Okta Introduces Innovations to Help Companies Harden their Security Posture and Protect Sensitive Transactions

Okta today announced new innovations that help organizations reduce their Identity attack surface, stay ahead of evolving threats, and support financial services companies in securing and streamlining sensitive digital experiences. 

Why it Matters:

• Identity has become the #1 attack vector in today’s threat landscape. Over 80% of data breaches¹ involve some kind of compromised identity – including legacy password compromises, privileged account takeovers, credential phishing and abuse, and stolen API keys. 
• Companies are also embracing multi-cloud and SaaS environments, with organizations deploying an average of 93 apps from various vendors globally. While this allows businesses to build a tech stack that best suits their needs, it also increases their attack surface.
• Cybercriminals are 300 times² as likely to target financial services companies than any other industry. With sensitive customer interactions vulnerable to fraud and subject to strict regulations, these companies require heightened security and privacy measures. 

What’s New – Identity Security Posture Management: 

Identity Security Posture Management is a new product that proactively identifies vulnerabilities and identity security gaps. A new product for Workforce Identity Cloud that is now available in North America, Identity Security Posture Management helps companies continuously assess their Identity risk posture, uncover critical misconfigurations and gaps–like inconsistent MFA enforcement and account sprawl–and prioritize and remediate the most pressing issues based on risk severity. 

“Identity is becoming increasingly complex with security teams lacking deep visibility and risk analysis in their different cloud and SaaS environments,” said Arnab Bose, Chief Product Officer, Workforce Identity Cloud at Okta. “With Okta’s Identity Security Posture Management, companies now have an in-depth view of their identity security risk, working as the first line of defense so security teams can discover gaps and take immediate action to reduce their attack surface.”

Identity Security Posture Management provides visibility into Identity posture across Okta, third-party Identity providers such as Azure AD, and cloud and SaaS environments like AWS, Salesforce.com, Office 365, and Github. Identity Security Posture Management provides: 

• Identity-focused risk analysis: Identity Security Posture Management leverages companies’  Identity data and threat intelligence sources to deliver a complete inventory of identities, permissions, actions, and risks. It provides a global view of companies’ Identity security postures and maps to popular security frameworks like NIST, SOX and ISO27001. 
• Prioritized insights that drive remediation: The outcome of the analysis is a set of prioritized, highly-granular, and contextualized insights and remediations that are crucial to mitigate the risk of potential Identity-driven threats and attacks. 
• Faster security outcomes: Fast to deploy, Identity Security Posture Management provides ongoing and continuous analysis of companies’ Identity security exposure and audit and compliance reporting on Identity security risks and threats.

^{Identity Security Posture Management helps companies reduce their identity attack surface}

Global sales software leader Xactly helps thousands of companies around the globe beat their revenue targets. Xactly started using Okta’s Identity Security Posture Management to provide visibility into their identity posture across Okta and their cloud and SaaS environments. 

"Identity has become the key to modern security. Controlling the identity sprawl while enabling business is a challenge that legacy solutions could not resolve. Identity Security Posture Management uniquely provides us with ongoing visibility and reduces identity risks with a quick time-to-value and a data-driven approach." - Matthew Sharp, CISO at Xactly

What’s New – Highly Regulated Identity:

Now available for financial services companies in North America, Highly Regulated Identity is a solution suite on the Customer Identity Cloud that delivers Financial Grade Identity™ with elevated security, privacy, and UX controls for sensitive customer interactions beyond login. 

Built in accordance with financial industry regulations and standards, Highly Regulated Identity helps organizations navigate security and compliance for high-risk customer scenarios like updating account information, accessing open banking payment, and sending money – while meeting end-users’ experience expectations. 

“Across all industries, but especially highly regulated ones like financial services, it’s difficult to deliver fast, intuitive, and secure digital experiences that drive customer loyalty,” said Shiven Ramji, President of Customer Identity Cloud at Okta. “With Highly Regulated Identity, companies can satisfy consumers’ need for instant gratification without sacrificing security.”

^{Highly Regulated Identity builds intuitive and secure experiences for sensitive operations like money transfers}

This new offering allows financial services companies to: 

• Increase security and prevent fraud: With Strong Customer Authentication (SCA), any sensitive financial operation prompts customers to verify their identity, allowing them to review and approve the transaction in real time. 

• Deliver intuitive user experiences: Integration with companies’ risk engines can enhance security in user-friendly ways. Enriched approval requests will only be sent when necessary to drive streamlined user adoption.

• Support compliance: Highly Regulated Identity provides a certified FAPI 1 Advanced security profile implementation, laying the groundwork for solutions that support compliance with open banking requirements.

Other New Innovations:  

• Identity Threat Protection with Okta AI: Available for Workforce Identity Cloud customers globally in Early Access, Identity Threat Protection is built with Okta AI and powered by insights pulled from an organization’s security stack. Identity Threat Protection in real time detects and responds to identity threats both during and post-authentication, amplifies security signal sharing across the ecosystem, and orchestrates remedying actions. Identity Threat Protection includes integrations built in collaboration with a robust ecosystem of partners, including Cloudflare, CrowdStrike, Jamf, Material Security, Netskope, Palo Alto Networks, Rubrik, SGNL, Zimperium, and Zscaler. 

• Workflows is Audit Ready for FedRAMP High: Okta Workflows, part of Workforce Identity Cloud, has reached Audit Ready status for Okta for Government High and is available for all eligible customers. Okta for Government High is Okta’s Identity platform built exclusively for U.S. government agencies and their partners at the FedRAMP High authorization level. These Identity-centric automation tools offer Federal teams low- and no-code options for building and managing complex functions, maintaining compliance standards, and improving experience management. 

• Forms for Actions: Available for Customer Identity Cloud Customers globally in Early Access, Forms for Actions is a new feature of Okta’s Customer Identity Cloud Actions extensibility platform that enables developers and UX teams with a no-code visual editor to orchestrate, personalize, and secure Identity flows easily.

^{Identity Threat Protection with Okta AI delivers real-time detection and response for Identity-based threats}

Okta Secure Identity Commitment: 

Okta is committed to arming customers with the products and services they need to secure Identity in today’s threat landscape. These new tools are a part of the Okta Secure Identity Commitment – Okta’s long-term plan to lead the industry in the fight against Identity attacks. 

Learn more about Okta’s latest innovations and our resources for developers. 

^{Disclaimer: Any products, features or functionality referenced in this post that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation or promise to deliver any product, feature or functionality, and you should not rely on them to make your purchase decisions.}

^{1 Crowdstrike, “Shift Focus From MFA to Continuous Adaptive Trust” Venu Shastri, May 1 2023}

^{2  Investopedia,”Cyberattacks and the Risk of Bank Failures” Justin Kuepper, May 28, 2024}