Relevance that can pass a security review: what tech and security leaders need to know about Rokt
For the engineers and security chiefs who keep e-commerce running, the mandate rarely changes. Support growth without making the stack harder to defend or harder to maintain. Real-time relevance, the AI driven practice of choosing the single most useful next action for a shopper, tests that mandate directly.
It sits next to checkout and payment, the systems technology teams guard most closely, and it depends on exactly the kind of data and decisioning that makes a chief information security officer ask hard questions.
Rokt, the New York-based e-commerce technology company, has begun making its case to those leaders directly. In a post addressed to technology and security leaders, part of a broader series on what it calls the transaction moment, the company argues that relevance can be delivered securely, reliably, and at scale without bolting new complexity onto the commerce stack. The claim is worth examining, in part because the timing makes it harder to meet.
Agentic commerce turns consent into an architecture problem
The complication is the arrival of AI agents that research, compare, and increasingly act on a customer's behalf. That forces a set of questions that used to be theoretical. How should a system tell human activity apart from agent-assisted and agent-initiated activity? How is a shopper's authority represented and passed along?
What context has to travel with an action for it to be accountable, and what records will a business need afterward to reconstruct what happened? Writing in Fast Company, Rokt chief commercial officer Elizabeth Buchanan argued that “the agent economy is no longer speculative; it's investable,” a shift that pushes these concerns out of strategy decks and into architecture diagrams.
The money behind the trend is now being modelled. A December 2025 eMarketer forecast cited in Rokt's own analysis of real-time relevance projects that AI platforms will drive $20.6 billion of US retail e-commerce sales in 2026 and $144 billion by 2029, while a broader Morgan Stanley estimate reaches $190 billion to $385 billion by 2030. Whatever the exact figure proves to be, the engineering implication is the same. The systems that handle consent, identity, and context at the transaction will carry more weight, not less.
The build trap
That is where the pitch meets a decision every technology leader recognises. Real-time relevance is not something a company builds once and leaves alone. It requires architecture, data pipelines, a decisioning layer, delivery, experimentation, governance, and continuous optimisation, each of which has to stay reliable as markets, rules, and use cases change. An internal build offers control, but the cost runs well past the first deployment and into years of maintenance.
Buying does not remove the diligence, the company acknowledges. It relocates it. Instead of estimating engineering hours, a CTO, chief architect, or head of platform operations ends up interrogating the vendor's architecture, security posture, reliability, data boundaries, and operating model, and asking whether all of it meets the standard the business would hold itself to. For data and AI teams, the added question is whether first-party data can be activated inside governed, measurable decisioning rather than shipped somewhere it can no longer be tracked.
What Rokt puts on the table
Rokt's technical answer centers on two components. The Rokt Brain is the decisioning engine that selects the next best action and native experience for each customer in real time. The Rokt Network supplies the reach and access to billions of e-commerce transaction moments that give the models something to learn from.
Per Rokt by the Numbers, the platform powers more than 13 billion transactions in 2026, the kind of volume a high traffic environment usually needs a partner to handle. The company recently shipped Brain V4, a new version of the engine built specifically for real-time e-commerce decisions, and it positions Rokt mParticle, its customer data platform with more than 300 native integrations, as the layer that unifies permitted first-party data behind those decisions.
The security posture
On the questions a security team asks first, Rokt leans on external certification. The platform supports enterprise grade certifications including SOC 2 and ISO 27001, and the company reports 99.992 percent uptime, a figure that speaks to the reliability half of technical trust. Certifications alone do not close an evaluation, as the company itself notes, since teams still have to judge how a platform manages access, monitoring, and change over time.
On data, Rokt describes itself as a trusted intermediary rather than an owner. The e-commerce business keeps ownership of its first-party data, customer experience, and customer relationship, and a client's data is used only for that client's purpose and is not shared with anyone else.
Proof by experiment
For technology and data teams, the most persuasive evidence tends to be operational rather than rhetorical. Rokt frames its relationships as continuous experiments, in which changes are tested on a slice of traffic, measured against clear outcomes, and scaled only when the numbers hold. Ankit Dutta, data science lead for commerce at Block, described that rhythm in the company's Afterpay partnership, saying “every interaction generates data, and every data point informs our next optimisation.”
Outside the case studies, Rokt's profile has been climbing. The deal tracking service Dealroom noted revenue above $800 million in 2025. The company appeared for the first time in the 2026 Gartner Market Guide for Retail and Commerce Media Networks and was shortlisted for the AdExchanger 2026 AI Innovator award, and a trade analysis of the sector's next phase credited its decisioning approach as a reason it has pulled ahead. For a technology or security leader, none of that is proof of fit, but it is the kind of signal that makes a closer evaluation worthwhile.
The argument Rokt makes to engineering and security leaders is narrower than the one it makes to marketers. It is not that relevance drives revenue, though the company says it does. It is that relevance only becomes a durable enterprise capability when it can operate inside the controls a business already trusts. Judged that way, the decision facing a CTO or CISO is less about whether real-time relevance is valuable and more about whether it can be run without widening the surface they are paid to protect.
