The New Trust Layer

2. Pillar One — Identity: The Explosion of Who

2.1 The threat

Identity is now the primary control plane of the enterprise — and the primary attack surface. The 2026 threat data shows attackers overwhelmingly obtaining legitimate credentials rather than breaking encryption or exploiting exotic vulnerabilities: 77% of hacking-related breaches involve stolen credentials, and in 2025 identity-related incidents were driven primarily by phishing (69%) and stolen credentials (37%). Account takeover attacks grew 24% year over year, with 74% of organizations experiencing at least one ATO attack in 2024.

But the structural change is the explosion of non-human identities. Machine identities — service accounts, workload credentials, API keys, OAuth tokens, and now AI agents — outnumber humans 109:1 and are growing 77% faster than the human population they serve. These identities are created by developers and pipelines “designed for velocity rather than governance,” frequently lack a named owner, and routinely outlive the projects that justified them. The Cloud Security Alliance calls this the governance vacuum: no owner, no lifecycle, no audit pressure — because compliance frameworks such as SOC 2 and ISO 27001 were simply not written for agentic AI.

2.2 Case evidence: the AI agent identity crisis

The arrival of autonomous AI agents has converted a slow-burn hygiene problem into an acute one. A Cloud Security Alliance survey of IT and security professionals commissioned by Strata Identity found that enterprises cannot move AI agents from pilot to production because identity governance does not exist for them — so teams are sharing human credentials and access tokens with agents because no alternative is in place. The numbers describe the vacuum precisely:

• Only 18% of security leaders are highly confident their IAM systems can manage agent identities.
• Agents are being authenticated with static API keys (44%), username/password (43%), and shared service accounts (35%) — persistent, often unmonitored access paths attached to entities that operate 24/7 across clouds.
• Only 21% maintain a real-time inventory of active agents, and only 28% can trace an agent’s actions back to a human sponsor. Roughly 80% of organizations deploying autonomous AI cannot say in real time what those systems are doing or who is responsible.
• Only 23% have a formal, enterprise-wide strategy for agent identity management; ownership is fragmented across security (39%), IT (32%), and emerging AI functions (13%).

Meanwhile, workforce fundamentals remain unfinished: workforce MFA adoption sits near 70%, meaning nearly a third of users still lack MFA at all.

2.3 What to rethink

Identity programs must be re-scoped from “people and passwords” to a full-spectrum identity fabric:

• Govern every identity class with one lifecycle. The CSA’s framework — a non-human identity registry capturing owner, purpose, privilege scope, and expiration for every credential; agent lifecycle management with documented justification and automated decommissioning; zero standing privilege with just-in-time, task-scoped, auto-revoked access; credential rotation and rapid revocation measured in minutes — applies equally to a contractor, a service account, and an AI agent.
• Retire shared credentials everywhere, especially for agents. Static keys and shared service accounts attached to autonomous systems are the new shared admin password. Purpose-built agent identity — dynamic authentication via on-behalf-of token exchange, runtime authorization, and continuous traceability — is the emerging standard.
• Deploy phishing-resistant authentication as the default. With AI phishing succeeding against 47% of trained professionals, cycle-based MFA is no longer a sufficient control. Organizations adopting FIDO2 passkeys report an 81% reduction in login-related help-desk incidents and a 98% reduction in mobile account takeover fraud — and help-desk calls are exactly where AI social engineering lands.
• Right-size access, human and machine. With 96% of organizations reporting humans operating far beyond role requirements, least-privilege remains the cheapest control never fully deployed.

3. Pillar Two — Vendor Access: The Perimeter You Don’t Own

3.1 The threat

The vendor channel is now the preferred highway into the enterprise. The 2026 DBIR shows third-party involvement in breaches at 48%, up 60% year over year. The mechanics are consistently banal: stolen credentials and compromised file-transfer and remote-access software. SecurityScorecard found that two exploited file-transfer vulnerabilities alone accounted for 63.5% of all third-party vulnerability-driven breaches, and that 41.4% of ransomware attacks involved third-party access. Retail (52.4%), technology (46.75%), and energy (46.7%) experienced the highest third-party breach rates.

The deeper problem is structural. Black Kite’s 2025 research across nearly 200,000 monitored organizations found that 54% of vendors carry at least one critical vulnerability, nearly a quarter have corporate credentials circulating on the dark web, and among the most critical vendors, 62% show corporate credentials in infostealer logs. Meanwhile the “silent window” between compromise and public disclosure averages 73 days — a median disclosure delay during which downstream organizations are exposed without warning. Risk concentrates at the highest points of connection: a small set of hyper-shared platforms (“the Elite 50”) whose compromise cascades across thousands of dependent companies.

3.2 Case evidence: concentration as a failure mode

The 2025 pattern — 136 verified third-party breaches, 719 named victims, an estimated 26,000 unnamed downstream organizations — represents not a series of accidents but “a systematic crisis,” in the words of Black Kite’s chief research and intelligence officer. The average blast radius per breach (5.28 downstream victims) has roughly doubled since 2024, driven by attackers deliberately moving upstream to shared platforms and centralized services. The implication is uncomfortable: an organization’s true risk exposure is increasingly determined by vendors it did not choose, at dependency layers it did not map, disclosed — if at all — months after exploitation.

3.3 What to rethink

• Replace questionnaire-era governance with continuous intelligence. Static annual assessments provide a snapshot; the most damaging activity unfolds inside the 73-day disclosure gap. Continuous monitoring of active threat signals — stealer-log exposure, targeting indicators, actively exploited vulnerabilities at the vendor — enables intervention before disclosure does.
• Map concentration risk, not just vendor risk. Nth-party dependency mapping should identify the central nodes whose compromise would trigger cascading failure, and treat them as critical infrastructure with contingency plans.
• Treat vendor identity as your identity. Federated, scoped, short-lived access with just-in-time elevation and session-level revocability should replace standing VPN accounts and shared vendor logins. A vendor’s credential hygiene is, operationally, yours.
• Plan for vendor failure, not just vendor breach. Black Kite recommends scenario-based assessments that model the financial and operational impact of losing critical shared services outright — building internal redundancy and rehearsed response for the platforms a business cannot function without.

4. Pillar Three — AI-Enabled Deception: When Seeing Is No Longer Believing

4.1 The threat

The newest pillar attacks the oldest control: human judgment. Generative AI has collapsed the cost of producing a convincing persona — a cloned executive voice, a live deepfaked video presence, a help-desk caller with flawless domain vocabulary. The FBI’s 2025 Internet Crime Report logged over 22,000 AI-related fraud complaints exceeding $893 million in losses, with fewer than 5% of voice-clone victims estimated to report — a substantial undercount. AI-powered BEC generated $2.77 billion in losses across 21,442 incidents in 2024, and the average cost of a BEC claim nearly tripled from $84,000 (2023) to $183,000 (2024).

4.2 Case evidence: the Arup deepfake

The canonical case remains the clearest. In early 2024, an employee of the UK engineering firm Arup joined what appeared to be a routine video conference with senior finance leadership — including the company’s chief financial officer and colleagues, all of whom were AI-generated deepfakes. Following the call, the employee authorized transfers totaling US$25 million (HK$200 million). Hong Kong police confirmed the mechanism; Arup later confirmed the loss publicly.

Two features make the case instructive. First, as Arup’s CIO Rob Greig emphasized, “none of our systems were compromised and there was no data affected” — he describes it as “technology-enhanced social engineering,” not a cyberattack in the traditional sense. Every technical control worked; the trust decision was defeated. Second, the barrier to entry has collapsed: Greig recounted that after the incident he used open-source software to create a real-time deepfake of himself in about 45 minutes — with minimal technical skill.

Related incidents show the pattern generalizing: a finance director authorizing a $499,000 transfer to executives who “were never on the call,” and deepfake fraud estimated to have cost businesses $1.1 billion in 2025, with smaller organizations increasingly targeted precisely because they lack verification protocols.

4.3 What to rethink

• Remove “sensing a person” from the control set. Voice, face, and familiarity are no longer verification factors. Verification must move to cryptographic and out-of-band channels: known callback numbers, passkey-confirmed approvals, dual authorization on payment rails.
• Design process controls that assume deception. Irreversible transactions above defined thresholds should require independent channel confirmation, time-delayed execution windows, and role-separated approval — controls that would have stopped Arup’s transfer regardless of how convincing the call was.
• Rehearse for psychological attack the way you rehearse for ransomware. Greig’s first lesson was visibility (“who has access to what and when? Who is trusted and what is not trusted?”); his second was rehearsing response to a class of incidents, so that no individual is improvising under pressure.
• Culture: normalize transparency. Greig argues organizations must be “more open and transparent” about being attacked — the stigma around reporting successful fraud is itself an attacker resource.

5. The New Trust Layer: An Integrated Framework

Treating identity, vendor access, and AI deception as separate programs produces the pattern the data shows: well-tooled organizations still breached. The three pillars fail at the same junction — the moment one party extends trust to another. The remedy is therefore architectural, not incremental: a deliberate New Trust Layer that sits between every requester and every resource, and between every claim of identity and every decision that depends on it. The framework has five layers:

The ordering is deliberate. Layer 1 is the human foundation — phishing-resistant authentication for every user, no exceptions, because credentials remain the raw material of most incidents. Layer 2 extends the same lifecycle discipline to the 109:1 machine population and the AI agents now sharing human credentials. Layer 3 moves vendor trust from contractual assumption to continuous verification, including the Nth-party dependencies no questionnaire will ever surface. Layer 4 defends specifically against synthetic deception — the training, tooling, and provenance controls for a world in which a voice or face is not evidence of anything. Layer 5 governs the trust decision itself: process architecture for irreversible actions that assumes, at some point, a perfect imitation will get through.

6. Maturity Model and Roadmap

6.1 A five-stage maturity model

6.2 Action roadmap

First 30 days — visibility and stopgap

• Inventory AI agents and non-human identities in use; identify shared credentials and static keys (expect the CSA pattern: static API keys ~44%, shared service accounts ~35%).
• Impose an immediate dual-authorization and out-of-band callback requirement for payments and access changes above a defined threshold — the control absent in the Arup case.
• Identify your top 20 vendors and check whether their credentials appear in stealer-log exposure; recall that 62% of the most critical vendors do.
• Brief the board with the three headline numbers: 9-in-10 identity breach rate, 48% third-party involvement, $893M+ reported AI fraud losses.

By 90 days — structural controls

• Close MFA gaps and begin phishing-resistant (FIDO2/passkey) deployment, prioritizing finance, IT help desk, and executives; expect ~81% fewer login-related help-desk incidents — the very channel AI fraud exploits.
• Stand up a non-human identity registry with named owners and expiration dates for every credential (CSA recommendation 7.1).[
• Replace standing vendor VPN/shared accounts with scoped, federated, short-lived access; begin continuous monitoring of critical vendors rather than questionnaire cycles.
• Deliver role-specific deepfake and voice-clone training, with a rehearsed “challenge protocol” that makes it safe to refuse and verify unusual requests.

Within 365 days — architecture

• Implement zero standing privilege and JIT access across human, machine, and agent populations; adopt agent-specific identity (on-behalf-of token exchange, runtime authorization, human-sponsor traceability) per emerging CSA/industry guidance.
• Complete Nth-party dependency mapping; identify concentration nodes and build contingency plans for the failure of critical shared services.
• Consolidate identity silos — the fragmentation currently adds ~12 hours to every identity incident response.
• Align the architecture to NIST SP 1800-35 reference implementations and IR 8587 token-hardening guidance; extend audit scope to agent behavior before regulators do it for you.
• Run a full deception-red-team exercise: a live deepfake attempt against finance and the help desk, with measured detection and refusal rates.

7. Questions Boards and CISOs Should Ask Now

8. Conclusion

The common thread across every statistic in this paper is not sophistication — it is trust issued without verification: a credential accepted, a vendor presumed secure, a voice presumed real. The organizations that weather the coming decade will be those that treat trust as an engineered property with five layers, continuous evidence, and rehearsed failure modes. The perimeter did not disappear; it fragmented into billions of identities, human and otherwise, and thousands of vendors. The New Trust Layer is how an enterprise follows it.