---
title: Okta CSO says phishing remains major threat even in AI agent era
url: https://www.elseif.net/okta-cso-says-phishing-remains-major-threat-even-in-ai-agent-era
published: 2026-10-04T14:03:55+00:00
language: en
section: Agents
source: https://japan.zdnet.com/article/35253164/
organizations: Okta, ZDNet Japan
publisher: elseif
---

# Okta CSO says phishing remains major threat even in AI agent era

Okta CSO David Bradbury says phishing remains the most visible attack front despite AI agent growth. He spoke at Oktane 2026 in Las Vegas on September 22-24. Bradbury notes attackers use AI to research targets and craft convincing phone calls. They direct victims to fake login pages that mimic Microsoft Entra, Ping Identity or Okta. The fake pages do not show phishing resistant methods like passkeys or YubiKey. Instead they push users to enter codes. This creates an authentication downgrade. Attackers then use the entered codes to register their own phones as authentication devices.

They impersonate victims and use AI to quickly extract data from Snowflake or Salesforce. The preparation speed has increased dramatically. Fake sites that look authentic can be built in seconds and domains change frequently. Okta monitors domains that resemble its own or customer domains but attackers rotate sites often. Bradbury stresses the need to adopt phishing resistant authentication more widely. Very few companies currently enable passkeys or security keys. He argues companies must focus on AI security while also solving phishing. Okta previously halted product development for 90 days after a support case management system breach.

Attackers stole session tokens from uploaded files and hijacked some customer sessions. Okta responded by making security the sole focus for all employees. The company now treats itself as a security company rather than just an identity company. This shift led to defenses against attacks using Salesloft Drift or Gainsight to access Salesforce. Attackers stole tokens from these services to impersonate customers. Okta's new measures successfully blocked those attempts.