Okta CSO says phishing remains top threat despite AI agent growth

Okta's chief security officer David Bradbury said phishing remains the most common attack seen at the front lines even as AI agents expand. He spoke at Oktane 2026 in Las Vegas on September 22 to 24. Bradbury noted that while AI creates new risks such as prompt injection and unintended agent actions, the entry point for many attacks is still traditional phishing. Recent phishing campaigns use phone calls to gather target job roles and contacts then lure victims to spoofed login pages for Microsoft Entra, Ping Identity or Okta. The fake pages hide passkey and YubiKey options and request simple code entry which Bradbury calls an authentication downgrade.

Attackers then capture the entered code and register their own phone as an authentication device to impersonate the victim and later extract data from Snowflake or Salesforce using AI. Okta monitors domains that resemble its own or customer brands but attackers frequently rotate the malicious sites. Bradbury emphasized the need to adopt phishing resistant authentication such as passkeys or security keys which are underused. In 2023 Okta disclosed a breach where stolen session tokens from a support case management system allowed some customers to be hijacked. The company paused product development for 90 days to focus entirely on security and declared that all employees must concentrate on security.