The AI PM's Guide to Security - with Okta's VP of PM & AI, Jack Hirsch

18 snips

Sep 22, 2025

Join Jack Hirsch, VP of Product & AI at Okta, as he dives into the frightening world of AI-driven identity threats. He reveals that over 80% of breaches start with identity attacks, spotlighting deepfakes and insider threats. Jack shares Okta's innovative strategies for safeguarding identities in this new landscape, stressing the importance of managing AI agents like identities. With practical tips for product managers, he also reflects on lessons from his career, including insights on building secure AI products.

Ask episode

AI Snips

Chapters

Transcript

Episode notes

ANECDOTE

DPRK Operatives Infiltrate Companies

DPRK actors pass full interview loops, ship laptops to device farms, and operate as inside threats.
Help-desk social engineering and voice deepfakes are used to reset MFA and gain access.

INSIGHT

Identity Is The Primary Threat Vector

Identity has become the primary attack vector, overtaking devices and networks.
You cannot secure modern systems without treating identity as the central security control.

ADVICE

Manage AI Agents As Identities

Treat AI agents as identities that require lifecycle, access controls, and visibility.
Limit agent access to only necessary resources and manage them via the identity provider.

Get the Snipd Podcast app to discover more snips from this episode

Get the app

Today's Episode

Here's what's happening right now:

Someone can clone your voice from a few YouTube videos and call your help desk pretending to be you.

AI can build a perfect fake of your login page in minutes.

This isn't some distant future threat. Jack Hirsch, VP of Product at Okta, sees this happening every day. Okta protects millions of logins and Jack has a front-row seat to how AI is completely changing cyber attacks.

And the scary part is most PMs have no idea this is happening to their products.

That's why I brought Jack on the show. He breaks down what's really happening and what you need to know as someone building products in the AI era.

----

Brought to you by:

* Amplitude: The market-leader in product analytics

* The AI Evals Course for PMs: Get $1155 off with code ‘ag-evals’

* The AI PM Certificate: The #1 AI PM certificate

* Kameleoon: Leading AI experimentation platform

----

Key Takeaways

1. Identity is Everything: Over 80% of breaches stem from identity attacks, not device or network vulnerabilities. You cannot get security right without getting identity right - this is the new reality.

2. DPRK Infiltration Operations: North Korean agents are passing full interview processes, getting hired, having laptops shipped to device farms, and operating as inside threats within major organizations.

3. AI Agents = Security Blindspot: Companies deploy AI agents en masse without treating them as identities requiring access management. JP Morgan's CISO called this out as the biggest current threat vector.

4. Help Desk Social Engineering: Attackers use AI voice cloning and deepfakes to impersonate employees calling help desk for password resets, MFA bypasses, and account access - often successfully.

5. Session Security Over Time: Authentication degrades after login. Okta focuses on continuous session monitoring and risk signal sharing between security vendors rather than constant MFA prompts.

6. T-Shaped Identity Strategy: Deep identity security (phishing-resistant auth, lifecycle management, risk sharing) plus broad integration across all enterprise systems - not just SSO and MFA.

7. Cross-App Access Standard: New OAuth standard allows AI agents to inherit user permissions across enterprise apps without individual OAuth dances for thousands of employees.

8. Essential vs Discretionary AI: Essential AI (bot detection, fraud prevention) stays always-on. Discretionary AI (log summaries, access reviews) gives customers opt-out control for compliance.

9. AI Product Principles: Accelerate don't abdicate, solve real problems before prototyping, ignore AI hype cycle. Use AI as thought partner, not replacement for product judgment and domain expertise.

10. Personal Security Stack: Lock credit reports immediately, use password manager with unique passwords, enable passkeys everywhere, lock phone number with carrier PIN to prevent SIM swapping attacks.

----