2-3

months of engineering time saved by implementing Auth0 rather than building authentication from scratch

1

engineering sprint to deploy a secure MCP server to production and onboard customers 

<2

hours to configure Custom Token Exchange

While agentic AI rapidly expands across industries, many organizations are struggling to keep up with the pace of innovation. Tracking and managing compliance and governance was already challenging in a pre-AI world, and the accelerated shift has only made their jobs more complicated. Regardless of where they are in their journey, Strike Graph helps organizations maintain and monitor their compliance programs, accelerate audits, eliminate redundant work, and build trust through secure, agentic technology and enterprise-ready data.

Since Strike Graph provides this simplicity and security to its customers, it’s vital that their own governance and IT management is user-friendly, consistent, and secure. By focusing on building a strong identity layer, Strike Graph is able to both advise on best-in-class access controls while implementing them to give customers and auditors proof of their commitment. “Because we're in the GRC space, we hold ourselves to a very high standard when it comes to security and data privacy,” says Micah Spieler, chief product officer. “We take our customers' data seriously, and want to provide strong assurance to them that their data is safe.”

As an AI-native company, Strike Graph is at the forefront of AI trends, including adopting new solutions to deeply integrate agentic AI. They set out to build their own Model Context Protocol (MCP) servers to empower clients to query sensitive cybersecurity compliance data using their own autonomous agents, but enforcing least privilege access controls manually for these hosted MCP servers became a complex challenge to solve. “AI agents are hungry,” Spieler jokes. “They take whatever information you give them, so we really have to be thoughtful about how we expose information to those AI agents to ensure no sensitive data is leaked.” 

The team decided early on that to protect customer data effectively, they had to retain custodial access to data as it’s processed by AI agents. They needed a verifiable chain of security controls from their own infrastructure to its customers to reinforce trust in their platform. This led Strike Graph to self-host and develop their own internal AI models. By self-hosting AI architecture, they ensure sensitive compliance and vendor risk data never flows to third-party AI services. However, this homegrown approach meant they eventually needed authentication and identity controls, and building controls to manage least privilege access for external agents was complex. 

Without a standardized way to securely authenticate access, the engineering team was responsible for building controls from scratch, and the time cost threatened to derail product roadmaps. “The biggest hurdle with securing our hosted MCP server was figuring out how we were going to integrate it with our existing auth flows,” says staff engineer Keith Catalano. “Security and identity are an entire team's worth of full-time work. It's complicated, hard to get right, and not our specialty, but also we really couldn't launch without a strong, unified authentication layer.”

To avoid sinking an entire team’s worth of engineering hours into custom identity infrastructure, Strike Graph sought a partner that could offer a secure, frictionless checkpoint between AI agents, enterprise-level organizations, and sensitive data stored in their cloud. Auth for MCP emerged as the obvious choice. Auth0 now provides the authentication infrastructure that helps Strike Graph meet industry-wide security standards, including SOC 2, ISO 27001, CMMC, and FedRAMP, in its own product. With these controls in place, customers can trust that the platform handling their compliance data is held to the same standards they strive to meet. “We were excited because we were able to take what Auth0 provides off-the-shelf and quickly start delivering it to customers,” Spieler says. “Because we had a strong player in our corner that helped us generate value, we were able to enter into conversations with new enterprises with confidence.” 

The engineering team was able to use Auth for MCP to get the token exchange working on their MCP server in just a few hours using the platform’s out-of-the-box Custom Token Exchange to make API calls on behalf of users and agents. “Our goal was to ensure our customers could instantly query their cybersecurity compliance data using their own AI agents while enforcing least privilege access,” Spieler shares. “Auth0 for AI Agents solved that bottleneck and helped us get an MVP for our MCP server up in a matter of weeks.”  

Catalano adds that Auth0’s documentation also helped set up the Strike Graph team to scale these new solutions. “The strong documentation allows our engineers to ramp up on security best practices,” he says. “When you have the industry’s best standard and understand why things are built out that way, you can more easily build on top of it.”

Using these industry standards as a benchmark, the team is treating AI agents the same way they manage human identities. By attaching each user’s permissions to their agents’ requests, Strike Graph ensures that agents can only access the same data as their owners. Now, the team can connect customers to their hosted MCP server and deliver personalized compliant AI insights at scale. “We are able to get our MCP server into production, give it to our customers to test, and collect feedback all within one sprint,” Spieler says. “That’s largely because Auth0’s authentication layer was already in place.”

In addition to supporting new product development, Auth0 has also given Strike Graph access to a novel revenue stream. As they continue to grow their enterprise customer base, they’ve been able to offer self-service Single Sign-On and Multi-Factor Authentication security options without having to build the options in-house. These additional security layers have also improved the company’s security-forward brand identity for customers and prospects. “Our go-to-market teams love the fact that we’ve designed our AI systems from the ground up with security and data privacy in mind,” Spieler says. “We see our customers trusting our AI at a much higher rate than we've seen elsewhere.”

Following the successful rollout of Strike Graph’s MCP server, the team is excited to plan for more features and products that can leverage more of Auth0’s functionality. “Auth0 has shown us that we can ship things quickly and securely,” says Catalano. “We have a list of feature updates we’re dreaming up, and that wouldn’t be possible for our lean team if we didn’t work with Auth0.”

Beyond individual product launches, the team trusts the partnership with Auth0 to help them stay on top of industry trends to keep customers secure and satisfied at every turn. “Knowing that Auth0 is in lockstep with us and keeping up with what's happening in the industry is huge,” Catalano adds.”We always want to be ready before our customers ask for something, and with Auth0, I trust that we can solve any auth challenges that come up in our AI journey.”