked down.

Aakash Gupta 34:17 Hmm.

Jack Hirsch 34:18 Um, I think it's, at this point, we no longer... Most organizations, most startups, I would imagine most of your viewers, they're not gonna be working from a SKIF, you know, for the DoD, right? They're gonna be sitting in a room like this, maybe not with the microphones and lights, but they're gonna be working together on something that they think is gonna be cool and change the world.

Aakash Gupta 34:37 Yeah.

Jack Hirsch 34:37 And that's awesome, and they should do that, but as soon as you have something to lose, get that identity security down right, because then you're gonna have other people. You might have contractors. You might be using, you know, uh, you might be using contracting platforms to give other people access to various parts of your ecosystem. How do you secure their access? How do you make sure that, uh, they have access to the right things only, right? So maybe it's really easy if you have Google Workspace and you're just giving them access to one or two docs, and they have their own domain, but as soon as you need to bring them into your trusted boundary, say they're labeling your A, you know, they're labeling your data for AI, they're working in your code base, they're working in your design base, they're, uh, a guest member in your Google Workspace, um, that's when it starts to get very, very real, and those things happen very quickly as you're scaling, right? You always, you're gonna end up bringing contractors, consultants, business partners. They come in very, very quickly, and making sure that they have the right access, uh, fundamentally is an identity challenge.

Aakash Gupta 35:41 And for people who don't truly grok what's going, what you're saying here, basically you're saying that you should have the login for these systems go through an identity portal like Okta, which is identifying do they actually have access to this? Are they getting the right access? And did I understand that correctly?

Jack Hirsch 35:57 That's exactly right. So, you know, fundamentally when people think about Okta, it's like, oh, it's, it's a single sign-on, right? You sign on once with one set of credentials, and I get access to all my work tools. That's, that's sort of where Okta started 10, 15 years ago, and now, if you're, sorry, 15, 17 years ago. But now-Identity is so much more than that. Uh, it can't just be that. It can't just be that login box. So that's a simple enabler of IT productivity. But then it's, it's all the security stuff that we were talking about, that's, that's the, the key driver right now. So as soon as you start exposing any part of your ecosystem and bringing users into your safe boundary-

Aakash Gupta 36:38 Mm

Jack Hirsch 36:38 ... that's when identity becomes critical. Because ultimately, I might be using a devi- you know, if, if you're starting a company and I'm a contractor, I might be using a device that you give me. Chances are I'm using my device. Do you know if I have malware on my device? Do you know if I'm a malicious actor? How are you logging what's happening, you know, in your ecosystem? Identity is that, the first and last fence when you don't have network control. If you go work at, you know, any of the largest organizations in your, in the world, you're gonna be using a VPN on your device. So they know that you're gonna be inside a trusted network boundary. You can't do that as a startup, right? You're not gonna do that as a startup. Same thing like, ooh, there's gonna be device management on your device. That means they're gonna put a binary on your device, and they're gonna be monitoring everything that you're doing. They're gonna be controlling what websites you go to so that you're not gonna download that malware that's gonna expose all of their corporate systems. As you're building, you don't have that.

Aakash Gupta 37:35 Yeah.

Jack Hirsch 37:35 Right? And so fundamentally, all you have is making sure the right users get access to the right thing at the right time, and that's it.

Aakash Gupta 37:42 Mm-hmm.

Jack Hirsch 37:43 So, uh, yeah, if I had one easy button for someone starting up or thinking about their security posture and their step one, it's identity, identity, identity. That's it.

Aakash Gupta 37:56 What AI security threat is coming in the next few years that companies aren't preparing for?

Jack Hirsch 38:02 Pass. [both laughing] Um, no, legitimately, I, I honestly... There is so much in flux right now that it is, it is hard to see around the bend.

Aakash Gupta 38:16 Yeah.

Jack Hirsch 38:16 I think we are-- So that message of, uh, you know, and you choose to use this or not for the-

Aakash Gupta 38:24 Mm-hmm

Jack Hirsch 38:24 ... the podcast, but fundamentally, most organizations have not done the basics, and that's not to, like, shame most of- Like, every, every organization of any consequence has breaches. Spoiler alert, everyone gets breached.

Aakash Gupta 38:39 Mm.

Jack Hirsch 38:40 Now, it's how you detect it, how fast you respond, what your internal and public responses are to that, that, that separate. Like, you know, again, I, I don't wanna pick on competitors here, but like, uh, or pick on anyone in the security space 'cause everyone gets punched in the nose. Heck, Okta got punched in the nose a couple years ago. Um, and so you just have to assume that, that that is going to happen, and there are gonna be new vectors that come up. And so securing thing, like discovering your service accounts, so if you have, like, standing credentials, you know, and you're building an app, you're using N8N internally, and you're orchestrating a bunch of things, but you, you grab those credentials to your Salesforce, and that's where all your customer data or your CRM, where all your user data is, and you hand that off to N8N, and it's just sitting there as a static credential, that's a breach vector.

Aakash Gupta 39:25 Mm.

Jack Hirsch 39:25 That means that there's a static credential that probably no one is watching. And so you're not putting that in a system where it's locked, where it's being rotated automatically, um, so that if it does get leaked, that it won't be actually be used for, uh, nefarious purposes. So there's all these, like, basics that need to be done in most organizations where like, yeah, the threat vectors will continue to evolve. But if we're as, you know, if we are not evolving our security posture as modern organizations, the basics are gonna be the thing that trip us up, not the novel AI-driven, you know, threat vector. It's all identity, identity, identity. Again, 80% today, it was 80% last year, it was 80% the year before.

Aakash Gupta 40:08 Wow.

Jack Hirsch 40:09 Um, so again, security identity, everything else, everything can be secondary after that, and I think that will be a, a really good way to future-proof yourself.

Aakash Gupta 40:19 Okay. So we talked a lot about security. We have one last angle on security, which is building AI secure products. How has AI changed how you build products at Okta, and what are your AI security principles?

Jack Hirsch 40:32 There's sort of two ways to answer this. One is the products that we're, we're building and delivering for our customers, and the other one is how we build products in the age of AI. And I will start with how we're delivering AI products to our customers.

Aakash Gupta 40:45 Mm.

Jack Hirsch 40:45 I think, uh, we basically made the ter- determination that there are two categories of AI products for our customers. Uh, the first are essential AI services. This is what we were talking about earlier, blocking bot attacks, right? Catching credential stuffing, catching MFA bombing, those sorts of things, we don't wanna turn that off. We can't turn that off and keep the system up. It's like, it's like, uh, turning off DDoS protection. Like, we're not gonna do it, right? And so that is just part of keeping our service healthy. We run multi-tenant SaaS. If you get, uh, if you get taken down, there might be collateral damage. If someone is DDoSing you, they might, you know, have collateral damage on other tenants in that environment. Um, so we don't wanna shut that down, and that keeps us safe, that keeps all of our customers safe, and those are essential AI services. Now, there's the other tier, which are discretionary. Those are things like, "Hey, we're using an LLM to summarize how did you get access to the thing you had access to when your identity was compromised?" Or when we're doing a, an access review to make sure that, "Oh, you, you, you have access to the, uh, special, super secret Asana finance, uh, uh, Asana finance, uh, uh, workflow. Y- how did you get access to that?" Well, we probably want an LLM to summarize that because there's probably umpteen checkpoints that you went through, and I don't know. I'm, I'm just making, making the, the access mechanism up. But we wanna summarize how you got access with an LLM. That's discretionary. We can give you the raw log output, and you can have at it.Uh, if you don't want any part of your data processed by an LLM. So we give our customers the control to either opt in or opt out. So if they're buy- and, and it can be either opt in or opt out, frankly. So, like, if you're buying a, a product or a SKU from us, we assume you're opting in. If you don't want that functionality, you don't have to buy the product. Um, but if it comes by default out of the, you know, it comes by default out of the, uh, out of the box, we're gonna let our customers turn that off. So for those discretionary services, we wanna make sure we give ultimate control to our customers. Uh, we wanna make sure... I mean, we work in, you know, [chuckles] global supply chain logistics trust us with FedEx.

Aakash Gupta 43:01 Mm-hmm.

Jack Hirsch 43:01 The Department of Defense trusts Okta. So we are working... There are healthcare systems that are running on Okta, and so we need to make sure that in whatever regulatory environment, whatever security environment, we're doing the best we can to protect our customers and make sure that they're operating like they want to, so we gotta give our con- uh, that control to our customers.

Aakash Gupta 43:21 Hmm. I just wanted to cover, like, if some people wanna build, like, we just hyped up AI so much, AI threats, so as a PM or as a product builder, what are the things you need to be thinking about to make sure that your product's AI secure?

Jack Hirsch 43:35 Oh. Uh, well then, uh, I think the first thing I would do, uh, is look into the new OAuth standard that's coming out, which is Cross-App Access.

Aakash Gupta 43:45 Yeah.

Jack Hirsch 43:45 And so I would imagine that a significant portion of your audience is building B2B SaaS, is that right?

Aakash Gupta 43:50 Yeah, 100%.

Jack Hirsch 43:51 Okay.

Aakash Gupta 43:51 More than 50%, actually. [chuckles]

Jack Hirsch 43:52 Great. Uh, okay. 150 or above 50%, either way.

Aakash Gupta 43:55 Yeah, above 50 is what I meant.

Jack Hirsch 43:56 Excellent, excellent. So, uh, if you are trying to deploy software inside of a modern enterprise, use the security capabilities that are available to you to become enterprise-ready.

Aakash Gupta 44:07 Yep.

Jack Hirsch 44:07 So, uh, a year ago we announced a, a standard with the OpenID Foundation we called IPSI. Uh, the Interoperability Profile for Secure Identity in the Enterprise, but no o- no one cares about the, the, the acronym is what matters. And it's literally just make sure your app supports SSO. Make sure your app supports lifecycle management so users can be deprovision, you know, provisioned on day one, deprovisioned on their last day, so you don't have random user accounts floating around in your critical systems. It's very ba- very, very basic, like, things like that.

Aakash Gupta 44:39 Yeah.

Jack Hirsch 44:39 And then with Cross-App Access, make sure that when you're deploying into an enterprise, especially if you're building an AI agent, you should not be tapping all of those users for OAuth grants to every single downstream app they want.

Aakash Gupta 44:52 Okay.

Jack Hirsch 44:52 Right? So I'll, uh... Actually, let's, let's use n8n as an example.

Aakash Gupta 44:57 Yeah.

Jack Hirsch 44:57 So let's say that you are deploying n8n into an enterprise, right? There are two different ways you could go about doing that. One is, like, min bar access, where you say n8n has access to just, like, the corporate help desk content, right? So I wanna use this as, like, a help desk, uh, deflection tool. Well, that's not super secure content. Everyone in the organization is gonna have the same level of access. There's nothing novel that's gonna differ between your access and my access. But that's not gonna change the world. That's not gonna change how people work. What you really want is something, especially when you think about MCP and agent-to-agent access and agent-to-resource access, you want something that is gonna know, like, if you're deploying an AI agent, that is gonna know that you're you and I'm me, and we each have different levels of access. And so that's what Cross-App Access does, is it gives the enterprise the ability to say, "Hey, the, uh, security admins get access to all of these applications here," and your AI agent or your application that you're building gets access to those. So this works for AI agents, it works for to-do apps, wiki apps, knowledge management apps. Uh, and so the same way that you wanna just, like, basically, uh, provision access by using that OAuth standard-

Aakash Gupta 46:12 Yeah

Jack Hirsch 46:13 ... uh, of Cross-App Access, that is going to give the enterprise visibility and control over those OAuth grants so that your users don't have to do it, and it's gonna smooth out the delivery into any modern enterprise, uh, going forward. So there's an adoption game there. Don't get me wrong, like, it's gonna take a year or two for, for that to get adopted. But if you go to websites like Enterprise Ready and you're looking at, like, the spec sheet of stuff they have where it's like SOC 2 and, you know, oh, you must support SSO, obviously you wanna support SSO. You definitely wanna support provisioning. But I think

Jack Hirsch 46:47 getting the security story straight, it will be a, an incredible unblocker to get you into any business, small or big.

Aakash Gupta 46:55 Security, we talked about it. It was the whole first half of the podcast. Now I wanna move into building products.

Jack Hirsch 47:00 Sure.

Aakash Gupta 47:02 So you lead the AI products that are being built at Okta. What are the fundamental principles you guys are following? How are you guys building AI product at Okta?

Jack Hirsch 47:11 Maybe I'll just talk about how we build using AI-

Aakash Gupta 47:14 Mm

Jack Hirsch 47:15 ... and some principles there. Um, 'cause I think, I think that's actually almost more interesting, the AI products. We talked a lot about identity. I think it's sort of how we build, which is interesting-

Aakash Gupta 47:24 Yeah

Jack Hirsch 47:24 ... and kind of the secret sauce. I think there are three principles or a few principles, and I'll just name three of them. Like, the first one is just use AI to accelerate, not abdicate responsibility.

Aakash Gupta 47:34 Mm.

Jack Hirsch 47:34 So acceleration over abdication. I think that's, that's one. Um, two is don't forget your PM fundamentals. Jumping to prototypes oftentimes leads us to solution... like jumping to solutions without really deeply understanding the problem.

Aakash Gupta 47:48 Yeah.

Jack Hirsch 47:49 And so I think that's two. And then three is, like, be aware that we're in an AI hype cycle and don't fall victim to it, right? Really focus on problems. Really focus on customer problems, on user pain points, and that will always lead the way to great products. So, uh, well, we can, we can go through this. So, like, on the acceleration, not abdication, everyone should be using AI to be better at their job, regardless of their function. Today, if you're not using AI, you are being left behind, full stop.But that doesn't mean that you wanna abdicate 100% of your responsibility. Like, I imagine that many of the people that are watching, watching this or listening to this, they are looking for ways to be better, and there's a temptation to effectively outsource your entire role to the best prompt you've ever created and the best conversation in your million token context window. Don't do that. That's terrible. Like, that's not why, that's not why you were hired, right?

Aakash Gupta 48:46 Yeah.

Jack Hirsch 48:46 You were hired because... You know, maybe use AI to get you 80% of the way there.

Aakash Gupta 48:50 Yep.

Jack Hirsch 48:51 But use your own intellect and your own creativity to hone the last 20%, because that's the difference between, like, you know, original LLM output that's super anodyne and magical content that really helps you, you know, visualize the outcome you want, that feels like you've already had the sparring partner. Um, I've had really wonderful examples of when we didn't do that, uh, we, we, we didn't- we abdicated too much responsibility. And I, I won't call those PMs out here, obviously.

Aakash Gupta 49:23 [laughs]

Jack Hirsch 49:23 But, uh, I was reading a spec, uh, once that had a bunch of competitive intelligence in it, and it looked, it looked bland in the way that if you look at a bunch of AI-written text-

Aakash Gupta 49:34 [laughs]

Jack Hirsch 49:34 ... you sort of know. You're like, you don't know, but you know without, you know, without... You don't-

Aakash Gupta 49:38 Almost sniffing it, right?

Jack Hirsch 49:39 Yeah. Yeah. You smell it, you know.

Aakash Gupta 49:41 [laughs]

Jack Hirsch 49:41 And I saw it, and I was like, just out of curiosity, I'm gonna put an AI checker, and like sure enough, 100% AI-generated. And I was like, damn it, okay, I'll just... Uh, we'll, we'll, we'll go with it. Because I assumed that they must have checked it and just used that to sort of rewrite it. This particular spec had a bunch of competitive positioning in it, and when I brought that to the field, when we brought that to the field, our, our, our sales, there was someone who had worked at that competitor, and they were like, "That is factually incorrect, and all of the assumptions that you've been using to build that product are wrong." [laughs] And so that was horrible, like, change costs for us. We had to, like, effectively go back to the drawing board.

Aakash Gupta 50:22 Oh, man.

Jack Hirsch 50:22 So please use it to accelerate, not abdicate your responsibility. We hired you because you're brilliant and you're passionate. Use that brilliance and that passion to deliver the, the last bit. Um-

Aakash Gupta 50:33 Yeah. It hallucinates a lot, though, so you really have to check the facts.

Jack Hirsch 50:38 Absolutely. And even if you're using, I mean, it doesn't matter which, you know, whether it be, you know, ChatGPT or Grok or Gemini, whatever, like, doesn't matter how good you think you've gotten your prompt, there's always gonna be hallucination. There's always gonna be... I mean, it's like, uh, using Wikipedia for your reports, you know, way back when.

Aakash Gupta 50:58 Yeah.

Jack Hirsch 50:58 Like, you gotta check the, check the original sources, right?

Aakash Gupta 51:01 Yeah. So that's principle one. Principle two was?

Jack Hirsch 51:05 Uh, don't miss solving the real problem, and there's that temptation with prototyping-

Aakash Gupta 51:10 Yeah

Jack Hirsch 51:10 ... uh, that you wanna just... Prototyping is cool, right? We're like, "Oh, we have this idea, and we can go from idea to reality, and we can just get customer feedback immediately. That's amazing." And I've seen this so many times where we'll, we'll get customer feedback. We're like, "Yeah, yeah. Wait a second. What are we solving again? What are we doing again? Why are we here? Oh, wait, we didn't..." Then, and, you know, y- and then you'll get massed user or customer feedback where they'll say, "Oh, well, that's really cool." And you're like, "Yeah, I got positive validation," but cool doesn't mean they're gonna buy.

Aakash Gupta 51:42 Mm-hmm.

Jack Hirsch 51:42 Cool doesn't mean it's solving the problem. Um, and so going back to first principles thinking, understanding the problem deeply, that is absolutely mission critical. So, uh, I think jumping straight to prototypes definitely risks missing the problem statement. I do think that there's a little bit of a nuance here if you're a pre-product market fit or post-product market fit. I think pre-product market fit, you'll probably have a bunch of ideas that might be very problem informed, um, and you do wanna prototype very quickly. Amazing. Absolutely amazing. Post-product market fit, doing that, that l- last mile iteration, I've seen it just fall off the rails too many times.

Aakash Gupta 52:19 Mm.

Jack Hirsch 52:19 So I think, uh, don't forget those, uh, foundational product management principles. Don't lose them. Go back to, go back to basics. Keep the problem in mind.

Aakash Gupta 52:30 So what does a PRD look like in a world of AI prototyping?

Jack Hirsch 52:34 Uh, it always starts with context. I think, uh, PMs are ultimately keepers of context, right? We're responsible for what we're building and why, not how we're building it. And so AI has this, is this temptation to just be like, "Oh, well, we're gonna build it. How we're building it? Oh, we're gonna vibe code it. We're just gonna feel our way into it." The, the spec still remains very, very problem and customer focused, right? There's gonna be business context. There's gonna be customer context. There's gonna be, depending on the market, there might be competitor context. There might be analytic... You know, there might be qualitative data, quantitative data. I think that's actually something that's, that's a little bit unique about Okta. We have a pretty heavyweight spec process.

Aakash Gupta 53:13 Mm.

Jack Hirsch 53:14 Um, and it's, it's there effectively to ensure comprehensive thinking, right? Make sure that we're, we're hitting all the angles. So I think there's this temptation to use AI to write specs, and I, I saw, uh... Depending on the organization, um, there's a shift in, uh, need to go from, you know, we're, we're always, like, developer constrained, right? Engineering constrained. There's always engineering constraints in every organization, and I've heard in some organizations that they're shifting back, and we felt this a little bit, to product constrained.

Aakash Gupta 53:46 Yeah.

Jack Hirsch 53:47 And so that shift, there's a temptation, again, to abdicate the responsibility of defining a great product, having taste, having sense, having intuition to AI, and that's where it just goes completely wrong. So I think specs are still, if, if done right, still focus on user-centered problems, customer-centered problems, uh, market-centered opportunities, not, uh, whatever-You know, drivel AI will produce on an even day

Aakash Gupta 54:17 Mm. Because there's, this has been the hottest thing right now in product. I think it was Madhu Guru over at Google, he's head of product at Gemini. He said, "We're moving from a writing-first culture to a prototype-first culture." But you think there's still a place for writing?

Jack Hirsch 54:31 Oh, absolutely. I mean, I think, you know, uh, it doesn't matter where... Any number of brilliant people smarter than I have basically said that, like, writing is the best way to clarify your thoughts. I mean, I think about it in terms of, you know, computing, right? It's how I... Writing is how I refactor my thoughts.

Aakash Gupta 54:50 Yeah.

Jack Hirsch 54:50 Right? And so I need to get my thoughts out on paper. I will use AI to be a sparring partner, um, which I think is a great use of AI. Um, but again, jumping straight to those prototypes without having that deep understanding and going through the various facets of what it means to be successful, and truly understanding are we solving a need? Are we solving a, are we solving a pain point? And again, deeply understanding that need and l- living it, wallowing in it, spending time just exploring it, talking to people about that problem without bringing a solution. 'Cause again, when you bring the solution, you start over fitting to that solution. You start forgetting edges of the problem, and you end up with partial solutions. So-

Aakash Gupta 55:36 Mm

Jack Hirsch 55:36 ... um, I think it's, you know, maybe a little bit of a contrarian, contrarian take, but frankly, prototyping is helpful. Um, but it's too easy to abdicate the, the deep thinking about the problem that you're actually trying to solve.

Aakash Gupta 55:50 So use AI prototyping tools, but once you have conviction on the problem space.

Jack Hirsch 55:57 Absolutely. And iteration then can go much faster, right? Iteration can go much faster. But the reality is so many people now are living in a digital native world where, like, you can pretty quickly spin up... I mean, if you spin up a very, very basic prototype, everyone, like, we... There used to be so much focus on design principles and understanding, you know, like UX principles. It is so easy now to build incredibly elegant user experiences that that last prototyping should be like a validation.

Aakash Gupta 56:28 Mm.

Jack Hirsch 56:28 Not a testing, not... You know, you should have that taste, that intuition to get you 90, 95% the way there. There's a reason why, in general, you don't need to user test with more than three to five people, right? You get, you get the-

Aakash Gupta 56:40 You converge at some point.

Jack Hirsch 56:42 Yeah, exactly, and it converges fairly quickly. And so if you've been around the block a little bit in product management, design, user experience, you know the patterns and the anti-patterns right out of the gate, and you can tell when something is probably going to work more than, more often than not.

Aakash Gupta 56:55 And principle three was?

Jack Hirsch 56:58 Uh, there, there is an AI hype cycle.

Aakash Gupta 57:00 Yeah.

Jack Hirsch 57:01 And so we're in it, right? The, the Gartner hype cycle, you know, you've got your peak of inflated expectations, your trough of disillusionment, your slope of enlightenment, and we are very much in the peak of inflated expectations mode.

Aakash Gupta 57:13 Okay.

Jack Hirsch 57:13 Very much, right? And so, uh, I mean, even in your intro, you're like, "Oh, Jack's responsible for AI stuff." Everyone at Okta is responsible for AI stuff. Uh, and the reality is we need to, again, stay centered on our customers' problems. If AI is the right tool, great. Let's solve it with AI. But if a standard linear thought process is the best answer, or, uh, linear UX flow that is developed the old-fashioned way is the right answer, that, that's also the right answer. We don't have to AI-fy everything.

Aakash Gupta 57:44 And it's gonna be re- a lot more reliable and cheaper if it doesn't have AI, right?

Jack Hirsch 57:48 Exactly. Well, eh, it depends. You know, there's some, there's some efficiencies to be gained with AI.

Aakash Gupta 57:53 Okay.

Jack Hirsch 57:53 But that whole idea that, like, AI is gonna solve everything. I'll take a great example. Uh, building security tool, and if we leave Okta aside, if you're a security, if you're a security professional, you want deterministic steps to be taken in an incident. You do not want... LLMs, by their nature, are non-deterministic.

Aakash Gupta 58:13 Yeah.

Jack Hirsch 58:13 You do not want to outsource that to a non-deterministic system, right? And so you need something that is gonna operate linearly. You need to define that linear pattern. You are gonna be in control of it. There are gonna be stage gates along the way. So there are use cases where AI is not quite the best, the, the best fit. And so I think, you know, two years ago, I'd say probably in the, uh, immediately after, uh... And this is, you know, uh, after Transformers, but immediately when, uh, ChatGPT was announced. The next year, maybe 18 months, everyone was asking, "What's your AI strategy? What's your AI strategy? What's your AI strategy?"

Aakash Gupta 58:55 Yeah.

Jack Hirsch 58:55 And the answer is like, well, for Okta, it was what's our product strategy, and can AI accelerate it? Can A- AI augment it? Can AI provide new ways to deliver those solutions to our customers? That's the answer. Um, and so AI is fundamentally a tool. It's like, oh, well, we discovered relational databases. What's your relational database strategy? Well, you know, it's, it's a really, really valuable tool. Um, and so again, we had a, we had a wonderful product that we had, uh, we called Log Investigator, and it was this idea that, you know, to decode security logs, you, you, you need the decoder ring, right? If you're gonna look at security logs. There's all sorts of esoteric context in there. You not only have to be a security professional, in our case, you need to be an Okta... You know, know what's going on in Okta. And we're like, "Oh, well, we're gonna take that. We're gonna feed all the context into an LLM, uh, and it's gonna explain exactly what's happening." Now, the reality when we actually went and tested this is in those situations, our customers don't want or didn't want non-deterministic output.

Aakash Gupta 59:58 Mm.

Jack Hirsch 59:58 They wanted deterministic output. They needed the decoder ring, but they didn't want it from an LLM. And so things like, you know, automating configuration, that's a really tough thing to fully hand off to a non-deterministic system. When you know exactly what the acceptance criteria are, maybe there's a lossy path to get there-

Aakash Gupta 1:00:19 Mm

Jack Hirsch 1:00:19 ... um, if there are appropriate guardrails. But again, thisAI for AI's sake, we have to be really, really careful. And I, I think there are also, like, business fundamentals that we tend to forget, right? There's competitive dynamics, there are market forces, there are network effects that we need to be paying attention to, uh, as, you know, product development professionals, right? So again, uh, the ag- you know, the AI hype, uh, is very, very real. Um, the reality is not quite there. Um, don't get me wrong. Is it gonna be transformative? Yes, absolutely. But, you know, it's that, that adage that we overestimate what's gonna happen in the near term and underestimate what's gonna happen in the long term. Absolutely. We've overestimated what's happening in the near term, um, and we've forgotten, you know, the basics.

Aakash Gupta 1:01:05 Yeah. AI sprinkles, it hasn't worked for anybody. You have to actually-

Jack Hirsch 1:01:09 AI sprinkles, I love that

Aakash Gupta 1:01:10 ... bake it into the cake, right? It has to be solving some of the core problems that you were solving. Has to be solving it in a way that other technology, deterministic technology that's usually more reliable couldn't have solved. So that's the fundamental. I'm curious, AI agents, you didn't talk too much about those. How should PMs be using AI agents?

Jack Hirsch 1:01:31 So first off, EV- AI agents, there's like... I don't know, they're a nebulous term. How would you define them, out of curiosity?

Aakash Gupta 1:01:37 I would say it's an LLM that plans, takes action, and reflects.

Jack Hirsch 1:01:44 Okay.

Aakash Gupta 1:01:44 Think plan, act, reflect, I think is the loop, yeah.

Jack Hirsch 1:01:46 Okay. That's a, that's a good... Okay. So, great. Um, is ChatGPT on its own an agent?

Aakash Gupta 1:01:53 If you turn on the agent mode, it can browse something. So I guess it's like one step, but the agents that I think PMs should use, right, if I were to recommend, is a lot of the, uh, no-code agent builders out there.

Jack Hirsch 1:02:05 Sure.

Aakash Gupta 1:02:05 Like, uh, Lindy or n8n we talked a little bit about.

Jack Hirsch 1:02:09 Right.

Aakash Gupta 1:02:09 It's like deploying those for your more repetitive work use cases. Like an example, like in security, we just talked about the threats in AI, they're changing every single day. Just to keep up with that, it could take you an hour a day. So why not create an AI agent that's summarizing for you, "Hey, in the past seven days, these were the most important new cybersecurity AI threats out there. Here are links to three articles." Like, that type of thing you can create really reliably now.

Jack Hirsch 1:02:37 Oh, absolutely. So, so that to me, that to me is a really, uh... I, I think that's sort of short term, right?

Aakash Gupta 1:02:44 Yeah.

Jack Hirsch 1:02:44 This whole idea of... So but yes, that is an agent. I would actually take a more expansive view of what an agent is, right? I think that Claude, in a simple chat interface with MCP, is an agent.

Aakash Gupta 1:02:57 Mm-hmm.

Jack Hirsch 1:02:57 Right? You can tell it to go do a bunch of things, and it will go do a bunch of things, even not in necessarily agent mode. I think we're using terms like agent mode to sort of create some differentiation between something that's like goal seek over a longer period of time, or goal seek that might have access to a desktop or browser interface. Uh, or it could be something that's like a no-code, low-code flow builder type thing. I think all of those are derivatives of AI agents, even at the very, very basic text box and text response.

Aakash Gupta 1:03:33 Mm.

Jack Hirsch 1:03:33 Um, so I guess, okay, so back to your question.

Aakash Gupta 1:03:36 Yeah.

Jack Hirsch 1:03:36 So yeah, w- where were we? Let's, let's start with, like, the, the expansive view.

Aakash Gupta 1:03:40 Yeah. Like, how should you be using those at work?

Jack Hirsch 1:03:43 Um, I think number one, uh, be pragmatic. Um, use the right tool for the job. I think that means we all... Okay, so I'll, I'll speak to PMs specifically. Uh, so PMs need to be experimenting with absolutely everything, everything out there. If you're not spending your nights and weekends playing with various AI tools, um, you are going to get left behind unfortunately. Everything is changing very, very quickly, and that means that you'll be able to use specific tools for specific jobs.

Aakash Gupta 1:04:15 Mm.

Jack Hirsch 1:04:15 And so that means that, you know, you can create your AI board of directors, and it's up to you whether you wanna use that in Claude or Gemini or ChatGPT or Grok or whatever. Um, or you wanna build it in, you know, on some, uh, homegrown system, you know, in Bedrock. Build your AI board of directors. If you want to build automated workflows, you know, and you wanna call those agentic workflows, you can. You know, grab n8n, grab the cloud version, uh, you know, or, or grab the open source version, deploy locally, whatever you wanna do. Go play with it. Go experiment with it. If you, uh... Go vibe code some things. Go, go play with it and see what they're good for, and just be wary of that AI hype, right?

Aakash Gupta 1:04:54 Yeah.

Jack Hirsch 1:04:54 So don't abdicate your responsibility. So I think number one is just be a pragmatic tool user. Um, [lip smack] uh, yeah. I think second I would say, uh, and I, I wanna go into... I really wanna double down on that AI as a thought partner. Again, fundamentally, you're the knowledge worker, right? You're the one that should be coming up with these ideas. Granted, you can use AI to help you generate those ideas, but fundamentally, it's your taste, it's your life, it's your interest. Um, and so if there... You know, I think one of the things that I learned, uh, that was probably most valuable for me from s- my startup journey is build something you're really passionate about.

Aakash Gupta 1:05:31 Mm.

Jack Hirsch 1:05:31 Because you're gonna be spending every waking hour and minute, seven days a week, working on this thing. And so if you outsource that to AI, you're not gonna be, you're not gonna be fulfilled. And so I think, uh, really, really use AI as that, that thought partner. Think about the types of advice you want, the types of consult you want. Um, uh, "Hey, I would love to have you and your entire knowledge base and conversation base as a sparring partner for me as I'm thinking about product management and the AI in the era of AI. I would love to ingest all of that and take that all in and build a, build a, a thought partner out of that." "Oh, hey, I wanna build financial excellence, so I need to build financial projections because I'm gonna go raise money from a VC. What pitch decks work? What pitch deck didn't? There are databases of pitch decks. Give me all the best, you know, the best tips and tricks." Um, so creating that-Board of directors, super,

Jack Hirsch 1:06:29 super valuable.

Aakash Gupta 1:06:30 Mm. And then it sounds like engineering that board of directors with the right context.

Jack Hirsch 1:06:34 Absolutely.

Aakash Gupta 1:06:36 So you just mentioned your startup, and that's exactly where I wanted to go next, was a little bit about your background. Um, you created an AI startup well before it was cool. So tell us the story of Butter.ai. How did it come about?

Jack Hirsch 1:06:51 So first off, uh, the name Butter is really, really important to it. I don't know if you know why it was called Butter. You familiar, uh, you know the show Rick and Morty?

Aakash Gupta 1:07:00 Yes.

Jack Hirsch 1:07:00 Okay. So you know the Butter Bot in Rick and Morty?

Aakash Gupta 1:07:02 Oh, I don't, but I know-

Jack Hirsch 1:07:03 So, okay. So, so there was a scene in Rick and Morty where they're sitting around, they're sitting around the dining room table, they're having a conversation. Uh, and Rick, who's the, you know, sort of mad scientist, uh, mad scientist character, fiddling with a robot and it comes to life on the table. And it rolls over to him and says, "What is my purpose?" And he says, "Oh, uh, pass the butter." And the robot comes, you know, passes butter, and he says, "Thank you," and swipes a piece of butter, you know, on the toast. Conversation keeps going, the butter- the Butter Bot interrupts, and he says, "What is my purpose?" And he says, "Oh, you pass butter." And the robot looks down at his little robot hand and says, "Oh my God." And Rick's like, "Yeah, welcome to the club, pal." And so it's this like whole moment of like you realize that your purpose is just to pass butter and, uh, you know, you're sort of this bot. This agent, this AI thing is feigning self-awareness, but is it self-aware? Is it just feigning self-awareness? We don't know. It's never really discussed in the show. And so we created Butter.ai, uh, as a way of just passing the information. It was, the whole idea is like you're just gonna say, "Hey, where are the Q3 financials? How did we do last quarter?" It's gonna find the information. It's gonna find the right document. If you don't have the right access to the right document, it'll way, find its way through the organization, ask permission on your behalf if you want it to, grab that information, and surface it up to you. So that was the whole... So initially we wanted to call it DocuBot. We thought that was lame, and so we went with Butter.

Aakash Gupta 1:08:27 [laughs] And why did you build an AI startup? What was this, 2017?

Jack Hirsch 1:08:32 This was 2015.

Aakash Gupta 1:08:34 Wow. This is-

Jack Hirsch 1:08:34 2015. So timing is everything in startup, folks. Don't for- don't forget that. Timing is everything. Uh, being too early doesn't always pay.

Aakash Gupta 1:08:42 Yeah.

Jack Hirsch 1:08:42 Um, so yeah. I think we, we, uh, overshot it a little bit in terms of timing. This was like just pre-LLM-

Aakash Gupta 1:08:50 Mm

Jack Hirsch 1:08:50 ... um, LLM world. The value of it, I mean, so frankly, we were at Evernote, and we had this, we kept having this problem of like, where's that document? Where is that document? We need, we need like a docu bot. We need, and enterprise search sucks. It's terrible.

Aakash Gupta 1:09:05 Yeah.

Jack Hirsch 1:09:05 Um, and so we need something that's smarter. Search has gotten better. Let's just build that. And so this was one of like a handful of, of, uh, product ideas we were batting around back in 2015. Um, and yeah, we, we test- we did a bunch of, you know, we again, tested a bunch of prototypes. Turns out search is a Sisyphean challenge. Um, you're never gonna get it exactly quite right, and the cost of missing is really hard in enterprise search. So enterprise search is a really hard market to, to play in. It's very, very tempting, especially with LLMs, but it's a difficult market to be in.

Aakash Gupta 1:09:40 I think Glean is kind of in that market now.

Jack Hirsch 1:09:41 Absol- oh, absolutely. And Glean, if you're out there, a huge fan. Uh, they actually, I, I think, um, I think the, the enterprise, I, I don't even know if I would call them enterprise search anymore, but it's sort of where they, where they started. Um, but yeah, there's, th- this has been going for a long time. Like, you know, we keep trying to solve very similar problems. There was Coveo way back in the day. So like enterprise search is a, is a well-established place, and what's great is we have these technology leaps that create new opportunities to remake whole industries. And Glean is taking a really clever approach now, where obviously it's not just about, you know, click-through rang- click-through rate and mean reciprocal rank, and where in the search results those things are that you're finding, and making sure that it's the top one, two, or three. It's about grabbing that information, surfacing the right context out of those documents with LLMs, um, creating agentic workflows that are sort of like content aware. Really cool space to be in. Really, really hard market.

Aakash Gupta 1:10:39 Mm-hmm. It sounds like you didn't build, you didn't succeed as much as you wanted to with Butter. Did LLM unlock something specifically for Glean that wasn't there when you were working on Butter?

Jack Hirsch 1:10:49 Oh, a- absolutely. Um, absolutely. I think we spent a, we spent a lot of sort of organizational calories on things like text summarization, NLP. Remember that?

Aakash Gupta 1:11:01 Yeah.

Jack Hirsch 1:11:01 Remember natural language processing, understanding. So this is, you know, the first, the first iteration of this was a Slack bot where you could just, you could add it to a bunch of channels, you can @mention it, you do whatever, and it would just go find you the bot. And so Slack was the original interface. We also did, um, we built a Chrome extension, so if you're searching like Google, but your result happened to be in Dropbox, it would surface, say, "Actually, the thing I think you're looking for is in Dropbox," or, "The thing that you're looking for is in Notion," or the, you know, somewhere else. So the interface, you know, there were a few interfaces to it. Um, but yeah, I, I wish we had the technology of LLMs. I think it might have changed some things, but fundamentally it's a knowledge management challenge. It's really, really hard, uh, to get right, and I think that, uh, from a business perspective, it's, it's a difficult place to be in. I'd much rather be in the path of revenue. I'd much rather be helping customers or users make money, save money, be more secure. There are some like core value props that I think are much more attractive from a business standpoint. Um, and I think that, you know, enterprise, like productivity on a personal level, so, so anchored to it, so gravitated. Like I love the idea of augmenting, you know, myself as a human. I felt like Evernote, when I was using it in grad school, gave me superpowers, 'cause I could dump everything in there. I could search through case studies and documentation and notes and everything, and I just like had it all at my fingertips, and I felt superhuman as I was doing that. And that, that I think is, you know, enhancing personal productivity is a virtuous cause. I love it.But it's always considered discretionary spending.

Aakash Gupta 1:12:40 Yeah.

Jack Hirsch 1:12:41 And so it was very, very subject to, you know, uh, economic dips. Um, and, uh, you know, in a business context, especially in the past few years with everything been, being so topsy-turvy, that discretionary spending is the first thing to get cut. Um, and so I'd much rather be in those mission critical industries, um, and delivering mission critical outcomes to customers or users.

Aakash Gupta 1:13:05 So you're living the dream. You're a founder. You get acquired, and now for the last, I guess, seven or eight years, you've been a product leader. What has that transition been like? What's kept you in product leadership?

Jack Hirsch 1:13:17 The-- Well, I will say this, and this is, uh, I love Box, uh, love Box, love all my former colleagues at Box, love my current, uh, people that are still there. Uh, still a huge fan of the people there. But I described it, uh, to the now CTO at Box that I felt like I was a bullet hitting jello.

Aakash Gupta 1:13:34 [chuckles]

Jack Hirsch 1:13:34 Just full stop, right? It just like, it took all of this like passion and energy and just raw grounded to a halt. Um, and so I, I definitely had a bit of like a crisis while I was at Box, um, because everything was moving slowly. I felt like I couldn't like move fast and break things and, you know, that, that's sort of the, what I wanted. And then I realized that, hey, look, this is a, this isn't, you know, a dinghy that I was used to in startup land. This is a tanker. This thing, if it turns two degrees northeast, we're moving millions of gallons of water. This is, You're gonna feel the reverberations miles away, right? And so the impact of the scale of something like Box, unparalleled. And I became addicted to that, like that idea of like, you know, for me it's around like f- solving hard problems at scale that I really fell in love with. Um, and at Okta it's the same thing. I mean, I mentioned earlier, I work at an organization, you know, where we see macroeconomic trends play out in our data. That is wild to me. And so that's something that we have to keep in mind in our spec writing process as an example, right? And so I think I fell in love with, you know, operating at scale. Some people do get frustrated with the pace. I think the pace is still really, really fast. Um, it's just different, you know? But you, but the scale of impact that you have is just otherworldly. Um, so, you know, it's a balance, right? Move fast and break things, but, you know, you maybe break a few users.

Aakash Gupta 1:15:16 Mm-hmm.

Jack Hirsch 1:15:16 Versus, uh, move slowly, cautiously, trust, be trustworthy along the way, and impact, you know, again, we have to tens of billions of monthly auths a month at, at Okta, so it's a massive scale. Um, and I found that really, really personally motivating. Um, yeah. And it's kept me, kept me going. I also had a, had a bit of crisis of conscience when I chose product management versus engineering.

Aakash Gupta 1:15:42 Yeah.

Jack Hirsch 1:15:42 'Cause that's when I actually had to make the s- the, the choice is, uh, in 2018 during the acquisition. They were like, "Which way are you gonna go?"

Aakash Gupta 1:15:48 Oh.

Jack Hirsch 1:15:49 Um, and so yeah, very, very glad I went into product management.

Aakash Gupta 1:15:52 Okay. So there's a lot of product managers, product leaders, maybe VPs of product, and Angelique, you were at Evernote, who are thinking about becoming a founder, and they're saying, "Oh, well, his didn't go as well as he dreamed." Like, would you recommend that people just go for it and become founders?

Jack Hirsch 1:16:09 Um, I think there are a few... So blanket statement, yes. If you have that passion, if you have that like, I, y- I can't go to sleep without like thinking about this. I wake up and I'm thinking about it. I'm on a run, I'm thinking about it. I'm exercising, I'm thinking about it. I'm hanging out with my friends and I'm like thinking about it. I wanna talk about it. I wanna get their opinions on it. Like, if you have that fire, go.

Aakash Gupta 1:16:32 Mm.

Jack Hirsch 1:16:32 Right? Like, you're just gonna regret it. Um, so I would just say like, if you, if you wanna go do that, you should absolutely go do that. I think, you know, in retrospect, I think that it's, it is definitely more calculus than linear algebra. Like there's, you're optimizing for a set of variables, right? What do I want out of my one precious life? What do I wanna be doing? Do I feel so strongly about this problem that I am ready to spend nights, weekends, every waking hour and more on this problem? I mean, if the answer is yes, then you know your answer already and you should just go do it.

Aakash Gupta 1:17:10 Mm.

Jack Hirsch 1:17:10 Um, but I think there are a lot of people that feel like they should start a company and it's kind of for the wrong reasons. They get frustrated because of lack of autonomy, right?

Aakash Gupta 1:17:21 Yeah.

Jack Hirsch 1:17:21 It's like an externalized problem, right? It's lack of autonomy, lack of empowerment, lack of ability to experiment, and they think they have like, you know, a better, a better way of doing something, a better process. Um, maybe there's a feature that they wish they could build and they, they can't, and they can't get it off the ground at whatever organization they're at. And that's probably not the right set of reasons to go off and found a company.

Aakash Gupta 1:17:46 Yeah.

Jack Hirsch 1:17:46 Um, and so I think there's a, and I obviously like in Silicon Valley and tech in general, we glorify founders. Um, but the reality is, you know, there's also, there's also like the mental health toll on founders that isn't really often talked about. I was surprised to find out that there are like support circles for CEOs.

Aakash Gupta 1:18:06 Yeah.

Jack Hirsch 1:18:06 I was like, "Whoa, wait a second." Like CEOs wear the crown, but also heavy is the head, right? And so, um, I think, uh, you don't hear about those stories, right? You don't hear the stories of founders that have significant, you know, real, real emotional health issues. They have family issues. Not everyone gets their spot blown up at a Coldplay concert, um, that are, you know, CEOs, uh, that, you know.

Aakash Gupta 1:18:30 [laughs]

Jack Hirsch 1:18:31 Sorry, I'll leave that aside. But like, I think, I think, uh, reality is we, we glorify it. Um, we glorify the successes, but we all know the stats, right? The vast majority will fail.Pretty spec- you know, and, and they'll go quietly. No one talks about the failures. Um, and, you know, I failed back in 2008, right? But, like, that's not what we're talking about here, right? There's like, "Oh, there was an acquisition. Oh, that was a success." Was it as big a success as I wanted? Absolutely not. I wanted to go much, much bigger. But we should also, like, put that into the calculus, right? If you know that there's a 90-plus percent chance that you're gonna go quietly into, into the ether, are you still... Are you gonna regret not doing it?

Aakash Gupta 1:19:11 Yeah.

Jack Hirsch 1:19:12 Right? So if you stare down those odds, then go. Just go do it.

Aakash Gupta 1:19:17 So you mentioned Evernote,

Aakash Gupta 1:19:18 and we have to talk about it because it was like the king of the world. Where I operate in the productivity space, building a second brain, that was like everything. And like you said, that aha moment when you start searching your Evernote database, your notes, you're making connections you didn't think about. It was wonderful back in 2017. Why did it all fall apart?

Jack Hirsch 1:19:38 Oh my gosh, it was still wonderful in 2017?

Aakash Gupta 1:19:40 [laughs] I think so.

Jack Hirsch 1:19:42 Yeah, I do. [laughs] Uh, yeah. So I guess where, where do you wanna start?

Aakash Gupta 1:19:46 Well, why did it-

Jack Hirsch 1:19:47 Why did-

Aakash Gupta 1:19:47 Why is it, you know, not one of the big Silicon Valley success stories?

Jack Hirsch 1:19:51 Um, that's... Okay, that's a good question. Um, I'd say probably... Let's see. Let- I'll give it three reasons. Um, one is personal productivity just has a limited TAM, okay? So that's, that's one. I'd say two is Evernote was inherently single player. When Evernote was born, I think it was 2008, 2007, 2008, it was the era of social media when everything belonged to the world, right? And Evernote was yours. It was your private thoughts. And so everything from the ground up was architected to be single player. And to graduate to the next level, uh, Evernote needed to go multiplayer.

Aakash Gupta 1:20:31 Mm.

Jack Hirsch 1:20:32 And so when some... Uh, so that, that was probably two. And then three is I think we raised too much money-

Aakash Gupta 1:20:37 Mm

Jack Hirsch 1:20:38 ... frankly, and we got out over our skis. And so I think there are other, like, compounding factors there. I think, you know, there was a breach that really... That, like, data-wise, that set us back between

Jack Hirsch 1:20:48 6 and 12 months-

Aakash Gupta 1:20:49 Wow

Jack Hirsch 1:20:50 ... which in VC-funded world, especially late stage, that is an absolute killer, right? So I think there's, there's other, other factors there, but I'd say those three are probably the biggest ones. So yeah, TAM, uh, inability for, to transition from single to multiplayer, um, and just raising too much money.

Aakash Gupta 1:21:06 So you had a really interesting story about how you hustled your way into PM at Evernote. How did that happen?

Jack Hirsch 1:21:11 That was actually really funny. So it started here in San Francisco. I was sitting in Dolores, uh, with a good friend of mine, and he asked me, "Where, where do you wanna go? What do you wanna work on after you graduate from your MBA? Do you wanna work at a place like Google?" And I said, "Oh, you know, as much as I love Google, I wanna work for something I'm, like, deeply passionate about, something I love. Like, I wanna work on a product that I love, something like Evernote, you know?" And he was like, "Whoa, my dad works at Evernote."

Aakash Gupta 1:21:36 Oh.

Jack Hirsch 1:21:36 And I was like, "Oh, interesting." Okay. So I went home. I was going to school in Baltimore at the time, so I went all the way back across the country. Uh, on Evernote's website at the time, they had a bunch of coding challenges. So they didn't have any PM roles posted. They had a bunch of coding challenges for engineers, and I solved all of the coding challenges. I printed them out on paper, I mailed them to my friend, and I said, "Hey, put these on your dad's desk." And on the, the cover sheet was, "Put on Phil Constantino," the then VP of Product's desk.

Aakash Gupta 1:22:09 Mm.

Jack Hirsch 1:22:10 And so I got a call a few days later from the then VP of Product, and he basically asked, "Why am I talking to you?"

Aakash Gupta 1:22:16 [laughs]

Jack Hirsch 1:22:17 And this was, like, you know, uh, second year. This is post summer internship of an, a two-year MBA program, and this is, like, maybe November or December of that year. And he was like, "Why am I talking to you?" And I was like, "Uh, uh, uh, a, a winter internship."

Aakash Gupta 1:22:33 Oh.

Jack Hirsch 1:22:33 And he said, "Oh. How much time do you get off your winter internship?" And I'm like, "I don't know, three, four weeks." He's like, "Can you do something in three, four weeks?" I was like, "Absolutely, I can do a lot in three to four weeks. Put me in, coach."

Aakash Gupta 1:22:44 [laughs]

Jack Hirsch 1:22:44 And he's like, "How often are you in California?" And I was like, "Oh, I'm in California all the time. I'm actually gonna be there next week." I literally opened up southwest.com-

Aakash Gupta 1:22:51 [laughs]

Jack Hirsch 1:22:51 ... as we're on that call. I flew myself, like, the next day across the country, and I showed up at their office like everything was cool and I was meant to be there.

Aakash Gupta 1:23:01 Wow.

Jack Hirsch 1:23:01 Um, and you know, I had, uh, basically three weeks to prove myself. Um, and then the, uh, CEO, uh, Phil Libin was like, "Hey, you wanna join, you gotta join now. We're not gonna wait six months."

Aakash Gupta 1:23:15 Oh.

Jack Hirsch 1:23:16 And I called my school and I said, "Hey, how many classes can I miss?" [laughs]

Aakash Gupta 1:23:22 Uh-huh.

Jack Hirsch 1:23:22 They gave me the exact number, and that is exactly the number that I missed, and I was basically flying my way back and forth across the country. And I mean, at the time, like, the team that I, I joined, like, they had just been on the cover of Inc. magazine. Like, they were flying high. This was pre-billion dollar, you know, billion-plus valuation, but it was, like, the start of this idea of, like, you know, bettering yourself, right? It was... It really was that iconic personal productivity brand that was blooming-

Aakash Gupta 1:23:47 Mm

Jack Hirsch 1:23:47 ... and just, like, crossing the chasm into mainstream, and I just, I wanted to find my seat on that rocket ship, and I wouldn't trade it for the world. But yeah, that was my, my intro to PM, um, was starting, starting effectively as an intern.

Aakash Gupta 1:24:03 That's insane hustle, though. So how can people reverse engineer that? What... I think, I guess, some of the lessons, right, network and location. You being in SF and talking to a friend in SF helped because his dad was at Evernote. Number two, like, thinking super creatively, I guess, about how to get in, right? Doing coding challenges for a PM interview, very rare. And then I think third thing, taking a lot of initiative to just, "Yeah, I'll do an internship for [laughs] three to four weeks," right? Nobody does that. Are there any other elements people should focus on?

Jack Hirsch 1:24:36 I mean, I think... So when hunting for roles, I think it's really natural for people to treat it like-I don't know, online dating.

Aakash Gupta 1:24:45 [laughs]

Jack Hirsch 1:24:46 Just, like, swipe left, swipe... I mean, there are tools now, right? Like, oh, you swipe right on a job and an LLM will apply for you.

Aakash Gupta 1:24:52 Yep.

Jack Hirsch 1:24:53 Cool. If you wanna play the numbers game, great. That works. I, since, now it's 2010, I've never, I have not played in my career the numbers game at all.

Aakash Gupta 1:25:03 Mm.

Jack Hirsch 1:25:03 Um, and a lot of the people that have grown very rapidly in their career are not playing the numbers game. Um, and so find a set of targets that you wanna go after and work your way in really hard. I mean, at Ever- uh, this is really funny, at Evernote, because it was, like, an it company, and I'm sure, gosh, you ask, like, any of the late-stage VC-funded, you know, it companies of any era what they saw in the recruiting pipeline, like, I get... I've seen people write songs-

Aakash Gupta 1:25:32 [laughs]

Jack Hirsch 1:25:32 ... to get in, like play songs on the guitar, send YouTube videos, like s- I've received, like, gifts and books from candidates. It's like people are very, very creative to get in. But again, you can't, it's not a numbers game. You have to know exactly what you want, and you have to go for it. Um, and so you can call that networking. You can call that any number of things, but again, it's just avoiding the numbers game and being focused. I think that's, that's really, really key. I had three to five target companies that I wanted-

Aakash Gupta 1:26:04 Wow

Jack Hirsch 1:26:04 ... to go at, and I effectively didn't wanna take no for an answer. I mean, actually, I would've taken no had they turned me down.

Aakash Gupta 1:26:11 Yeah.

Jack Hirsch 1:26:12 Actually turned me down, but I'm not gonna fire something into the void and assume that that is them turning me down. That means that I wasn't given the appropriate consideration. So, like, how do I get the appropriate consideration? And so doing something that stands out to get you that appropriate consideration. You obviously have to earn it after that, right? The person who wrote a song, uh, I won't name the employer, won't name the person, uh, they're a very talented musician. They did not get the role because, you know, that, that's step one in the process, right? It's a, it's a funnel.

Aakash Gupta 1:26:38 Yep.

Jack Hirsch 1:26:38 Um, but I think, I think being much more targeted in the search, mission-critical, like absolutely have to do that.

Aakash Gupta 1:26:44 Mm. I wanna circle back to our topic right at the beginning. As we've told

Aakash Gupta 1:26:51 people, AI cybersecurity attacks, they're crazy, and they're gonna continue to get more and more sophisticated. We walked through the playbook companies must have. Let's end on the personal angle. Let's say my identity gets breached tomorrow by some ibers- AI cybersecurity threat. What's the one thing I can do to save myself?

Jack Hirsch 1:27:12 Number one, so your physical identity, you, your Social Security number, your credit score, all of that is very, very easy to breach.

Aakash Gupta 1:27:22 Mm.

Jack Hirsch 1:27:22 Like trivial, trivial to breach. Lock your security reports. Like, it's so easy. Just go to the major credit bureaus, TransUnion, Equi- like, just go to them. There's online flows. They'll try to get you to pay for them. You don't have to pay. Go lock your credit reports.

Aakash Gupta 1:27:40 Oh.

Jack Hirsch 1:27:40 That means that any time someone tries to open a checking account in your name, a credit card, sign up for a phone, file an insurance claim, or sign up for an insurance, uh, uh, sign up for insurance, file an insurance claim against your current insurance, all of that stuff effectively gets blocked-

Aakash Gupta 1:27:58 Mm

Jack Hirsch 1:27:58 ... while your credit report is frozen. So I think your physical identity is this horrible vestige [laughs] that we need to be securing. So I think that is, that is number one, and it can be absolutely ruinous if you have had this happen to you. I have actually had my physical identity compromised when I was buying a house.

Aakash Gupta 1:28:17 [lips smack] Oh, man.

Jack Hirsch 1:28:17 So I had to, I unlocked my credit report. There was paper, that I got mail stolen. I hadn't locked... I didn't know that I had mail stolen. Um, and then I found out that people had used my, someone had used my Social Security number. Um, so locking your credit report is number one. Then there's, like, digital security. So I think physical security, so easy to breach. Lock it down. Digital security, goodness gracious, please, please, please, please use a password manager. Use strong passwords. Use different passwords for every site.

Aakash Gupta 1:28:51 Mm-hmm.

Jack Hirsch 1:28:52 Uh, use passkeys. If you haven't used a passkey, it's magical. Uh, passkeys, uh, actually, we can get into why they're so magical and why they're so awesome and why they're so secure. You're not using a password. You are just using a biometric, some sort of biometric marker for yourself, and that's a multi-factor in and of itself-

Aakash Gupta 1:29:12 Yeah

Jack Hirsch 1:29:12 ... because you're using a possession factor and an inherence factor, your possession of your device and something that is inherent to you, like your fingerprint or your face ID.

Aakash Gupta 1:29:20 Yep.

Jack Hirsch 1:29:20 So password manager, passkeys, please, and then last one, last bonus, lock your phone number.

Aakash Gupta 1:29:29 Oh.

Jack Hirsch 1:29:30 So, uh, oftentimes you will get, you know, f- probably if you don't use a super modern bank, you'll get MFA codes via SMS. SMS is really, really easy to, to breach. Um, and so, uh, make sure that your phone number is locked with your provider. So I, I can speak confidently in the United States, every single phone provider gives you the option to give you some sort of a PIN code or secondary security lock that makes it so that you can't steal the phone number and transfer it to another third-party SIM. So stealing someone's, effectively, their phone number means that if they do happen to get your password, your MFA is compromised, right?

Aakash Gupta 1:30:09 Yeah.

Jack Hirsch 1:30:09 Um, so SMS is a really bad second factor, it turns out.

Aakash Gupta 1:30:12 Mm.

Jack Hirsch 1:30:12 So it's not phishing-resistant. Um, and so yeah, I would say that's probably good. So physical identity with, uh, your credit reports, use a password manager, use passkeys. Um, yeah, that's probably a, a great start.

Aakash Gupta 1:30:27 This was a masterclass not just in security, but building AI products, using AI to build products. Thank

Aakash Gupta 1:30:36 you so much, Jack.

Jack Hirsch 1:30:37 Thanks for having me.

Aakash Gupta 1:30:39 All right. Bye, everybody. So if you wanna learn more about how to shift to this way of working, check out our full conversation on Apple or Spotify Podcasts. And if you want the actual documents that we showed, the tools and frameworks and public links, be sure to check out my newsletter post with all of the details. Finally, thank you so much for watching. It would really mean a lot if you could make sure you are subscribed on YouTube, following on Apple or Spotify Podcasts, and leave us a review on those platforms. That really helps grow the podcast and support our work so that we can do bigger and better productions. I'll see you in the next one.