Okta's Identity Chief: Most CISOs Can't Answer This AI Question
Show notes
Which AI agents can access what? Are those permissions even right? And can you stop a compromised agent mid-action? Okta's Dan Cinnamon says most enterprises can't answer any of the three.
Dan Cinnamon has built software, run SAP GRC without an implementation partner, and now architects identity for one of the industry's biggest players. In this conversation with Justin Beals, he lays out why "discoverability" — simply knowing what agents exist and what they're touching — is the single biggest blind spot in enterprise AI right now, and why there's no silver bullet coming to fix it. They also dig into passkeys as a rare win-win security standard, the maturing MCP spec, and where the hard line on agent containment should actually sit.
**Timestamps:**
0:00 Intro
1:20 From writing code to securing identity
4:45 Passkeys: the security/usability unicorn
8:30 The SAP GRC re-implementation story
14:10 Attribution and the agentic AI identity gap
18:55 How fast MCP has matured—and what's next
23:40 The 3 unanswered questions every enterprise faces
27:15 Granular identity vs. inherited permissions
32:00 Containment: moving controls closer to the data
36:45 Consent, provenance, and healthcare AI
40:30 Closing thoughts
#CISO #AIstrategy, #enterprise #AIsecurity, #agentic #AIgovernance, #Okta #MCPstandard, #zerotrust #AI agents