Identity management company Okta on Thursday unveiled its 'Identity Security Fabric', designed to secure AI agents and replace the fragmented security system that enterprises use today to manage users, applications and AI systems.
See also: Okta warns of phishing attacks
The announcement was made at Okta’s annual conference in Las Vegas, as organizations struggled to manage AI systems that operated with elevated privileges but often lacked proper oversight. Research firm Gartner predicted that by 2027, identity fabric immunity principles would prevent 85% of new attacks and reduce the financial impact of breaches by 80%. While 91% of organizations were already using AI agents, only 10% had developed strategies to manage these non-human identities, Okta’s research found.
As evidence of the security risks, the company cited an incident where “an AI recruiting bot exposed the data of millions of candidates to hackers who tried the password ‘123456.’” “The modern enterprise requires an identity security fabric that can reduce the attack surface,” said Kristen Swanson, Okta’s senior vice president of design and research. Current fragmented security architectures “can no longer keep up” with AI-driven threats, she added.
The concept of the identity fabric integrated previously separate security functions — user management, application security, and AI oversight — into a single platform. This approach came as enterprises faced increasing complexity from AI agents operating with increasingly elevated privileges alongside traditional human users.
The platform consists of three main components, with AI agent lifecycle management as the first core component. Okta has dubbed it “Okta for AI Agents,” scheduled for early access in the first quarter of fiscal 2027. This component will discover existing AI agents within enterprise networks, establish appropriate identity credentials, enforce access controls, and monitor their activities.
See also: Okta Verify Agent Vulnerability Allows Password Theft
“AI is changing the workplace faster than organizations can adapt,” Swanson added. “We’re starting to see poorly built, deployed, or managed agents exposing the risks of using a traditional, fragmented identity system.” The system will “enforce security policies to enforce the principle of least privilege, granting AI agents the access they need only for the time they need it,” the company said in the statement.
The second component was Cross App Access, an extension of OAuth designed to secure communications between AI agents and enterprise applications. The protocol gained support from major technology vendors, including Amazon Web Services, Google Cloud, Salesforce, Box , and Automation Anywhere. The protocol moved security control from individual applications to centralized identity systems, allowing security teams to monitor AI agent behavior across their entire technology stack. Cross App Access will be available in early access within the Okta platform for enterprise customers, the statement added.
The third component of the fabric is digital credentials capabilities through the Okta Verifiable Digital Credentials (VDC), scheduled for release in fiscal year 2027. The system will allow organizations to issue cryptographically secure versions of government IDs, business records, and professional certifications. Okta said it will start with support for mobile driver's licenses before expanding to additional types of identities.
See also: Okta: Possible exploitation of recently patched vulnerability
The focus on identity security challenges extended beyond Okta’s announcements at the Las Vegas event. Data protection company Rubrik also unveiled Rubrik Okta Recovery, designed to provide automated backup and recovery for Okta environments, underscoring the broader industry recognition of identity infrastructure vulnerabilities, Rubrik said in a separate statement.
