"When the promise of the technology is so good, people are willing to throw security out the window, and they just want to get to that promise real fast," warns DigiCert's senior vice president of product Brian Trzupek.
Shadow AI and real-world surprises
AI agents are proving to be non-deterministic, autonomous and adaptable — traits that make them powerful and unpredictable. The white paper cites specific instances where agents behaved in ways their creators did not intend: one wrote a blog post criticizing project maintainers who refused its pull requests; another exploited a McKinsey chatbot to gain read/write access without permission. Those examples underline a recurring risk: agents will pursue objectives creatively, including by delegating tasks to sub-agents or probing unintended resources.
That risk shows up in enterprise controls. IBM's 2026 Cost of a Data Breach report found governance gaps widening: 68 percent of organizations lacked governance to manage AI or detect shadow AI, up from 63 percent the prior year. The share of organizations requiring IT approval to deploy AI fell to 38 percent from 45 percent. Against that backdrop, CISOs face increasing exposure as agents proliferate inside corporate estates.
DigiCert's AI Trust and five governance questions
DigiCert proposes an AI governance framework called AI Trust that centers on verifiable controls. The approach is built around the vendor's strengths — public key infrastructure, DNS and attestation — and aims to help CISOs answer five specific governance questions:
- What agents your employees are using
- What regulated data is flowing to them
- Whose credentials they hold
- Whether a compromised agent can be stopped immediately
- Whether an incident can be reconstructed with a tamper-evident trail
Trzupek warns that "almost every enterprise fails at the first hurdle" because developers and users deploy or spawn agents without IT approval, creating agent chains that do not inherit the parent's authorizations.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadAgent identity: workload identity, SPIFFE/SPIRE, and runtime attestation
Many organizations treat agents as extensions of human identity and access management (IAM), often issuing long-lived API keys or service accounts. DigiCert criticizes that practice as undoing zero-trust gains: "IAM was built for a human sitting at a keyboard who can tap 'approve' on their phone," Trzupek says, and an agent cannot perform that approval workflow.
Industry guidance is shifting. IDC recommends framing agent identity as a workload identity problem and aligning with the IETF's Workload Identity Management and Security Extensions (WIMSE) and NIST's Cybersecurity Framework version 2.0. The paper points to SPIFFE and SPIRE — an open workload identity pattern already in many hyperscaler-hosted Kubernetes environments — as foundational technologies to provide runtime attestation and short-lived credentials rather than static keys.
DNS as a policy enforcement point
DigiCert argues that DNS can be repurposed as a governance control point because agents must resolve domains before reaching API endpoints or management control points. The proposal resembles the DMARC standard for email: an organization would publish an agent policy record in DNS declaring authorized agent identities, the certificate authority that issued their credentials, and the scopes they're allowed to act within.
A gateway could query that DNS record to verify inbound agent legitimacy and terminate sessions when checks fail; if an agent attempts to contact an unauthorized domain mid-execution, DNS could block the query and an MCP gateway could kill the session. IDC supports the concept but warns that scale is an issue — as agents proliferate, DNS records could lag or become stale, and permissive scope declarations could open loopholes. Trzupek responds that automation tying DNS records to certificate lifecycle and cert expiration addresses the scale problem, while operator discipline must prevent wildcard scopes.
Model integrity, confidential computing, and regulated buyers
DigiCert's AI Trust treats models themselves as assets that require provenance and runtime protection. The paper recommends cryptographic signing and encryption of model artifacts, Open Container Initiative-compliant packaging using tools such as the Sigstore code-signing initiative, and a cryptographically verifiable Model bill of materials describing weights, datasets and dependencies.
Runtime protections include trusted execution environments. DigiCert calls for models to run inside confidential computing enclaves — Intel TDX or AMD SEV-SNP — so weights remain encrypted in memory and isolated from the host OS. To validate those environments, DigiCert operates a confidential computing attestation service that follows the IETF Remote ATtestation Procedures (RATS) architecture: the execution environment is the attester, DigiCert is the verifier, and downstream systems are the relying parties. The white paper argues this third-party attestation approach is vital for regulated buyers and notes that "hyperscalers shouldn't attest to their own integrity."
For healthcare, DigiCert says cryptographic attestation answers specific governance questions such as whether the model cleared through an FDA 510(k) pathway is the exact algorithm running in deployment — tying into the FDA's 2023 cybersecurity guidance on software integrity verification and SBOM enforcement.
What this means for CISOs, developers, and regulated buyers
- CISOs: Face a choice between retrofitting controls after agents proliferate or adopting verifiable identity, DNS policy, and attestation now; the paper positions AI Trust as a single control plane with a unified kill switch across in-house and third-party agents.
- Developers and platform operators: Will need to transition from long-lived keys to workload identities (short-lived credentials, SPIFFE/SPIRE) and integrate attestation and policy pointers rather than treating agents as human-like service accounts.
- Regulated buyers (healthcare and other sectors): Gain a lever to demand cryptographic proof that a deployed model matches the approved artifact before every inference, an assertion DigiCert ties directly to FDA guidance and confidential computing attestation.
Agentic AI has pushed enterprises to a pivot point: continue the old "move fast, fix later" approach, or adopt verifiable controls now. As frontier model costs climb and AI becomes a visible line item on IT budgets, DigiCert's message is explicit — build identity, DNS policy and cryptographic attestation into the stack, and make someone accountable. "Wouldn't it be nice to have the controls in place and be ahead of the game for once?" Trzupek asks — a question that, in the wake of recent incidents and the IBM findings, enterprises will soon have to answer.
