The digital identity industry has been diligently working on how to authenticate people without risking exposure to fraud attacks, particularly phishing, even as a new problem has emerged. AI agents are emerging as a primary concern for enterprise cybersecurity, Hypr data shows. Yet Indicio starts its new paper on agentic identity with a series of reports that forecast trillions of dollars in agentic commerce over the next half-decade.
Identity is a necessary component of agentic governance, and cryptography is the mechanism for secure verification. These are already familiar foundations for identity and access management (IAM). But the authorization that extends from that identity layer must go a step further, and that remains a heavy lift, at least for now.
Generative AI and agentic AI have surpassed stolen credentials as the top concern among identity security professionals, according to Hypr’s latest State of Passwordless Identity Assurance report.
Automation has changed the scale of the identity security battle, Hypr says, and rendered point-in-time security measures inadequate. This view aligns with Google Threat Intelligence Group’s recent observation that agentic AI is being used to automate credential theft. Identity verification is the step enterprises need to keep up with agentic identity security requirements, Hypr suggests.
‘You can’t prove I lost your credentials, or even that I’m a robot’
API keys and OAuth tokens are vulnerable to credential theft and do not include information about the context they are meant for. That makes AI agents deployed by enterprise infrastructure with these tools potentially insecure and dangerous.
At the same time, the humans are continuing to resist the measures that would make their credentials more secure. The adoption of passwordless authentication has hit a plateau, according to Hypr’s data, even as agents surpass people in password leakage.
Even confirming whether a password or other credential’s compromise is a person or agent’s fault may be getting harder.
OpenAI Member of Technical Staff Sharif Shameem shared a video on X of GPT-6 Astra passing all 48 levels of the “I’m Not a Robot” game created by Neal Agarwal. The game is based on the Captchas that still differentiate people from bots on most of the net.
Decentralized ID and VCs to the rescue
The situation is far from hopeless, however.
Indicio’s new white paper on “Identity, Commerce, and the Agentic Web” argues that decentralized identity and verifiable credentials represent the way to deliver the kind of secure identity verification Hypr refers to.
The ecosystem is maturing with protocols to allow agents to interact with systems, like MCP, and each other, like Google’s A2A. But three conditions need to be satisfied for those interactions to be trusted.
Agents need cryptographic binding to a legitimate person or organization, authorization for a given action and the consent of the party they are performing it on behalf of for secure compliance, Indicio says. The decentralized digital identity models that powered web3 are also applicable to AI agents, with VCs providing a way to verify the agent, their instructions and who they are bound to.
Investment is already shifting in recognition of the impact of agents on commerce, and trust on agentic commerce, according to Indicio. It will go to infrastructure to support the governance of autonomous software agents, along with the verifiable agent credentials themselves.
The pricing for the technologies that provide digital trust will also have to evolve. IAM has long relied on a “per-seat” pricing model, where the seats each represent a human user. As those users represent a declining share, usage-based models make more sense.
Luckily, the analysts say agentic commerce will be generating plenty of money to pay for any reasonable pricing model.
Article Topics
agentic commerce | AI agents | digital identity | HYPR | identity access management (IAM) | Indicio
Latest Biometrics News
Sep 10, 2026, 4:52 pm EDT
Clearview AI has developed an experimental AI tool that could extend a facial recognition search into broader automated research on…
Sep 10, 2026, 11:35 am EDT
Africa’s next wave of digital identity investment may have surprisingly little to do with biometrics, wallets or credentials. In early…
Sep 10, 2026, 10:59 am EDT
Europe’s digital identity ambitions are approaching an important deadline. By the end of 2026, EU Member States are expected to…
Sep 10, 2026, 10:55 am EDT
By Joshua W.J. Brown Biometric authentication has mature ways to talk about comparison error. That is exactly why accessibility failures…
Sep 10, 2026, 10:54 am EDT
The Philippines is getting tougher on social media platforms and called attention to the backlash that Meta in particular has…
Sep 10, 2026, 10:53 am EDT
The deadline for EU member states to offer a digital wallet under the EU Digital Identity Wallet (EUDI Wallet) scheme…