Skip to content

Company

Okta

Okta is an identity and access management company offering cloud-based single sign-on, multi-factor authentication, and identity governance for enterprises.

Known aliases

  • NASDAQ: OKTA
  • okta.com
  • Okta Cross App Access
  • Okta Inc.
  • Okta, Inc.
  • Okta SSO
  • Okta Threat Intelligence
  • Okta Ventures

Current stories

buildOne report1 publisher

ShinyHunters-linked crews take Okta with a phone call and a rogue MFA device, Health-ISAC warns

Health-ISAC warned members in September 2026 that ShinyHunters-linked crews extort healthcare without encrypting files, in one case taking over 1TB. A dev.to write-up of the warning points to new factor enrollments and bulk exports as the signals to watch.

Publishers:dev.to

Reality

Evidence50
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence50
leadershipOne report1 publisher

Workday's chief executive says the company is still learning how to price AI agents

Workday CEO Aneel Bhusri said the company is "still learning" how to price AI agents. On liability for agent errors, his reported answer opens with a human-in-the-loop principle. That is what buyers have to go on this quarter.

Publishers:itwire.com

Reality

Evidence50
Adoption
Not scored
Hype gap
Not scored
Incentives55
Confidence55
securityOne report1 publisher

UK ministers commit frontier AI to hunting flaws in government systems

UK AI minister Kanishka Narayan said on October 12 that government will use frontier AI to find flaws in its systems, after hackathons found over 400 flaws. The fix-time fall from 50 days to eight is credited to a central monitoring service.

Reality

Evidence35
Adoption25
Hype gap+30
Incentives55
Confidence55
leadershipConfirmed2 publishers

Calendar phishing reaches staff through auto-added invites even when the email lands in spam

Sublime Security says calendar phishing is growing exponentially as apps like Google Calendar add invites automatically, even from emails sent to spam. That moves the defence from the mail filter to calendar settings and to what staff do with an unexpected meeting.

Reality

Evidence52
Adoption
Not scored
Hype gap+20
Incentives55
Confidence62
investOne report1 publisher

Security pros rate their firms secure even where MFA stays optional, Yubico and Okta find

Yubico and Okta's survey of 1,890 tech and security professionals found 23% work where multifactor login is not required on every application. With 88% still rating their company secure, at least one respondent in nine gave both answers.

Publishers:fortune.com

Reality

Evidence45
Adoption55
Hype gap+15
Incentives75
Confidence50
investOne report1 publisher

Okta's earnings multiple gained 32 turns while cRPO growth gained two points

Okta's forward earnings multiple went from about 18x to about 50x in five months while its full-year EPS guide rose about 2%. That ties the price as much to investors' view of AI security stocks as to Okta's own forward bookings.

Publishers:saastr.com

Reality

Evidence55
Adoption40
Hype gap+35
Incentives
Not scored
Confidence50
buildConfirmed2 publishers

CloudWatch Omni opens incident investigation to staff without AWS console access

AWS's CloudWatch Omni, generally available since September 23, lets Okta and Entra ID users investigate incidents without AWS console access. CloudWatch dashboard sharing has let outsiders view prebuilt graphs since 2020, so what Omni adds is the investigation itself, one of the reasons teams paid for third-party platforms.

Publishers:dev.to infoq.com

Reality

Evidence50
Adoption
Not scored
Hype gap+20
Incentives60
Confidence55
securityOne report1 publisher

Remote-worker fraud spreads beyond North Korea to Pakistan, India and Russia, Okta says

Okta's Katie Nickels says fake remote IT workers now operate from Pakistan, India and Russia as well as North Korea, mixing AI with human techniques. That moves the first security check on a new employee into the hiring process.

Publishers:scworld.com

Reality

Evidence30
Adoption
Not scored
Hype gap+35
Incentives
Not scored
Confidence40
buildOne report1 publisher

MCP's September 28 release lets any server behind a load balancer answer any request

Agentic AI Foundation's September 28 MCP release finalizes stateless servers and bars removing deprecated features before July 2027. Teams moving servers off sessions now have a dated floor to plan migrations against.

Publishers:dev.to

Reality

Evidence35
Adoption
Not scored
Hype gap+30
Incentives55
Confidence30
securityOne report1 publisher

Blueprint Alliance coalition aims to build agentic AI security standards around four key questions, lists six identity principles as governance guidance

Okta has gathered a dozen-odd technology companies into the Blueprint Alliance to write open security and interoperability standards for AI agents. The standards are still unwritten, and the six principles published so far are identity-management rules, the category Okta sells.

Publishers:scworld.com

Reality

Evidence45
Adoption10
Hype gap+25
Incentives75
Confidence40
securityOne report1 publisher

Australian Signals Directorate tells AI customers to guard their own keys and sessions

Australia's Signals Directorate says attackers are using stolen AI API keys, tokens and hijacked sessions to get into organisations' AI services. Its guidance tells customers to protect those credentials themselves. In one reported case, a stolen key ran up about US$600,000 in model credits over three weeks.

Reality

Evidence45
Adoption
Not scored
Hype gap+15
Incentives
Not scored
Confidence50
securityOne report1 publisher

Stolen AI session cookies survive a password reset, SOCRadar's exposure report says

SOCRadar tied 5,434 infostealer records for AI tools to 1,500 corporate email addresses at 482 large enterprises. The report says those AI accounts belong under the same sign-on and session controls as a company's identity provider and code repositories.

Reality

Evidence35
Adoption
Not scored
Hype gap+35
Incentives85
Confidence40
securityOne report1 publisher

Stolen ChatGPT sessions turn up at 358 of 482 companies in SOCRadar's stealer-log study

SOCRadar found captured ChatGPT sessions at 358 of the 482 companies whose AI accounts turned up in 90 days of infostealer logs. The firm ties the spread to shadow AI, with employees opening work-email accounts that IT never sees.

Reality

Evidence45
Adoption
Not scored
Hype gap+15
Incentives
Not scored
Confidence45
securityConfirmed2 publishers

Okta's Blueprint Alliance gives buyers a six-point checklist for AI agent identity

Okta and 11 vendors including AWS, Google Cloud and CrowdStrike signed six shared principles for securing AI agents under a new Blueprint Alliance. Buyers can put the list to vendors in procurement now, while Okta's release describes a reference architecture with no stated way to test compliance.

Publishers:okta.com scworld.com

Reality

Evidence40
Adoption
Not scored
Hype gap+35
Incentives70
Confidence55
securityOne report1 publisher

Collaboration-tool alerts quadrupled in a year. The inspection budget still sits with email.

Unit 42 reports endpoint alerts tied to collaboration tools more than quadrupled in 12 months, with 99% linked to chat phishing. Most controls still watch email and logins, not authenticated sessions.

Reality

Evidence35
Adoption
Not scored
Hype gap+20
Incentives80
Confidence50
securityConfirmed5 publishers

ShinyHunters phished the firm that had just profiled it, and device trust was the only thing that mattered

A ReliaQuest employee gave up a password and an MFA push five days after the company named the .claims campaign. Device trust, not training, kept the session worthless.

Perspective Coverage

5 publishers
Builder
Builder 29%
Operator
Operator 56%
Investor
Investor 15%

Reality

Evidence58
Adoption
Not scored
Hype gap+25
Incentives70
Confidence62
productConfirmed5 publishers

CrowdStrike and Fortinet co-sign a letter that dates the security tooling they sell

More than 100 companies signed a call for collective action on cyber defence whose first principle is that status quo security will not be enough, a sentence co-signed by five of the vendors who supply that status quo.

Perspective Coverage

5 publishers
Builder
Builder 33%
Operator
Operator 42%
Investor
Investor 25%

Reality

Evidence70
Adoption20
Hype gap+35
Incentives80
Confidence65
investConfirmed3 publishers

Blackstone bets one part in 48,000 of its assets on a startup founded in 2025

Huskeys closed $27m five months after leaving stealth, with Blackstone leading what Globes calls the firm's first early-stage cybersecurity round. The cheque is worth about 0.002% of its assets.

Perspective Coverage

3 publishers
Builder
Builder 25%
Operator
Operator 25%
Investor
Investor 50%

Reality

Evidence55
Adoption25
Hype gap+35
Incentives75
Confidence60

Earlier coverage

  1. McKesson's 8-K locates the stolen data inside third-party applications

    Security · August 28, 2026 · Confirmed9 publishers

  2. Flock's ALPR firmware hard-codes an API key that anyone can pull from a public image

    Security · September 16, 2026 · Confirmed2 publishers

  3. Okta extends just-in-time privilege to AI agents and CI/CD pipelines

    Security · September 16, 2026 · One report1 publisher

  4. CrowdStrike Stock Jumps 13.8% to Record High as AI-Safety Fears Boost Cybersecurity Sector

    Invest · September 14, 2026 · Confirmed3 publishers

  5. OpenAI, Anthropic and 100+ others urge governments to fund defenses against AI-enabled cyberattacks

    Invest · August 30, 2026 · Confirmed8 publishers

  6. Unit 42 timed an agentic intrusion at fifty ATT&CK techniques in under ten hours

    Science · September 5, 2026 · Confirmed2 publishers

  7. Rubrik's $1.66B ARR grew faster than its customer count

    Product · August 28, 2026 · One report1 publisher

  8. NovaCookies: $320 a month buys a session-theft rig that rides real Docusign mail

    Security · August 26, 2026 · Confirmed2 publishers